telecode-etsit.com
Open in
urlscan Pro
217.182.207.4
Malicious Activity!
Public Scan
Effective URL: https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/Login.php?websrc=59c275dc2e97dd3b89...
Submission: On December 19 via manual from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 14th 2018. Valid for: 3 months.
This is the only time telecode-etsit.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:30:... 2606:4700:30::6812:38c2 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
4 24 | 217.182.207.4 217.182.207.4 | 16276 (OVH) (OVH) | |
3 | 2a02:26f0:6c0... 2a02:26f0:6c00:2bf::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a00:1450:400... 2a00:1450:4001:81d::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
27 | 5 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
trometo.com |
ASN20940 (AKAMAI-ASN1, US)
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
telecode-etsit.com
4 redirects
telecode-etsit.com |
2 MB |
3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
294 KB |
2 |
google-analytics.com
www.google-analytics.com |
17 KB |
1 |
gstatic.com
fonts.gstatic.com |
20 KB |
1 |
trometo.com
trometo.com |
399 B |
27 | 5 |
Domain | Requested by | |
---|---|---|
24 | telecode-etsit.com |
4 redirects
trometo.com
telecode-etsit.com www.google-analytics.com |
3 | secure.aadcdn.microsoftonline-p.com |
telecode-etsit.com
|
2 | www.google-analytics.com |
telecode-etsit.com
|
1 | fonts.gstatic.com |
www.google-analytics.com
|
1 | trometo.com | |
27 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni173594.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-10-09 - 2019-04-17 |
6 months | crt.sh |
telecode-etsit.com cPanel, Inc. Certification Authority |
2018-12-14 - 2019-03-14 |
3 months | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 1 |
2017-08-15 - 2019-08-15 |
2 years | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2018-11-27 - 2019-02-19 |
3 months | crt.sh |
*.google.com Google Internet Authority G3 |
2018-11-27 - 2019-02-19 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=51&id=9286764992&email=lba@enbridge.com
Frame ID: D0E50B15039EA71DE60646DF0BF774F2
Requests: 7 HTTP requests in this frame
Frame:
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/data_files/Prefetch.html
Frame ID: 610EF3A5523F97D3998C2A0F90E675A8
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://trometo.com/Me0147/?email=bGJhQGVuYnJpZGdlLmNvbQ== Page URL
-
https://telecode-etsit.com/wp-snapshots/tmp/office.com?email=bGJhQGVuYnJpZGdlLmNvbQ==
HTTP 301
https://telecode-etsit.com/wp-snapshots/tmp/office.com/?email=bGJhQGVuYnJpZGdlLmNvbQ== HTTP 302
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923?email=lba@enbri... HTTP 301
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/?email=lba@enbr... HTTP 302
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/Login.php?websr... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://trometo.com/Me0147/?email=bGJhQGVuYnJpZGdlLmNvbQ== Page URL
-
https://telecode-etsit.com/wp-snapshots/tmp/office.com?email=bGJhQGVuYnJpZGdlLmNvbQ==
HTTP 301
https://telecode-etsit.com/wp-snapshots/tmp/office.com/?email=bGJhQGVuYnJpZGdlLmNvbQ== HTTP 302
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923?email=lba@enbridge.com&.email?auth=2&home=1&from=PortalLanding&client-request-id=bcc7c79d-ad79-43ec-9c70-d12e378805d20cDovL3d3dy5hc@ HTTP 301
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/?email=lba@enbridge.com&.email?auth=2&home=1&from=PortalLanding&client-request-id=bcc7c79d-ad79-43ec-9c70-d12e378805d20cDovL3d3dy5hc@ HTTP 302
https://telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=51&id=9286764992&email=lba@enbridge.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
trometo.com/Me0147/ |
145 B 399 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Login.php
telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/ Redirect Chain
|
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.login.min.css
telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/data_files/ |
84 KB 85 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/data_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picker_account_aad.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6970.12/content/images/ |
756 B 866 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Prefetch.html
telecode-etsit.com/wp-snapshots/tmp/office.com/7c9383a5e6214a9cc0b92fdbaa82f923/data_files/ Frame 610E |
24 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/ |
291 KB 292 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
telecode-etsit.com/wp-content/plugins/tt-inscription-form/css/ Frame 610E |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
estilos.css
telecode-etsit.com/wp-content/plugins/asesor-cookies-para-la-ley-en-espana/html/front/ Frame 610E |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
telecode-etsit.com/wp-content/plugins/contact-form-7/includes/css/ Frame 610E |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.min.css
telecode-etsit.com/wp-content/themes/Avada/assets/css/ Frame 610E |
204 KB 204 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5ac5cc33c1dc1beae9265abb15db43fd.min.css
telecode-etsit.com/wp-content/uploads/fusion-styles/ Frame 610E |
638 KB 639 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
telecode-etsit.com/wp-includes/js/jquery/ Frame 610E |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-migrate.min.js
telecode-etsit.com/wp-includes/js/jquery/ Frame 610E |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
principal.js
telecode-etsit.com/wp-content/plugins/asesor-cookies-para-la-ley-en-espana/html/front/ Frame 610E |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_telecode_default_2.png
telecode-etsit.com/wp-content/uploads/2017/12/ Frame 610E |
20 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_telecode_default_3.png
telecode-etsit.com/wp-content/uploads/2017/12/ Frame 610E |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts.js
telecode-etsit.com/wp-content/plugins/contact-form-7/includes/js/ Frame 610E |
14 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
09f58fc2f73230bf9c32da385543f81c.min.js
telecode-etsit.com/wp-content/uploads/fusion-scripts/ Frame 610E |
762 KB 762 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wp-embed.min.js
telecode-etsit.com/wp-includes/js/ Frame 610E |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wp-emoji-release.min.js
telecode-etsit.com/wp-includes/js/ Frame 610E |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Frame 610E |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern18.png
telecode-etsit.com/wp-content/themes/Avada/assets/images/patterns/ Frame 610E |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v18/ Frame 610E |
35 KB 20 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
programming-1009134_1280.jpg
telecode-etsit.com/wp-content/uploads/2017/12/ Frame 610E |
213 KB 214 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ Frame 610E |
35 B 111 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
secure.aadcdn.microsoftonline-p.com
telecode-etsit.com
trometo.com
www.google-analytics.com
217.182.207.4
2606:4700:30::6812:38c2
2a00:1450:4001:81d::200e
2a00:1450:4001:821::2003
2a02:26f0:6c00:2bf::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1892fca1bb91523ba679f03c557ccf4ccaf0abc4774a3ffa33de7c058ac5e645
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
276b31874d7e51ba2a8aaf0073c1d5185ba2ed837db29d5580716ba11259a23a
2abe34835f5555333edccab5786c3fb72eb1755110f38d2fdb2c0ae7ed4db6ed
3935fabaf5801db2decff61e57a5a7459f5917ffd156fc8b15c93869ec439a4d
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
67b4d982a3345028f2e04de0dfa253e0ab0ee62962c5e47ac529b2f4c7c40a0e
68c088d83f9e539a8a480141a6cf6bd545f96c276692892e22026d027b3eccd4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9e4e658477797bc3a350a705418742a3c59c11bdd31c9838105ccb12558cd54d
9f44116dd75e4f3090b2184b1ccdcf8465d2dc679b2b9e75e6625f664ce2f5f0
9fc0d62f6caef34567f639429c38858abbd30f80f8116c9e3a886d880554f71f
a559ba07f12aeda335ca811bb96b6f57b555815a835fe5f86ad6e7f166190e6d
aa5f78842a4c5d6c8c82d2854f192a97751ddb775f7e9f0a28e3dddce7c34b18
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
bf67f0825d2f71a8757c7e62d857e8d6c60652f7703304587ce9e437b813a8b8
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
d0f40b6e10bca83a3d0143c9203b42b1f8fd9d28a2cf268d4377bc8406e50b8a
d2458b9fd9089fdcb9de317093e004ef3a65597dc68b9adfdeb15a7c9968d0d5
d839b42355f00847b52a99d33bb768cd15ff8106eed0796d5f0d3e86f0d08764
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e