urlscan.io logo urlscan.io
SecurityTrails logo

emta.internal.ee Open in urlscan Pro
46.226.143.54  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://emta.internal.ee/79ami2iobawh5tpu
Submission: On September 29 via manual from EE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 46.226.143.54, located in Estonia and belongs to EE-CERT EE CERT, EE. The main domain is emta.internal.ee.
TLS certificate: Issued by R3 on August 21st 2023. Valid for: 3 months.
This is the only time emta.internal.ee was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 11 46.226.143.54 56588 (EE-CERT E...)
8 2
Apex Domain
Subdomains		 Transfer
11 internal.ee
emta.internal.ee
44 KB
8 1
Domain Requested by
11 emta.internal.ee 3 redirects emta.internal.ee
8 1

This site contains no links.

Subject Issuer Validity Valid
emta.internal.ee
R3		 2023-08-21 -
2023-11-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://emta.internal.ee/79ami2iobawh5tpu
Frame ID: 2037FB7F7593F79D695FC332D7536CE4
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

43 kB
Transfer

103 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://emta.internal.ee/js/events.js HTTP 302
  • https://emta.internal.ee/obfuscate?path=js/events.js
Request Chain 4
  • https://emta.internal.ee/js/timeme.min.js HTTP 302
  • https://emta.internal.ee/obfuscate?path=js/timeme.min.js
Request Chain 5
  • https://emta.internal.ee/js/time-tracker.js HTTP 302
  • https://emta.internal.ee/obfuscate?path=js/time-tracker.js

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 79ami2iobawh5tpu
emta.internal.ee/ 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
f461879360934e6e3fa4ee59b15914b5fdc9723eb8e23ac93451eafbe97963b8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
*
Access-Control-Allow-Methods
*
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
2812
Content-Type
text/html; charset=UTF-8
Date
Fri, 29 Sep 2023 07:05:35 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Lucy
Vary
Accept-Encoding
obfuscate
emta.internal.ee/
Redirect Chain
  • https://emta.internal.ee/js/events.js
  • https://emta.internal.ee/obfuscate?path=js/events.js
558 B
957 B 		Script
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/obfuscate?path=js/events.js
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://emta.internal.ee/79ami2iobawh5tpu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 29 Sep 2023 07:05:35 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
558
Keep-Alive
timeout=5, max=97
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Date
Fri, 29 Sep 2023 07:05:35 GMT
Server
Lucy
Content-Type
text/html; charset=iso-8859-1
Location
https://emta.internal.ee/obfuscate?path=js/events.js
Cache-Control
max-age=1
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
301
Expires
Fri, 29 Sep 2023 07:05:36 GMT
style.css
emta.internal.ee/public/campaign/102/138/11/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/public/campaign/102/138/11/style.css
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://emta.internal.ee/79ami2iobawh5tpu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date
Fri, 29 Sep 2023 07:05:35 GMT
Server
Lucy
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
261
Content-Type
text/html; charset=iso-8859-1
logo.png
emta.internal.ee/public/campaign/126/165/12/static/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://emta.internal.ee/public/campaign/126/165/12/static/logo.png
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://emta.internal.ee/79ami2iobawh5tpu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date
Fri, 29 Sep 2023 07:05:35 GMT
Last-Modified
Fri, 18 Nov 2022 07:47:11 GMT
Server
Lucy
ETag
"509-5edb9e9d49b61"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1289
jquery-3.7.0.min.js.js
emta.internal.ee/public/campaign/175/246/12/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/public/campaign/175/246/12/jquery-3.7.0.min.js.js
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
646be94d8c530951d009c8553231592b098e8708da86fbf13019cde550148742

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://emta.internal.ee/79ami2iobawh5tpu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date
Fri, 29 Sep 2023 07:05:35 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2023 10:30:51 GMT
Server
Lucy
ETag
"155a8-5fd9bbf218990-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
30343
obfuscate
emta.internal.ee/
Redirect Chain
  • https://emta.internal.ee/js/timeme.min.js
  • https://emta.internal.ee/obfuscate?path=js/timeme.min.js
4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/obfuscate?path=js/timeme.min.js
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://emta.internal.ee/79ami2iobawh5tpu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 29 Sep 2023 07:05:35 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
4210
Keep-Alive
timeout=5, max=95
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Date
Fri, 29 Sep 2023 07:05:35 GMT
Server
Lucy
Content-Type
text/html; charset=iso-8859-1
Location
https://emta.internal.ee/obfuscate?path=js/timeme.min.js
Cache-Control
max-age=1
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
305
Expires
Fri, 29 Sep 2023 07:05:36 GMT
obfuscate
emta.internal.ee/
Redirect Chain
  • https://emta.internal.ee/js/time-tracker.js
  • https://emta.internal.ee/obfuscate?path=js/time-tracker.js
2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/obfuscate?path=js/time-tracker.js
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
f53941103f6922446d2f5490b628638bffa13b74888ca07f40b2811ac743d98c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://emta.internal.ee/79ami2iobawh5tpu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 29 Sep 2023 07:05:36 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
1575
Keep-Alive
timeout=5, max=98
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Date
Fri, 29 Sep 2023 07:05:35 GMT
Server
Lucy
Content-Type
text/html; charset=iso-8859-1
Location
https://emta.internal.ee/obfuscate?path=js/time-tracker.js
Cache-Control
max-age=1
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
307
Expires
Fri, 29 Sep 2023 07:05:36 GMT
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
30271beec01049a656ff39203516835b71c8119cab983e394ed1eb37bad26d01

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Content-Type
image/svg+xml
track-time
emta.internal.ee/scenario/ 		0
562 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://emta.internal.ee/scenario/track-time
Requested by
Host: emta.internal.ee
URL: https://emta.internal.ee/79ami2iobawh5tpu
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE),
Reverse DNS
outlook.o365.ee
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://emta.internal.ee/79ami2iobawh5tpu
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Fri, 29 Sep 2023 07:05:37 GMT
Server
Lucy
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
*
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
0
Keep-Alive
timeout=5, max=97
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| lucyDispatchEvent number| signmode function| clickSign function| $ function| jQuery object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runTimeTracker function| isChrome

2 Cookies

Domain/Path Name / Value
emta.internal.ee/ Name: PHPSESSID
Value: 3hc6ufcs1kudqldfff02uvd3ok
emta.internal.ee/ Name: link
Value: 79ami2iobawh5tpu

1 Console Messages

Source Level URL
Text
network error URL: https://emta.internal.ee/public/campaign/102/138/11/style.css
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)