t-teg.com Open in urlscan Pro
2606:4700:3032::ac43:d4fa  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://chandrujobs.in/service.php Page URL
2. https://t-teg.com/Account/?apsignin Page URL
3. https://t-teg.com/Account/ap/signin?session=1b26e0f6ffabc40d551e33a6ff827c79c84da378 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	service.php chandrujobs.in/	377 B 811 B	552ms 520ms	Document text/html	2606:4700:3037::6815:22da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://chandrujobs.in/service.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:22da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority chandrujobs.in :scheme https :path /service.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 08 Jul 2021 16:31:55 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding referrer-policy no-referrer-when-downgrade x-turbo-charged-by LiteSpeed cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2p9Kb2U4z12eEwpzDaxPT%2BuEKz7WQO3%2B7IOgaKuJTnQAiYUSPzDJ9uTxfnunKKap7EJ8M2Z8Wf2lMTgcsJGmgvf1dbTUd0MziI8wnXbRrBINCrmzh5Vqw5HqcYakVMhR3AK%2BAsih1t4%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 66bab4a12acc4dc4-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
POST H2	200	/ t-teg.com/Account/	121 B 933 B	347ms 313ms	Document text/html	2606:4700:3032::ac43:d4fa
General Check archive.org Show headers Download Go to Full URL https://t-teg.com/Account/?apsignin Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:d4fa , United States, ASN (), Reverse DNS Software cloudflare / PHP/7.4.14 Resource Hash Security Headers Name Value X-Xss-Protection 1; mode=block Request headers :method POST :authority t-teg.com :scheme https :path /Account/?apsignin content-length 65 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 origin https://chandrujobs.in content-type application/x-www-form-urlencoded user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://chandrujobs.in/service.php accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 Origin https://chandrujobs.in Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://chandrujobs.in/service.php Response headers date Thu, 08 Jul 2021 16:31:55 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.4.14 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=7ffgb0fh33kr6bt6aspht4n55g; path=/ x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=RrMhFjpxQ%2BfI4Rcb2xP4X1T8JkaQRhj875jzi%2B%2Bh1Zt1GArfKBUc%2BStg5ojm13jfhrXOBfMYzalUlnfbR0N2ryh4kaav5ujOnVaIG3xfOg%2FF4kPudAbqOJu0HBOth4D8K9v8"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 66bab4a4ac5a3260-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H3-29	200	Primary Request signin Show response t-teg.com/Account/ap/	8 KB 3 KB	382ms 367ms	Document text/html	2606:4700:3032::ac43:d4fa
General Check archive.org Show headers Download Go to Full URL https://t-teg.com/Account/ap/signin?session=1b26e0f6ffabc40d551e33a6ff827c79c84da378 Requested by Host: t-teg.com URL: https://t-teg.com/Account/?apsignin Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3032::ac43:d4fa , United States, ASN (), Reverse DNS Software cloudflare / PHP/7.4.14 Resource Hash 365cf35be98f1e594353daa8ff7e9c38d8ab840367e02e0e14c0256a5ab35bbd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority t-teg.com :scheme https :path /Account/ap/signin?session=1b26e0f6ffabc40d551e33a6ff827c79c84da378 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://t-teg.com/Account/?apsignin accept-encoding gzip, deflate, br accept-language en-US cookie PHPSESSID=7ffgb0fh33kr6bt6aspht4n55g Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://t-teg.com/Account/?apsignin Response headers date Thu, 08 Jul 2021 16:31:56 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.4.14 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block x-content-type-options nosniff cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=CA5u%2F4LLwD4t%2BjHcUc95hejX5P4QZIDATRvhUf893r4Ms%2F8THXAf8PA5btOkfTwmTFz76SrIu4RXCroEWi3IXw%2B%2F8q%2Fh6M7VHcxDe8OO0rzlg7O03eMXx0kqRlLXuynt3SN9"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 66bab4a6c8224e0e-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H3-29	200	main.css t-teg.com/Account/assets/css/	173 KB 28 KB	25ms 25ms	Stylesheet text/css	2606:4700:3032::ac43:d4fa
General Check archive.org Show headers Download Go to Full URL https://t-teg.com/Account/assets/css/main.css Requested by Host: t-teg.com URL: https://t-teg.com/Account/ap/signin?session=1b26e0f6ffabc40d551e33a6ff827c79c84da378 Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3032::ac43:d4fa , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash aa5644422e8bb32d16c6e5c9375c2947b6413bc6cbc0d00dfce630002c1a000b Security Headers Name Value X-Xss-Protection 1; mode=block Request headers :path /Account/assets/css/main.css pragma no-cache cookie PHPSESSID=7ffgb0fh33kr6bt6aspht4n55g accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority t-teg.com referer https://t-teg.com/Account/ap/signin?session=1b26e0f6ffabc40d551e33a6ff827c79c84da378 :scheme https sec-fetch-site same-origin :method GET Referer https://t-teg.com/Account/ap/signin?session=1b26e0f6ffabc40d551e33a6ff827c79c84da378 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 08 Jul 2021 16:31:56 GMT content-encoding br origin https://www.fbi.gov cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 203 cf-polished origSize=177536 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=kU8utaYUK0%2F6nw5p9OWHHjyHczwRc481P83i1FCcf%2BPT0g5%2F77UxUraeVHMbMcpzyyP3RPsEGcZMcmAiakL8V1B2ppyLSFYfOLyLMDxWJdribqPaCdEi1a1u1yqWhvYCxXGt"}],"group":"cf-nel","max_age":604800} x-forwarded-host www.fbi.gov x-forwarded-proto https alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 x-xss-protection 1; mode=block x-content-type nosniff remote_addr 104.16.77.187 last-modified Thu, 08 Jul 2021 14:11:25 GMT server cloudflare x_forwarded_for 104.16.77.187 etag W/"2b580-5c69d3b045387" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding host www.fbi.gov content-type text/css cache-control max-age=14400 referer https://www.fbi.gov cf-ray 66bab4a91e1c4e0e-FRA cf-bgj minify
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	29ms 12ms	Image image/png	2600:9000:21f3:8e00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: t-teg.com URL: https://t-teg.com/Account/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:8e00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5 Request headers Referer https://t-teg.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 08 Feb 2021 09:57:16 GMT via 1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront) age 13468804 edge-cache-tag x-cache-378,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 x-cache Hit from cloudfront content-length 27972 surrogate-key x-cache-378 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 last-modified Fri, 22 Sep 2017 00:23:19 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 1dd77c05-c248-4274-b8c8-a68634def112 x-amz-cf-pop FRA2-C2 timing-allow-origin https://www.amazon.com x-amz-cf-id VsJJGInL4p5-jvTWIEPgWC-5ULLjuf7v14a_2164ReNg4QZmYyH6NA== expires Mon, 28 Jan 2041 19:11:52 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated number| ue_t0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			t-teg.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7ffgb0fh33kr6bt6aspht4n55g

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chandrujobs.in
m.media-amazon.com
t-teg.com
2600:9000:21f3:8e00:1d:d7f6:39cf:a761
2606:4700:3032::ac43:d4fa
2606:4700:3037::6815:22da
365cf35be98f1e594353daa8ff7e9c38d8ab840367e02e0e14c0256a5ab35bbd
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
aa5644422e8bb32d16c6e5c9375c2947b6413bc6cbc0d00dfce630002c1a000b