www.maventreeconsulting.com
Open in
urlscan Pro
192.169.146.198
Malicious Activity!
Public Scan
Submission: On February 01 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on May 29th 2023. Valid for: a year.
This is the only time www.maventreeconsulting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 192.169.146.198 192.169.146.198 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 2 | 23.53.42.160 23.53.42.160 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a02:26f0:480... 2a02:26f0:480:d::210:f15c | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
9 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 198.146.169.192.host.secureserver.net
www.maventreeconsulting.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-42-160.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN20940 (AKAMAI-ASN1, NL)
events.api.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
maventreeconsulting.com
www.maventreeconsulting.com |
531 KB |
2 |
secureserver.net
events.api.secureserver.net — Cisco Umbrella Rank: 8665 |
580 B |
2 |
wsimg.com
1 redirects
img1.wsimg.com — Cisco Umbrella Rank: 7508 |
14 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
6 | www.maventreeconsulting.com |
www.maventreeconsulting.com
|
2 | events.api.secureserver.net |
img1.wsimg.com
|
2 | img1.wsimg.com |
1 redirects
www.maventreeconsulting.com
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
maventreeconsulting.com Go Daddy Secure Certificate Authority - G2 |
2023-05-29 - 2024-06-29 |
a year | crt.sh |
*.api.secureserver.net Starfield Secure Certificate Authority - G2 |
2023-07-10 - 2024-08-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.maventreeconsulting.com/
Frame ID: 08CD36931F3C29554C56CF9B6CB36045
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
- https://img1.wsimg.com/signals/js/clients/tccl/tccl.min.js
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.maventreeconsulting.com/ |
21 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serengetti.css
www.maventreeconsulting.com/ |
86 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serengetti.js
www.maventreeconsulting.com/ |
278 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serengetti.png
www.maventreeconsulting.com/ |
166 KB 166 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serengetti3.png
www.maventreeconsulting.com/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tccl.min.js
img1.wsimg.com/signals/js/clients/tccl/ Redirect Chain
|
46 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serengetti2.png
www.maventreeconsulting.com/ |
265 KB 265 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 290 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 290 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| validateuname function| meetU function| meetData function| meetP1 function| meetData1 function| meetP function| meetData2 object| _trfd boolean| _tcclPageReqFired object| _tcclInternal object| _expDataLayer object| _signalsDataLayer object| tccl object| _trfq2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.maventreeconsulting.com/ | Name: _tccl_visitor Value: 1f621913-52f5-5aa8-bb26-d2a0dbaf27eb |
|
.maventreeconsulting.com/ | Name: _tccl_visit Value: 1f621913-52f5-5aa8-bb26-d2a0dbaf27eb |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
events.api.secureserver.net
img1.wsimg.com
www.maventreeconsulting.com
192.169.146.198
23.53.42.160
2a02:26f0:480:d::210:f15c
04da5a9e7e0f8601354e40a8f75b8f4b3074132d50216fe4ac83141c813c2ff0
265a924c42de4784cba8fd0e1bd77133bc833ea5f5a31fc77e08922c18fcfa43
53861a013923acea8c682704f3fbcaf994d38a0d2c857e9ba45ae77483b5baf0
a8e954fc9668172a94b5e7d74efca982d6abd6891d0457e3d859c99018087fff
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ddb6b5706f83f5a11d4de018b5b1d40164ee2703f95e4ed6ba93a656f6b17edd
df6c9ddf4e344ff9386f6cd0f81db72890857b378a6a1d8cd3693cb769c8ab30
e2f8ccc8a603135d9669b71f5b695def341c88d73b622ab4827397c418805e7b