mail-sync.tiiny.site
Open in
urlscan Pro
2600:9000:214f:b800:19:266d:4200:93a1
Malicious Activity!
Public Scan
Submission: On August 12 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Amazon RSA 2048 M02 on January 11th 2024. Valid for: a year.
This is the only time mail-sync.tiiny.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2600:9000:214... 2600:9000:214f:b800:19:266d:4200:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 3.10.126.206 3.10.126.206 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 108.156.60.66 108.156.60.66 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 76.223.87.32 76.223.87.32 | 16509 (AMAZON-02) (AMAZON-02) | |
9 | 5 |
ASN16509 (AMAZON-02, US)
mail-sync.tiiny.site |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-10-126-206.eu-west-2.compute.amazonaws.com
analytics.tiiny.site |
ASN16509 (AMAZON-02, US)
PTR: server-108-156-60-66.ams1.r.cloudfront.net
tiiny.host |
ASN16509 (AMAZON-02, US)
PTR: a5c358b10ce834189.awsglobalaccelerator.com
api.bigdatacloud.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
tiiny.site
mail-sync.tiiny.site analytics.tiiny.site |
1 MB |
2 |
tiiny.host
tiiny.host |
16 KB |
1 |
bigdatacloud.net
api.bigdatacloud.net — Cisco Umbrella Rank: 33874 |
179 B |
9 | 3 |
Domain | Requested by | |
---|---|---|
4 | mail-sync.tiiny.site |
mail-sync.tiiny.site
|
2 | tiiny.host |
mail-sync.tiiny.site
|
2 | analytics.tiiny.site |
mail-sync.tiiny.site
analytics.tiiny.site |
1 | api.bigdatacloud.net |
mail-sync.tiiny.site
|
9 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
tiiny.host |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tiiny.site Amazon RSA 2048 M02 |
2024-01-11 - 2025-02-07 |
a year | crt.sh |
tiiny.host Amazon RSA 2048 M03 |
2024-03-10 - 2025-04-08 |
a year | crt.sh |
*.bigdatacloud.net Amazon RSA 2048 M02 |
2024-04-01 - 2025-04-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://mail-sync.tiiny.site/
Frame ID: 4B303A5E145445E4C9548BDD31F85D3B
Requests: 13 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
mail-sync.tiiny.site/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-58ff9501.js
mail-sync.tiiny.site/assets/ |
962 KB 964 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-08f4087a.css
mail-sync.tiiny.site/assets/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plausible.js
analytics.tiiny.site/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad-script.js
tiiny.host/ |
981 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
event
analytics.tiiny.site/api/ |
2 B 363 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad.png
tiiny.host/assets/img/ |
14 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client-ip
api.bigdatacloud.net/data/ |
55 B 179 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vite.png
mail-sync.tiiny.site/ |
46 KB 46 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| plausible number| show0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.tiiny.site
api.bigdatacloud.net
mail-sync.tiiny.site
tiiny.host
108.156.60.66
2600:9000:214f:b800:19:266d:4200:93a1
3.10.126.206
76.223.87.32
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
08f4087a4424125e778cd707d4b9540f0a75adaa0d3782ebacabedb8f01c1629
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
7983d92d94ac1327a01aae67c2713fef1f541d59ce98cb3b7535b3a69beeb86f
79e91d58ec9e2b46e0923456ce78a90e5afedfdfd043237eb15081ae4c48c0db
7a1d0f35d1eb5c4ed12a663dfab94ce04d2a2a511086cab3815674721bc0bccb
7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9
8b4acd798be56d8477834b91cea59d86163d2e16296901f26bec7eade5b17093
a62574a226521160282d55fa0e3e6bed6f79486df00cce16e5878c74d7c7024c
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
ae784a79cba674c9c0679ed64c8cf5b8733b0dcd130a465e696a73b7e1b4000a
ca79fddb2e51a07cb916ce815f359c147d1000e2f27df40bbedd98f88d84dd48
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b