flying-wings-consultants.com
Open in
urlscan Pro
68.168.220.50
Malicious Activity!
Public Scan
URL:
https://flying-wings-consultants.com/wp-admin/includes/secured/m-login.php?&id=21618e1e7921096b1bee9470186b9f6260baa6b0d315fdc4ce05fe...
Submission: On July 05 via api from TW
Submission: On July 05 via api from TW
Summary
This website contacted 4 IPs
in 1 countries
across 3 domains to perform 15 HTTP transactions.
The main IP is 68.168.220.50, located in
Secaucus, United States and
belongs to IS-AS-1, US.
The main domain is flying-wings-consultants.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 30th 2020. Valid for: 3 months.
This is the only time flying-wings-consultants.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on June 30th 2020. Valid for: 3 months.
This is the only time flying-wings-consultants.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BT (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 68.168.220.50 68.168.220.50 | 19318 (IS-AS-1) (IS-AS-1) | |
| 13 | 68.142.68.29 68.142.68.29 | 22822 (LLNW) (LLNW) | |
| 1 | 68.142.70.29 68.142.70.29 | 22822 (LLNW) (LLNW) | |
| 15 | 4 |
1
68.168.220.50
(Secaucus, United States)
ASN19318 (IS-AS-1, US)
PTR: plesk3100.is.cc
ASN19318 (IS-AS-1, US)
PTR: plesk3100.is.cc
| flying-wings-consultants.com |
13
68.142.68.29
(United States)
ASN22822 (LLNW, US)
PTR: https-68-142-68-29.any.llnw.net
ASN22822 (LLNW, US)
PTR: https-68-142-68-29.any.llnw.net
| img01.bt.co.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
bt.co.uk
img01.bt.co.uk |
156 KB |
| 1 |
bt.com
home.bt.com |
2 KB |
| 1 |
flying-wings-consultants.com
flying-wings-consultants.com |
4 KB |
| 15 | 3 |
| Domain | Requested by | |
|---|---|---|
| 13 | img01.bt.co.uk |
flying-wings-consultants.com
|
| 1 | home.bt.com |
flying-wings-consultants.com
|
| 1 | flying-wings-consultants.com | |
| 15 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| flying-wings-consultants.com Let's Encrypt Authority X3 |
2020-06-30 - 2020-09-28 |
3 months | crt.sh |
| www.bt.com DigiCert SHA2 Extended Validation Server CA |
2019-10-14 - 2020-10-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://flying-wings-consultants.com/wp-admin/includes/secured/m-login.php?&id=21618e1e7921096b1bee9470186b9f6260baa6b0d315fdc4ce05fe3937c23db09ed757b8fed2280b997f668e98511eba81d19a4b41105470f124d780
Frame ID: D18A3391073E695BB70910C40F60D0E4
Requests: 16 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
m-login.php
flying-wings-consultants.com/wp-admin/includes/secured/ |
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-datalayer.js
img01.bt.co.uk/s/assets/260320/js/ |
710 B 896 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common-reset.css
img01.bt.co.uk/s/assets/260320/css/ |
65 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.css
img01.bt.co.uk/s/assets/260320/css/ |
181 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
img01.bt.co.uk/s/assets/260320/aauth/css/ |
125 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bts-common.css
img01.bt.co.uk/s/assets/260320/css/ |
88 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-index.css
img01.bt.co.uk/s/assets/260320/css/ |
76 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rebrand-bt-logo-login-page-136440342141502601-191112130458.png
home.bt.com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
error.png
img01.bt.co.uk/s/assets/260320/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logintextboxbg.png
img01.bt.co.uk/s/assets/260320/images/ |
966 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
42 KB 42 KB |
Font
font/truetype |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icons-sprite-8bit.png
img01.bt.co.uk/s/assets/260320/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
LoginButtonBg.png
img01.bt.co.uk/s/assets/260320/images/ |
211 B 608 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-back.png
img01.bt.co.uk/s/assets/260320/images/ |
279 B 698 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bttv_rg-webfont.woff
img01.bt.co.uk/s/assets/260320/aauth/css/fonts/ |
26 KB 26 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bt-footer-bg.jpg
img01.bt.co.uk/s/assets/260320/images/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BT (Telecommunication)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| analyticsPageName object| tar string| formTarget object| digitalData object| _exhaust_init_queue function| emitToExhaust1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| flying-wings-consultants.com/ | Name: PHPSESSID Value: 452dm85qa78vev2c9bcm2stfod |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
flying-wings-consultants.com
home.bt.com
img01.bt.co.uk
68.142.68.29
68.142.70.29
68.168.220.50
12f8e6f2951f94dcf7e830cd7dcf8eabcd4f11b87a39e0c8150661ab0b032064
1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9
2b1930ba4a2e3f401d744fc3d55c2464a79736bfbc0f0875d98dca864b16449f
32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8
670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42
6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f
6de9b19d62ae2029b5d7c51c7eb8fcbdee6503abf32cd74fa3963c76490bc0ac
7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8
7d07871057d85653214fe44050af27bac0997d3ed973960b93b309dc4dd8d8ef
7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43
91d32af051d9ace7282b43d300b85debad94fa8659ee69f3e7616e4e1a7605e2
c5f82b0a249afe838c24e127133a8706da913f49cd63a6e58629b7aabda6c3d6
c8f47c528c93a4dc7104388ee8d7e5fd2e67efd2cc641116825f4d539198cd2a
cbf86fc1cedf23b294f4610fe0140df33f350071028953d6cc1c2c4249851038
d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015
e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0