techdealoftheweek.xyz
Open in
urlscan Pro
172.67.197.9
Malicious Activity!
Public Scan
Effective URL: https://techdealoftheweek.xyz/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub4=&sub5=21726&source...
Submission: On October 03 via manual from SE — Scanned from SE
Summary
TLS certificate: Issued by WE1 on September 3rd 2024. Valid for: 3 months.
This is the only time techdealoftheweek.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.221.185.234 162.221.185.234 | 33182 (DIMENOC) (DIMENOC) | |
1 1 | 95.182.96.103 95.182.96.103 | 56971 (AS56971 A...) (AS56971 AS56971 Cloud) | |
1 5 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 172.67.140.120 172.67.140.120 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 24 | 172.67.197.9 172.67.197.9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3036::6815:1b98 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
29 | 4 |
ASN33182 (DIMENOC, US)
PTR: server.dataempresarial.com
insolvenciaconsultores.com |
ASN13335 (CLOUDFLARENET, US)
www.myredirectservices.com | |
trk-consulatu.com | |
event.trk-consulatu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
techdealoftheweek.xyz
1 redirects
techdealoftheweek.xyz |
3 MB |
4 |
trk-consulatu.com
trk-consulatu.com — Cisco Umbrella Rank: 157217 event.trk-consulatu.com — Cisco Umbrella Rank: 275323 |
3 KB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1222 |
426 KB |
1 |
webtofast.com
1 redirects
www.webtofast.com |
876 B |
1 |
myredirectservices.com
1 redirects
www.myredirectservices.com |
804 B |
1 |
emilitrad.com
1 redirects
emilitrad.com |
322 B |
1 |
insolvenciaconsultores.com
insolvenciaconsultores.com |
568 B |
29 | 7 |
Domain | Requested by | |
---|---|---|
24 | techdealoftheweek.xyz |
1 redirects
insolvenciaconsultores.com
techdealoftheweek.xyz |
3 | event.trk-consulatu.com |
trk-consulatu.com
|
1 | trk-consulatu.com |
techdealoftheweek.xyz
|
1 | use.fontawesome.com |
techdealoftheweek.xyz
|
1 | www.webtofast.com | 1 redirects |
1 | www.myredirectservices.com | 1 redirects |
1 | emilitrad.com | 1 redirects |
1 | insolvenciaconsultores.com | |
29 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
insolvenciaconsultores.com.fundacionparalapazylaequidad.org R11 |
2024-08-06 - 2024-11-04 |
3 months | crt.sh |
techdealoftheweek.xyz WE1 |
2024-09-03 - 2024-12-02 |
3 months | crt.sh |
use.fontawesome.com WE1 |
2024-09-09 - 2024-12-09 |
3 months | crt.sh |
trk-consulatu.com WE1 |
2024-08-18 - 2024-11-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://techdealoftheweek.xyz/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub4=&sub5=21726&source_id=20271&ip=185.41.240.29&domain=www.webtofast.com
Frame ID: 67CC801FF6536D8CFBA17562E11B30CA
Requests: 28 HTTP requests in this frame
Screenshot
Page Title
Motormännens Riksförbund - EnkätbelöningarPage URL History Show full URLs
- https://insolvenciaconsultores.com/wp-content/uploads/2024/06/RediR.html Page URL
-
http://emilitrad.com/RnFlYkRkdEUzTFNOTFA4QzlnRE9wMDJZMVVRZ09zQ0NnRnNTL2RVa3pZLzZIV1RkL2NwNzJrR3JU...
HTTP 307
https://emilitrad.com/RnFlYkRkdEUzTFNOTFA4QzlnRE9wMDJZMVVRZ09zQ0NnRnNTL2RVa3pZLzZIV1RkL2NwNzJrR3JU... HTTP 307
http://emilitrad.com/RnFlYkRkdEUzTFNOTFA4QzlnRE9wMDJZMVVRZ09zQ0NnRnNTL2RVa3pZLzZIV1RkL2NwNzJrR3JU... HTTP 302
https://www.myredirectservices.com/25T99KMS/7D2X13S4/?sub1=2&sub2=9304_0&sub3=45_117864_6907_276669_md HTTP 302
https://www.webtofast.com/2W1Q1KK/2CGHQBMR/?sub1=754e5dee1638447781bd163167109def&source_id=20271&sub5... HTTP 302
https://techdealoftheweek.xyz/khsVCKdEJs3JbV-zan5FX39L5l-Ofi4seaQe38/?encoded_value=223GDT1&sub1=754e5dee1... HTTP 302
http://techdealoftheweek.xyz/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub... HTTP 307
https://techdealoftheweek.xyz/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub... Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
animate.css (Web Frameworks) Expand
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://insolvenciaconsultores.com/wp-content/uploads/2024/06/RediR.html Page URL
-
http://emilitrad.com/RnFlYkRkdEUzTFNOTFA4QzlnRE9wMDJZMVVRZ09zQ0NnRnNTL2RVa3pZLzZIV1RkL2NwNzJrR3JUUyt6S2gwZmZRVzAvMXUzcDh0Z0FCTXVtdk5EMlE9PQ__
HTTP 307
https://emilitrad.com/RnFlYkRkdEUzTFNOTFA4QzlnRE9wMDJZMVVRZ09zQ0NnRnNTL2RVa3pZLzZIV1RkL2NwNzJrR3JUUyt6S2gwZmZRVzAvMXUzcDh0Z0FCTXVtdk5EMlE9PQ__ HTTP 307
http://emilitrad.com/RnFlYkRkdEUzTFNOTFA4QzlnRE9wMDJZMVVRZ09zQ0NnRnNTL2RVa3pZLzZIV1RkL2NwNzJrR3JUUyt6S2gwZmZRVzAvMXUzcDh0Z0FCTXVtdk5EMlE9PQ__ HTTP 302
https://www.myredirectservices.com/25T99KMS/7D2X13S4/?sub1=2&sub2=9304_0&sub3=45_117864_6907_276669_md HTTP 302
https://www.webtofast.com/2W1Q1KK/2CGHQBMR/?sub1=754e5dee1638447781bd163167109def&source_id=20271&sub5=101095 HTTP 302
https://techdealoftheweek.xyz/khsVCKdEJs3JbV-zan5FX39L5l-Ofi4seaQe38/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub4=&sub5=21726&source_id=20271&ip=185.41.240.29&domain=www.webtofast.com HTTP 302
http://techdealoftheweek.xyz/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub4=&sub5=21726&source_id=20271&ip=185.41.240.29&domain=www.webtofast.com HTTP 307
https://techdealoftheweek.xyz/?encoded_value=223GDT1&sub1=754e5dee1638447781bd163167109def&sub2=&sub3=&sub4=&sub5=21726&source_id=20271&ip=185.41.240.29&domain=www.webtofast.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
RediR.html
insolvenciaconsultores.com/wp-content/uploads/2024/06/ |
148 B 568 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
techdealoftheweek.xyz/ Redirect Chain
|
28 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
speculation
techdealoftheweek.xyz/cdn-cgi/ |
128 B 546 B |
Other
application/speculationrules+json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
techdealoftheweek.xyz/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
animate.min.css
techdealoftheweek.xyz/css/ |
70 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.js
use.fontawesome.com/releases/v5.15.4/js/ |
1 MB 426 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
datehead.js
techdealoftheweek.xyz/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
techdealoftheweek.xyz/images/ |
20 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flaglogo.png
techdealoftheweek.xyz/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
product.png
techdealoftheweek.xyz/images/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
loadingBL.gif
techdealoftheweek.xyz/images/ |
122 KB 122 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prize1.png
techdealoftheweek.xyz/images/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1.jpg
techdealoftheweek.xyz/images/ |
43 KB 43 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2.jpg
techdealoftheweek.xyz/images/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
comm_pic_1.jpg
techdealoftheweek.xyz/images/ |
117 KB 117 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3.jpg
techdealoftheweek.xyz/images/ |
49 KB 50 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4.jpg
techdealoftheweek.xyz/images/ |
36 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
comm_pic_2.jpg
techdealoftheweek.xyz/images/ |
101 KB 101 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
5.jpg
techdealoftheweek.xyz/images/ |
39 KB 40 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f_guarantee.png
techdealoftheweek.xyz/images/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f_secure_1.png
techdealoftheweek.xyz/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo2.png
techdealoftheweek.xyz/images/ |
20 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
techdealoftheweek.xyz/js/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg.png
techdealoftheweek.xyz/images/ |
262 KB 263 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
64d5p99gj0
trk-consulatu.com/scripts/push/script/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
oldwwwy7dz
event.trk-consulatu.com/register/event_log/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
oldwwwy7dz
event.trk-consulatu.com/register/event_log/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
techdealoftheweek.xyz/ |
555 B 616 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
oldwwwy7dz
event.trk-consulatu.com/register/event_log/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| datehax function| datenhax function| datenhay function| startTimer object| answers number| lastQnum function| toNext object| states object| dones object| loadImg object| loadBgCol function| drawloader number| qn number| dsq object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore function| setAttributes5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.myredirectservices.com/ | Name: uniqueClick_7D2X13S4 Value: a8d14f13-f9cb-494a-85d7-0d27c325be74:1727969063 |
|
www.myredirectservices.com/ | Name: transaction_id Value: 754e5dee1638447781bd163167109def |
|
www.webtofast.com/ | Name: uniqueClick_2CGHQBMR Value: 02288867-6048-4827-be56-92eeddd2dd9e:1727969064 |
|
www.webtofast.com/ | Name: transaction_id Value: 9c0becdce19343e1903d75ab786f12a1 |
|
techdealoftheweek.xyz/ | Name: SESSIONIDS Value: khsVCKdEJs3JbV-zan5FX39L5l-Ofi4seaQe38 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
emilitrad.com
event.trk-consulatu.com
insolvenciaconsultores.com
techdealoftheweek.xyz
trk-consulatu.com
use.fontawesome.com
www.myredirectservices.com
www.webtofast.com
162.221.185.234
172.67.140.120
172.67.197.9
188.114.96.3
2606:4700:3036::6815:1b98
95.182.96.103
062683ed452655836e5618503da63e88c8d39138dd354313bc0b0f0b90ce63a8
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
20eefd318c1202f420e0426f18933ab7b588fa6fdcf4802d1d3d930e87785999
3f48e05169cac5389d508a46392f485b3f1e7fe7873c5e16b82d1b217d209158
4e1a0514b56e71cc2aa45f94495ab76be4bac3c35fb5a04a14d5afa78a1fd62a
50518d5c34d90b337324a0620c5ab3eef615a24ed46584bc90646ef0eab207f4
52296d70b84210b5cdb81e15617528bf1de8ecad7631d57a2f0cda6b4151be33
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
624a7a5d76af17f419dc83d2d76da7169984a8c0aab3e6dcca44d65f1a3bda9c
812ab0e46f86b2ce98ab2425ab2224b90d0845952a1ac0d5abd734b6217e98bf
8487b6ab99989d856601eb4850af16582ca42fbe56f42fd46fcda4a55853358c
87687157e271dac0f92db33652af99ee198ba25bbed4dfab3919a31ab9057f02
8b9734fc406a08cb8dd5949329d1eb5226ff5e2a4497761f20d5aca2bde98e41
a1713fcdfdf4715b08d5a6275e3b5a170cb38ec4c37414c25ac281402a2d315d
a71f1ee3765916ab7cffacc781362496866174143a34805290af8385ca85c693
a7b1134fe25cbdb9acde1808002978b3c43da07fa74d14dd5e84a5622cacc57d
a9d7fbdfcc21e8bd5c4110b2cc67acf17d1dd274ede4d6142b1454e2a6ddd9c1
ac63058c3ad2c75d9993b432f2c47e6348eda1b97d43312fbd74e375142c8e53
ba2555f84dc9e6aa1d1825835f303e17d5e86bcaeee0cb2c9008b7008c94b0be
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c0acefaab37732f6979096afcc259d00ed81235bab3b723e592db986a98d1b75
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
c92a6fbf931147b76b419ad65419c0f108fb015c0b53651c8983146575cd3153
cd64d193b13884349f3e9744957d10458ea4b5a8d709c03d1c4c8b4143965f87
fb7f1a948ae5a69c23c53b5147406a417a2394eee8b8a1183d077baa883e139e
fceb0d068af15a9a7f7e1164b97f543a1755fcadfe95ca71dea2eb8dbd07be1d