btconnect-9877d2.webflow.io

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 7 HTTP transactions. The main IP is 151.101.194.132, located in United States and belongs to FASTLY, US. The main domain is btconnect-9877d2.webflow.io.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2022 Q2 on May 24th 2022. Valid for: a year.

This is the only time btconnect-9877d2.webflow.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY)
5	99.86.4.125 99.86.4.125	16509 (AMAZON-02) (AMAZON-02)
1	99.86.1.115 99.86.1.115	16509 (AMAZON-02) (AMAZON-02)
7	3

1 151.101.194.132 (United States)

ASN54113 (FASTLY, US)

btconnect-9877d2.webflow.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.86.4.125 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-125.fra6.r.cloudfront.net

uploads-ssl.webflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.1.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-1-115.fra6.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	webflow.com uploads-ssl.webflow.com — Cisco Umbrella Rank: 10845	120 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	30 KB
1	webflow.io btconnect-9877d2.webflow.io	2 KB
7	3

	Domain	Requested by
5	uploads-ssl.webflow.com	btconnect-9877d2.webflow.io
1	d3e54v103j8qbb.cloudfront.net	btconnect-9877d2.webflow.io
1	btconnect-9877d2.webflow.io
7	3

This site contains no links.

Subject Issuer	Validity	Valid
*.webflow.io GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-05-24` - `2023-06-25`	a year	crt.sh
uploads-ssl.webflow.com Amazon	`2022-08-28` - `2023-09-26`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://btconnect-9877d2.webflow.io/
Frame ID: 827AE94B6F00B3EF342CD24757FF4A64
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Btconnect

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

151 kB
Transfer

263 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
btconnect-9877d2.webflow.io/ 4 KB
2 KB 259ms
146ms Document
text/html 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://btconnect-9877d2.webflow.io/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

7268325ac37a969150df87278810eb0812013083fbbcad2c54d69f0f7e04667b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

accept-ranges: bytes
age: 0
content-encoding: gzip
content-length: 1438
content-security-policy: frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com
content-type: text/html
date: Wed, 01 Feb 2023 22:17:23 GMT
vary: Accept-Encoding,x-wf-forwarded-proto
x-cache: HIT, MISS
x-cache-hits: 1, 0
x-served-by: cache-iad-kjyo7100110-IAD, cache-hhn-etou8220035-HHN
x-timer: S1675289844.839938,VS0,VE91

GET
H2 200 btconnect-9877d2.webflow.bf20945c2.css
uploads-ssl.webflow.com/63d93176d90042724126f879/css/ 32 KB
9 KB 590ms
454ms Stylesheet
text/css 99.86.4.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/63d93176d90042724126f879/css/btconnect-9877d2.webflow.bf20945c2.css
Requested by: Host: btconnect-9877d2.webflow.io
URL: https://btconnect-9877d2.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-125.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 38fb4afeffc0e0aafc51b37e5d4a7cef98ea73252e3f4a6988be467227b5f5e0

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://btconnect-9877d2.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-version-id: _U9Noig48V5pbQygdfNVpRjDFr0HiBBh
content-encoding: gzip
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
date: Wed, 01 Feb 2023 22:17:25 GMT
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
content-length: 8429
last-modified: Tue, 31 Jan 2023 15:22:57 GMT
server: AmazonS3
etag: "003d4796b96abf283d6f433139ade05a"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: rUZ9Sv9dBM6Fg10YoqFP6eMqxR7tRG9Y3qE8_rORYLJE0bZ-8nONiw==

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 201ms
66ms Script
application/javascript 99.86.1.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=63d93176d90042724126f879
Requested by: Host: btconnect-9877d2.webflow.io
URL: https://btconnect-9877d2.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.1.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-1-115.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://btconnect-9877d2.webflow.io/
Origin: https://btconnect-9877d2.webflow.io
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 19:25:41 GMT
content-encoding: br
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
age: 62254
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: GPrInkz7T5G0Zl2qt4RiwUJkgZ6gacxXe30WqGdek7xOZvrL5eXnIQ==

GET
H2 200 webflow.55831244f.js Show response
uploads-ssl.webflow.com/63d93176d90042724126f879/js/ 46 KB
16 KB 599ms
465ms Script
text/javascript 99.86.4.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploads-ssl.webflow.com/63d93176d90042724126f879/js/webflow.55831244f.js
Requested by: Host: btconnect-9877d2.webflow.io
URL: https://btconnect-9877d2.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-125.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 36ea5bac08837aa169ef1f009cee1ebbac499558702e5053f396419d5361b035

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://btconnect-9877d2.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-version-id: xnq_DVJuPULQGBBdrsub3.yWmkNCm_5U
content-encoding: gzip
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
date: Wed, 01 Feb 2023 22:17:25 GMT
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
content-length: 16220
last-modified: Tue, 31 Jan 2023 15:22:57 GMT
server: AmazonS3
etag: "ec5d248a3b541d0b2371508e693dcf70"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: fhFnPafpClpbCoXrcn5Oh1sVk6DtyF34oteOEZ1en85hzki_6fBr6A==

GET
H2 200 63d931a4f723fc5f77fd2b25_btheader-p-1600.jpg
uploads-ssl.webflow.com/63d93176d90042724126f879/ 26 KB
27 KB 84ms
84ms Image
image/jpg 99.86.4.125
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/63d93176d90042724126f879/63d931a4f723fc5f77fd2b25_btheader-p-1600.jpg
Requested by: Host: btconnect-9877d2.webflow.io
URL: https://btconnect-9877d2.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-125.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5ba52412e7008273d96a2f54d6daae84f1a2db6c31bba2678e30cbada326b1be

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://btconnect-9877d2.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 08:14:23 GMT
x-amz-version-id: eLNqIIW_roEiaYm3.Ak3kiL811.dIn2S
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 50582
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26743
last-modified: Tue, 31 Jan 2023 15:20:08 GMT
server: AmazonS3
etag: "1695b02860f962705f0025843003af9a"
content-type: image/jpg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: CmFYbkDxLMw67yKGL670JmrQ4OhsDoXGnisu42Bzkyj-HU0Z-377eA==

GET
H2 200 63d931aa874138295832c0e3_btside-p-500.jpg
uploads-ssl.webflow.com/63d93176d90042724126f879/ 25 KB
26 KB 69ms
69ms Image
image/jpg 99.86.4.125
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/63d93176d90042724126f879/63d931aa874138295832c0e3_btside-p-500.jpg
Requested by: Host: btconnect-9877d2.webflow.io
URL: https://btconnect-9877d2.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-125.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 56b2be5e9411486db32b08e7f1a2a596ade13f6000cdcbd1c2ec1dcd8280d3f7

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://btconnect-9877d2.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Tue, 31 Jan 2023 18:09:57 GMT
x-amz-version-id: fc_LlE_EAd2zps7JuKM8_DxPhAVbg1pz
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 101248
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 25720
last-modified: Tue, 31 Jan 2023 15:20:12 GMT
server: AmazonS3
etag: "3b0b1f7a8fd03c5786393d7dd06efbdd"
content-type: image/jpg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 3FJxarkk7xcIJO3pZAhlnTHSA7WRVmSoCQCeoLbiZj7h8BqJlUVgSg==

GET
H2 200 63d9319fa4eebdcac2ac596a_bt-bottom-p-1600.jpg
uploads-ssl.webflow.com/63d93176d90042724126f879/ 42 KB
42 KB 121ms
121ms Image
image/jpg 99.86.4.125
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uploads-ssl.webflow.com/63d93176d90042724126f879/63d9319fa4eebdcac2ac596a_bt-bottom-p-1600.jpg
Requested by: Host: btconnect-9877d2.webflow.io
URL: https://btconnect-9877d2.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-125.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c1fc19c4dcb5e69c6c112dd803053379c86280e89eee96c5b62a3f0c3489ebeb

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://btconnect-9877d2.webflow.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 08:14:23 GMT
x-amz-version-id: bF6QK4Nv_mcZepGeqMuTRRn3ff_yof1k
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
age: 50582
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 42830
last-modified: Tue, 31 Jan 2023 15:20:02 GMT
server: AmazonS3
etag: "ca00d74d30861e8b4de46111fab4a899"
content-type: image/jpg
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: Ldy4YOf-lzD7CpnRKYxTnECu7FkHgq4H4DINw7yyoJwT4WBzX-sL2g==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

btconnect-9877d2.webflow.io
d3e54v103j8qbb.cloudfront.net
uploads-ssl.webflow.com
151.101.194.132
99.86.1.115
99.86.4.125
36ea5bac08837aa169ef1f009cee1ebbac499558702e5053f396419d5361b035
38fb4afeffc0e0aafc51b37e5d4a7cef98ea73252e3f4a6988be467227b5f5e0
56b2be5e9411486db32b08e7f1a2a596ade13f6000cdcbd1c2ec1dcd8280d3f7
5ba52412e7008273d96a2f54d6daae84f1a2db6c31bba2678e30cbada326b1be
7268325ac37a969150df87278810eb0812013083fbbcad2c54d69f0f7e04667b
c1fc19c4dcb5e69c6c112dd803053379c86280e89eee96c5b62a3f0c3489ebeb
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

btconnect-9877d2.webflow.io Open in urlscan Pro 151.101.194.132 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

151 kBTransfer

263 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

btconnect-9877d2.webflow.io Open in urlscan Pro
151.101.194.132 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

151 kB
Transfer

263 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!