![](/screenshots/1509afaf-bc76-4ef3-bb47-2521bbd17a64.png)
flightsxpress.co.uk
Open in
urlscan Pro
192.185.10.230
Malicious Activity!
Public Scan
Submission: On March 19 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 18th 2024. Valid for: 3 months.
This is the only time flightsxpress.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
17 | 192.185.10.230 192.185.10.230 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 104.102.55.191 104.102.55.191 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 184.25.199.174 184.25.199.174 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
23 | 4 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: pss18b.win.hostgator.com
flightsxpress.co.uk |
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-55-191.deploy.static.akamaitechnologies.com
www.citi.com |
ASN16625 (AKAMAI-AS, US)
PTR: a184-25-199-174.deploy.static.akamaitechnologies.com
online.citi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
flightsxpress.co.uk
flightsxpress.co.uk |
703 KB |
3 |
citi.com
www.citi.com — Cisco Umbrella Rank: 29463 Failed online.citi.com — Cisco Umbrella Rank: 23657 |
145 KB |
23 | 2 |
Domain | Requested by | |
---|---|---|
17 | flightsxpress.co.uk |
flightsxpress.co.uk
|
2 | online.citi.com |
flightsxpress.co.uk
|
1 | www.citi.com |
flightsxpress.co.uk
|
23 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
flightsxpress.co.uk R3 |
2024-03-18 - 2024-06-16 |
3 months | crt.sh |
www.citi.com DigiCert EV RSA CA G2 |
2023-11-07 - 2024-12-05 |
a year | crt.sh |
online.citibank.com DigiCert SHA2 Extended Validation Server CA |
2023-04-28 - 2024-05-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://flightsxpress.co.uk/login/?id=84450e2b30b12327b4caf9f28a580e05c9642b9b&acc=blocked
Frame ID: B45E23DA7B6A836B9D04605BBF8D0397
Requests: 23 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
flightsxpress.co.uk/login/ |
257 KB 258 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Regular.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin.css
flightsxpress.co.uk/login/assets/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stylee.css
flightsxpress.co.uk/login/assets/ |
1 MB 146 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
origination.css
flightsxpress.co.uk/login/assets/img/ |
560 KB 72 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.7083615ebe6cea4aa24b.css
www.citi.com/cbol-pre-login-static-assets/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citilogoredesign.png
flightsxpress.co.uk/login/assets/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
050-location@2x.svg
flightsxpress.co.uk/login/assets/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_globe_med-grey@2x.svg
flightsxpress.co.uk/login/assets/img/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LSO_4959.jpg
flightsxpress.co.uk/login/assets/img/ |
171 KB 171 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Light.woff
flightsxpress.co.uk/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Citi-Branding-Sprite.png
flightsxpress.co.uk/login/assets/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Appstore-Googleplay-JDPower-Sprite.png
flightsxpress.co.uk/login/assets/img/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-media_facebook@3x.png
flightsxpress.co.uk/login/assets/img/ |
445 B 486 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-media_twitter@3x.png
flightsxpress.co.uk/login/assets/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-media_youtube@3x.png
flightsxpress.co.uk/login/assets/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Bold.woff
flightsxpress.co.uk/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Light.ttf
flightsxpress.co.uk/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Bold.ttf
flightsxpress.co.uk/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Light.woff
online.citi.com/US/ag/commonui-assets/fonts/interstate/ |
74 KB 74 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Interstate-Bold.woff
online.citi.com/US/ag/commonui-assets/fonts/interstate/ |
70 KB 71 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| email object| password object| email_error object| pass_error function| validated function| email_Verify function| pass_Verify1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
flightsxpress.co.uk/ | Name: PHPSESSID Value: h27000e55v6bn0dj3kcknsf225 |
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
flightsxpress.co.uk
online.citi.com
www.citi.com
www.citi.com
104.102.55.191
184.25.199.174
192.185.10.230
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
78a7019b985cc187d3677d7ad21a629fe5a38e91f4bd0bcb29839afafe986919
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
c894545e827f3f02d6db3e2648acc4348dd917fcdeb4f200d17f53babef50fcd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef511af95bd66dd8adedcd888a6cbecb7ce2dc86267328ee0a2575fda5dd0f23
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296