urlscan.io logo urlscan.io
SecurityTrails logo

sisekontroll.eu Open in urlscan Pro
46.226.143.54  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Submission: On November 17 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 46.226.143.54, located in Estonia and belongs to EE-CERT EE CERT, EE. The main domain is sisekontroll.eu.
TLS certificate: Issued by R3 on October 29th 2023. Valid for: 3 months.
This is the only time sisekontroll.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 11 46.226.143.54 56588 (EE-CERT E...)
8 2
Apex Domain
Subdomains		 Transfer
11 sisekontroll.eu
sisekontroll.eu
42 KB
8 1
Domain Requested by
11 sisekontroll.eu 3 redirects sisekontroll.eu
8 1

This site contains no links.

Subject Issuer Validity Valid
sisekontroll.eu
R3		 2023-10-29 -
2024-01-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://sisekontroll.eu/ozj5s800swz2smu1
Frame ID: 8BC64C3A0A1AF24350CA87D7BB8E8AFB
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

42 kB
Transfer

110 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://sisekontroll.eu/js/events.js HTTP 302
  • https://sisekontroll.eu/obfuscate?path=js/events.js
Request Chain 4
  • https://sisekontroll.eu/js/timeme.min.js HTTP 302
  • https://sisekontroll.eu/obfuscate?path=js/timeme.min.js
Request Chain 5
  • https://sisekontroll.eu/js/time-tracker.js HTTP 302
  • https://sisekontroll.eu/obfuscate?path=js/time-tracker.js

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ozj5s800swz2smu1
sisekontroll.eu/ 		15 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
ad08dc726690cfd7de7a2ddf2b38947a7adf2072fad36c0579dae8ffb3179230

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
3737
content-type
text/html; charset=UTF-8
date
Fri, 17 Nov 2023 15:14:09 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Lucy
vary
Accept-Encoding
obfuscate
sisekontroll.eu/
Redirect Chain
  • https://sisekontroll.eu/js/events.js
  • https://sisekontroll.eu/obfuscate?path=js/events.js
558 B
608 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/obfuscate?path=js/events.js
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sisekontroll.eu/ozj5s800swz2smu1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 15:14:09 GMT
server
Lucy
access-control-allow-methods
*
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-headers
*
expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

location
https://sisekontroll.eu/obfuscate?path=js/events.js
date
Fri, 17 Nov 2023 15:14:09 GMT
cache-control
max-age=1
expires
Fri, 17 Nov 2023 15:14:10 GMT
server
Lucy
content-length
299
content-type
text/html; charset=iso-8859-1
style.css
sisekontroll.eu/public/campaign/102/138/11/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/public/campaign/102/138/11/style.css
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sisekontroll.eu/ozj5s800swz2smu1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 15:14:09 GMT
server
Lucy
content-length
260
content-type
text/html; charset=iso-8859-1
logo.png
sisekontroll.eu/public/campaign/126/165/12/static/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sisekontroll.eu/public/campaign/126/165/12/static/logo.png
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sisekontroll.eu/ozj5s800swz2smu1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 15:14:09 GMT
last-modified
Fri, 18 Nov 2022 07:47:11 GMT
server
Lucy
accept-ranges
bytes
etag
"509-5edb9e9d49b61"
content-length
1289
content-type
image/png
jquery-3.7.0.min.js.js
sisekontroll.eu/public/campaign/175/246/12/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/public/campaign/175/246/12/jquery-3.7.0.min.js.js
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
646be94d8c530951d009c8553231592b098e8708da86fbf13019cde550148742

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sisekontroll.eu/ozj5s800swz2smu1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 15:14:09 GMT
content-encoding
gzip
last-modified
Thu, 08 Jun 2023 10:30:51 GMT
server
Lucy
etag
"155a8-5fd9bbf218990-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
30343
obfuscate
sisekontroll.eu/
Redirect Chain
  • https://sisekontroll.eu/js/timeme.min.js
  • https://sisekontroll.eu/obfuscate?path=js/timeme.min.js
4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/obfuscate?path=js/timeme.min.js
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sisekontroll.eu/ozj5s800swz2smu1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 15:14:09 GMT
server
Lucy
access-control-allow-methods
*
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-headers
*
expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

location
https://sisekontroll.eu/obfuscate?path=js/timeme.min.js
date
Fri, 17 Nov 2023 15:14:09 GMT
cache-control
max-age=1
expires
Fri, 17 Nov 2023 15:14:10 GMT
server
Lucy
content-length
303
content-type
text/html; charset=iso-8859-1
obfuscate
sisekontroll.eu/
Redirect Chain
  • https://sisekontroll.eu/js/time-tracker.js
  • https://sisekontroll.eu/obfuscate?path=js/time-tracker.js
2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/obfuscate?path=js/time-tracker.js
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
f53941103f6922446d2f5490b628638bffa13b74888ca07f40b2811ac743d98c

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sisekontroll.eu/ozj5s800swz2smu1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 15:14:09 GMT
server
Lucy
access-control-allow-methods
*
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-headers
*
expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

location
https://sisekontroll.eu/obfuscate?path=js/time-tracker.js
date
Fri, 17 Nov 2023 15:14:09 GMT
cache-control
max-age=1
expires
Fri, 17 Nov 2023 15:14:10 GMT
server
Lucy
content-length
305
content-type
text/html; charset=iso-8859-1
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
30271beec01049a656ff39203516835b71c8119cab983e394ed1eb37bad26d01

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/svg+xml
track-time
sisekontroll.eu/scenario/ 		0
219 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://sisekontroll.eu/scenario/track-time
Requested by
Host: sisekontroll.eu
URL: https://sisekontroll.eu/ozj5s800swz2smu1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sisekontroll.eu/ozj5s800swz2smu1
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 15:14:11 GMT
server
Lucy
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS, PUT, PATCH, HEAD, *
content-type
text/html; charset=UTF-8
access-control-allow-origin
*, *
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, *
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| lucyDispatchEvent function| TokenSigning number| signmode function| clickSign function| $ function| jQuery object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runTimeTracker function| isChrome

2 Cookies

Domain/Path Name / Value
sisekontroll.eu/ Name: PHPSESSID
Value: je0hruvg04tnjnfp66uvel685u
sisekontroll.eu/ Name: link
Value: ozj5s800swz2smu1

1 Console Messages

Source Level URL
Text
network error URL: https://sisekontroll.eu/public/campaign/102/138/11/style.css
Message:
Failed to load resource: the server responded with a status of 404 ()