urlscan.io logo urlscan.io
SecurityTrails logo

kasutajatugi.eu Open in urlscan Pro
46.226.143.54  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Submission Tags: @phish_report
Submission: On December 18 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 46.226.143.54, located in Estonia and belongs to EE-CERT EE CERT, EE. The main domain is kasutajatugi.eu.
TLS certificate: Issued by R3 on December 8th 2023. Valid for: 3 months.
This is the only time kasutajatugi.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 11 46.226.143.54 56588 (EE-CERT E...)
8 2
Apex Domain
Subdomains		 Transfer
11 kasutajatugi.eu
kasutajatugi.eu
42 KB
8 1
Domain Requested by
11 kasutajatugi.eu 3 redirects kasutajatugi.eu
8 1

This site contains no links.

Subject Issuer Validity Valid
kasutajatugi.eu
R3		 2023-12-08 -
2024-03-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Frame ID: ECA2735FC3FE31B15898D829516A86A1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

42 kB
Transfer

110 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://kasutajatugi.eu/js/events.js HTTP 302
  • https://kasutajatugi.eu/obfuscate?path=js/events.js
Request Chain 4
  • https://kasutajatugi.eu/js/timeme.min.js HTTP 302
  • https://kasutajatugi.eu/obfuscate?path=js/timeme.min.js
Request Chain 5
  • https://kasutajatugi.eu/js/time-tracker.js HTTP 302
  • https://kasutajatugi.eu/obfuscate?path=js/time-tracker.js

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request wol0cy6r6jt9khpz
kasutajatugi.eu/ 		15 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
ad08dc726690cfd7de7a2ddf2b38947a7adf2072fad36c0579dae8ffb3179230

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language
fi-FI,fi;q=0.9

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
3737
content-type
text/html; charset=UTF-8
date
Mon, 18 Dec 2023 13:27:32 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Lucy
vary
Accept-Encoding
obfuscate
kasutajatugi.eu/
Redirect Chain
  • https://kasutajatugi.eu/js/events.js
  • https://kasutajatugi.eu/obfuscate?path=js/events.js
558 B
586 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/obfuscate?path=js/events.js
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

pragma
no-cache
date
Mon, 18 Dec 2023 13:27:33 GMT
server
Lucy
access-control-allow-methods
*
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-headers
*
expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

location
https://kasutajatugi.eu/obfuscate?path=js/events.js
date
Mon, 18 Dec 2023 13:27:33 GMT
cache-control
max-age=1
expires
Mon, 18 Dec 2023 13:27:34 GMT
server
Lucy
content-length
299
content-type
text/html; charset=iso-8859-1
style.css
kasutajatugi.eu/public/campaign/102/138/11/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/public/campaign/102/138/11/style.css
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 18 Dec 2023 13:27:33 GMT
server
Lucy
content-length
260
content-type
text/html; charset=iso-8859-1
logo.png
kasutajatugi.eu/public/campaign/126/165/12/static/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kasutajatugi.eu/public/campaign/126/165/12/static/logo.png
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 18 Dec 2023 13:27:33 GMT
last-modified
Fri, 18 Nov 2022 07:47:11 GMT
server
Lucy
accept-ranges
bytes
etag
"509-5edb9e9d49b61"
content-length
1289
content-type
image/png
jquery-3.7.0.min.js.js
kasutajatugi.eu/public/campaign/175/246/12/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/public/campaign/175/246/12/jquery-3.7.0.min.js.js
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
646be94d8c530951d009c8553231592b098e8708da86fbf13019cde550148742

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 18 Dec 2023 13:27:33 GMT
content-encoding
gzip
last-modified
Thu, 08 Jun 2023 10:30:51 GMT
server
Lucy
etag
"155a8-5fd9bbf218990-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
30343
obfuscate
kasutajatugi.eu/
Redirect Chain
  • https://kasutajatugi.eu/js/timeme.min.js
  • https://kasutajatugi.eu/obfuscate?path=js/timeme.min.js
4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/obfuscate?path=js/timeme.min.js
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

pragma
no-cache
date
Mon, 18 Dec 2023 13:27:33 GMT
server
Lucy
access-control-allow-methods
*
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-headers
*
expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

location
https://kasutajatugi.eu/obfuscate?path=js/timeme.min.js
date
Mon, 18 Dec 2023 13:27:33 GMT
cache-control
max-age=1
expires
Mon, 18 Dec 2023 13:27:34 GMT
server
Lucy
content-length
303
content-type
text/html; charset=iso-8859-1
obfuscate
kasutajatugi.eu/
Redirect Chain
  • https://kasutajatugi.eu/js/time-tracker.js
  • https://kasutajatugi.eu/obfuscate?path=js/time-tracker.js
2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/obfuscate?path=js/time-tracker.js
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
f53941103f6922446d2f5490b628638bffa13b74888ca07f40b2811ac743d98c

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

pragma
no-cache
date
Mon, 18 Dec 2023 13:27:33 GMT
server
Lucy
access-control-allow-methods
*
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-headers
*
expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

location
https://kasutajatugi.eu/obfuscate?path=js/time-tracker.js
date
Mon, 18 Dec 2023 13:27:33 GMT
cache-control
max-age=1
expires
Mon, 18 Dec 2023 13:27:34 GMT
server
Lucy
content-length
305
content-type
text/html; charset=iso-8859-1
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
30271beec01049a656ff39203516835b71c8119cab983e394ed1eb37bad26d01

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/svg+xml
track-time
kasutajatugi.eu/scenario/ 		0
220 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://kasutajatugi.eu/scenario/track-time
Requested by
Host: kasutajatugi.eu
URL: https://kasutajatugi.eu/wol0cy6r6jt9khpz
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://kasutajatugi.eu/wol0cy6r6jt9khpz
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Content-type
application/json

Response headers

pragma
no-cache
date
Mon, 18 Dec 2023 13:27:34 GMT
server
Lucy
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS, PUT, PATCH, HEAD, *
content-type
text/html; charset=UTF-8
access-control-allow-origin
*, *
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, *
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| lucyDispatchEvent function| TokenSigning number| signmode function| clickSign function| $ function| jQuery object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runTimeTracker function| isChrome

2 Cookies

Domain/Path Name / Value
kasutajatugi.eu/ Name: PHPSESSID
Value: jjq1ct8p93l19cjg5t096vnd7l
kasutajatugi.eu/ Name: link
Value: wol0cy6r6jt9khpz

1 Console Messages

Source Level URL
Text
network error URL: https://kasutajatugi.eu/public/campaign/102/138/11/style.css
Message:
Failed to load resource: the server responded with a status of 404 ()