![](/screenshots/7968ab89-d818-4648-9378-7b0772fb8c7f.png)
kasutajatugi.eu
Open in
urlscan Pro
46.226.143.54
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On December 18 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by R3 on December 8th 2023. Valid for: 3 months.
This is the only time kasutajatugi.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 11 | 46.226.143.54 46.226.143.54 | 56588 (EE-CERT E...) (EE-CERT EE CERT) | |
8 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
kasutajatugi.eu
3 redirects
kasutajatugi.eu |
42 KB |
8 | 1 |
Domain | Requested by | |
---|---|---|
11 | kasutajatugi.eu |
3 redirects
kasutajatugi.eu
|
8 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
kasutajatugi.eu R3 |
2023-12-08 - 2024-03-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kasutajatugi.eu/wol0cy6r6jt9khpz
Frame ID: ECA2735FC3FE31B15898D829516A86A1
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/7968ab89-d818-4648-9378-7b0772fb8c7f.png)
Page Title
Sign in to your Microsoft accountDetected technologies
![](/vendor/wappa/icons/TrackJs.png)
Detected patterns
- tracker\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://kasutajatugi.eu/js/events.js HTTP 302
- https://kasutajatugi.eu/obfuscate?path=js/events.js
- https://kasutajatugi.eu/js/timeme.min.js HTTP 302
- https://kasutajatugi.eu/obfuscate?path=js/timeme.min.js
- https://kasutajatugi.eu/js/time-tracker.js HTTP 302
- https://kasutajatugi.eu/obfuscate?path=js/time-tracker.js
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
wol0cy6r6jt9khpz
kasutajatugi.eu/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
obfuscate
kasutajatugi.eu/ Redirect Chain
|
558 B 586 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
kasutajatugi.eu/public/campaign/102/138/11/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
kasutajatugi.eu/public/campaign/126/165/12/static/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.0.min.js.js
kasutajatugi.eu/public/campaign/175/246/12/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
obfuscate
kasutajatugi.eu/ Redirect Chain
|
4 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
obfuscate
kasutajatugi.eu/ Redirect Chain
|
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
track-time
kasutajatugi.eu/scenario/ |
0 220 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| lucyDispatchEvent function| TokenSigning number| signmode function| clickSign function| $ function| jQuery object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runTimeTracker function| isChrome2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kasutajatugi.eu/ | Name: PHPSESSID Value: jjq1ct8p93l19cjg5t096vnd7l |
|
kasutajatugi.eu/ | Name: link Value: wol0cy6r6jt9khpz |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
kasutajatugi.eu
46.226.143.54
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d
20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce
30271beec01049a656ff39203516835b71c8119cab983e394ed1eb37bad26d01
646be94d8c530951d009c8553231592b098e8708da86fbf13019cde550148742
ad08dc726690cfd7de7a2ddf2b38947a7adf2072fad36c0579dae8ffb3179230
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f53941103f6922446d2f5490b628638bffa13b74888ca07f40b2811ac743d98c