practical-lewin.46-252-25-14.plesk.page
Open in
urlscan Pro
46.252.25.14
Malicious Activity!
Public Scan
Submitted URL: https://smallitter-bb95.lilmeat8i3.workers.dev/
Effective URL: https://practical-lewin.46-252-25-14.plesk.page/ova/authy.php
Submission: On February 22 via automatic, source links-suspicious — Scanned from NL
Effective URL: https://practical-lewin.46-252-25-14.plesk.page/ova/authy.php
Submission: On February 22 via automatic, source links-suspicious — Scanned from NL
Summary
This website contacted 5 IPs
in 3 countries
across 4 domains to perform 23 HTTP transactions.
The main IP is 46.252.25.14, located in
Cologne, Germany and
belongs to GD-EMEA-DC-SXB1, DE.
The main domain is practical-lewin.46-252-25-14.plesk.page.
TLS certificate: Issued by R3 on February 22nd 2023. Valid for: 3 months.
This is the only time practical-lewin.46-252-25-14.plesk.page was scanned on urlscan.io!
TLS certificate: Issued by R3 on February 22nd 2023. Valid for: 3 months.
This is the only time practical-lewin.46-252-25-14.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BT (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2a06:98c1:312... 2a06:98c1:3121::c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 16 | 46.252.25.14 46.252.25.14 | 8972 (GD-EMEA-D...) (GD-EMEA-DC-SXB1) | |
| 5 | 178.79.243.140 178.79.243.140 | 22822 (LLNW) (LLNW) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 23 | 5 |
1
2a06:98c1:3121::c
(United States)
ASN13335 (CLOUDFLARENET, US)
ASN13335 (CLOUDFLARENET, US)
| smallitter-bb95.lilmeat8i3.workers.dev |
16
46.252.25.14
(Cologne, Germany)
ASN8972 (GD-EMEA-DC-SXB1, DE)
PTR: j356236.servers.jiffybox.net
ASN8972 (GD-EMEA-DC-SXB1, DE)
PTR: j356236.servers.jiffybox.net
| practical-lewin.46-252-25-14.plesk.page |
5
178.79.243.140
(Frankfurt am Main, Germany)
ASN22822 (LLNW, US)
PTR: https-178-79-243-140.fra.llnw.net
ASN22822 (LLNW, US)
PTR: https-178-79-243-140.fra.llnw.net
| img01.bt.co.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
plesk.page
practical-lewin.46-252-25-14.plesk.page |
124 KB |
| 5 |
bt.co.uk
img01.bt.co.uk — Cisco Umbrella Rank: 118363 |
97 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 699 |
30 KB |
| 1 |
workers.dev
smallitter-bb95.lilmeat8i3.workers.dev |
576 B |
| 23 | 4 |
| Domain | Requested by | |
|---|---|---|
| 16 | practical-lewin.46-252-25-14.plesk.page |
practical-lewin.46-252-25-14.plesk.page
|
| 5 | img01.bt.co.uk |
practical-lewin.46-252-25-14.plesk.page
img01.bt.co.uk |
| 1 | code.jquery.com |
practical-lewin.46-252-25-14.plesk.page
|
| 1 | smallitter-bb95.lilmeat8i3.workers.dev | |
| 23 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| home.bt.com |
| my.bt.com |
| www.btwifi.co.uk |
| www.btireland.com |
| shop.bt.com |
| www.businessdirect.bt.com |
| www.openreach.co.uk |
| www.thephonebook.bt.com |
| www.btwholesale.com |
| www.redcare.bt.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.lilmeat8i3.workers.dev GTS CA 1P5 |
2023-02-22 - 2023-05-23 |
3 months | crt.sh |
| practical-lewin.46-252-25-14.plesk.page R3 |
2023-02-22 - 2023-05-23 |
3 months | crt.sh |
| www.bt.com GeoTrust EV RSA CA 2018 |
2022-09-02 - 2023-09-20 |
a year | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://practical-lewin.46-252-25-14.plesk.page/ova/authy.php
Frame ID: 7F80BF16725A06034BBC01C05047FEB9
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
Login PagePage URL History Show full URLs
- https://smallitter-bb95.lilmeat8i3.workers.dev/ Page URL
- https://practical-lewin.46-252-25-14.plesk.page/ova/authy.php Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
URL: https://home.bt.com/login/loginform?TYPE=33554433&REALMOID=06-f1aca0f0-9277-1028-a2aa-843bdb4e0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$jaE9RZHjBubvgi6UkuSlm3S9U4%2f%2fhegw3cPiRzNtV%2fxpvcJIObGL7PMFGk1F%2fqs88fC1UwqZHelSgJpU668r0pZ3Na7N6zn9&TARGET=$SM$HTTPS%3a%2f%2fhome%2ebt%2ecom%2fss%2fSatellite%2fsecure%2floginforward%3fsite%3dbtcom%26view%3dmybt%26redirectURL%3dhttps$%3A$%2F$%2Fmy%2ebt%2ecom$%2Fmybt
Title: Log in
Title: Log in
Search URL Search Domain Scan URL
URL: https://my.bt.com/s/apps/appsselfserve/index.html#/forgotlogindetails?srfd=y&view=mybt&TARGET=%24SM%24HTTPS%3A%2F%2Fhome%2Ebt%2Ecom%2Fss%2FSatellite%2Fsecure%2Floginforward%3Fsite%3Dbtcom%26view%3Dmybt%26redirectURL%3Dhttps%24%3A%24%2F%24%2Fmy%2Ebt%2Ecom%24%2Fmybt
Title: Forgotten your login details?
Title: Forgotten your login details?
Search URL Search Domain Scan URL
URL: https://home.bt.com/login/loginform?TYPE=33554433&REALMOID=06-f1aca0f0-9277-1028-a2aa-843bdb4e0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$jaE9RZHjBubvgi6UkuSlm3S9U4%2f%2fhegw3cPiRzNtV%2fxpvcJIObGL7PMFGk1F%2fqs88fC1UwqZHelSgJpU668r0pZ3Na7N6zn9&TARGET=$SM$HTTPS%3a%2f%2fhome%2ebt%2ecom%2fss%2fSatellite%2fsecure%2floginforward%3fsite%3dbtcom%26view%3dmybt%26redirectURL%3dhttps$%3A$%2F$%2Fmy%2ebt%2ecom$%2Fmybt#cxtHelp_portal-logininbox
Title: )
Title: )
Search URL Search Domain Scan URL
URL: https://www.btwifi.co.uk/
Title: Wifi
Title: Wifi
Search URL Search Domain Scan URL
URL: https://www.btireland.com/
Title: BT Ireland
Title: BT Ireland
Search URL Search Domain Scan URL
URL: https://shop.bt.com/
Title: BT Shop
Title: BT Shop
Search URL Search Domain Scan URL
URL: https://www.businessdirect.bt.com/
Title: Business Direct
Title: Business Direct
Search URL Search Domain Scan URL
URL: https://www.openreach.co.uk/
Title: Openreach
Title: Openreach
Search URL Search Domain Scan URL
URL: https://www.thephonebook.bt.com/
Title: The Phone Book
Title: The Phone Book
Search URL Search Domain Scan URL
URL: https://www.btwholesale.com/
Title: BT Wholesale
Title: BT Wholesale
Search URL Search Domain Scan URL
URL: https://www.redcare.bt.com/
Title: BT Redcare
Title: BT Redcare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://smallitter-bb95.lilmeat8i3.workers.dev/ Page URL
- https://practical-lewin.46-252-25-14.plesk.page/ova/authy.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
smallitter-bb95.lilmeat8i3.workers.dev/ |
114 B 576 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
authy.php
practical-lewin.46-252-25-14.plesk.page/ova/ |
26 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
override.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-index.css
img01.bt.co.uk/s/assets/210322/css/ |
76 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common-reset.css
img01.bt.co.uk/s/assets/210322/css/ |
65 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.css
img01.bt.co.uk/s/assets/210322/aauth/css/ |
125 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common-reset.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
65 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
181 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
125 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bts-common.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
88 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-index.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
76 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
responsive-footer.css
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
error.png
img01.bt.co.uk/s/assets/210322/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-footer2018.svg
practical-lewin.46-252-25-14.plesk.page/ova/assets/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1534441432041_Feedback-Desktop-35X112px.png
practical-lewin.46-252-25-14.plesk.page/ova/assets/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logintextboxbg.png
practical-lewin.46-252-25-14.plesk.page/ova/assets/images/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icons-sprite-8bit.png
practical-lewin.46-252-25-14.plesk.page/ova/assets/images/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-back.png
practical-lewin.46-252-25-14.plesk.page/ova/assets/images/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
42 KB 42 KB |
Font
font/truetype |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bttv_rg-webfont.woff
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
BTFont_Rg.woff
practical-lewin.46-252-25-14.plesk.page/ova/assets/fonts/bt/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bttv_rg-webfont.ttf
practical-lewin.46-252-25-14.plesk.page/ova/assets/css/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bttv_rg-webfont.woff
img01.bt.co.uk/s/assets/210322/aauth/css/fonts/ |
26 KB 26 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BT (Telecommunication)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery function| checkImage function| goNext function| closeBox function| checkSubmit function| isEmail function| iserror0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
img01.bt.co.uk
practical-lewin.46-252-25-14.plesk.page
smallitter-bb95.lilmeat8i3.workers.dev
178.79.243.140
2001:4de0:ac18::1:a:1b
2a06:98c1:3121::c
46.252.25.14
07e9d4d6a617d90407a0041a950912ba8f85bcb61be41deec67fc95aa16062a1
12f8e6f2951f94dcf7e830cd7dcf8eabcd4f11b87a39e0c8150661ab0b032064
1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f1984e9f8c8cddcbb3f8a9b8e1847685af0d55852873f7fd12378bbfba86d75
32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8
3b08992554ee957c4fa7e6f2a2a743bf222c14e3b641dbd36cb7a8998741a55d
425f3e3943172803a8b9f0520d73b6227698f8bbf8eeb304045996e201d3fbf6
6119be7cc96b4af4062655f430e186e0d838a832c0d6e51ca073311ca0719632
670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42
7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43
9a3984fb403af4bf065fe25eaceefa9a4d8fb72de45eed011df7d99905a49423
a2ea72aac1d255823b18f4e67a137511ba739e11b3d8267bdfe6ea63c43abb7d
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
d1b4997b7a3e2fac66632a3321c1121ee468f1e94834efbd4125b1c65af0648a
d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015
d72ecb212984592129b1aaaead91855a72dffa15bddb9f2e7d5cdca4edd0a63d
e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0