Report - eaura.lk/mde/anti.php

Report Overview

Submitted URL
eaura.lk/mde/anti.php
IP
124.43.17.224
ASN
#9329 Sri Lanka Telecom Internet
Submitted
2024-04-18 09:35:59
Access
public
Website Title
Login Page
Final URL
safeloggingin.com/voicemail.btlandline.com/
Tags
phishing
urlquery detections
Phishing - Generic phishing

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
eaura.lk	unknown	unknown	2021-05-30	2024-04-16	734 B	11 kB	124.43.17.224
safeloggingin.com	unknown	2023-07-12	2023-07-13	2023-11-21	1.9 kB	50 kB	188.114.97.1
img01.bt.co.uk	110885	1996-08-01	2013-06-19	2024-03-27	6.5 kB	189 kB	95.140.228.46
home.bt.com	98505	1992-06-18	2013-06-19	2024-03-24	480 B	2.5 kB	95.140.228.46
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-18	434 B	90 kB	142.250.74.138

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	safeloggingin.com	Sinkholed
2024-04-18	medium	safeloggingin.com	Sinkholed
2024-04-18	medium	safeloggingin.com	Sinkholed
2024-04-18	medium	safeloggingin.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (20)

	URL	Size	First Seen	Last Seen
	img01.bt.co.uk/s/assets/210322/js/aref.min.js	460 B	2023-03-07	2024-04-25
Pretty URL img01.bt.co.uk/s/assets/210322/js/aref.min.js IP 95.140.228.46 ASN #22822 LLNW Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 22:46:00 Last Seen2024-04-25 19:51:25 Times Seen92 Hash dd1c386f518ac1a0aedc22f38fee5077 87004997bee6cc9a552e43561806ede26e358c19 5fec331e4a79b49d22b0c9dc7ea1db7f7b9daac7b405a1465b764d563a24b0c0 Loading...

	unknown	905 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:08 Last Seen2024-04-18 11:36:08 Times Seen1 Hash be952ff05878791608117e36f60a6def 6f2f7998d2156441b0684d642f05fb2991bf1a57 f33a6d88f9f35077de30338af811ec7ccdf826f9c1f9e57afe6ed0753c83bfec Loading...

	unknown	988 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:08 Last Seen2024-04-18 11:36:08 Times Seen1 Hash d6f99753353c22ac70e6d6ceab6e7854 080d45b9263f35d4551eaa47b01ce9081e5f5414 613ece278a02478c1dc6b12223d794a258f622fdcb0d9d01a0fe4ec0383cfce3 Loading...

	unknown	491 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:08 Last Seen2024-04-18 11:36:08 Times Seen1 Hash d81ca2a13cced84687c426b12727c6d6 98d75a3561566a8f3ddc79bb13a7ee353975ef59 79f9eb180607655cb92848855996b8183a6820cf290fa5e2034c8687b7272372 Loading...

	unknown	363 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 7fdf7cad7da21660e92eb11239264ccf 430881d48e46ec2483ce82035d3a8c4b9f7c39be 5777911d8538e98f9adf8fd037709d1b90665621b462dff1bd08e54caae8fafa Loading...

	safeloggingin.com/voicemail.btlandline.com/	50 kB	2024-04-18	2024-04-25
Pretty URL safeloggingin.com/voicemail.btlandline.com/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-25 19:51:25 Times Seen3 Hash 8d6948fc3bcd02f3e524790a2277f63a d025606cd52c989d4e78ff0df8bd5ea47977ae66 d84f6e36cbaafbf50dd8cfa4490095a6a47a8ffe060208ccca1964a060123e58 Loading...

	unknown	426 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 2d21d81816e29d8844154edbf28df6da 85e09d189d858af19ed6a71d9f36b7befada9432 4198d40e04a5b5cfa9955c2ede0b429396833799fc7291f2b71b34416a056fc1 Loading...

	unknown	1.3 kB	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash dc0981bab9d5d371ed76aaf03457c699 7a622ea3c0c3ba429ae5bec1addc49b47c05e79b f79a17ad7077b798f9f27d43358b68ef1402e76dafcbea9fa123e856c36d19d4 Loading...

	safeloggingin.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	7.9 kB	2024-04-18	2024-04-18
Pretty URL safeloggingin.com/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 12:37:08 Times Seen4 Hash a79fd4d37f40c0eccca8ac1f8f54a6fd 3cf786584ac3a41c1ba813f66192ddbab4a058f7 13eb16ad583ce79c039f5754606e3090cf00cac932e3a9e438f5dfe0c7bf28f8 Loading...

	safeloggingin.com/voicemail.btlandline.com/	1.1 kB	2024-04-18	2024-04-18
Pretty URL safeloggingin.com/voicemail.btlandline.com/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 18e55908e83eb81745acbe87dfc796c6 ff9a9440d1362091c1c3ebd5c22d0f27308cec79 37f2c88e208d87339d27f23277b682050d8c39867115f3624dcf0e78714b301b Loading...

	img01.bt.co.uk/s/assets/210322/js/sportnav.api.js	64 kB	2024-04-18	2024-04-25
Pretty URL img01.bt.co.uk/s/assets/210322/js/sportnav.api.js IP 95.140.228.46 ASN #22822 LLNW Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-25 19:51:25 Times Seen6 Hash 7e9a430d7ea22a8432f0299fbb781335 c58bc3a3afdf93be5a77d97b5bba893a61d22fed 37bd5abded7188b4ce9650f92ee5659d68a750307f57d9b8b2a9dbfb87d3fca4 Loading...

	unknown	684 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash c08b0444065aa42eb1e802bc7c8c1bc7 df7c99b2de9896c10a2ac3bdec1ee5ae5bb69f4e 5e9097f858375b0bc122983cd1d01929da987631b9b610cb632f1aba61efc056 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js	90 kB	2023-03-07	2024-05-01
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 142.250.74.138 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-05-01 05:10:50 Times Seen140522 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	img01.bt.co.uk/s/assets/210322/js/dantegh.api-1.1.js	48 kB	2024-04-18	2024-04-25
Pretty URL img01.bt.co.uk/s/assets/210322/js/dantegh.api-1.1.js IP 95.140.228.46 ASN #22822 LLNW Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-25 19:51:25 Times Seen6 Hash c1dd1c347045d7de73124a81a0ee3d8f 92041994fb8aa6c2eeeb4a0573dcde1834baab97 475d296c4cdeb0cf7744315129f7400d90a392d1884ef993e0281f4d66d43c31 Loading...

	unknown	275 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 31700ca13408f3c74ca4db5a902c70d3 af622b20b41ae7000cfe9d47ac6bf35a0c3af8e2 2c99670d3627db07a350fb07a8c82542a344b0492b3b61d58c88fd66cd133d06 Loading...

	unknown	246 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 1732ea0bcebc909eecfb12504d8db199 8562146712fb3aa8723d6d7222a6d0a0199cafa7 4e5b331409c9e68587921fb8a995f77bd5276d63c1d7068cb6d8388e7bfd4bd5 Loading...

	unknown	312 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash eb9148a7c363378b0a8e3cbe7625724f d599bffc81c04e649ed54d6430c8a2567bcb9934 6b799b5c60fc1c6170613e6e83be1e284152babccf8ae833676dba7b2fd258ac Loading...

	unknown	3.2 kB	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 59d8f7fd69d902b45666f759f8b1e669 77a692023a5706f0f113cd2aeeda594e5d74853f db5d6a33213b2a474c7168b0a15292a68c456f5e8bc70a96a3cbfd1f8a54a6d8 Loading...

	unknown	247 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-18 11:36:09 Times Seen1 Hash 81726beaf5dda71d8e2036a7bccc14fe ee661f4b840fd713cd5c3145a74d39baa04904cb de2d5316ba17b7ba9bc45bb7c37cdd4a3c1cc6ea502a4b4596c00df1a3e4dc5b Loading...

		Size	First Seen	Last Seen
	#1 Write - 757fa4b9c0f32409746764f3d5c733d2	16 kB	2024-04-18	2024-04-25
Pretty Observations First Seen2024-04-18 11:36:09 Last Seen2024-04-25 19:51:25 Times Seen3 Hash 757fa4b9c0f32409746764f3d5c733d2 336c23155ba987f0e1b36a3a6326c21a302aba16 1df18a9529695a288ad798673007b46f687d9aa5789860b54e1cba6673e7de14 Loading...

HTTP Transactions (22)

URL IP Response Size

eaura.lk/mde/anti.php

124.43.17.224

302 Found

0 B

URL User Request GET HTTP/2
eaura.lk/mde/anti.php
IP
124.43.17.224:443
ASN
#9329 Sri Lanka Telecom Internet

Certificate
IssuerLet's Encrypt
Subjecteaura.lk
Fingerprint2D:0D:35:47:5C:94:4B:CE:E4:0C:ED:AE:91:DC:9A:BF:7B:30:B2:F1
ValidityWed, 13 Mar 2024 05:15:17 GMT - Tue, 11 Jun 2024 05:15:16 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /mde/anti.php HTTP/1.1
Host: eaura.lk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 18 Apr 2024 09:35:33 GMT
server: Apache
x-powered-by: PHP/8.2.18
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=jl3ck5gus00idj7m4jktfaoe7j; path=/
location: https://safeloggingin.com/voicemail.btlandline.com/
content-length: 0
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2

eaura.lk/

124.43.17.224

11 kB

URL
eaura.lk/
IP
124.43.17.224:0
ASN
#9329 Sri Lanka Telecom Internet

Certificate
IssuerLet's Encrypt
Subjecteaura.lk
Fingerprint2D:0D:35:47:5C:94:4B:CE:E4:0C:ED:AE:91:DC:9A:BF:7B:30:B2:F1
ValidityWed, 13 Mar 2024 05:15:17 GMT - Tue, 11 Jun 2024 05:15:16 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (14235), with CRLF, LF line terminators
Size
11 kB (10636 bytes)
Hash
91fbcd029a1a8bce59eeb2be8ad916d2
b717763f4be2d394521b820604dcd549338ed642
0d99aa181e537298f5de4ec2e0e7e88e1fbb2091fb7bd8b01ce39126ee96df47

HTTP Headers

GET / HTTP/1.1
Host: eaura.lk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 09:35:35 GMT
Server: Apache
X-Powered-By: PHP/8.2.18
Cache-Control: no-cache
Content-Encoding: gzip
WPO-Cache-Status: cached
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 17 Apr 2024 15:33:43 GMT
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

safeloggingin.com/voicemail.btlandline.com/

188.114.97.1

200 OK

39 kB

URL User Request GET HTTP/2
safeloggingin.com/voicemail.btlandline.com/
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectsafeloggingin.com
Fingerprint7C:A9:0F:C5:FF:A1:B6:46:7D:99:62:9E:D2:0E:78:66:39:67:22:AB
ValidityTue, 05 Mar 2024 01:52:35 GMT - Mon, 03 Jun 2024 01:52:34 GMT

File type
HTML document, ASCII text, with very long lines (50614)
Size
39 kB (38930 bytes)
Hash
3f834134af7e55f55c3659b0d202a502
fb77fb99f3fc2dabaa136f4dbbe18099d1995a0e
53d7ae2218e3826a03a9988dcca81b804791440ead39574cf9ea515cba2890c9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /voicemail.btlandline.com/ HTTP/1.1
Host: safeloggingin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 09:35:36 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CX5wQbtsh1NKZj%2F%2F%2F7Z9Bc2NdxDLBCECnS1s3Z8E%2BFMcoeJ6%2BcRB9VJZlB1ReE%2Bjfvv4%2FgS2qx0LQmwNhoRzJFq7yEX9Ml6udr7jrAjf178qTRhzKsGKGJdzL3VGnjtD8VKyEA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8763aa684e9db500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/css/common.css

95.140.228.46

200 OK

35 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/css/common.css
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
35 kB (34693 bytes)
Hash
42b71010477a66fb289df26af2851ee7
9e097c6ca44103a1bc9d8e0694c87e533869d5f3
425f3e3943172803a8b9f0520d73b6227698f8bbf8eeb304045996e201d3fbf6

HTTP Headers

GET /s/assets/210322/css/common.css HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: text/css
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: c943d2efee04bd793ce81b85072ffbd9
content-length: 34693
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/js/sportnav.api.js

95.140.228.46

200 OK

14 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/js/sportnav.api.js
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (51514)
Size
14 kB (13784 bytes)
Hash
7e9a430d7ea22a8432f0299fbb781335
c58bc3a3afdf93be5a77d97b5bba893a61d22fed
37bd5abded7188b4ce9650f92ee5659d68a750307f57d9b8b2a9dbfb87d3fca4

HTTP Headers

GET /s/assets/210322/js/sportnav.api.js HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: application/javascript
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: 774df47fd3d5a38905310692d7a4dc46
content-length: 13784
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/css/login-index.css

95.140.228.46

200 OK

14 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/css/login-index.css
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
14 kB (13465 bytes)
Hash
3c18027fd05cc70469601d03b182b1d6
013d046727ad19e7dfa9fa02e059cedabd16b004
32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8

HTTP Headers

GET /s/assets/210322/css/login-index.css HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: text/css
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: 9cf118f8fdaedda77792de512e4f7e6e
content-length: 13465
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/aauth/css/index.css

95.140.228.46

200 OK

20 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/aauth/css/index.css
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65371)
Size
20 kB (20406 bytes)
Hash
a83d1c5540027b1fdefe4a9c17c6de26
c4284af605a92367f0d38aa019461e6f39f78628
e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0

HTTP Headers

GET /s/assets/210322/aauth/css/index.css HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: text/css
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: 7db32d8a84f552c8810a50e61f2b3754
content-length: 20406
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/css/bts-common.css

95.140.228.46

200 OK

13 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/css/bts-common.css
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
13 kB (12866 bytes)
Hash
61a42f0e1205043bf13792d91f697349
5a4a58c410667d31694e3ec4a3ba7d277ded9a7e
7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43

HTTP Headers

GET /s/assets/210322/css/bts-common.css HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: text/css
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: c858fa61c89bb48d6832e453d2855824
content-length: 12866
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/js/aref.min.js

95.140.228.46

200 OK

325 B

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/js/aref.min.js
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (460), with no line terminators
Size
325 B (325 bytes)
Hash
dd1c386f518ac1a0aedc22f38fee5077
87004997bee6cc9a552e43561806ede26e358c19
5fec331e4a79b49d22b0c9dc7ea1db7f7b9daac7b405a1465b764d563a24b0c0

HTTP Headers

GET /s/assets/210322/js/aref.min.js HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=86400
content-type: application/javascript
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
content-encoding: gzip
vary: Accept-Encoding
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: e9a0f23d221d3097ecc0bc47f01756d9
content-length: 325
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/js/dantegh.api-1.1.js

95.140.228.46

200 OK

11 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/js/dantegh.api-1.1.js
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (36897)
Size
11 kB (11371 bytes)
Hash
c1dd1c347045d7de73124a81a0ee3d8f
92041994fb8aa6c2eeeb4a0573dcde1834baab97
475d296c4cdeb0cf7744315129f7400d90a392d1884ef993e0281f4d66d43c31

HTTP Headers

GET /s/assets/210322/js/dantegh.api-1.1.js HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: application/javascript
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: 794befdfc4d2d9f96eadb0208d95c24a
content-length: 11371
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/css/common-reset.css

95.140.228.46

200 OK

35 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/css/common-reset.css
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
35 kB (35373 bytes)
Hash
3ab81e53b960d66a047a55fd8d77ff20
27dd315ea3ba542274ddfab51acd8fa2fe724490
d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015

HTTP Headers

GET /s/assets/210322/css/common-reset.css HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
cache-control: max-age=86400
content-type: text/css
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6109
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:47 GMT
x-llid: d3a11c4a85bf63f6eb8f17ecb529fbec
content-length: 35373
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/images/logintextboxbg.png

95.140.228.46

200 OK

966 B

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/images/logintextboxbg.png
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
PNG image data, 8 x 32, 8-bit colormap, non-interlaced
Size
966 B (966 bytes)
Hash
fe7cda01b77b68681305d3939db634db
10b1e66949c3c5089811d11f4644b02bb74629bd
2b1930ba4a2e3f401d744fc3d55c2464a79736bfbc0f0875d98dca864b16449f

HTTP Headers

GET /s/assets/210322/images/logintextboxbg.png HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://img01.bt.co.uk/s/assets/210322/css/login-index.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: max-age=86400
content-type: image/png
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6108
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:48 GMT
x-llid: 0377ce64da41975142b3e0e3bea3fd9b
content-length: 966
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/images/LoginButtonBg.png

95.140.228.46

200 OK

211 B

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/images/LoginButtonBg.png
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
PNG image data, 7 x 39, 8-bit colormap, non-interlaced
Size
211 B (211 bytes)
Hash
304450d2013a1e851172337c628b852f
5d4481dec455d483cd5d57be203fea6a5987dadc
7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8

HTTP Headers

GET /s/assets/210322/images/LoginButtonBg.png HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://img01.bt.co.uk/s/assets/210322/css/common.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: max-age=86400
content-type: image/png
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6108
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:48 GMT
x-llid: 833e62993df29bbe7bd0567b2fdebc8d
content-length: 211
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/images/icons-sprite-8bit.png

95.140.228.46

200 OK

5.1 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/images/icons-sprite-8bit.png
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
PNG image data, 45 x 551, 8-bit colormap, non-interlaced
Size
5.1 kB (5100 bytes)
Hash
f24d82a8130bbdfbb43e74ef498cea4e
46cb4b88dbc42f72b1cdf8162545102982b6d3c1
6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f

HTTP Headers

GET /s/assets/210322/images/icons-sprite-8bit.png HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://img01.bt.co.uk/s/assets/210322/css/common.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: max-age=86400
content-type: image/png
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
age: 6108
date: Thu, 18 Apr 2024 09:35:36 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 07:53:48 GMT
x-llid: fa84e151371b4f14ac766e05fd06ac0f
content-length: 5100
X-Firefox-Spdy: h2

safeloggingin.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

188.114.97.1

302 Found

0 B

URL GET HTTP/3
safeloggingin.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectsafeloggingin.com
Fingerprint7C:A9:0F:C5:FF:A1:B6:46:7D:99:62:9E:D2:0E:78:66:39:67:22:AB
ValidityTue, 05 Mar 2024 01:52:35 GMT - Mon, 03 Jun 2024 01:52:34 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: safeloggingin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 302 Found
date: Thu, 18 Apr 2024 09:35:36 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
cache-control: max-age=300, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LjISk4XWVvatsXqfST0BER6eqLQ35KlKW4HfGpT%2B32ocYIExz%2F8z%2BwIrKLbXg0bXAjgPBD6hK2u4VoNk9gCQas3BeOKKq%2B6xnI9Fds83GEgNiLTdPGk%2FSc6ElDxi%2F8O2wjz0mg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8763aa701fd856cc-OSL
alt-svc: h3=":443"; ma=86400

safeloggingin.com/cdn-cgi/challenge-platform/h/g/jsd/r/8763aa684e9db500

188.114.97.1

200 OK

0 B

URL POST HTTP/3
safeloggingin.com/cdn-cgi/challenge-platform/h/g/jsd/r/8763aa684e9db500
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectsafeloggingin.com
Fingerprint7C:A9:0F:C5:FF:A1:B6:46:7D:99:62:9E:D2:0E:78:66:39:67:22:AB
ValidityTue, 05 Mar 2024 01:52:35 GMT - Mon, 03 Jun 2024 01:52:34 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/jsd/r/8763aa684e9db500 HTTP/1.1
Host: safeloggingin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12168
Origin: https://safeloggingin.com
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/voicemail.btlandline.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 18 Apr 2024 09:35:37 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=zQZKQpKTPXzrzp5F6UZTmv2RgSvV_Qf01Qplh_Ti8D4-1713432937-1.0.1.1-8.UigIeuTMcEJdIM.66_4aryB20T4FkkFHQsiDKmtOqmseH0ZJJ1ZginyV0Zym7bHQNOO8Bby2W6MJGL23kuwQ; path=/; expires=Fri, 18-Apr-25 09:35:37 GMT; domain=.safeloggingin.com; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UAS6POLtCpNiaCoy0wZ%2BMfp6fWnWIH%2Fhm0CmhTVUkJ1ixLFgZrTZG95KXvH2K9qQ%2Fy1LQSPNYpMsiW%2BuU4IxxFAlwuq9mEsdSY%2FKkH6xvyQv8UH3YVpLfMsP%2BaTS5fZZXbyyoA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8763aa7109d856cc-OSL
alt-svc: h3=":443"; ma=86400

img01.bt.co.uk/s/assets/210322/aauth/css/fonts/bttv_rg-webfont.woff

95.140.228.46

200 OK

27 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/aauth/css/fonts/bttv_rg-webfont.woff
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 26600, version 1.0
Size
27 kB (26600 bytes)
Hash
f580ac43b3f6d8ed2eb7c8af9e27fb74
20e63cf27d203f6a6182f86285bbef5111c2b2a7
1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9

HTTP Headers

GET /s/assets/210322/aauth/css/fonts/bttv_rg-webfont.woff HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://safeloggingin.com
DNT: 1
Connection: keep-alive
Referer: https://img01.bt.co.uk/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: max-age=86400
content-type: application/x-font-woff
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
date: Thu, 18 Apr 2024 09:35:37 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 09:35:37 GMT
x-llid: e59193da50df3dbed828fc1725b3eaa2
content-length: 26600
access-control-allow-origin: *
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/images/logo/favicon.ico

95.140.228.46

200 OK

877 B

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/images/logo/favicon.ico
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Size
877 B (877 bytes)
Hash
94b202992ffe98669f5fb197704edac4
8edbc09e80fefb4f7eb8dcf223845e7b43f09cf3
fd98910da13b877b92584901ae97b8aa508c1d55bd132cbdde01f45bdeb1008c

HTTP Headers

GET /s/assets/210322/images/logo/favicon.ico HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: max-age=86400
content-type: image/x-icon
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
date: Thu, 18 Apr 2024 09:35:37 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 09:35:37 GMT
x-llid: ab3b1d07e43a0f07ae39242e31076c17
content-length: 877
X-Firefox-Spdy: h2

img01.bt.co.uk/s/assets/210322/images/logo/apple-touch-icon-180x180.png

95.140.228.46

200 OK

5.9 kB

URL GET HTTP/2
img01.bt.co.uk/s/assets/210322/images/logo/apple-touch-icon-180x180.png
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced
Size
5.9 kB (5903 bytes)
Hash
d49cfe2ac5a1f807adcf76132a8ee761
4f08422de230e0997b51dad89258f3905633953f
38e0cca268fa06be6d397bfc7dfc334e59fdf235fa8f87a35450ca5e0659329b

HTTP Headers

GET /s/assets/210322/images/logo/apple-touch-icon-180x180.png HTTP/1.1
Host: img01.bt.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: max-age=86400
content-type: image/png
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
accept-ranges: bytes
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
date: Thu, 18 Apr 2024 09:35:37 GMT
last-modified: Wed, 07 Feb 2024 18:38:15 GMT
expires: Fri, 19 Apr 2024 09:35:37 GMT
x-llid: fe5cb1575f22ee6477097fa4f177222d
content-length: 5903
X-Firefox-Spdy: h2

home.bt.com/images/rebrand-bt-logo-login-page-136440342141502601-211006161335.png

95.140.228.46

200 OK

1.7 kB

URL GET HTTP/2
home.bt.com/images/rebrand-bt-logo-login-page-136440342141502601-211006161335.png
IP
95.140.228.46:443
ASN
#22822 LLNW

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerDigiCert Inc
Subjectwww.bt.com
Fingerprint7A:55:96:BE:64:7C:4D:C9:C5:3A:5A:09:B5:A6:6D:D3:17:B1:5F:1F
ValidityMon, 04 Sep 2023 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT

File type
PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Size
1.7 kB (1720 bytes)
Hash
f4f77e3d7b7604f96def395052ca464f
1394275d37eaabaf0df1619f486973f00839c326
670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42

HTTP Headers

GET /images/rebrand-bt-logo-login-page-136440342141502601-211006161335.png HTTP/1.1
Host: home.bt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=86400
content-type: image/png
mdt-type: abinary; charset=UTF-8
content-security-policy: frame-ancestors 'self'
date: Thu, 18 Apr 2024 09:35:37 GMT
x-xss-protection: 1; mode=block
set-cookie: X-Mapping-okbjfidf=8F2AF8B7D0A05484C1B06A17DCD07FFA; path=/
JSESSIONID_SS_CBB=LWHwj8JVjSDT6_v8UDgejDQyAtwU4SJH9a-Z5VwtmI9fLGme4jNG!-969370409; domain=.bt.com; path=/; HttpOnly
SS_X_JSESSIONID_CSD_CBA=iSzwj8L3Lg3aaY-gprx86BSqJ8cnkrzz2963s23Tc6Dt2Lu75P6q!-1216155647; path=/
X-Mapping-knlpoeag=31388DEA7E3577C75724E11288BF6E50; path=/
btsite=1; domain=.bt.com; path=/
last-modified: Thu, 18 Apr 2024 09:35:36 GMT
x-ua-compatible: IE=Edge
x-frame-options: SAMEORIGIN
x-btsite: 1
x-llid: c8c8c95824df9a2470b03537e53547aa
X-Firefox-Spdy: h2

safeloggingin.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js

188.114.97.1

200 OK

7.9 kB

URL GET HTTP/3
safeloggingin.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectsafeloggingin.com
Fingerprint7C:A9:0F:C5:FF:A1:B6:46:7D:99:62:9E:D2:0E:78:66:39:67:22:AB
ValidityTue, 05 Mar 2024 01:52:35 GMT - Mon, 03 Jun 2024 01:52:34 GMT

File type
JavaScript source, ASCII text, with very long lines (7863), with no line terminators
Size
7.9 kB (7863 bytes)
Hash
a79fd4d37f40c0eccca8ac1f8f54a6fd
3cf786584ac3a41c1ba813f66192ddbab4a058f7
13eb16ad583ce79c039f5754606e3090cf00cac932e3a9e438f5dfe0c7bf28f8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/54ea73d52131/main.js HTTP/1.1
Host: safeloggingin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 18 Apr 2024 09:35:37 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
content-encoding: br
vary: accept-encoding
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f8fNQeiLiRgrWeUWzEkB8UyIi0ivmgZydW08Cnkwanp14HYP0DD0NyvJZ489MKrBoy8HI0YhJpHyaUKr0WL8HIkhIOEkF6ggrNciAzDI9%2BYgT4aS%2BieYeELybEd99ANpJN32wA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8763aa70380556cc-OSL
alt-svc: h3=":443"; ma=86400

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

142.250.74.138

200 OK

90 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
142.250.74.138:443
ASN
#15169 GOOGLE

Requested by
https://safeloggingin.com/voicemail.btlandline.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
90 kB (89476 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://safeloggingin.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 16 Apr 2024 09:56:44 GMT
expires: Wed, 16 Apr 2025 09:56:44 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 171532
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (20)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP