acctttiioon4433.atwebpages.com
Open in
urlscan Pro
185.176.43.108
Malicious Activity!
Public Scan
Effective URL: http://acctttiioon4433.atwebpages.com/index1.php
Submission: On June 06 via manual from US — Scanned from DE
Summary
This is the only time acctttiioon4433.atwebpages.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tuya (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a04:e4c7:fff... 2a04:e4c7:ffff::69 | 36692 (OPENDNS) (OPENDNS) | |
1 1 | 104.47.66.28 104.47.66.28 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 2606:4700:10:... 2606:4700:10::ac43:1e1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 185.176.43.108 185.176.43.108 | 44476 (ZETTA-AS) (ZETTA-AS) | |
2 | 45.60.46.18 45.60.46.18 | 19551 (INCAPSULA) (INCAPSULA) | |
1 | 143.204.201.92 143.204.201.92 | 16509 (AMAZON-02) (AMAZON-02) | |
8 | 3 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
nam12.safelinks.protection.outlook.com |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-92.fra53.r.cloudfront.net
script.hotjar.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
atwebpages.com
acctttiioon4433.atwebpages.com |
165 KB |
2 |
tuya.com.co
www.tuya.com.co — Cisco Umbrella Rank: 714549 |
94 KB |
1 |
hotjar.com
script.hotjar.com — Cisco Umbrella Rank: 713 |
3 KB |
1 |
tinyurl.com
1 redirects
tinyurl.com — Cisco Umbrella Rank: 17254 |
430 B |
1 |
outlook.com
1 redirects
nam12.safelinks.protection.outlook.com — Cisco Umbrella Rank: 8305 |
611 B |
1 |
cisco.com
1 redirects
secure-web.cisco.com — Cisco Umbrella Rank: 12399 |
376 B |
8 | 6 |
Domain | Requested by | |
---|---|---|
5 | acctttiioon4433.atwebpages.com |
acctttiioon4433.atwebpages.com
|
2 | www.tuya.com.co |
acctttiioon4433.atwebpages.com
|
1 | script.hotjar.com |
acctttiioon4433.atwebpages.com
|
1 | tinyurl.com | 1 redirects |
1 | nam12.safelinks.protection.outlook.com | 1 redirects |
1 | secure-web.cisco.com | 1 redirects |
8 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tuya.com.co Go Daddy Secure Certificate Authority - G2 |
2020-06-09 - 2022-07-06 |
2 years | crt.sh |
*.hotjar.com Amazon |
2021-11-25 - 2022-12-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://acctttiioon4433.atwebpages.com/index1.php
Frame ID: 97C83C1005F3D5333A04B1408343D295
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
TransaccionalPage URL History Show full URLs
-
https://secure-web.cisco.com/1Dq7a2R6r3m4i4i5ZMl8h-zCak86WJKedOBetj4JSeiDAXMeuZ4ZqViKtgYp_xl9avAHFhD2ZgsE...
HTTP 302
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftinyurl.com%2F5465564retre453453&data=05%7C01%7C%7C422826... HTTP 302
https://tinyurl.com/5465564retre453453 HTTP 301
http://acctttiioon4433.atwebpages.com/index1.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://secure-web.cisco.com/1Dq7a2R6r3m4i4i5ZMl8h-zCak86WJKedOBetj4JSeiDAXMeuZ4ZqViKtgYp_xl9avAHFhD2ZgsEr4iX8x7ZXy7aQ4EHeaXh9-ehehcXTVNlgOdPZKT_5tAh868ZYV5BhkFTcsSlgqYEONQH6tn6QjGdCxOFd3RO2gEAaY6gP3ul2iwgl4NvL5-6X17yfI3x9GmULDqb30GLCNz2FRIHBbqRKy47Q8RVvDrK9jYvImel0FbE5xT56aatoBbnvRjD3PjJ4_g95wohMaSBlQIGLCvwBWkAAyb4wv6wgjMVfF3kvqD1rkffhVKNxancnTApKLKiNWyMfdgt2TvEhQsK0Q3sPT7s-FlSqUdWf7qrHQoaUucs7TbGkv0ZaSWQtWpgGvePefQn_bvqyYLpsybgylX-HhrGM9tHEFK_bh0krcZ4KYu9oSgb0ZXEt3ZDDdSiKQvrIig1mJ-zf6z-VDuYwxQ/https%3A%2F%2Fnam12.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Ftinyurl.com%252F5465564retre453453%26data%3D05%257C01%257C%257C4228260e37f64cac622a08da476fff6a%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C637900843588540513%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3DZR3bzD7GT9gWz72D3tblyQtXdsEO7U3AAg19Xp2R18s%253D%26reserved%3D0
HTTP 302
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftinyurl.com%2F5465564retre453453&data=05%7C01%7C%7C4228260e37f64cac622a08da476fff6a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637900843588540513%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ZR3bzD7GT9gWz72D3tblyQtXdsEO7U3AAg19Xp2R18s%3D&reserved=0 HTTP 302
https://tinyurl.com/5465564retre453453 HTTP 301
http://acctttiioon4433.atwebpages.com/index1.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index1.php
acctttiioon4433.atwebpages.com/ Redirect Chain
|
106 KB 106 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Default1.css
acctttiioon4433.atwebpages.com/files/ |
16 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
preact-incoming-feedback.49D2SNGzC9GHcrUUaqinbv3Z2PLFKvxxmFNNsY6aQG72DmWbGET77srS3bd7S1wwYLTnyPqURASpx15UMac6uZKxFzSmgvJ:normal;font-family:Arial,%20sans-serif,%20Tahoma%20!important;text-transform...
acctttiioon4433.atwebpages.com/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerPortalSinMarcas.PNG
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PublicidadPortal.JPG
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ |
77 KB 78 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
titulos-productos.png
acctttiioon4433.atwebpages.com/files/ |
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-hotjar_5.65042d.woff2
script.hotjar.com/ |
2 KB 3 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
botonAceptar.png
acctttiioon4433.atwebpages.com/files/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tuya (Financial)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.tuya.com.co/ | Name: visid_incap_1881794 Value: GVzVz7SVRGiLDRNky1yUZGBmnmIAAAAAQUIPAAAAAADA5HftlAyc40rvXhITKPU8 |
|
.tuya.com.co/ | Name: incap_ses_877_1881794 Value: tFcjG662yjgRlncte7srDGBmnmIAAAAAcojnb6WaW02PgFBn4pVLbQ== |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
acctttiioon4433.atwebpages.com
nam12.safelinks.protection.outlook.com
script.hotjar.com
secure-web.cisco.com
tinyurl.com
www.tuya.com.co
104.47.66.28
143.204.201.92
185.176.43.108
2606:4700:10::ac43:1e1
2a04:e4c7:ffff::69
45.60.46.18
721617d6bd7e2ea4388479bc9fc491f5aaeed5052b3a9921ab3414b62ff5078d
72a927e2b16de3869cd61aebf6cab10e36c1eb5a2a0d97c0d646f75483d56d1c
7faebc0f10df9657e25c137ad413ec2850639a3008fcbbaecbb1e9730051db15
883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155
a6da54728e886aee1a97754a538987fab290e3786e5cb7dbec91b37ce028d302
fab4fef6bbfa8d6464403a14be7de1be5e3e63637a96d994fab10266e1eaf6da
fdd025456871d99b45cf95a30a097d5c168a62c91fd86852cba4802321f6e36a