chats.landbot.io
Open in
urlscan Pro
34.120.69.71
Malicious Activity!
Public Scan
Submission: On August 27 via manual from US
Summary
TLS certificate: Issued by R3 on July 26th 2021. Valid for: 3 months.
This is the only time chats.landbot.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 34.120.69.71 34.120.69.71 | 15169 (GOOGLE) (GOOGLE) | |
1 | 35.227.225.91 35.227.225.91 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2010 | 15169 (GOOGLE) (GOOGLE) | |
1 | 35.205.50.59 35.205.50.59 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:80e::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:827::2010 | 15169 (GOOGLE) (GOOGLE) | |
9 | 2600:1901:0:9... 2600:1901:0:94b6:: | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
25 | 10 |
ASN15169 (GOOGLE, US)
PTR: 71.69.120.34.bc.googleusercontent.com
chats.landbot.io |
ASN15169 (GOOGLE, US)
PTR: 91.225.227.35.bc.googleusercontent.com
static.landbot.io |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: 59.50.205.35.bc.googleusercontent.com
welcome.landbot.io |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
ASN15169 (GOOGLE, US)
daisho.firebaseio.com | |
s-usc1c-nss-261.firebaseio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
firebaseio.com
daisho.firebaseio.com s-usc1c-nss-261.firebaseio.com |
4 KB |
8 |
googleapis.com
fonts.googleapis.com storage.googleapis.com www.googleapis.com |
77 KB |
4 |
gstatic.com
fonts.gstatic.com |
79 KB |
4 |
landbot.io
chats.landbot.io static.landbot.io welcome.landbot.io |
391 KB |
25 | 4 |
Domain | Requested by | |
---|---|---|
8 | s-usc1c-nss-261.firebaseio.com |
static.landbot.io
|
4 | www.googleapis.com |
static.landbot.io
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
3 | storage.googleapis.com |
static.landbot.io
|
2 | chats.landbot.io |
static.landbot.io
|
1 | daisho.firebaseio.com |
static.landbot.io
|
1 | welcome.landbot.io |
static.landbot.io
|
1 | fonts.googleapis.com |
static.landbot.io
|
1 | static.landbot.io |
chats.landbot.io
|
25 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
documents-heart-de98.puahalsitc.workers.dev |
Subject Issuer | Validity | Valid | |
---|---|---|---|
chats.landbot.io R3 |
2021-07-26 - 2021-10-24 |
3 months | crt.sh |
static.landbot.io R3 |
2021-07-31 - 2021-10-29 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2021-07-26 - 2021-10-18 |
3 months | crt.sh |
welcome.landbot.io R3 |
2021-08-10 - 2021-11-08 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
firebaseio.com GTS CA 1D4 |
2021-07-01 - 2021-09-29 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://chats.landbot.io/v3/H-984199-HF7OMO7WRPKW41A8/index.html
Frame ID: D95CB1AA4149C637BAB0ECBDBFAFD16B
Requests: 14 HTTP requests in this frame
Frame:
https://daisho.firebaseio.com/.lp?start=t&ser=51171527&cb=1&v=5
Frame ID: 58576816DB0899B3F079F363EEDD50B3
Requests: 8 HTTP requests in this frame
Frame:
https://s-usc1c-nss-261.firebaseio.com/.lp?dframe=t&id=8136360&pw=2p2Hc1wuYh&ns=daisho
Frame ID: FF67972265B06771209000310FA3D58A
Requests: 1 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: PRINT / PREVIEW DOCUMENTS HERE
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
chats.landbot.io/v3/H-984199-HF7OMO7WRPKW41A8/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
landbot-3.0.0.js
static.landbot.io/landbot-3/ |
2 MB 384 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.json
chats.landbot.io/v3/H-984199-HF7OMO7WRPKW41A8/ |
5 KB 5 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 791 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UVULC0H45YAUTFDLD9AN5P3HGBYIKP3A.png
storage.googleapis.com/media.landbot.io/229532/channels/ |
33 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
welcome.landbot.io/visitors/ |
1 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ |
19 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
verifyCustomToken
www.googleapis.com/identitytoolkit/v3/relyingparty/ |
1 KB 882 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
verifyCustomToken
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
getAccountInfo
www.googleapis.com/identitytoolkit/v3/relyingparty/ |
262 B 226 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3-29 |
getAccountInfo
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
UKB148V2RM10STC0AFBQBENT23YTH06D.png
storage.googleapis.com/media.landbot.io/229532/channels/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
daisho.firebaseio.com/ Frame 5857 |
422 B 664 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
UKB148V2RM10STC0AFBQBENT23YTH06D.png
storage.googleapis.com/media.landbot.io/229532/channels/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
fonts.gstatic.com/s/montserrat/v18/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
JTUPjIg1_i6t8kCHKm459WxZcgvz_PZw.woff2
fonts.gstatic.com/s/montserrat/v18/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame FF67 |
420 B 649 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
15 B 256 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
58 B 299 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
434 B 676 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
146 B 388 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
15 B 256 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
47 B 288 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
.lp
s-usc1c-nss-261.firebaseio.com/ Frame 5857 |
96 B 337 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| setupLandbot object| webpackChunklandbot_3 object| Landbot function| Container function| ContainerPopup function| Fullpage function| Livechat function| Native function| Popup object| _landbot function| pLPCommand1 function| pRTLPCB10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chats.landbot.io
daisho.firebaseio.com
fonts.googleapis.com
fonts.gstatic.com
s-usc1c-nss-261.firebaseio.com
static.landbot.io
storage.googleapis.com
welcome.landbot.io
www.googleapis.com
2600:1901:0:94b6::
2a00:1450:4001:80e::200a
2a00:1450:4001:811::200a
2a00:1450:4001:827::2010
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2010
2a00:1450:4001:830::2003
34.120.69.71
35.205.50.59
35.227.225.91
0882fe11baf5c777266a9ab3f14aa451432c7099158b2d69b3515ee5c8e66d4d
0eee88be5cdf56e0cd27562ed6871be22556dfe51027c127501571b2387bfd10
1690098d91976fc03b9c2e0126889a7e251adf3fdf6cfec9fde26035591d0c24
1a4722f7c6bfc8ed582a1da7f4e552be5350efe348638b31ec4a1291963c8e8e
1f4fc00a246eb1388058c38ffcd2a1b74b00378fe2a74e01272da07fc997768c
285a2ce6c13392f7f89bbfae67dfab78618b02229c61c00f4ff1c8de9e993251
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
2f0a8482332a976b2b9301e1e64bce4ee7426f480ba7d7b6d52c9f2f84d57a15
3d14e96bd08692f39b357173c908dcb0b21ee11d0bdb29b963ce7fcc836eb4fd
42d9184eb89548d86f71975b0975c7be0e7673a6a11747fcbace5f840565d29e
45f837c1c225d528ca6eaeb5db4485a0f8093444f3c47e04ed0c5a14b3e45ac7
4d2e9bd42d24ae143477552c55b5ec25ff5898b3d6f6e728da0f22503bd17fe8
63ad8b0e59bb3be9fde8cde9b2f09f305bf649fc8a330f4be9d068fc74134def
6cd6b556e33cd8119d93a52f6c512ca8ae3eb012d37f16f00e013e2168c7fd18
83cde2cdcb79fe64065f81db36cad934876509c509f22b941fbbcf2e7913455b
903ad26476ec3efb4ad65dcc0a9672e6c8d1e6a3354f8f817e919b16bc180f9d
ca5f5f8a91c3fcdcb913041dba7a8eee676b5c0c5c9e25f5cc470699d4700d68
cbeff97bbd608957a32b2e55be4dc9d630e30461711752d815191b6d85b119dd
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60
ec83f9cccd120b3497a09d26618b516b2bd2c8e0e930919c0eda5516991901f6
ee256511c83e767a2d32b8e2f0c561ac0ab04dde7e6ebe1a0f2eef3698393dbb
ef824052cc54e24358011a6d1f363813e99264883d6a019f5c98f75e43f78dc9