139.59.211.44
Open in
urlscan Pro
139.59.211.44
Malicious Activity!
Public Scan
Effective URL: http://139.59.211.44/btinternet/
Submission: On April 02 via manual from GB
Summary
This is the only time 139.59.211.44 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BT (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 166.62.10.189 166.62.10.189 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
9 | 139.59.211.44 139.59.211.44 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 | 209.197.3.15 209.197.3.15 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2606:4700::68... 2606:4700::6813:c797 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 3 | 2.18.232.160 2.18.232.160 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
4 | 23.43.113.242 23.43.113.242 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
21 | 8 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-10-189.ip.secureserver.net
setup-activate.ltd |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
139.59.211.44 |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net
stackpath.bootstrapcdn.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-160.deploy.static.akamaitechnologies.com
cdn.livechatinc.com | |
accounts.livechatinc.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a23-43-113-242.deploy.static.akamaitechnologies.com
secure.livechatinc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
livechatinc.com
1 redirects
cdn.livechatinc.com secure.livechatinc.com accounts.livechatinc.com |
68 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
82 KB |
2 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
30 KB |
1 |
gstatic.com
fonts.gstatic.com |
10 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
21 KB |
1 |
setup-activate.ltd
1 redirects
setup-activate.ltd |
306 B |
21 | 6 |
Domain | Requested by | |
---|---|---|
4 | secure.livechatinc.com |
cdn.livechatinc.com
139.59.211.44 |
2 | cdn.livechatinc.com |
1 redirects
139.59.211.44
|
2 | cdnjs.cloudflare.com |
139.59.211.44
|
1 | accounts.livechatinc.com |
cdn.livechatinc.com
|
1 | fonts.gstatic.com |
139.59.211.44
|
1 | ajax.googleapis.com |
139.59.211.44
|
1 | fonts.googleapis.com |
139.59.211.44
|
1 | stackpath.bootstrapcdn.com |
139.59.211.44
|
1 | setup-activate.ltd | 1 redirects |
21 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA |
2018-10-03 - 2019-10-12 |
a year | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-03-01 - 2019-05-24 |
3 months | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-03-02 - 2019-09-08 |
6 months | crt.sh |
*.livechatinc.com DigiCert ECC Secure Server CA |
2019-02-10 - 2020-05-11 |
a year | crt.sh |
*.google.com Google Internet Authority G3 |
2019-03-01 - 2019-05-24 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://139.59.211.44/btinternet/
Frame ID: EE3FD71DBEB77FFDE3AE319C5DEA2DFF
Requests: 20 HTTP requests in this frame
Frame:
https://secure.livechatinc.com/licence/9024220/v2/open_chat.cgi?license=9024220&group=0&embedded=1&widget_version=3&unique_groups=0
Frame ID: A4522A4F402A148508EFA639205FCC20
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://setup-activate.ltd/btinternet/
HTTP 302
http://139.59.211.44/btinternet/ Page URL
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
LiveChat (Live Chat) Expand
Detected patterns
- script /cdn\.livechatinc\.com\/.*tracking\.js/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://setup-activate.ltd/btinternet/
HTTP 302
http://139.59.211.44/btinternet/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- http://cdn.livechatinc.com/tracking.js HTTP 301
- https://cdn.livechatinc.com/tracking.js
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
139.59.211.44/btinternet/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.1.1/css/ |
138 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
786 B 435 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BT_logo.png
139.59.211.44/btinternet/assets/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ad1.jpg
139.59.211.44/btinternet/assets/ |
52 KB 52 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ad2.gif
139.59.211.44/btinternet/assets/ |
143 KB 143 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading_apple.gif
139.59.211.44/btinternet/assets/ |
80 KB 80 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BT_mark_4col_rev_59x36.png
139.59.211.44/btinternet/assets/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking.js
cdn.livechatinc.com/ Redirect Chain
|
226 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_graybutton.png
139.59.211.44/btinternet/assets/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LoginButtonBg.png
139.59.211.44/btinternet/assets/ |
211 B 494 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons-sprite-8bit.png
139.59.211.44/btinternet/assets/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2sDfZG1Wl4LcnbuKjk0mRUe0Aw.woff2
fonts.gstatic.com/s/oxygen/v8/ |
10 KB 10 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
get_dynamic_config.js
secure.livechatinc.com/licence/9024220/v2/ |
1 KB 2 KB |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
9024220
accounts.livechatinc.com/licence/ |
0 2 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
get_static_config.0.675.7.7.587.13.13.8.9.6.6.6.67.js
secure.livechatinc.com/licence/9024220/v2/ |
4 KB 2 KB |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat_widget_init
secure.livechatinc.com/licence/9024220/v2/metrics/ |
0 203 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
open_chat.cgi
secure.livechatinc.com/licence/9024220/v2/ Frame A452 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BT (Telecommunication)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| __lc number| __lc_inited object| AutoInvitation object| PersonalInvitation object| LC_API object| __lc_script_version function| __lc_data_181321 function| __lc_data_static_config1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.livechatinc.com/licence/9024220 | Name: __livechat Value: lc_all_invitation%3D0%26lc_auto_invites_shown%3D%26lc_chat_number%3D0%26lc_client_version%3D%26lc_goals_achieved%3D%26lc_integration_params%3D%26lc_lang%3Den%26lc_last_chat_start_time%3D0%26lc_last_conference_id%3D%26lc_last_operator_id%3D%26lc_last_operator_key%3D%26lc_last_operator_key_per_skill%3D%26lc_last_operator_per_skill%3D%26lc_last_visit%3D1554190398%26lc_nick%3D%26lc_ok_invitation%3D0%26lc_page_view%3D0%26lc_session%3DS1554190398.9e218becbf%26lc_visit_number%3D0%26mcid%3D0ee5d72d-c006-4af6-5683-33a8a1205e02%26mcid_done%3D0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.livechatinc.com
ajax.googleapis.com
cdn.livechatinc.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
secure.livechatinc.com
setup-activate.ltd
stackpath.bootstrapcdn.com
139.59.211.44
166.62.10.189
2.18.232.160
209.197.3.15
23.43.113.242
2606:4700::6813:c797
2a00:1450:4001:809::2003
2a00:1450:4001:821::200a
2a00:1450:4001:825::200a
05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec
64bedd57e310d3b3fe9958f126eb0f9f41dda092421a363b26ea4bb49c648a90
6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f
7085a0b5a938355565b61cf2243562351790b95a346783d6d8efcfc222406c1d
7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a775ae66ff661ca89af9421261b49812881e45a8d03134e248714c955c210cd
7fdc10620dce41c6dffa9ad5e284454c157003172e99ed6fb340d6965e568837
81ea269d00dbe2f60c8e4dc8cd8ef4773552e5e030d8ce4391525b25f2a398d6
9256f04fce5bdfe0dd0e8a5ee25736d725193d67a071b7bd7e367456043b0d85
9d36e99c1168a684a4c55ff2bf647516be71ab6328326f513f8557a6d2401902
cfd00d0aac1340e7f4c77e7aa85cd5331ad21b655216944b2f952e25d7e1957a
dc0a53da553a5f0478b09830bf36e949a5674c1a530248c3edd1caeccd7198b6
e0f49049bbf8071312c4a4554e9332d420b7277fc310ab02fb2ef031e48128f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8661c283a3286fad3c83888f88215eee9754c98e990abb835b07483b815ad5e