updatenow.tiiny.site

Summary

This website contacted 4 IPs in 4 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2600:9000:2449:da00:19:266d:4200:93a1, located in United States and belongs to AMAZON-02, US. The main domain is updatenow.tiiny.site.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 11th 2024. Valid for: a year.

This is the only time updatenow.tiiny.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.18.0.248 104.18.0.248	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:244... 2600:9000:2449:da00:19:266d:4200:93a1	16509 (AMAZON-02) (AMAZON-02)
2	3.10.126.206 3.10.126.206	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
6	4

1 104.18.0.248 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

flowcode.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2449:da00:19:266d:4200:93a1 (United States)

ASN16509 (AMAZON-02, US)

updatenow.tiiny.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.10.126.206 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-10-126-206.eu-west-2.compute.amazonaws.com

analytics.tiiny.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	tiiny.site updatenow.tiiny.site analytics.tiiny.site	26 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380	30 KB
1	flowcode.com 1 redirects flowcode.com — Cisco Umbrella Rank: 82522	666 B
6	3

	Domain	Requested by
3	updatenow.tiiny.site	updatenow.tiiny.site
2	analytics.tiiny.site	updatenow.tiiny.site analytics.tiiny.site
1	ajax.googleapis.com	updatenow.tiiny.site
1	flowcode.com	1 redirects
6	4

This site contains no links.

Subject Issuer	Validity	Valid
*.tiiny.site Amazon RSA 2048 M02	`2024-01-11` - `2025-02-07`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://updatenow.tiiny.site/
Frame ID: 8D67EC1CB7536512308D50D02A2FF069
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login screen

Page URL History Show full URLs

http://flowcode.com/p/rtMK9VtGE?fc=3D0 HTTP 307
https://flowcode.com/p/rtMK9VtGE?fc=3D0 HTTP 302
https://updatenow.tiiny.site/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

4
Countries

57 kB
Transfer

118 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://flowcode.com/p/rtMK9VtGE?fc=3D0 HTTP 307
https://flowcode.com/p/rtMK9VtGE?fc=3D0 HTTP 302
https://updatenow.tiiny.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
updatenow.tiiny.site/
Redirect Chain

http://flowcode.com/p/rtMK9VtGE?fc=3D0
https://flowcode.com/p/rtMK9VtGE?fc=3D0
https://updatenow.tiiny.site/

21 KB
22 KB

237ms
123ms

Document
text/html

2600:9000:2449:da00:19:266d:4200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://updatenow.tiiny.site/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:da00:19:266d:4200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 24a90cac25cb1b5585a64933909b48c6b1d2ba4ebfc8c99831a2649c50f83eae

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

content-length: 21538
content-type: text/html
date: Tue, 07 May 2024 17:20:51 GMT
etag: "a5e7806214de66e761b3df08501adc57"
last-modified: Sat, 04 May 2024 19:04:52 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 c88ca2a75ca16a71cee4beefb2f6e6b8.cloudfront.net (CloudFront)
x-amz-cf-id: 1gAHyJFsuxP_MpJ3m0LKhSC436tqAzUWMBo94STuHJeS6ZIgepUAHA==
x-amz-cf-pop: AMS58-P6
x-amz-id-2: b7a0IdbRSUK5wwq3Pg9li26vdXS/bOg5RgxZ34XdxG6MjXZIUbZOGE1IB4aYrj6OSsCdcSScSis=
x-amz-request-id: TT5XEKBF88B8N4SR
x-amz-version-id: 5TLm1nwe7.H1cUCpyYa2QF3l6QQOm7Of
x-cache: Miss from cloudfront

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8802e207adfc30f4-FRA
content-type: text/html; charset=utf-8
date: Tue, 07 May 2024 17:20:50 GMT
expires: Thu, 01 Jan 1970 00:00:00 UTC
location: https://updatenow.tiiny.site/
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload

GET
H2 404 style.css
updatenow.tiiny.site/ 0
0 202ms
202ms Stylesheet
text/html 2600:9000:2449:da00:19:266d:4200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://updatenow.tiiny.site/style.css
Requested by: Host: updatenow.tiiny.site
URL: https://updatenow.tiiny.site/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:da00:19:266d:4200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://updatenow.tiiny.site/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

x-amz-version-id: HQS3hfcAn_bhUiNmm.npdf.2W05oQE2X
x-amz-error-code: NoSuchKey
via: 1.1 c88ca2a75ca16a71cee4beefb2f6e6b8.cloudfront.net (CloudFront)
date: Tue, 07 May 2024 17:20:49 GMT
x-amz-request-id: TT5VF4Y079A7XJBD
x-amz-cf-pop: AMS58-P6
x-amz-error-message: The specified key does not exist.
x-cache: Error from cloudfront
content-length: 2289
x-amz-id-2: tLTcvOPtU2zAXI2e0OLjAjqznksgg+Jbj7T1tNq5mBtwVhwZtDaTfBeQwYmGktCB3xbgLTNTOMg=
last-modified: Thu, 26 Oct 2023 17:50:12 GMT
server: AmazonS3
etag: "50d4d74a6cc2bc8a4fbeaefad288fb01"
vary: Accept-Encoding
x-amz-error-detail-key: updatenow/style.css
content-type: text/html
x-amz-cf-id: IiuQTg441eFwNDcu4ndCexO_kaTGAel9aSfpOX6C1InhOe9kKUezjg==

GET
H/1.1 200
OK plausible.js Show response
analytics.tiiny.site/js/ 1 KB
2 KB 132ms
39ms Script
application/javascript 3.10.126.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.tiiny.site/js/plausible.js

Requested by

Host: updatenow.tiiny.site
URL: https://updatenow.tiiny.site/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.10.126.206 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-10-126-206.eu-west-2.compute.amazonaws.com

Software

nginx/1.22.1 /

Resource Hash

7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://updatenow.tiiny.site/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Tue, 07 May 2024 17:20:50 GMT
x-content-type-options: nosniff
Server: nginx/1.22.1
Content-Type: application/javascript
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 1332

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Content-Type: image/svg+xml

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 99ms
32ms Script
text/javascript 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: updatenow.tiiny.site
URL: https://updatenow.tiiny.site/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://updatenow.tiiny.site/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 07 May 2024 10:15:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30462
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 May 2025 10:15:08 GMT

POST
H/1.1 202
Accepted event Show response
analytics.tiiny.site/api/ 2 B
363 B 115ms
41ms XHR
text/plain 3.10.126.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiiny.site/api/event
Requested by: Host: analytics.tiiny.site
URL: https://analytics.tiiny.site/js/plausible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.10.126.206 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-10-126-206.eu-west-2.compute.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://updatenow.tiiny.site/
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Content-Type: text/plain

Response headers

Date: Tue, 07 May 2024 17:20:50 GMT
Server: nginx/1.22.1
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 2
x-request-id: F81El3-jbRwX9b4DGebh

GET
H2 404 att-favicon.png
updatenow.tiiny.site/ 2 KB
3 KB 209ms
209ms Other
text/html 2600:9000:2449:da00:19:266d:4200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://updatenow.tiiny.site/att-favicon.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:da00:19:266d:4200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0134f88c5aa272b6544b744fe5ba9fa92fc1719aed38b7287ace9e0fa50c4474

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://updatenow.tiiny.site/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

x-amz-version-id: HQS3hfcAn_bhUiNmm.npdf.2W05oQE2X
x-amz-error-code: NoSuchKey
via: 1.1 c88ca2a75ca16a71cee4beefb2f6e6b8.cloudfront.net (CloudFront)
date: Tue, 07 May 2024 17:20:49 GMT
x-amz-request-id: TT5QTGXC6RNMM97V
x-amz-cf-pop: AMS58-P6
x-amz-error-message: The specified key does not exist.
x-cache: Error from cloudfront
content-length: 2289
x-amz-id-2: AtzIQKFOxj3W2+kZY/JfS1udhDbBSmXfg07Hh1mTdEDkH8aMcUqbcc49OpY08lD4CUzH7CA10/c=
last-modified: Thu, 26 Oct 2023 17:50:12 GMT
server: AmazonS3
etag: "50d4d74a6cc2bc8a4fbeaefad288fb01"
vary: Accept-Encoding
x-amz-error-detail-key: updatenow/att-favicon.png
content-type: text/html
x-amz-cf-id: mA9wIxZl3oTPJcj_AWyRo70t83gU6gvcS-7I6wHAoQnZHAeXFqK8hA==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.flowcode.com/	1970-01-21 06:01:02	Name: rdservice Value: f3e551a5-bd06-40bc-a0ca-e3f75aed4084-SSE:1715102449
.flowcode.com/	1970-01-20 20:25:04	Name: __cf_bm Value: h7lFSjbC28sM8Ht7_AqIRS1AQLBP2FxIgO8O3VWssWM-1715102450-1.0.1.1-YVNdgJlMz_NfQVv3GgJjTJb4Ilux0snbMHFdijQZC4FkHqH4Wo_S2fuRK9bYTEjhu0tbAqvBvQ75A2fc.X8UEw
.flowcode.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 9jb.yoydH6kFzWQ3Q4FPlwNl3YMvyaGu0V2u_kJTF7g-1715102450012-0.0.1.1-604800000

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://updatenow.tiiny.site/style.css Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://updatenow.tiiny.site/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://updatenow.tiiny.site/att-favicon.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
analytics.tiiny.site
flowcode.com
updatenow.tiiny.site
104.18.0.248
2600:9000:2449:da00:19:266d:4200:93a1
2a00:1450:4001:828::200a
3.10.126.206
0134f88c5aa272b6544b744fe5ba9fa92fc1719aed38b7287ace9e0fa50c4474
24a90cac25cb1b5585a64933909b48c6b1d2ba4ebfc8c99831a2649c50f83eae
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

updatenow.tiiny.site Open in urlscan Pro 2600:9000:2449:da00:19:266d:4200:93a1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

4 IPs

4 Countries

57 kBTransfer

118 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

3 Cookies

3 Console Messages

Indicators

updatenow.tiiny.site Open in urlscan Pro
2600:9000:2449:da00:19:266d:4200:93a1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

4
Countries

57 kB
Transfer

118 kB
Size

3
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!