treehausatl.com
Open in
urlscan Pro
69.49.230.76
Malicious Activity!
Public Scan
URL:
http://treehausatl.com/dhjkhds/office%20(4)%20(1)/login/?access=valid&sessionid=gbc5d7fi9+e4h8+j01362a2+glo+wt8
Submission: On March 18 via automatic, source openphish — Scanned from DE
Submission: On March 18 via automatic, source openphish — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 69.49.230.76, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is treehausatl.com.
The Cisco Umbrella rank of the primary domain is 923223.
This is the only time treehausatl.com was scanned on urlscan.io!
This is the only time treehausatl.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 69.49.230.76 69.49.230.76 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 12 | 1 |
12
69.49.230.76
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-230-76.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-230-76.unifiedlayer.com
| treehausatl.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
treehausatl.com
treehausatl.com — Cisco Umbrella Rank: 923223 |
660 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 12 | treehausatl.com |
treehausatl.com
|
| 12 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://treehausatl.com/dhjkhds/office%20(4)%20(1)/login/?access=valid&sessionid=gbc5d7fi9+e4h8+j01362a2+glo+wt8
Frame ID: DF6911353C5DB56E423C9137E3A67A16
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Sign in to your Мiсrоsоft ассоuntDetected technologies
animate.css (Web Frameworks) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/ |
4 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
normalize.css
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
animate.css
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
76 KB 76 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fonts.css
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.svg
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow_left.svg
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
513 B 758 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.5.1.min.js
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.js
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mainbg.svg
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SegoeUISemiBold.woff
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/fonts/SegoeUI/SegoeUISemiBold/ |
189 KB 189 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SegoeUIRegular.woff
treehausatl.com/dhjkhds/office%20(4)%20(1)/login/assets/fonts/SegoeUI/SegoeUIRegular/ |
275 KB 275 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
%20(1)/login/assets/logo.svg){kind=link}
%20(1)/login/assets/logo.svg){kind=link}
%20(1)/login/assets/arrow_left.svg){kind=link}
%20(1)/login/assets/arrow_left.svg){kind=link}
%20(1)/login/assets/mainbg.svg){kind=link}
%20(1)/login/assets/mainbg.svg){kind=link}
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| treehausatl.com/ | Name: PHPSESSID Value: 2f21e01162c15096ad8283682540d8aa |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
treehausatl.com
69.49.230.76
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
063ed57101f21c8a0d95975e2d00f87c6d57fd6d20d65b3aa077cd73e3c9941c
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
4c9c2d9f3391fe10abe201b45ff7d32f97dc4e35df9450ef39aeca3d3f52a994
580818700724d42d7fcc4979b0197971fca1c6d2e0286769237a0ac897df5512
a6bd510fcb0a3e7e274824c8272223a2d9d664ce6634559f18200f9fc0bb4371
ac29faf3e74304e08266253f2d2a44a389db618e1cf38ddb799fe1d287bb0d0b
b1d523f8e8855c9438d840eb3104e8fc94ba2eb3aa42edc0c4481c44b8ea6286
ca237ccd4bfd5cbc632986f1cb82fb4e73717d8b82b003553ee97045af9a1cfa
f1b5ccd9e804dd7d91f5443bfa76cfe71ce082009ebee0d6a759641170ed9261
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d