Skip to content

Instantly share code, notes, and snippets.

@kmsec-uk

kmsec-uk/Note.md

Created September 27, 2024 11:44
Show Gist options
  • Save kmsec-uk/343ffb3744bddc605e7f4469ba912922 to your computer and use it in GitHub Desktop.
Save kmsec-uk/343ffb3744bddc605e7f4469ba912922 to your computer and use it in GitHub Desktop.
Download ZIP
SCATTERED SPIDER urlscan.io triage
Raw
hunt.py
#!/usr/bin/env python3.11
"""
Hunt for SCATTERED SPIDER infrastructure using URLScan basic tier.
"""
import asyncio
import json
import aiohttp
import os
import re
api_key = os.environ.get("URLSCAN_API_KEY")
urlscan_base_url = "https://urlscan.io/api/v1/"
headers = {"Content-Type": "application/json", "API-Key": api_key}
domain_regex = re.compile(r'https?:\/\/(?P<domain>.+?)\/')
def extract_domain(url: str):
groups = re.findall(domain_regex, url)
return groups[0]
class APISearch:
def __init__(self, search: str) -> None:
self.search = search
self.session = None
self.search_results = []
self.subtask_queue = asyncio.Queue()
self.task_results = []
async def return_results(self) -> None:
"""returns the search results and puts tasks (search results) in the subtask_queue"""
search_params = {"q": self.search}
async with self.session.get(
urlscan_base_url + "search", params=search_params, headers=headers
) as response:
print("Status:", response.status)
if response.ok:
j = await response.json()
for result in j["results"]:
await self.subtask_queue.put(result)
else:
raise Exception(str(response.status) + " from " + str(response.url))
async def subtask(self) -> None:
"""Pick up task from the queue (a result from the search query), retrieve the details, and save the resulting details to self.task_results"""
while True:
if self.subtask_queue.empty():
break
try:
task = await self.subtask_queue.get()
task_url = task["task"]["url"]
print("processing ", task_url, task["result"])
async with self.session.get(
task["result"], headers=headers
) as response:
if response.ok:
j = await response.json()
# we find and confirm the IOC by checking that the second request in the request chain
page = j["page"]
links = [link['href'] for link in j["data"]["links"]]
try:
page_title = page.get("title")
server = page["server"]
page_asn = page["asn"]
page_asnname = page["asnname"]
links = ", ".join(links)
except (KeyError, TypeError, IndexError) as e:
print(f"{e} on {task_url}")
self.task_results.append(
{
"domain" : page["domain"],
"url" : page["url"],
"page_title" : page_title,
"server" : server,
"page_asn": page_asn,
"page_asnname" : page_asnname,
"links" : links
}
)
else:
raise Exception(
str(response.status) + " from " + str(response.url)
)
self.subtask_queue.task_done()
except asyncio.exceptions.CancelledError:
break
async def start(self) -> None:
"""entrypoint - sets up an aiohttp ssession and proceeds until the initial task (the search) and each subtask is completed. Saves the results to results.json."""
async with aiohttp.ClientSession(trust_env=True) as session:
self.session = session
await self.return_results()
workers = [asyncio.create_task(self.subtask()) for _ in range(5)]
await asyncio.gather(*workers)
with open("results.json", "w") as results:
results.write(json.dumps(self.task_results, indent=2))
print(json.dumps(self.task_results, indent=2))
async def main():
# Reasonably high fidelity search for Okta phishing pages.
search = APISearch(
'stats.requests:<30 domain:oktacdn.com filename:(okta-sign-in.min.js AND okta-sign-in.min.css) page.server:apache NOT (page.domain:okta.com)'
)
await search.start()
if __name__ == "__main__":
asyncio.run(main())
Raw
Note.md

Hunt for SCATTERED SPIDER infrastructure using urlscan.io

This hunt script leverages a reasonably high fidelity urlscan.io search for SCATTERED SPIDER phishing pages:

stats.requests:<30 domain:oktacdn.com filename:(okta-sign-in.min.js AND okta-sign-in.min.css) page.server:apache NOT (page.domain:okta.com)

The results of this search are then retrieved and stored into results.json.

Raw
results.json
[
{
"domain": "unchainedprod-okta.com",
"url": "https://unchainedprod-okta.com/",
"page_title": null,
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "www.ultainternal.com",
"url": "https://www.ultainternal.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "ultahub.com",
"url": "https://ultahub.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "ultainternal.com",
"url": "https://ultainternal.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "ultainternal.com",
"url": "https://ultainternal.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "toughask.com",
"url": "https://toughask.com/FN/info.php?Key=164.92.212.136=48c6e3335a7a148cf24929833a5c20d648c6e3335a7a148cf24929833a5c20d648c6e3335a7a148cf24929833a5c20d648c6e3335a7a148cf24929833a5c20d6",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "toughask.com",
"url": "https://toughask.com/FN/email.php?Key=164.92.212.136=e0f9ae91a42f46e31f294f58103ef5bae0f9ae91a42f46e31f294f58103ef5bae0f9ae91a42f46e31f294f58103ef5bae0f9ae91a42f46e31f294f58103ef5ba",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "ultainternal.com",
"url": "https://ultainternal.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "toughask.com",
"url": "https://toughask.com/FN/otp.php?Key=164.92.212.136=821a9f3278bdf788acb5c5fda5863e01821a9f3278bdf788acb5c5fda5863e01821a9f3278bdf788acb5c5fda5863e01821a9f3278bdf788acb5c5fda5863e01",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "toughask.com",
"url": "https://toughask.com/FN/card.php?Key=164.92.212.136=f75d510c1bb581e9b282591635e8de2ff75d510c1bb581e9b282591635e8de2ff75d510c1bb581e9b282591635e8de2ff75d510c1bb581e9b282591635e8de2f",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "toughask.com",
"url": "https://toughask.com/FN/error.php?Key=164.92.212.136=a4695d6d75845cae799ef58a41183808a4695d6d75845cae799ef58a41183808a4695d6d75845cae799ef58a41183808a4695d6d75845cae799ef58a41183808",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "afldevelopers.com",
"url": "https://afldevelopers.com/FN/login.php?Key=206.204.13.88=d8b0d57b0ad1cfff0b7fb3c448ae5fe2d8b0d57b0ad1cfff0b7fb3c448ae5fe2d8b0d57b0ad1cfff0b7fb3c448ae5fe2d8b0d57b0ad1cfff0b7fb3c448ae5fe2206.204.13.88United+States",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "apple-vpn.com",
"url": "https://apple-vpn.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "acwa-apple.com",
"url": "https://acwa-apple.com/",
"page_title": "Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "ogcstg.ogc-ownbackup.com",
"url": "https://ogcstg.ogc-ownbackup.com/ob_idp_users/log_in",
"page_title": "Page not found (404) | Own",
"server": "Apache",
"page_asn": "AS8987",
"page_asnname": "AMAZON EXPANSION, IE",
"links": "https://www.owndata.com/contact-us, https://www.owndata.com/privacy-policy, https://www.owndata.com/terms-of-service"
},
{
"domain": "www.okta.blackdoorsec.net",
"url": "https://www.okta.blackdoorsec.net/",
"page_title": "Symphony Talent - Sign In",
"server": "Apache",
"page_asn": "AS46606",
"page_asnname": "UNIFIEDLAYER-AS-1, US",
"links": "https://symphonytalent.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "afldevelopers.com",
"url": "https://afldevelopers.com/FN/card.php?Key=164.92.212.136=cb9465154c48010ab199c63ee37a00bacb9465154c48010ab199c63ee37a00bacb9465154c48010ab199c63ee37a00bacb9465154c48010ab199c63ee37a00ba",
"page_title": "securebanklogin.com - Sign In",
"server": "Apache",
"page_asn": "AS393960",
"page_asnname": "HOST4GEEKS-LLC, US",
"links": "https://www.securebanklogin.com/auth/default/forgot-user-id, https://auth.securebanklogin.com/help/login"
},
{
"domain": "lbadirectory.aenetworks.com",
"url": "https://lbadirectory.aenetworks.com/login.php",
"page_title": "L&BA Directory",
"server": "Apache/2.2.34 (Amazon)",
"page_asn": "AS14618",
"page_asnname": "AMAZON-AES, US",
"links": "https://aenetworks.okta.com/help/login"
},
{
"domain": "okta.blaesing.work",
"url": "https://okta.blaesing.work/",
"page_title": "Evilokta",
"server": "Apache",
"page_asn": "AS24940",
"page_asnname": "HETZNER-AS, DE",
"links": ""
},
{
"domain": "lbadirectory.aenetworks.com",
"url": "https://lbadirectory.aenetworks.com/login.php",
"page_title": "L&BA Directory",
"server": "Apache/2.2.34 (Amazon)",
"page_asn": "AS14618",
"page_asnname": "AMAZON-AES, US",
"links": "https://aenetworks.okta.com/help/login"
},
{
"domain": "okta.somerford.co",
"url": "https://okta.somerford.co/",
"page_title": "Somerford Portal - Sign-in",
"server": "Apache",
"page_asn": "AS16509",
"page_asnname": "AMAZON-02, US",
"links": "https://somerford.okta-emea.com/help/login"
},
{
"domain": "okta.reset-appfolio.com",
"url": "https://okta.reset-appfolio.com/",
"page_title": "AppFolio, Inc. - Sign In",
"server": "Apache/2.4.58 (Debian)",
"page_asn": "AS14618",
"page_asnname": "AMAZON-AES, US",
"links": "https://appfolio.okta.com/help/login, https://www.okta.com/?internal_link=wic_login"
},
{
"domain": "icsafronden.xyz",
"url": "https://icsafronden.xyz/main/",
"page_title": null,
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS60117",
"page_asnname": "HS, AE",
"links": ""
},
{
"domain": "okta.reset-appfolio.com",
"url": "http://okta.reset-appfolio.com/",
"page_title": "AppFolio, Inc. - Sign In",
"server": "Apache/2.4.58 (Debian)",
"page_asn": "AS14618",
"page_asnname": "AMAZON-AES, US",
"links": "https://appfolio.okta.com/help/login, https://www.okta.com/?internal_link=wic_login"
},
{
"domain": "okta.reset-appfolio.com",
"url": "https://okta.reset-appfolio.com/",
"page_title": "AppFolio, Inc. - Sign In",
"server": "Apache/2.4.58 (Debian)",
"page_asn": "AS14618",
"page_asnname": "AMAZON-AES, US",
"links": "https://appfolio.okta.com/help/login, https://www.okta.com/?internal_link=wic_login"
},
{
"domain": "margennuw.life",
"url": "https://margennuw.life/main/",
"page_title": "Telekom DE - Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS49544",
"page_asnname": "I3DNET, NL",
"links": "https://t-mobilestaging.oktapreview.com/help/login, http://www.okta.com/"
},
{
"domain": "margennuw.life",
"url": "https://margennuw.life/main/",
"page_title": "Telekom DE - Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS49544",
"page_asnname": "I3DNET, NL",
"links": "https://t-mobilestaging.oktapreview.com/help/login, http://www.okta.com/"
},
{
"domain": "squarespacehr.com",
"url": "https://squarespacehr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.52 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "margennuw.life",
"url": "https://margennuw.life/main/",
"page_title": "Telekom DE - Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS49544",
"page_asnname": "I3DNET, NL",
"links": "https://t-mobilestaging.oktapreview.com/help/login, http://www.okta.com/"
},
{
"domain": "magentmpol.publicvm.com",
"url": "https://magentmpol.publicvm.com/main/",
"page_title": "Telekom DE - Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS60117",
"page_asnname": "HS, AE",
"links": "https://t-mobilestaging.oktapreview.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "magentmpol.publicvm.com",
"url": "https://magentmpol.publicvm.com/main/",
"page_title": "Telekom DE - Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS60117",
"page_asnname": "HS, AE",
"links": "https://t-mobilestaging.oktapreview.com/help/login, http://www.okta.com/"
},
{
"domain": "193.149.176.19",
"url": "http://193.149.176.19/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "ews-signon.com",
"url": "https://ews-signon.com/",
"page_title": null,
"server": "Apache/2.4.52 (Ubuntu)",
"page_asn": "AS14618",
"page_asnname": "AMAZON-AES, US",
"links": "https://ews.okta.com/help/login, http://www.okta.com/, https://ews.okta.com/privacy"
},
{
"domain": "squarespacehr.com",
"url": "https://squarespacehr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.52 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "193.149.176.19",
"url": "http://193.149.176.19/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "193.149.176.19",
"url": "http://193.149.176.19/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "216.245.184.53",
"url": "https://216.245.184.53/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "216.245.184.53",
"url": "https://216.245.184.53/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "intercom-hr.com",
"url": "https://intercom-hr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "prntsrc.net",
"url": "https://prntsrc.net/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "prntsrc.net",
"url": "https://prntsrc.net/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "intercom-hr.com",
"url": "https://intercom-hr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "prntsrc.net",
"url": "https://prntsrc.net/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "activecampainhr.com",
"url": "https://activecampainhr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "intercom-hr.com",
"url": "https://intercom-hr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "intercom-hr.com",
"url": "https://intercom-hr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "fportal.cloud",
"url": "https://fportal.cloud/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "fportal.cloud",
"url": "https://fportal.cloud/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "http://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "fportal.cloud",
"url": "https://fportal.cloud/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "fportal.cloud",
"url": "https://fportal.cloud/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "fportal.cloud",
"url": "https://fportal.cloud/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "fportal.cloud",
"url": "https://fportal.cloud/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "foxnetworksinfo.com",
"url": "https://foxnetworksinfo.com/login",
"page_title": "\n\t\tLogin\t\t\t\t - FOX Networks Info\n\t\t",
"server": "Apache",
"page_asn": "AS29802",
"page_asnname": "HVC-AS, US",
"links": "https://foxconnect.okta.com/help/login, https://www.foxcorporation.com/"
},
{
"domain": "162.33.179.76",
"url": "https://162.33.179.76/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "https://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://login.tportal.cloud/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "foxnetworksinfo.com",
"url": "https://foxnetworksinfo.com/login",
"page_title": "\n\t\tLogin\t\t\t\t - FOX Networks Info\n\t\t",
"server": "Apache",
"page_asn": "AS29802",
"page_asnname": "HVC-AS, US",
"links": "https://foxconnect.okta.com/help/login, https://www.foxcorporation.com/"
},
{
"domain": "activecampaign-hr.com",
"url": "https://activecampaign-hr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "gemini-sso.com",
"url": "https://gemini-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "stargate-sso.com",
"url": "https://stargate-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "gemini-sso.com",
"url": "https://gemini-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "216.245.184.53",
"url": "https://216.245.184.53/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "gemini-sso.com",
"url": "https://gemini-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "stargate-sso.com",
"url": "https://stargate-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "activecampaign-hr.com",
"url": "https://activecampaign-hr.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "162.33.179.76",
"url": "https://162.33.179.76/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "stargate-sso.com",
"url": "https://stargate-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "162.33.179.76",
"url": "https://162.33.179.76/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "170.64.139.104",
"url": "http://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://frontieradvisors.okta.com/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "170.64.139.104",
"url": "http://170.64.139.104/",
"page_title": "Frontier Advisors - Sign In",
"server": "Apache/2.4.58 (Ubuntu)",
"page_asn": "AS14061",
"page_asnname": "DIGITALOCEAN-ASN, US",
"links": "https://frontieradvisors.okta.com/help/login, https://www.okta.com/?internal_link=wic_login, https://frontieradvisors.okta.com/privacy"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "gemini-sso.com",
"url": "https://gemini-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
},
{
"domain": "uscellular-sso.com",
"url": "https://uscellular-sso.com/",
"page_title": "Sign In",
"server": "Apache/2.4.41 (Ubuntu)",
"page_asn": "AS399629",
"page_asnname": "BLNWX, US",
"links": "https://nigga.okta.com/help/login, http://www.okta.com/"
}
]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment