ttmedicalmanagement.com

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 27.111.83.13, located in Australia and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is ttmedicalmanagement.com.

This is the only time ttmedicalmanagement.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	27.111.83.13 27.111.83.13	38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited)
1	69.192.218.105 69.192.218.105	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.84.251.89 52.84.251.89	16509 (AMAZON-02) (AMAZON-02)
4	3

2 27.111.83.13 (Australia)

ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: linp11.webpanel.hk

ttmedicalmanagement.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.218.105 (Central, Hong Kong)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a69-192-218-105.deploy.static.akamaitechnologies.com

th.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.84.251.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-251-89.sin5.r.cloudfront.net

blog.rapid7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ttmedicalmanagement.com ttmedicalmanagement.com	3 KB
1	rapid7.com blog.rapid7.com — Cisco Umbrella Rank: 669283	168 KB
1	bing.com th.bing.com — Cisco Umbrella Rank: 247	28 KB
4	3

	Domain	Requested by
2	ttmedicalmanagement.com	ttmedicalmanagement.com
1	blog.rapid7.com	ttmedicalmanagement.com
1	th.bing.com	ttmedicalmanagement.com
4	3

This site contains no links.

Subject Issuer	Validity	Valid
r.bing.com Microsoft RSA TLS CA 01	`2022-11-15` - `2023-11-15`	a year	crt.sh
blog.rapid7.com Amazon RSA 2048 M02	`2023-02-28` - `2023-06-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://ttmedicalmanagement.com/css/tmm.php?email=
Frame ID: E9AB183F2FBAE2E5B6AD360DFD700998
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Undelivered Files to

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

198 kB
Transfer

197 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request tmm.php Show response
ttmedicalmanagement.com/css/ 2 KB
3 KB 542ms
249ms Document
text/html 27.111.83.13
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: http://ttmedicalmanagement.com/css/tmm.php?email=
Protocol: HTTP/1.1
Server: 27.111.83.13 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS: linp11.webpanel.hk
Software: nginx / PHP/5.6.40 PleskLin
Resource Hash: 4ff10487cc6d31d35558cd204282b6dff2cc2906e1163e9bef745f35cd6509a2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 20 Mar 2023 10:12:45 GMT
Server: nginx
Transfer-Encoding: chunked
X-Powered-By: PHP/5.6.40 PleskLin

GET
H2 200 R.ca73a49c84bb242212d7e22e2a650ecf
th.bing.com/th/id/ 27 KB
28 KB 981ms
245ms Image
image/png 69.192.218.105
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://th.bing.com/th/id/R.ca73a49c84bb242212d7e22e2a650ecf?rik=GwbwcyrJb9Hz0w&riu=http%3a%2f%2f2.bp.blogspot.com%2f-Ic6m4yd5Nmw%2fUonYWk43K2I%2fAAAAAAAAh8s%2fv53SyuO962k%2fs1600%2foffice365logo.png&ehk=UAr5Y%2bXk77KTy%2bEr6vlLUnc0MlzhVHg%2fq9cZYpwm1Ws%3d&risl=&pid=ImgRaw&r=0
Requested by: Host: ttmedicalmanagement.com
URL: http://ttmedicalmanagement.com/css/tmm.php?email=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.218.105 Central, Hong Kong, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a69-192-218-105.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74d40bcb758797d85c503ac0c291d5bdc9e3abddcd00a51726be2a752445b21e

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://ttmedicalmanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Mon, 20 Mar 2023 10:12:46 GMT
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
x-check-cacheable: YES
akamai-grn: 0.65dac045.1679307166.1462c55a
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
content-type: image/png
access-control-allow-origin: *
x-cache: TCP_MEM_HIT from a69-192-218-101.deploy.akamaitechnologies.com (AkamaiGHost/11.0.2-47081134) (-)
cache-control: public, max-age=4605395
timing-allow-origin: *
access-control-allow-headers: *
content-length: 27846
alt-svc: h3=":443"; ma=93600

GET
H/1.1 404
Not Found bootstrap.min.js
ttmedicalmanagement.com/css/assets/bootstrap/js/ 0
0 260ms
259ms Script
text/html 27.111.83.13
DREAMSCAPE-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: http://ttmedicalmanagement.com/css/assets/bootstrap/js/bootstrap.min.js
Requested by: Host: ttmedicalmanagement.com
URL: http://ttmedicalmanagement.com/css/tmm.php?email=
Protocol: HTTP/1.1
Server: 27.111.83.13 , Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS: linp11.webpanel.hk
Software: nginx / PHP/5.6.40
Resource Hash

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://ttmedicalmanagement.com/css/tmm.php?email=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date: Mon, 20 Mar 2023 10:12:45 GMT
Server: nginx
Connection: keep-alive
X-Powered-By: PHP/5.6.40
Content-Length: 888
Content-Type: text/html;charset=UTF-8

GET
H/1.1 200
OK background.jpg
blog.rapid7.com/content/images/2019/08/ 167 KB
168 KB 587ms
194ms Image
image/jpeg 52.84.251.89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2019/08/background.jpg

Requested by

Host: ttmedicalmanagement.com
URL: http://ttmedicalmanagement.com/css/tmm.php?email=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.84.251.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-251-89.sin5.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

fa62c98e730e29e0c76279345adf39d3b95ce0ffe1695b0936ecfef47b1a7481

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://ttmedicalmanagement.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Date: Mon, 20 Mar 2023 10:10:05 GMT
Via: 1.1 490cd3b4c8c8e2aafa0be58f76446f44.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: SIN5-C1
Age: 159
X-Powered-By: Express
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 170945
Last-Modified: Tue, 20 Aug 2019 05:00:07 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: W/"29bc1-16cad6583d8"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: pyHxO5lIMl-21vzyAHud8zvAo03V-WY8U9WlGJyTgjGpiUg7pUm1Lg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://ttmedicalmanagement.com/css/assets/bootstrap/js/bootstrap.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.rapid7.com
th.bing.com
ttmedicalmanagement.com
27.111.83.13
52.84.251.89
69.192.218.105
4ff10487cc6d31d35558cd204282b6dff2cc2906e1163e9bef745f35cd6509a2
74d40bcb758797d85c503ac0c291d5bdc9e3abddcd00a51726be2a752445b21e
fa62c98e730e29e0c76279345adf39d3b95ce0ffe1695b0936ecfef47b1a7481

ttmedicalmanagement.com Open in urlscan Pro 27.111.83.13 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

198 kBTransfer

197 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

ttmedicalmanagement.com Open in urlscan Pro
27.111.83.13 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

198 kB
Transfer

197 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!