flying-wings-consultants.com Open in urlscan Pro
68.168.220.50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://flying-wings-consultants.com/wp-admin/includes/secured/m-login.php?&amp;id=3ee28084ed59360ebc8113e009df654898936937f7ec95...
Submission: On July 09 via api (July 9th 2020, 6:16:45 pm UTC) from TW

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 15 HTTP transactions. The main IP is 68.168.220.50, located in Secaucus, United States and belongs to IS-AS-1, US. The main domain is flying-wings-consultants.com.

This is the only time flying-wings-consultants.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	68.168.220.50 68.168.220.50	19318 (IS-AS-1) (IS-AS-1)
14	68.142.70.29 68.142.70.29	22822 (LLNW) (LLNW)
15	3

1 68.168.220.50 (Secaucus, United States)

ASN19318 (IS-AS-1, US)

flying-wings-consultants.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 68.142.70.29 (United States)

ASN22822 (LLNW, US)

img01.bt.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
home.bt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	bt.co.uk img01.bt.co.uk	156 KB
1	bt.com home.bt.com	2 KB
1	flying-wings-consultants.com flying-wings-consultants.com	4 KB
15	3

	Domain	Requested by
13	img01.bt.co.uk	flying-wings-consultants.com
1	home.bt.com	flying-wings-consultants.com
1	flying-wings-consultants.com
15	3

This site contains no links.

Subject Issuer	Validity	Valid
www.bt.com DigiCert SHA2 Extended Validation Server CA	`2019-10-14` - `2020-10-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://flying-wings-consultants.com/wp-admin/includes/secured/m-login.php?&amp;id=3ee28084ed59360ebc8113e009df654898936937f7ec95b895f6791c8c69204d8cc0572f728af78f68146842aec4b2efabedc7abaa091ed27c40d726
Frame ID: 4B3957304DE91A8C3AA5F1B7A4F6DC47
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

15
Requests

87 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

204 kB
Transfer

624 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set m-login.php Show response
flying-wings-consultants.com/wp-admin/includes/secured/ 9 KB
4 KB 952ms
160ms Document
text/html 68.168.220.50
IS-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://flying-wings-consultants.com/wp-admin/includes/secured/m-login.php?&amp;id=3ee28084ed59360ebc8113e009df654898936937f7ec95b895f6791c8c69204d8cc0572f728af78f68146842aec4b2efabedc7abaa091ed27c40d726
Protocol: HTTP/1.1
Server: 68.168.220.50 Secaucus, United States, ASN19318 (IS-AS-1, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7d07871057d85653214fe44050af27bac0997d3ed973960b93b309dc4dd8d8ef

Request headers

Host: flying-wings-consultants.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Set-Cookie: PHPSESSID=b6jgt1q2rldo0e54d3tpjlmkkh; path=/
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Thu, 09 Jul 2020 18:16:24 GMT
Content-Length: 3562

GET
H/1.1 200
OK login-datalayer.js Show response
img01.bt.co.uk/s/assets/260320/js/ 710 B
897 B 78ms
10ms Script
application/javascript 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

http://img01.bt.co.uk/s/assets/260320/js/login-datalayer.js

Requested by

Host: flying-wings-consultants.com
URL: http://flying-wings-consultants.com/wp-admin/includes/secured/m-login.php?&amp;id=3ee28084ed59360ebc8113e009df654898936937f7ec95b895f6791c8c69204d8cc0572f728af78f68146842aec4b2efabedc7abaa091ed27c40d726

Protocol

HTTP/1.1

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

c8f47c528c93a4dc7104388ee8d7e5fd2e67efd2cc641116825f4d539198cd2a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 82501
X-btsite: 1
Connection: keep-alive
Content-Length: 418
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=Edge
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=86400
Accept-Ranges: bytes
X-LLID: bb051568cac46b916058b12c0dd1897c
Expires: Thu, 09 Jul 2020 19:21:24 GMT

GET
H/1.1 200
OK common-reset.css
img01.bt.co.uk/s/assets/260320/css/ 65 KB
35 KB 143ms
11ms Stylesheet
text/css 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/common-reset.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 35373
X-LLID: 65e1cf6ced72a759511137abeaa0d622
Expires: Thu, 09 Jul 2020 19:21:25 GMT

GET
H/1.1 200
OK common.css
img01.bt.co.uk/s/assets/260320/css/ 181 KB
34 KB 144ms
11ms Stylesheet
text/css 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/common.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

c5f82b0a249afe838c24e127133a8706da913f49cd63a6e58629b7aabda6c3d6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 34678
X-LLID: 75450b36a1e9bb891bde069b477675f7
Expires: Thu, 09 Jul 2020 19:21:25 GMT

GET
H/1.1 200
OK index.css
img01.bt.co.uk/s/assets/260320/aauth/css/ 125 KB
20 KB 144ms
12ms Stylesheet
text/css 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/aauth/css/index.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 20406
X-LLID: 724cd09e384fde2c93ff695eb2d1d010
Expires: Thu, 09 Jul 2020 19:21:25 GMT

GET
H/1.1 200
OK bts-common.css
img01.bt.co.uk/s/assets/260320/css/ 88 KB
13 KB 142ms
10ms Stylesheet
text/css 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/bts-common.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 12866
X-LLID: 78004dd9a6de02450b5c194570f63fe5
Expires: Thu, 09 Jul 2020 19:21:25 GMT

GET
H/1.1 200
OK login-index.css
img01.bt.co.uk/s/assets/260320/css/ 76 KB
14 KB 270ms
139ms Stylesheet
text/css 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/login-index.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 13465
X-LLID: 00c04a961c1b33d6991fc1e1f8dd3bb3
Expires: Fri, 10 Jul 2020 18:16:26 GMT

GET
H/1.1 200
OK rebrand-bt-logo-login-page-136440342141502601-191112130458.png
home.bt.com/images/ 2 KB
2 KB 66ms
8ms Image
image/png 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://home.bt.com/images/rebrand-bt-logo-login-page-136440342141502601-191112130458.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://flying-wings-consultants.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:25 GMT
Last-Modified: Wed, 08 Jul 2020 19:10:02 GMT
X-XSS-Protection: 1; mode=block
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 2
Expires: Thu, 09 Jul 2020 19:21:25 GMT
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 1720
X-LLID: 6ffb9a1ba810153bafd299d22fe98c5b
mdt-type: abinary; charset=UTF-8

GET
H/1.1 200
OK error.png
img01.bt.co.uk/s/assets/260320/images/ 2 KB
2 KB 9ms
8ms Image
image/png 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/error.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

12f8e6f2951f94dcf7e830cd7dcf8eabcd4f11b87a39e0c8150661ab0b032064

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2087
X-LLID: b55e4d8af678cb664a9d61eb1c8ce50a
Expires: Thu, 09 Jul 2020 19:21:26 GMT

GET
H/1.1 200
OK logintextboxbg.png
img01.bt.co.uk/s/assets/260320/images/ 966 B
1 KB 127ms
127ms Image
image/png 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/logintextboxbg.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

2b1930ba4a2e3f401d744fc3d55c2464a79736bfbc0f0875d98dca864b16449f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/login-index.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 966
X-LLID: f76349aab7db127d91e6c4bd393875ef
Expires: Fri, 10 Jul 2020 18:16:26 GMT

GET
DATA 200
OK truncated
/ 42 KB
42 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91d32af051d9ace7282b43d300b85debad94fa8659ee69f3e7616e4e1a7605e2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: http://flying-wings-consultants.com

Response headers

Content-Type: font/truetype;charset=utf-8

GET
H/1.1 200
OK icons-sprite-8bit.png
img01.bt.co.uk/s/assets/260320/images/ 5 KB
5 KB 7ms
7ms Image
image/png 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/icons-sprite-8bit.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5100
X-LLID: cab31d5b67620574a8532fcefcd69e8b
Expires: Thu, 09 Jul 2020 19:21:26 GMT

GET
H/1.1 200
OK LoginButtonBg.png
img01.bt.co.uk/s/assets/260320/images/ 211 B
596 B 134ms
133ms Image
image/png 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/LoginButtonBg.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 211
X-LLID: 35113d0e62baf4f0a85a0ea5e97972db
Expires: Fri, 10 Jul 2020 18:16:26 GMT

GET
H/1.1 200
OK login-back.png
img01.bt.co.uk/s/assets/260320/images/ 279 B
686 B 134ms
134ms Image
image/png 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/login-back.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

6de9b19d62ae2029b5d7c51c7eb8fcbdee6503abf32cd74fa3963c76490bc0ac

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 279
X-LLID: 34ff3553deb5d7b722249a2f81d1735e
Expires: Fri, 10 Jul 2020 18:16:26 GMT

GET
H/1.1 200
OK bttv_rg-webfont.woff
img01.bt.co.uk/s/assets/260320/aauth/css/fonts/ 26 KB
26 KB 27ms
13ms Font
application/x-font-woff 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/aauth/css/fonts/bttv_rg-webfont.woff

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://img01.bt.co.uk/s/assets/260320/aauth/css/index.css
Origin: http://flying-wings-consultants.com

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 82500
X-Frame-Options: SAMEORIGIN
Content-Type: application/x-font-woff
Access-Control-Allow-Origin: *
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26600
X-LLID: e3b064dac75d8ede5a10fe295bbb0710
Expires: Thu, 09 Jul 2020 19:21:26 GMT

GET
H/1.1 200
OK bt-footer-bg.jpg
img01.bt.co.uk/s/assets/260320/images/ 1 KB
2 KB 142ms
141ms Image
image/jpeg 68.142.70.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/bt-footer-bg.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.70.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

Software

Resource Hash

cbf86fc1cedf23b294f4610fe0140df33f350071028953d6cc1c2c4249851038

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common-reset.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 18:16:26 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1251
X-LLID: b17f7d5cedfcd8a4b136d9ad2347c812
Expires: Fri, 10 Jul 2020 18:16:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			flying-wings-consultants.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: b6jgt1q2rldo0e54d3tpjlmkkh

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

flying-wings-consultants.com
home.bt.com
img01.bt.co.uk
68.142.70.29
68.168.220.50
12f8e6f2951f94dcf7e830cd7dcf8eabcd4f11b87a39e0c8150661ab0b032064
1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9
2b1930ba4a2e3f401d744fc3d55c2464a79736bfbc0f0875d98dca864b16449f
32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8
670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42
6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f
6de9b19d62ae2029b5d7c51c7eb8fcbdee6503abf32cd74fa3963c76490bc0ac
7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8
7d07871057d85653214fe44050af27bac0997d3ed973960b93b309dc4dd8d8ef
7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43
91d32af051d9ace7282b43d300b85debad94fa8659ee69f3e7616e4e1a7605e2
c5f82b0a249afe838c24e127133a8706da913f49cd63a6e58629b7aabda6c3d6
c8f47c528c93a4dc7104388ee8d7e5fd2e67efd2cc641116825f4d539198cd2a
cbf86fc1cedf23b294f4610fe0140df33f350071028953d6cc1c2c4249851038
d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015
e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0

flying-wings-consultants.com Open in urlscan Pro 68.168.220.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

204 kBTransfer

624 kBSize

1 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

flying-wings-consultants.com Open in urlscan Pro
68.168.220.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

204 kB
Transfer

624 kB
Size

1
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!