portaltuyatransaccionalss.atwebpages.com Open in urlscan Pro
185.176.43.108 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://portaltuyatransaccionalss.atwebpages.com/
Submission: On April 10 via api (April 10th 2023, 4:03:32 pm UTC) from JP — Scanned from JP

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 185.176.43.108, located in Bulgaria and belongs to ZETTA-AS, BG. The main domain is portaltuyatransaccionalss.atwebpages.com.

This is the only time portaltuyatransaccionalss.atwebpages.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tuya (Financial)

Domain & IP information

	IP Address	AS Autonomous System
4	185.176.43.108 185.176.43.108	44476 (ZETTA-AS) (ZETTA-AS)
2	13.35.49.106 13.35.49.106	16509 (AMAZON-02) (AMAZON-02)
13	45.60.48.18 45.60.48.18	19551 (INCAPSULA) (INCAPSULA)
19	3

4 185.176.43.108 (Bulgaria)

ASN44476 (ZETTA-AS, BG)

portaltuyatransaccionalss.atwebpages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.49.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-49-106.nrt20.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 45.60.48.18 (United States)

ASN19551 (INCAPSULA, US)

www.tuya.com.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	tuya.com.co www.tuya.com.co — Cisco Umbrella Rank: 684097	134 KB
4	atwebpages.com portaltuyatransaccionalss.atwebpages.com	129 KB
2	hotjar.com script.hotjar.com — Cisco Umbrella Rank: 927	34 KB
19	3

	Domain	Requested by
13	www.tuya.com.co	portaltuyatransaccionalss.atwebpages.com
4	portaltuyatransaccionalss.atwebpages.com	portaltuyatransaccionalss.atwebpages.com
2	script.hotjar.com	portaltuyatransaccionalss.atwebpages.com
19	3

This site contains no links.

Subject Issuer	Validity	Valid
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
*.tuya.com.co Go Daddy Secure Certificate Authority - G2	`2022-07-13` - `2023-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://portaltuyatransaccionalss.atwebpages.com/
Frame ID: 4614C71AF3BA8151710442CBF36FA350
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Portal Transaccional EXITO

Page Statistics

19
Requests

79 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

297 kB
Transfer

404 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
portaltuyatransaccionalss.atwebpages.com/ 110 KB
110 KB 823ms
282ms Document
text/html 185.176.43.108
ZETTA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://portaltuyatransaccionalss.atwebpages.com/
Protocol: HTTP/1.1
Server: 185.176.43.108 , Bulgaria, ASN44476 (ZETTA-AS, BG),
Reverse DNS
Software: Apache /
Resource Hash: 6ccb875d49765943c66a1340ccadcad7e08793c4158f8c9ac0b7bb9eb8e1f3e4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 112388
Content-Type: text/html; charset=UTF-8
Date: Mon, 10 Apr 2023 16:03:26 GMT
Keep-Alive: timeout=5, max=100
Server: Apache

GET
H/1.1 200
OK Default1.css
portaltuyatransaccionalss.atwebpages.com/index_files/ 17 KB
17 KB 274ms
273ms Stylesheet
text/css 185.176.43.108
ZETTA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/Default1.css
Requested by: Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/
Protocol: HTTP/1.1
Server: 185.176.43.108 , Bulgaria, ASN44476 (ZETTA-AS, BG),
Reverse DNS
Software: Apache /
Resource Hash: 3aa5795f80a26e621e26da216e7b66f055dad0a4019b80a361f005aea2f0985f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Mon, 10 Apr 2023 16:03:26 GMT
Last-Modified: Thu, 14 Apr 2022 22:06:00 GMT
Server: Apache
ETag: "4428-5dca47fc64200"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 17448

GET
H/1.1 404
Not Found preact-incoming-feedback.417f8858abb528f56b1d.js
portaltuyatransaccionalss.atwebpages.com/index_files/ 0
0 547ms
273ms Script
text/html 185.176.43.108
ZETTA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/preact-incoming-feedback.417f8858abb528f56b1d.js
Requested by: Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/
Protocol: HTTP/1.1
Server: 185.176.43.108 , Bulgaria, ASN44476 (ZETTA-AS, BG),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Mon, 10 Apr 2023 16:03:26 GMT
Last-Modified: Tue, 04 Oct 2022 10:16:58 GMT
Server: Apache
ETag: "7bce3-5ea32c2add078"
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 507107

GET
H2 200 preact-incoming-feedback.563a27a83688364f89f9.js Show response
script.hotjar.com/ 153 KB
31 KB 339ms
273ms Script
application/javascript 13.35.49.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/preact-incoming-feedback.563a27a83688364f89f9.js

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.49.106 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-49-106.nrt20.r.cloudfront.net

Software

Resource Hash

e7187f115b4479924d6a12618adb811fd4376fb97666ed433a8afddd54160931

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Mon, 10 Apr 2023 16:03:27 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 c6e672f66f0c430c2e883081a311e09e.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT20-C1
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 31521
last-modified: Wed, 13 Apr 2022 08:30:26 GMT
etag: "097cb79e983c8076614a6d4f7117b3c3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: Q5URntdeHcFrm78zg3bqOO889nnTCwgBy7v559IEzNV7XQi1G0hjvA==

GET
H/1.1 200
OK botonAceptar.png
portaltuyatransaccionalss.atwebpages.com/index_files/ 2 KB
2 KB 280ms
279ms Image
image/png 185.176.43.108
ZETTA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/botonAceptar.png
Requested by: Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/
Protocol: HTTP/1.1
Server: 185.176.43.108 , Bulgaria, ASN44476 (ZETTA-AS, BG),
Reverse DNS
Software: Apache /
Resource Hash: fdd025456871d99b45cf95a30a097d5c168a62c91fd86852cba4802321f6e36a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date: Mon, 10 Apr 2023 16:03:27 GMT
Last-Modified: Thu, 14 Apr 2022 22:06:00 GMT
Server: Apache
ETag: "6a3-5dca47fc64200"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1699

GET
H/1.1 200
OK bannerPortal.PNG
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 19 KB
21 KB 839ms
162ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/bannerPortal.PNG

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/Default1.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

ce4c41a5f975970fa6b4dcca965882e19c3e32ec39cbbac1bf6aef06d0b3f898

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:02:17 GMT
X-CDN: Imperva
ETag: "c4febfbf29ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 3-37589368-37589370 SNNN RT(1681142607358 622) q(0 0 0 0) r(2 2) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1113441180"
Accept-Ranges: bytes
Content-Length: 19954
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton7.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 2 KB
3 KB 839ms
159ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton7.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

81fdd88dc815fbcf6d9dcad7c79d9278220576d033761141f36d449ab67c0ae5

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:12 GMT
X-CDN: Imperva
ETag: "e3767db5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 10-72946150-72946151 SNNN RT(1681142607357 625) q(0 0 0 0) r(2 2) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 1622
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton2.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 2 KB
3 KB 879ms
182ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton2.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

5d4fb09832af72e1747b2ab493057a2856a1d31018f16226367a5d57010e41d2

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "1e1a66b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 4-52264620-52264621 SNNN RT(1681142607358 641) q(1 1 1 16) r(2 2) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 2046
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton1.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 1 KB
2 KB 899ms
162ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton1.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

fa9929129a567369394f0d97e9fab7fc320cd5eb21938a01e844dfbb8c1116d3

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "c2e360b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 4-52264619-52264622 SNNN RT(1681142607358 681) q(0 0 0 0) r(2 2) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="0", dtRpid;desc="1031794212"
Accept-Ranges: bytes
Content-Length: 1084
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton6.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 3 KB
4 KB 997ms
160ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton6.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

b7c27b2cb4cc310e1e675d2d19d5c2a0a88287740013558c47e18b8649ca804d

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "109b75b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 12-108881515-108881516 SNNN RT(1681142607357 783) q(0 0 0 0) r(1 1) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1953770158"
Accept-Ranges: bytes
Content-Length: 2580
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton8.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 3 KB
4 KB 1000ms
161ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton8.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

486d3c09c74ef88ccb58aabd7ac3010936f1c00a0cc788e7d86e970e69e36f22

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:12 GMT
X-CDN: Imperva
ETag: "f51180b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 10-72946150-72946151 SNNN RT(1681142607357 785) q(0 0 0 0) r(2 2) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 2741
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton3.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 2 KB
3 KB 723ms
676ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton3.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

d994557f9b3a2dbbf52cfbea260ae86c0e7815de3d2c798b42321363b0ac4ee3

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "7a46bb5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 4-52264619-52264622 NNNN CT(160 321 0) RT(1681142607358 7) q(0 0 5 2) r(7 7) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 2311
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton0.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 2 KB
3 KB 684ms
638ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton0.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

59f2629c01fc1dedc36d4d94e3d8dc5b95cebb41d95d1ee81a4fd9ac8445e59c

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "cdb65bb5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 4-52264620-52264621 NNNN CT(158 313 0) RT(1681142607358 5) q(0 0 5 2) r(6 6) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1430692183"
Accept-Ranges: bytes
Content-Length: 2390
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton4.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 2 KB
3 KB 664ms
617ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton4.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

7c109e713efe659aa8edda8af67fe41a4b27ca43f4a9c617a1766f5caa4e8b5b

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "c5db6eb5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 3-37589368-37589370 NNNN CT(151 304 0) RT(1681142607358 5) q(0 0 5 1) r(6 6) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 1577
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton5.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 2 KB
3 KB 663ms
619ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton5.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

ad755dfae1647fa2c926168ed41aef17961c7993a8362662707e57572e13e37b

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "9f2a74b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 12-108881515-108881516 NNNN CT(151 304 0) RT(1681142607357 3) q(0 0 5 0) r(6 6) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="0", dtRpid;desc="1525719862"
Accept-Ranges: bytes
Content-Length: 1839
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK boton9.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 3 KB
4 KB 824ms
160ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/boton9.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

57a1ec62cda2a2b0af03063e66e5590bd24fc8fb8576ebae5eb2372d64137ca9

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:12 GMT
X-CDN: Imperva
ETag: "d41785b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 12-108881515-108881516 SNNN RT(1681142607357 623) q(0 0 0 0) r(2 2) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 2593
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK BotonBorrar.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 4 KB
5 KB 666ms
620ms Image
image/png 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/BotonBorrar.png

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/Default1.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

3b78b12f2643778c214d1994ac99e64993e98997dc502a3164a8582f5d82d99b

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:14:11 GMT
X-CDN: Imperva
ETag: "4d8057b5f39ad81:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Iinfo: 10-72946150-72946151 NNNN CT(151 303 0) RT(1681142607357 4) q(0 0 5 0) r(6 6) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 4277
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK PublicidadPortal.JPG
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/ 77 KB
78 KB 680ms
635ms Image
image/jpeg 45.60.48.18
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/PublicidadPortal.JPG

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/Default1.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.48.18 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155

Security Headers

Name	Value
Strict-Transport-Security	1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://portaltuyatransaccionalss.atwebpages.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-content-type: nosniff
strict-transport-security: 1; mode=max-age=31536000; includeSubDomains; preload
Date: Mon, 10 Apr 2023 16:03:27 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 18 Jul 2022 22:02:17 GMT
X-CDN: Imperva
ETag: "f150bebf29ad81:0"
X-Frame-Options: DENY
Content-Type: image/jpeg
X-Iinfo: 9-59515944-59515946 NNNN CT(154 313 0) RT(1681142607357 4) q(0 0 5 0) r(6 6) U18
Cache-Control: max-age=0
Server-Timing: dtSInfo;desc="1"
Accept-Ranges: bytes
Content-Length: 78850
x-xss-protection: 1; mode=block

GET
H2 200 font-hotjar_5.65042d.woff2
script.hotjar.com/ 2 KB
3 KB 7ms
2ms Font
font/woff2 13.35.49.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/font-hotjar_5.65042d.woff2

Requested by

Host: portaltuyatransaccionalss.atwebpages.com
URL: http://portaltuyatransaccionalss.atwebpages.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.49.106 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-49-106.nrt20.r.cloudfront.net

Software

Resource Hash

fab4fef6bbfa8d6464403a14be7de1be5e3e63637a96d994fab10266e1eaf6da

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://portaltuyatransaccionalss.atwebpages.com/
Origin: http://portaltuyatransaccionalss.atwebpages.com
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date: Sun, 02 Apr 2023 18:07:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 aec8d6f81c23edb783499db703a75514.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT20-C1
age: 683761
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
last-modified: Fri, 31 Mar 2023 10:27:53 GMT
etag: "c9fb9163f8b7be37023ebe649688bebf"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: ry1Tt8bsS_PyQY-AtAk3hh9x34MZYl2Ry6978z1pNi3DvEdqdyWTkw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tuya (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.tuya.com.co/	1970-01-20 19:44:35	Name: visid_incap_1881794 Value: H27U9WuTQCy9f2nUizAsfk8zNGQAAAAAQUIPAAAAAAB8qqFutSGRcrcSvrPjAqPr
			.tuya.com.co/	1969-12-31 23:59:59	Name: incap_ses_896_1881794 Value: AmU5Qvto51OVyX0oyjtvDFAzNGQAAAAAvy2uTZZx9m+JcRGxqJ7PxA==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://portaltuyatransaccionalss.atwebpages.com/index_files/preact-incoming-feedback.417f8858abb528f56b1d.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

portaltuyatransaccionalss.atwebpages.com
script.hotjar.com
www.tuya.com.co
13.35.49.106
185.176.43.108
45.60.48.18
3aa5795f80a26e621e26da216e7b66f055dad0a4019b80a361f005aea2f0985f
3b78b12f2643778c214d1994ac99e64993e98997dc502a3164a8582f5d82d99b
486d3c09c74ef88ccb58aabd7ac3010936f1c00a0cc788e7d86e970e69e36f22
57a1ec62cda2a2b0af03063e66e5590bd24fc8fb8576ebae5eb2372d64137ca9
59f2629c01fc1dedc36d4d94e3d8dc5b95cebb41d95d1ee81a4fd9ac8445e59c
5d4fb09832af72e1747b2ab493057a2856a1d31018f16226367a5d57010e41d2
6ccb875d49765943c66a1340ccadcad7e08793c4158f8c9ac0b7bb9eb8e1f3e4
7c109e713efe659aa8edda8af67fe41a4b27ca43f4a9c617a1766f5caa4e8b5b
81fdd88dc815fbcf6d9dcad7c79d9278220576d033761141f36d449ab67c0ae5
883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155
ad755dfae1647fa2c926168ed41aef17961c7993a8362662707e57572e13e37b
b7c27b2cb4cc310e1e675d2d19d5c2a0a88287740013558c47e18b8649ca804d
ce4c41a5f975970fa6b4dcca965882e19c3e32ec39cbbac1bf6aef06d0b3f898
d994557f9b3a2dbbf52cfbea260ae86c0e7815de3d2c798b42321363b0ac4ee3
e7187f115b4479924d6a12618adb811fd4376fb97666ed433a8afddd54160931
fa9929129a567369394f0d97e9fab7fc320cd5eb21938a01e844dfbb8c1116d3
fab4fef6bbfa8d6464403a14be7de1be5e3e63637a96d994fab10266e1eaf6da
fdd025456871d99b45cf95a30a097d5c168a62c91fd86852cba4802321f6e36a

portaltuyatransaccionalss.atwebpages.com Open in urlscan Pro 185.176.43.108 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

19 Requests

79 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

297 kBTransfer

404 kBSize

2 Cookies

0 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

portaltuyatransaccionalss.atwebpages.com Open in urlscan Pro
185.176.43.108 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

79 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

297 kB
Transfer

404 kB
Size

2
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!