![](/screenshots/859f561e-dd49-4208-874d-0f73a8b3a8f4.png)
www.blue-birth-231.marcsjacobs.com
Open in
urlscan Pro
94.130.216.189
Malicious Activity!
Public Scan
Submission: On July 17 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R11 on July 17th 2024. Valid for: 3 months.
This is the only time www.blue-birth-231.marcsjacobs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Charles Schwab (Financial) Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 94.130.216.189 94.130.216.189 | 24940 (HETZNER-AS) (HETZNER-AS) | |
3 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 199.232.192.193 199.232.192.193 | 54113 (FASTLY) (FASTLY) | |
1 | 194.36.191.196 194.36.191.196 | 60117 (HS) (HS) | |
18 | 8 |
ASN24940 (HETZNER-AS, DE)
PTR: eu1.rapidcpanelserver.com
www.blue-birth-231.marcsjacobs.com |
ASN60117 (HS, AE)
PTR: hosting1.nl.hostsailor.com
thefleetlogistics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
marcsjacobs.com
www.blue-birth-231.marcsjacobs.com |
316 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
179 KB |
2 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7108 |
87 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4508 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1832 |
32 KB |
1 |
thefleetlogistics.com
thefleetlogistics.com |
338 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 |
30 KB |
18 | 6 |
Domain | Requested by | |
---|---|---|
9 | www.blue-birth-231.marcsjacobs.com |
www.blue-birth-231.marcsjacobs.com
|
3 | cdnjs.cloudflare.com |
www.blue-birth-231.marcsjacobs.com
cdnjs.cloudflare.com |
2 | i.imgur.com |
www.blue-birth-231.marcsjacobs.com
|
1 | thefleetlogistics.com |
ajax.googleapis.com
|
1 | maxcdn.bootstrapcdn.com |
www.blue-birth-231.marcsjacobs.com
|
1 | stackpath.bootstrapcdn.com |
www.blue-birth-231.marcsjacobs.com
|
1 | ajax.googleapis.com |
www.blue-birth-231.marcsjacobs.com
|
18 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sipc.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.blue-birth-231.marcsjacobs.com R11 |
2024-07-17 - 2024-10-15 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-15 - 2025-02-14 |
a year | crt.sh |
thefleetlogistics.com R3 |
2024-05-18 - 2024-08-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.blue-birth-231.marcsjacobs.com/
Frame ID: 1FF7C26E7708C67CF5279288DC536564
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/859f561e-dd49-4208-874d-0f73a8b3a8f4.png)
Page Title
Schwab | Account verificationDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- <script [^>]*src="[^"]*/popper\.js/([0-9.]+)
- /popper\.js/([0-9.]+)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: SIPC
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.blue-birth-231.marcsjacobs.com/ |
36 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
www.blue-birth-231.marcsjacobs.com/css/ |
26 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-component-responsive-secondary.css
www.blue-birth-231.marcsjacobs.com/css/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.blue-birth-231.marcsjacobs.com/css/ |
17 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdps.css
www.blue-birth-231.marcsjacobs.com/css/ |
158 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/ |
101 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slidercaptcha.min.css
www.blue-birth-231.marcsjacobs.com/css/ |
2 KB 661 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
longbow.slidercaptcha.min.js
www.blue-birth-231.marcsjacobs.com/css/ |
7 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GPmRJ4m.png
i.imgur.com/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
handler.php
thefleetlogistics.com/charlie/ |
17 B 338 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vClny8q.jpeg
www.blue-birth-231.marcsjacobs.com/images/ |
159 KB 159 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Login_Background.jpg
www.blue-birth-231.marcsjacobs.com/images/ |
110 KB 110 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/ |
153 KB 153 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zRNjNcz.png
i.imgur.com/ |
58 KB 58 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Charles Schwab (Financial) Generic Email (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| hurl function| sliderCaptcha function| $ function| jQuery object| bootstrap function| Popper string| sess function| fixSSN0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
i.imgur.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
thefleetlogistics.com
www.blue-birth-231.marcsjacobs.com
104.17.24.14
104.18.10.207
104.18.11.207
194.36.191.196
199.232.192.193
2a00:1450:4001:80f::200a
94.130.216.189
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2207bdb653a6f968fda1f0406b405779c6c4d5f6e4db1c4c496d221a21fff5ec
2ccc4d3be744a29473fefe2f313fdae488f460b85a47e8427f748358a54ba048
3c1e405db9fdc7ea43f4ac748a546bd54161bdecec8b8756b4e29b1359f2c856
4263e14af27312e425d9792a6df843853ce256057a8a629d7a5b611f71d7ab88
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
57796a96b323d002ef4dbc597efd87a3cde8745de9e6f4acc317200e8d379c74
5ceaaba22d75b58e04150311f596306562a3e595e27ed4b1dfa451b82dda9e50
69956546b189eee14c0fb675f03ec33fc504fc2c274dc196e858edd5d1f12273
79a306bfbadefd954a88675179e2ab9925719fe821d54fec7401e0c6931a9c24
7c423e620815424f90871d86bccadf4eab261ccbb1608eb4f4ab9fb2cf6d1a68
82f34e3c3e2fa4cea731ce0b84020803c1c469003a2efb0021f5dc76fc1154aa
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
ae17c16afbea216707b2203ea1cf9bdb45b9bfe47d0f4ae3258ddbc6294dd02f
be383e102e179d2d2db33c02e368897a92d0f5899bdad9e0ec752283197cf8f3
e378058155516106ec27571a247c0a3985759e505d4ab2351d638a9ac6ce7c25
e392fa475348e46987b86097d39761cb30d35d42820f1479b08e21de9c2ab2a7
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
fe780dc2585d3a58a8e3cad733fc87244ba3f14c0eb845768fb2b7e560005436