![](/screenshots/270ec381-9674-41ca-b584-a26d431c1086.png)
activision.okta.lannea.com
Open in
urlscan Pro
2001:df2:e580::101b
Malicious Activity!
Public Scan
Effective URL: https://activision.okta.lannea.com/home/oauth2/index.html
Submission Tags: phishing
Submission: On September 13 via api from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 12th 2023. Valid for: 3 months.
This is the only time activision.okta.lannea.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Activision (Online) Nordstrom (Fashion)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 11 | 2001:df2:e580... 2001:df2:e580::101b | 139995 (IDNIC-WID...) (IDNIC-WIDEHOSTMEDIA-AS-ID PT. Akashia Thuba Jaya) | |
1 | 18.66.26.86 18.66.26.86 | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 2 |
ASN139995 (IDNIC-WIDEHOSTMEDIA-AS-ID PT. Akashia Thuba Jaya, ID)
activision.okta.lannea.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-26-86.vie50.r.cloudfront.net
ok1static.oktacdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
lannea.com
2 redirects
activision.okta.lannea.com |
299 KB |
1 |
oktacdn.com
ok1static.oktacdn.com — Cisco Umbrella Rank: 22394 |
8 KB |
10 | 2 |
Domain | Requested by | |
---|---|---|
11 | activision.okta.lannea.com |
2 redirects
activision.okta.lannea.com
|
1 | ok1static.oktacdn.com |
activision.okta.lannea.com
|
10 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.okta.com |
nordstrom.okta.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
activision.okta.lannea.com cPanel, Inc. Certification Authority |
2023-09-12 - 2023-12-11 |
3 months | crt.sh |
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-01-03 - 2024-01-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://activision.okta.lannea.com/home/oauth2/index.html
Frame ID: 8205B620FC4E35A10AC60B83587FEB0B
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/270ec381-9674-41ca-b584-a26d431c1086.png)
Page Title
Activision Blizzard - Sign InPage URL History Show full URLs
-
https://activision.okta.lannea.com/home
HTTP 301
https://activision.okta.lannea.com/home/ HTTP 302
https://activision.okta.lannea.com/home/oauth2/index.html Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Okta
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://activision.okta.lannea.com/home
HTTP 301
https://activision.okta.lannea.com/home/ HTTP 302
https://activision.okta.lannea.com/home/oauth2/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
activision.okta.lannea.com/home/oauth2/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
okta-sign-in.min.css
activision.okta.lannea.com/home/oauth2/files/ |
215 KB 216 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css
activision.okta.lannea.com/home/oauth2/files/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style-sheet
activision.okta.lannea.com/home/oauth2/files/ |
556 B 773 B |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
okta-logo-end-user-dashboard.fc6d8fdbcb8cb4c933d009e71456cec6.svg
activision.okta.lannea.com/home/oauth2/files/ |
958 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fs01hfbn7u0Cpy23l0h8
ok1static.oktacdn.com/fs/bco/1/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fs057b5c9yZyDY3N32p7
activision.okta.lannea.com/home/oauth2/files/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
okticon.woff
activision.okta.lannea.com/home/oauth2/font/ |
20 KB 20 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-okta-regular-webfont.woff
activision.okta.lannea.com/home/oauth2/font/ |
21 KB 22 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
montserrat-okta-light-webfont.woff
activision.okta.lannea.com/home/oauth2/font/ |
22 KB 22 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Activision (Online) Nordstrom (Fashion)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
activision.okta.lannea.com
ok1static.oktacdn.com
18.66.26.86
2001:df2:e580::101b
19d20c363953ec52f2a0fa995bf5ae3451cff3f2048931cee8be86dec8d6fed0
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
3f3891aeaf25fec84fcdd3bb35e1c7900df90bd81262bddfe5b7519accfb3a97
7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1
9af30b5e4695010f9be253f861784e638c81274ca0390214629886029ca9b509
de8900c6296e31075d03e335173ab3798b0a5ff614e925bfdc6d2a07b47a8278
e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51
ea8d801deb6776d5aaf273dfbc42d503fdaaa6f51c8934d0961e3f2a1ba13ceb
efc51ec51e163ee050073c025bb4db4f3778ed27f2cf9a9848486d13fe1fafb4
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace