ftp.tassoestew.tech
Open in
urlscan Pro
162.0.213.15
Malicious Activity!
Public Scan
Effective URL: https://ftp.tassoestew.tech/m/2e51aa89e80b62293b399624f06ab829.html
Submission: On November 01 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on October 30th 2023. Valid for: 3 months.
This is the only time ftp.tassoestew.tech was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 162.0.213.15 162.0.213.15 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2607:f8b0:402... 2607:f8b0:4020:805::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 216.24.57.253 216.24.57.253 | 397273 (RENDER) (RENDER) | |
1 | 64.185.227.156 64.185.227.156 | 18450 (WEBNX) (WEBNX) | |
11 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: svr.hostpage.host
ftp.tassoestew.tech |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
tassoestew.tech
1 redirects
ftp.tassoestew.tech |
31 KB |
2 |
onrender.com
mainoffy.onrender.com |
227 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 3028 |
222 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 364 |
30 KB |
11 | 4 |
Domain | Requested by | |
---|---|---|
8 | ftp.tassoestew.tech |
1 redirects
ftp.tassoestew.tech
ajax.googleapis.com |
2 | mainoffy.onrender.com |
ftp.tassoestew.tech
|
1 | api.ipify.org |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
ftp.tassoestew.tech
|
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.09n4lb2jmf.culaereppy.tech R3 |
2023-10-30 - 2024-01-28 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-16 - 2024-01-08 |
3 months | crt.sh |
onrender.com Cloudflare Inc ECC CA-3 |
2023-09-17 - 2024-09-16 |
a year | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2023-02-07 - 2024-02-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ftp.tassoestew.tech/m/2e51aa89e80b62293b399624f06ab829.html
Frame ID: C93421E7572B1308F1C12CB182E866CF
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
EL5SLXZQYRZUG53EKOZEPage URL History Show full URLs
-
https://ftp.tassoestew.tech/
HTTP 302
https://ftp.tassoestew.tech/m/2e51aa89e80b62293b399624f06ab829.html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ftp.tassoestew.tech/
HTTP 302
https://ftp.tassoestew.tech/m/2e51aa89e80b62293b399624f06ab829.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
2e51aa89e80b62293b399624f06ab829.html
ftp.tassoestew.tech/m/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
ftp.tassoestew.tech/m/assets/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CX90YTAVTEOV0UO28HJ6KWDAW
ftp.tassoestew.tech/m/sm/ |
106 KB 18 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.0/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mlg.svg
ftp.tassoestew.tech/m/mxl/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sig_op.svg
ftp.tassoestew.tech/m/mxl/ |
2 KB 991 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authy.js
mainoffy.onrender.com/ |
415 KB 155 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
encrytCode.js
mainoffy.onrender.com/ |
195 KB 72 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GY94GMISZ6K7JZ8VV63KOA43Q
ftp.tassoestew.tech/m/bxg/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
22 B 222 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
script.php
ftp.tassoestew.tech/m/ |
5 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)106 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery string| pagemsg string| semail string| urlx string| purlx string| lmode function| _0x222688 function| _0x39b0c4 function| _0x4e1130 function| _0x40abc0 function| _0x40a7d3 object| _0xd0fac5 function| _0x385fc8 object| Errs string| email string| epass string| phone object| dVal object| lVal object| pages function| _0x5610ee string| Key string| randomNum number| skip undefined| myInterval undefined| Proofs undefined| Timeout string| IP undefined| GetCredential number| mhost string| pgtype function| _0x3cdc function| getpage function| isEmail function| nextto function| select_account function| _0x41fed9 function| back function| _0xf2847e function| cancel function| _0x470562 number| count number| lcount function| redlogin function| setCookie function| auth function| auth_live function| getproof function| SendCodeLive function| ihacode function| VerifyCodeLive function| GotoAuth function| authback function| GotoType function| AuthEdata function| verifyOTC function| beginAuth number| PollCount function| endAuth function| processAuth function| startEndath function| stopEndath function| datetoiso function| dec2hex function| generateId string| SesIN function| _0x5bf0 function| _0x290ab9 function| _0x42684f function| _0x1a4ce1 function| _0x8de6f3 function| _0xc2195 function| _0x508af5 function| _0x660f function| Encrypt function| PackageSADataForProof function| parseRSAKeyFromString function| hexStringToMP function| JSMPnumber function| applyPKCSv2Padding function| SHA1 function| PadSHA1Input function| SHA1RoundFunction function| rotateLeft function| wordToBytes function| MGF function| duplicateMP function| modularMultiply function| multiplyMP function| removeLeadingZeroes function| mpToByteArray function| multiplyAndSubtract function| normalizeJSMP function| divideMP function| _0x4e53 function| modularExp function| byteArrayToMP function| XORarrays function| RSAEncrypt function| mapByteToBase64 function| base64Encode function| byteArrayToBase64 function| RSAEncryptBlock function| _0x540dfa2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ftp.tassoestew.tech/ | Name: PHPSESSID Value: 9138e9daf4e35a26b8cb98919e4a8f07 |
|
ftp.tassoestew.tech/ | Name: rt Value: 2e51aa89e80b62293b399624f06ab829.html |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
ftp.tassoestew.tech
mainoffy.onrender.com
162.0.213.15
216.24.57.253
2607:f8b0:4020:805::200a
64.185.227.156
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0bd4a6fb4778d131182cf9f5d4d93042d37918152025209135588d8a53dd387d
23d7a58d80be43be37ab404b89f175d59a30e8e8b7ccb8799bf44f8d171d7b3d
48c33bdf6e695b865471d51ac2d77cb6da471645bc1b8e108c168ea4f3b1a559
6b95363e75460560ec869ebf93b3b4333988c32a81f6280f61791581f1dd08ed
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a82b912a48c04264589c738463094485d5cef427e0b2dc9435ad6c4f23812e48
b294d339f709a0620968800517ed512f5ea76a8d06959ff59f6f2ec6f3fdcdb7
caf478ab4df77496812b6dd021d1876f67752079b46811d47bc3673e2998c4e6
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855