taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev
172.67.192.108  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
http://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ2GhLQ6nPb-rOhevz5Xjj... 5yr old
Effective URL:
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com 1mo old
Submission: On June 04 via api (June 4th 2026, 3:06:26 pm UTC) from US — Scanned from DE
Summary HTTP 5 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 172.67.192.108, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev. 1mo old
TLS certificate: Issued by E7 on May 7th 2026. Valid for: 3mo.
This is the only time taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 3.69.98.154 3.69.98.154 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1 172.234.212.121 172.234.212.121 63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP - Akamai Connected Cloud)
1 4 172.67.192.108 172.67.192.108 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5 2
Apex Domain
Subdomains		 Transfer
4 workers.dev 1 redirects
taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev 1mo old
23 KB
1 edtcs.com 1 redirects
edtcs.com 3yr old
192 B
1 titanhq.com 1 redirects
linklock.titanhq.com — Cisco Umbrella Rank: 482433 5yr old
185 B
0 googleapis.com Failed
fonts.googleapis.com Failed 10yr old
5 4
Domain Requested by
4 taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev 1 redirects taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev
1 edtcs.com 1 redirects
1 linklock.titanhq.com 1 redirects
0 fonts.googleapis.com Failed taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev
5 4

This site contains no links.

Subject Issuer Validity Valid
info-pixology-co-za-s-account.workers.dev
E7		 2026-05-07 -
2026-08-05		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
Frame ID: 489159A88C89579701CCDFFDA5A17C5D
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft Outlook - Meeting Invitation

Page URL History Show full URLs

  1. http://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ... HTTP 307
    https://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ... HTTP 301
    https://edtcs.com/ HTTP 301
    https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/?email=mail%40microsoft.com HTTP 302
    https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com Page URL

Detected technologies

(Security)
Overall confidence: 100%
Detected patterns
  • ^https://[\w\d\.\-]+(?:\.dev)(?:/.+||/)$

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

23 kB
Transfer

28 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ2GhLQ6nPb-rOhevz5Xjj8RdAa2DjX6yYkl4z5wQwVD6M2rkxikiD-aGzIdgNJ3m-CBxarAXYHtB2SleyFrbpddtA3SsBkij4gHxx85qDQL7mFHjayyOlO_dpJvhPN3ONC1GQp-cUszvI7uNRaf6ednMrZd0INkRaIm0MxW_vpbSvAAAA__8cbUBP HTTP 307
    https://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ2GhLQ6nPb-rOhevz5Xjj8RdAa2DjX6yYkl4z5wQwVD6M2rkxikiD-aGzIdgNJ3m-CBxarAXYHtB2SleyFrbpddtA3SsBkij4gHxx85qDQL7mFHjayyOlO_dpJvhPN3ONC1GQp-cUszvI7uNRaf6ednMrZd0INkRaIm0MxW_vpbSvAAAA__8cbUBP HTTP 301
    https://edtcs.com/ HTTP 301
    https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/?email=mail%40microsoft.com HTTP 302
    https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
1 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 Primary Request c16a12d43b517fca Show response
taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/
Redirect Chain
  • http://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ2GhLQ6nPb-rOhevz5Xjj8RdAa2DjX6yYkl4z5wQwVD6M2rkxikiD-aGzIdgNJ3m-CBxarAXYHtB2SleyFrbpddtA3SsBk...
  • https://linklock.titanhq.com/analyse?url=https://edtcs.com/&data=eJx0zM2OwiAUQOGngcUkkAsXZtoFi_4MuxrjGyDQ2GhLQ6nPb-rOhevz5Xjj8RdAa2DjX6yYkl4z5wQwVD6M2rkxikiD-aGzIdgNJ3m-CBxarAXYHtB2SleyFrbpddtA3SsB...
  • https://edtcs.com/
  • https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/?email=mail%40microsoft.com
  • https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
14 KB
11 KB 		33ms
33ms 		Document
text/html		 172.67.192.108
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.192.108 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
52e669688e628dbc7c7c08636ee568e80751cf591252b42a41cb6fa0b1fd40bf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate
cf-ray
a067d77b3f733aa4-FRA
content-encoding
zstd
content-type
text/html;charset=UTF-8
date
Thu, 04 Jun 2026 15:06:29 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=eyexBZDj%2F4s20OnMDay%2BEFpIbyLkBEj1q8sy8h4i6YCfJTNiqbLHB00euMqg6O57BLHtvPzh0%2FJrh%2FygGCDUOUz8Y5CyBWZXpG%2F7GnvPyXjvN9rp0kKCeR8%2F3qiAvrmOIowSQ7HVqFQubME0eqh1LQCekhTXafe7Q9X9a6gkQ1DK3NCpYXSaJhRVcA%3D%3D"}]}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-ray
a067d77a8ede3aa4-FRA
content-length
0
date
Thu, 04 Jun 2026 15:06:28 GMT
location
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cwATkCsxstNmg4R%2F5hn8rQhOpID8UaFfSNMac47VYDEuKMgy4PxBhN9R%2FMnzK6CP5U5TW6pnCEp86jJrjcvEEms%2FoLP8EeC5N%2B%2BuDbyfb6TocOMradiopltPim5XYmo2ZabxpQ09ubp%2BOiLwuhtXrExzsjnR%2FQyd1UGGuNYob1EI9ItvCOLGcPph8Q%3D%3D"}]}
server
cloudflare
GET

css2
fonts.googleapis.com/ 		0
0

POST
H3 		200
 init Show response
taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/api/session/ 		137 B
571 B 		1155ms
1155ms 		Fetch
application/json		 172.67.192.108
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/api/session/init
Requested by
Host: taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev
URL: https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.108 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
76fc3de03b60f1078d6a03c5d67faf92901d746a13b59aafa79528dff504d920

Request headers

sec-ch-ua-platform
"Linux"
X-Antibot-Token
47ad59c91b68efde91a9d23e19d792cc5d0f76bde8012d4169ae9e0c9e341047
Referer
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pYVzXgKlreRwe%2BIbiiiDMnqPNksnG0bLAzmcqfKvtKE%2FsZwSD5VRxEJ4od4lxLKST1gkY23iycW3cMSf91TSU%2BFTjPcW6zRo4cWpzkPW68SrtOc4Vd%2FpFPWti5W4RIq6MRjYJ%2FqWHGZWvHbfDJGZ82o6Qpax675bc3uPiwRvLf1EIfRpbmeZEWdMvg%3D%3D"}]}
cf-ray
a067d77c19627d53-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 04 Jun 2026 15:06:30 GMT
content-type
application/json
server
cloudflare
priority
u=1,i
GET
DATA 		200
OK 		truncated
/ 		144 B
0 		Image
image/svg+xml
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c7f07d1ebe4aa5b561bc15d5efb2b2cda0abbf2a5b268cabbf9916baaeb6f702

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
H3 		200
 favicon.ico
taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/ 		14 KB
11 KB 		41ms
40ms 		Other
text/html		 172.67.192.108
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.192.108 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b26eeda98e4c07ea806409a461a65651e85088d127c71ae94f6c924c5a66c20

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/c16a12d43b517fca?email=mail%40microsoft.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1GLfvq4MkTnV42%2F78%2B2ZdZYh36QTXHJM7of%2F2v8eMW4RZ1kPFCpgvH9mGkMPy%2FhgTvypedVMmB04gmvJisstPdfEBbBO%2BkBWrHPm4AleXvzhQdDk8qSoLAlulMxjHOF06vwd3cDw9JyqaxoDi8oLgUvJ%2FdV5kWlLey4XE1YwsP64Z%2BOwWiEDxXrNyQ%3D%3D"}]}
cf-ray
a067d77c19647d53-FRA
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 04 Jun 2026 15:06:29 GMT
content-type
text/html;charset=UTF-8
server
cloudflare
priority
u=1,i
GET

dev_1780585589211_a57wgq16x
taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/api/session/status/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css2?family=Segoe+UI:wght@400;600;700&display=swap
Domain
taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev
URL
https://taay-uhm9-1hhx.info-pixology-co-za-s-account.workers.dev/api/session/status/dev_1780585589211_a57wgq16x

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer)

6 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| d function| sf function| ck function| cc function| gm function| se

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.