update.tlooz.co
Open in
urlscan Pro
43.130.120.148
Malicious Activity!
Public Scan
URL:
https://update.tlooz.co/
Submission: On March 26 via automatic, source certstream-suspicious — Scanned from DE
Submission: On March 26 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 7 HTTP transactions.
The main IP is 43.130.120.148, located in
Ashburn, United States and
belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN.
The main domain is update.tlooz.co.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on March 26th 2023. Valid for: 3 months.
This is the only time update.tlooz.co was scanned on urlscan.io!
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on March 26th 2023. Valid for: 3 months.
This is the only time update.tlooz.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UPS (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 43.130.120.148 43.130.120.148 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
| 7 | 3 |
6
43.130.120.148
(Ashburn, United States)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
| update.tlooz.co |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
tlooz.co
update.tlooz.co |
1 MB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
1 KB |
| 7 | 2 |
| Domain | Requested by | |
|---|---|---|
| 6 | update.tlooz.co |
update.tlooz.co
|
| 1 | fonts.googleapis.com |
update.tlooz.co
|
| 7 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.ups.com |
| about.ups.com |
| www.jobs-ups.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| update.tlooz.co ZeroSSL RSA Domain Secure Site CA |
2023-03-26 - 2023-06-24 |
3 months | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://update.tlooz.co/
Frame ID: C16E832184015E86285A6AFF32E9028B
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
UPS | We have issues with your shipping addressDetected technologies
Element UI
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <(?:div|button) class="el-(?:table-column|table-filter|popper|pagination|pager|select-group|form|form-item|color-predefine|color-hue-slider|color-svpanel|color-alpha-slider|color-dropdown|color-picker|badge|tree|tree-node|select|message|dialog|checkbox|checkbox-button|checkbox-group|container|steps|carousel|menu|menu-item|submenu|menu-item-group|button|button-group|card|table|select-dropdown|row|tabs|notification|radio|progress|progress-bar|tag|popover|tooltip|cascader|cascader-menus|cascader-menu|time-spinner|spinner|spinner-inner|transfer|transfer-panel|rate|slider|dropdown|dropdown-menu|textarea|input|input-group|popup-parent|radio-group|main|breadcrumb|time-range-picker|date-range-picker|year-table|date-editor|range-editor|time-spinner|date-picker|time-panel|date-table|month-table|picker-panel|collapse|collapse-item|alert|select-dropdown|select-dropdown__empty|select-dropdown__wrap|select-dropdown__list|scrollbar|switch|carousel|upload|upload-dragger|upload-list|upload-cover|aside|input-number|header|message-box|footer|radio-button|step|autocomplete|autocomplete-suggestion|loading-parent|loading-mask|loading-spinner|)
Vue.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
URL: https://www.ups.com/cn/en/Home.page
Search URL Search Domain Scan URL
URL: https://www.ups.com/track?loc=en_CN
Title: Tracking
Title: Tracking
Search URL Search Domain Scan URL
URL: https://www.ups.com/ship?loc=en_CN
Title: Shipping
Title: Shipping
Search URL Search Domain Scan URL
URL: https://www.ups.com/marketingpreferences/emailsubscription?loc=en_CN
Title: Communication Preferences
Title: Communication Preferences
Search URL Search Domain Scan URL
URL: https://about.ups.com/sg/en/home.html
Title: About UPS
Title: About UPS
Search URL Search Domain Scan URL
URL: https://www.ups.com/cn/en/supplychain/Home.page
Title: Supply Chain Solutions
Title: Supply Chain Solutions
Search URL Search Domain Scan URL
URL: https://www.jobs-ups.com/location
Title: UPS Jobs
Title: UPS Jobs
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
update.tlooz.co/ |
618 B 655 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index-6529deed.js
update.tlooz.co/assets/ |
727 KB 728 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index-bd93c572.css
update.tlooz.co/assets/ |
374 KB 374 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
UPS_logo-a416370f.svg
update.tlooz.co/assets/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
open
update.tlooz.co/api/generator/order/ |
38 B 307 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
664 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 3 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
element-icons-9c88a535.woff
update.tlooz.co/assets/ |
24 KB 24 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UPS (Transportation)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| dayjs boolean| __VUE__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
update.tlooz.co
2a00:1450:4001:828::200a
43.130.120.148
128abea51add98350a4035c5fed2bcffbbc3ff8a9ce672381a69e1a487cc0a33
5f4fc7407aed66bcb1c3d025f17e9db531c751329435de735ced041fd1b38c52
8a9cc7f2a446b96de2a86ba3f837415a1cea3dc3c649a6a0c3fa5ca10a7fe455
90fff0d62b24bab551bf6228f4b55b758b1a65c977752532cd5d15e06239c7b2
9c88a535dc764ff18a237202d19f9d62976637c8e7a324cf69e2ba2d4066f6eb
a416370f6f98339e7edf9fe2c70a45bf9cfba93c0520921db47d15c27934ba88
bd93c572ae263698af302c75f6ea391d4d1c6a9329fb49a98fe3dcf702599436
debcb87cbafe376b3af5ab1eb56ff38e4a6b9f09adc33361230d7f6624998f27
f3dae51b562acce52562f517e58b627e71aff1dca8c1f78dfc0d86bd4e86c50d