uuringutulemused.ee Open in urlscan Pro
46.226.143.54 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://uuringutulemused.ee/7jekheffbhax5o8w
Submission: On September 27 via manual (September 27th 2023, 10:35:13 am UTC) from EE — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 46.226.143.54, located in Estonia and belongs to EE-CERT EE CERT, EE. The main domain is uuringutulemused.ee.
TLS certificate: Issued by R3 on September 25th 2023. Valid for: 3 months.

This is the only time uuringutulemused.ee was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
4 15	46.226.143.54 46.226.143.54	56588 (EE-CERT E...) (EE-CERT EE CERT)
1	2a00:1450:400... 2a00:1450:4001:80e::200d	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1 2	104.244.42.1 104.244.42.1	13414 (TWITTER) (TWITTER)
14	5

15 46.226.143.54 (Estonia) 4 redirects

ASN56588 (EE-CERT EE CERT, EE)
PTR: outlook.o365.ee

uuringutulemused.ee	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

plus.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

workspaceupdates.googleblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.1 (United States) 1 redirects

ASN13414 (TWITTER, US)

twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	uuringutulemused.ee 4 redirects uuringutulemused.ee	49 KB
2	twitter.com 1 redirects twitter.com — Cisco Umbrella Rank: 361	424 B
2	google.com 1 redirects accounts.google.com — Cisco Umbrella Rank: 71 plus.google.com — Cisco Umbrella Rank: 14687	316 B
1	googleblog.com workspaceupdates.googleblog.com — Cisco Umbrella Rank: 113279
14	4

	Domain	Requested by
15	uuringutulemused.ee	4 redirects uuringutulemused.ee
2	twitter.com	1 redirects uuringutulemused.ee
1	workspaceupdates.googleblog.com	uuringutulemused.ee
1	plus.google.com	1 redirects
1	accounts.google.com	uuringutulemused.ee
14	5

This site contains no links.

Subject Issuer	Validity	Valid
uuringutulemused.ee R3	`2023-09-25` - `2023-12-24`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://uuringutulemused.ee/7jekheffbhax5o8w
Frame ID: A009CD63EE27443C1CCF3EE07CA4AE53
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

57 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

48 kB
Transfer

111 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://uuringutulemused.ee/js/events.js HTTP 302
https://uuringutulemused.ee/obfuscate?path=js/events.js

Request Chain 4

https://uuringutulemused.ee/js/timeme.min.js HTTP 302
https://uuringutulemused.ee/obfuscate?path=js/timeme.min.js

Request Chain 5

https://uuringutulemused.ee/js/time-tracker.js HTTP 302
https://uuringutulemused.ee/obfuscate?path=js/time-tracker.js

Request Chain 6

https://uuringutulemused.ee/js/analyse.js HTTP 302
https://uuringutulemused.ee/obfuscate?path=js/analyse.js

Request Chain 8

https://plus.google.com/up/?continue=https://www.google.com/intl/en/images/logos/accounts_logo.png&type=st&gpsrc=ogpy0 HTTP 301
https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html

Request Chain 9

https://twitter.com/login?redirect_after_login=/favicon.ico HTTP 302
https://twitter.com/i/flow/login?redirect_after_login=%2Flogin%3Fredirect_after_login%3D%2Ffavicon.ico

14 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 7jekheffbhax5o8w Show response uuringutulemused.ee/	13 KB 5 KB	403ms 185ms	Document text/html	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `815091d784da87267d5cdaa4d19d7db179649a3d61a0f7fe20165cbe6d1b11d5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Access-Control-Allow-Headers * Access-Control-Allow-Methods * Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 4091 Content-Type text/html; charset=UTF-8 Date Wed, 27 Sep 2023 10:35:08 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Lucy Vary Accept-Encoding
GET H/1.1	200 OK	obfuscate Show response uuringutulemused.ee/ Redirect Chain https://uuringutulemused.ee/js/events.js https://uuringutulemused.ee/obfuscate?path=js/events.js	558 B 957 B	185ms 135ms	Script text/javascript	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/obfuscate?path=js/events.js Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 558 Keep-Alive timeout=5, max=97 Expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Content-Type text/html; charset=iso-8859-1 Location https://uuringutulemused.ee/obfuscate?path=js/events.js Cache-Control max-age=1 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 307 Expires Wed, 27 Sep 2023 10:35:09 GMT
GET H/1.1	404 Not Found	style.css uuringutulemused.ee/public/campaign/102/138/11/	0 0	101ms 50ms	Stylesheet text/html	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/public/campaign/102/138/11/style.css Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 264 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	logo.png uuringutulemused.ee/public/campaign/126/165/12/static/	1 KB 2 KB	54ms 53ms	Image image/png	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Show image Full URL https://uuringutulemused.ee/public/campaign/126/165/12/static/logo.png Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Wed, 27 Sep 2023 10:35:08 GMT Last-Modified Fri, 18 Nov 2022 07:47:11 GMT Server Lucy ETag "509-5edb9e9d49b61" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1289
GET H/1.1	200 OK	jquery-3.7.0.min.js.js Show response uuringutulemused.ee/public/campaign/175/246/12/	85 KB 30 KB	60ms 60ms	Script application/javascript	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/public/campaign/175/246/12/jquery-3.7.0.min.js.js Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `646be94d8c530951d009c8553231592b098e8708da86fbf13019cde550148742` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Wed, 27 Sep 2023 10:35:08 GMT Content-Encoding gzip Last-Modified Thu, 08 Jun 2023 10:30:51 GMT Server Lucy ETag "155a8-5fd9bbf218990-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30343
GET H/1.1	200 OK	obfuscate Show response uuringutulemused.ee/ Redirect Chain https://uuringutulemused.ee/js/timeme.min.js https://uuringutulemused.ee/obfuscate?path=js/timeme.min.js	4 KB 5 KB	159ms 159ms	Script text/javascript	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/obfuscate?path=js/timeme.min.js Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 4210 Keep-Alive timeout=5, max=98 Expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Content-Type text/html; charset=iso-8859-1 Location https://uuringutulemused.ee/obfuscate?path=js/timeme.min.js Cache-Control max-age=1 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 311 Expires Wed, 27 Sep 2023 10:35:09 GMT
GET H/1.1	200 OK	obfuscate Show response uuringutulemused.ee/ Redirect Chain https://uuringutulemused.ee/js/time-tracker.js https://uuringutulemused.ee/obfuscate?path=js/time-tracker.js	2 KB 2 KB	163ms 163ms	Script text/javascript	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/obfuscate?path=js/time-tracker.js Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `f53941103f6922446d2f5490b628638bffa13b74888ca07f40b2811ac743d98c` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 1575 Keep-Alive timeout=5, max=95 Expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Content-Type text/html; charset=iso-8859-1 Location https://uuringutulemused.ee/obfuscate?path=js/time-tracker.js Cache-Control max-age=1 Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 313 Expires Wed, 27 Sep 2023 10:35:09 GMT
GET H/1.1	200 OK	obfuscate Show response uuringutulemused.ee/ Redirect Chain https://uuringutulemused.ee/js/analyse.js https://uuringutulemused.ee/obfuscate?path=js/analyse.js	3 KB 3 KB	137ms 136ms	Script text/javascript	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/obfuscate?path=js/analyse.js Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `91c41d9e81d8e6842726b8e34e0b25a018585a05c07ccb07b3e362a79da968b8` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/7jekheffbhax5o8w User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 2938 Keep-Alive timeout=5, max=99 Expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers Date Wed, 27 Sep 2023 10:35:08 GMT Server Lucy Content-Type text/html; charset=iso-8859-1 Location https://uuringutulemused.ee/obfuscate?path=js/analyse.js Cache-Control max-age=1 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 308 Expires Wed, 27 Sep 2023 10:35:09 GMT
GET H2	400	CheckCookie accounts.google.com/	0 0	56ms 29ms	Image text/html	2a00:1450:4001:80e::200d GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1 Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers
GET H2	200	new-community-features-for-google-chat-and-an-update-currents%20.html workspaceupdates.googleblog.com/2023/04/ Redirect Chain https://plus.google.com/up/?continue=https://www.google.com/intl/en/images/logos/accounts_logo.png&type=st&gpsrc=ogpy0 https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html	0 0	303ms 226ms	Image text/html	2a00:1450:4001:813::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol H2 Server 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Redirect headers date Wed, 27 Sep 2023 10:34:26 GMT x-content-type-options nosniff server sffe age 42 content-type text/html; charset=UTF-8 location https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html cache-control public, max-age=1800 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 314 x-xss-protection 0 expires Wed, 27 Sep 2023 11:04:26 GMT
GET H2	200	login twitter.com/i/flow/ Redirect Chain https://twitter.com/login?redirect_after_login=/favicon.ico https://twitter.com/i/flow/login?redirect_after_login=%2Flogin%3Fredirect_after_login%3D%2Ffavicon.ico	0 0	133ms 132ms	Image text/html	104.244.42.1 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://twitter.com/i/flow/login?redirect_after_login=%2Flogin%3Fredirect_after_login%3D%2Ffavicon.ico Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol H2 Server 104.244.42.1 , United States, ASN13414 (TWITTER, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://uuringutulemused.ee/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Redirect headers x-response-time 120 date Wed, 27 Sep 2023 10:35:08 GMT strict-transport-security max-age=631138519 content-encoding gzip server tsa_o x-powered-by Express vary Accept content-type text/plain; charset=utf-8 location /i/flow/login?redirect_after_login=%2Flogin%3Fredirect_after_login%3D%2Ffavicon.ico x-transaction-id d097bab6125918f1 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 7efac3b265dca4c533f257569b11f2becfff83f03cb07f0e835e6a8a164506af content-length 99
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `30271beec01049a656ff39203516835b71c8119cab983e394ed1eb37bad26d01` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Content-Type image/svg+xml
POST H/1.1	200 OK	run-analyse Show response uuringutulemused.ee/7jekheffbhax5o8w/	0 392 B	133ms 132ms	XHR text/html	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/7jekheffbhax5o8w/run-analyse Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://uuringutulemused.ee/7jekheffbhax5o8w accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryma3EZiuPkfaYUZTf Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:09 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 0 Keep-Alive timeout=5, max=94 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	run-analyse Show response uuringutulemused.ee/7jekheffbhax5o8w/	0 392 B	138ms 138ms	XHR text/html	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/7jekheffbhax5o8w/run-analyse Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://uuringutulemused.ee/7jekheffbhax5o8w accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundarycl926O72AGxehgtL Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:09 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 0 Keep-Alive timeout=5, max=98 Expires Thu, 19 Nov 1981 08:52:00 GMT
POST H/1.1	200 OK	track-time uuringutulemused.ee/scenario/	0 562 B	130ms 130ms	Ping text/html	46.226.143.54 EE-CERT EE CERT
General Check archive.org Show headers Download Go to Full URL https://uuringutulemused.ee/scenario/track-time Requested by Host: uuringutulemused.ee URL: https://uuringutulemused.ee/7jekheffbhax5o8w Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.226.143.54 , Estonia, ASN56588 (EE-CERT EE CERT, EE), Reverse DNS outlook.o365.ee Software Lucy / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://uuringutulemused.ee/7jekheffbhax5o8w accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Pragma no-cache Date Wed, 27 Sep 2023 10:35:10 GMT Server Lucy Access-Control-Max-Age 86400 Access-Control-Allow-Methods * Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 0 Keep-Alive timeout=5, max=97 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
uuringutulemused.ee/	1969-12-31 23:59:59	Name: PHPSESSID Value: sau7vuo477qehrpurn5dcg8h0o
uuringutulemused.ee/	1970-01-20 15:46:42	Name: link Value: 7jekheffbhax5o8w
.twitter.com/	1970-01-21 00:33:45	Name: guest_id Value: v1%3A169581090891702218

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://uuringutulemused.ee/public/campaign/102/138/11/style.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1 Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
plus.google.com
twitter.com
uuringutulemused.ee
workspaceupdates.googleblog.com
104.244.42.1
2a00:1450:4001:80e::200d
2a00:1450:4001:813::2001
2a00:1450:4001:829::200e
46.226.143.54
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d
20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce
30271beec01049a656ff39203516835b71c8119cab983e394ed1eb37bad26d01
646be94d8c530951d009c8553231592b098e8708da86fbf13019cde550148742
815091d784da87267d5cdaa4d19d7db179649a3d61a0f7fe20165cbe6d1b11d5
91c41d9e81d8e6842726b8e34e0b25a018585a05c07ccb07b3e362a79da968b8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f53941103f6922446d2f5490b628638bffa13b74888ca07f40b2811ac743d98c

uuringutulemused.ee Open in urlscan Pro 46.226.143.54 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

57 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

48 kBTransfer

111 kBSize

3 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

uuringutulemused.ee Open in urlscan Pro
46.226.143.54 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

57 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

48 kB
Transfer

111 kB
Size

3
Cookies

14 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!