coloursofeurope.cn
Open in
urlscan Pro
210.56.60.146
Malicious Activity!
Public Scan
Submission: On December 01 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 4th 2022. Valid for: 3 months.
This is the only time coloursofeurope.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: CenturyLink (Telecommunication) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 210.56.60.146 210.56.60.146 | 38197 (SUNHK-DAT...) (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone) | |
1 2 | 13.36.218.177 13.36.218.177 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 2 |
ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK)
PTR: hk4.cycom.asia
coloursofeurope.cn |
ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
synacor.112.2o7.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
coloursofeurope.cn
coloursofeurope.cn |
296 KB |
2 |
2o7.net
1 redirects
synacor.112.2o7.net |
1 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | coloursofeurope.cn |
coloursofeurope.cn
|
2 | synacor.112.2o7.net |
1 redirects
coloursofeurope.cn
|
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.centurylink.com |
secure.centurylink.net |
centurylink.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.coloursofeurope.cn R3 |
2022-10-04 - 2023-01-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://coloursofeurope.cn/europes/centrurylink/9744e8/en/
Frame ID: 578AA556557BCFCDEA765BC4C36F048F
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Centurylink | LoginDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: CenturyLink High-Speed Internet®
Search URL Search Domain Scan URL
Title: Forgot Password?
Search URL Search Domain Scan URL
Title: Create Account
Search URL Search Domain Scan URL
Title: Back to CenturyLink.net
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://synacor.112.2o7.net/b/ss/synacortveauth/1/H.24.4/s03629482635474?AQB=1&ndh=1&t=1%2F11%2F2022%2013%3A32%3A1%204%200&ce=UTF-8&ns=synacor&pageName=Federated%20Login&g=https%3A%2F%2Fcoloursofeurope.cn%2Feuropes%2Fcentrurylink%2F9744e8%2Fen%2F&cc=USD&c1=CenturyLink&c6=Federated%20Login&c7=54df4f2bc904b109354d9c84dedf8a2e&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1 HTTP 302
- https://synacor.112.2o7.net/b/ss/synacortveauth/1/H.24.4/s03629482635474?AQB=1&pccr=true&vidn=31C45668E2FC26F2-40001084FA2FF5E0&ndh=1&t=1%2F11%2F2022%2013%3A32%3A1%204%200&ce=UTF-8&ns=synacor&pageName=Federated%20Login&g=https%3A%2F%2Fcoloursofeurope.cn%2Feuropes%2Fcentrurylink%2F9744e8%2Fen%2F&cc=USD&c1=CenturyLink&c6=Federated%20Login&c7=54df4f2bc904b109354d9c84dedf8a2e&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
coloursofeurope.cn/europes/centrurylink/9744e8/en/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
103 KB 104 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social.css
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
7 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social_responsive.css
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social_login.css
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr.js.download
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js.download
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
91 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
92368.png
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js.download
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
28 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_code.js.download
coloursofeurope.cn/europes/centrurylink/9744e8/en/index_files/ |
30 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s03629482635474
synacor.112.2o7.net/b/ss/synacortveauth/1/H.24.4/ Redirect Chain
|
43 B 270 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: CenturyLink (Telecommunication) Generic (Online)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange object| html5 object| Modernizr function| yepnope function| $ function| jQuery function| updateTracking object| jQuery1810844954541366495 string| s_account object| s string| s_code string| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq object| s_i_synacor object| $elements string| $escaped3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.coloursofeurope.cn/ | Name: s_cc Value: true |
|
.coloursofeurope.cn/ | Name: s_sq Value: %5B%5BB%5D%5D |
|
.synacor.112.2o7.net/ | Name: s_vi Value: [CS]v1|31C45668E2FC26F2-40001084FA2FF5E0[CE] |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
coloursofeurope.cn
synacor.112.2o7.net
13.36.218.177
210.56.60.146
34e7485254321247359d42d049d1e880f0c54c3a6e9232ee99ccf9c17622b67f
678142bea0f875f9140575b7643f9f76486cf2139270371acd1543f063c93ec1
7470f9d78491838f5cc3ee51d4ed4d8a232f6c80ae80706dff96c062d3d663b6
82aa8220b0b10115902bf05d352ad727a2c21a7af61b20ae05dff5ff061de65c
a1305347219d673cc973172494248e557ce8eccaf65af995c07c9d7daed4475d
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b095c14e576cb3c64990abce12a5efb2e319999721456f2258e7c362834b673d
c1a6271a5555389794ea8089b6e7e7cc30af7a3d0a1aecdc02896e7cc26a3868
f36832aff6c3266f0a321a84be626fdd30d55eb3ffcc004ed27de9194c0cce1c
f8e673c25be39d8531277d87b18ac3cf91def3c21ca9c171625e6c2aaa796bbd
fd413a60f3084fd9f633f1fcdf7ba4cb0a53f5eadc42ec0272d9a0fb9c439a50