urlscan.io logo urlscan.io
SecurityTrails logo

oneindex1.archive.us-east-1.oortech.com Open in urlscan Pro
170.106.201.213  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://oneindex1.archive.us-east-1.oortech.com/dobe34
Submission: On September 07 via api from CH — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 170.106.201.213, located in Ashburn, United States and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is oneindex1.archive.us-east-1.oortech.com.
TLS certificate: Issued by TrustAsia RSA DV TLS CA G2 on March 28th 2024. Valid for: a year.
This is the only time oneindex1.archive.us-east-1.oortech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

IP Address AS Autonomous System
1 170.106.201.213 132203 (TENCENT-N...)
2 151.101.130.132 54113 (FASTLY)
1 2a04:4e42:400... 54113 (FASTLY)
1 2607:f8b0:400... 15169 (GOOGLE)
5 4
Apex Domain
Subdomains		 Transfer
2 glitch.global
cdn.glitch.global — Cisco Umbrella Rank: 432012
175 KB
1 googleapis.com
firebasestorage.googleapis.com — Cisco Umbrella Rank: 6369
118 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211
31 KB
1 oortech.com
oneindex1.archive.us-east-1.oortech.com
3 KB
5 4
Domain Requested by
2 cdn.glitch.global oneindex1.archive.us-east-1.oortech.com
1 firebasestorage.googleapis.com oneindex1.archive.us-east-1.oortech.com
1 code.jquery.com oneindex1.archive.us-east-1.oortech.com
1 oneindex1.archive.us-east-1.oortech.com
5 4

This site contains no links.

Subject Issuer Validity Valid
*.archive.us-east-1.oortech.com
TrustAsia RSA DV TLS CA G2		 2024-03-28 -
2025-03-28		 a year crt.sh
cdn.glitch.global
R11		 2024-07-29 -
2024-10-27		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
upload.video.google.com
WR2		 2024-08-12 -
2024-11-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://oneindex1.archive.us-east-1.oortech.com/dobe34
Frame ID: CC8BE76864A621F5F1889CF6E140DFA4
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PDF ONLINE DOCUMENT

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

326 kB
Transfer

563 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request dobe34
oneindex1.archive.us-east-1.oortech.com/ 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://oneindex1.archive.us-east-1.oortech.com/dobe34
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.106.201.213 Ashburn, United States, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
00f0c94a8c2a40a31a881ad7a3a29696418d602d3e645b842be1f854646057f6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Authorization, Content-Length, X-CSRF-Token, token, session, Accept, Origin, Host, Connection, Accept-Encoding, Accept-Language, DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type
access-control-allow-methods
GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Content-Type, token, refresh_token
access-control-max-age
3628800
content-disposition
inline; filename="dobe34"
content-encoding
gzip
content-type
text/html
date
Sat, 07 Sep 2024 08:07:47 GMT
last-modified
Mon, 02 Sep 2024 08:45:23 GMT
server
nginx/1.18.0 (Ubuntu)
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
pdf-logo.png
cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/ 		174 KB
175 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/pdf-logo.png?v=1703176079035
Requested by
Host: oneindex1.archive.us-east-1.oortech.com
URL: https://oneindex1.archive.us-east-1.oortech.com/dobe34
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.132 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327
Security Headers
Name Value
Content-Security-Policy script-src 'none'

Request headers

Referer
https://oneindex1.archive.us-east-1.oortech.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy
script-src 'none'
via
1.1 varnish, 1.1 varnish
date
Sat, 07 Sep 2024 08:07:47 GMT
x-amz-request-id
P611PTNE2K64CFD3
age
2775104
x-amz-server-side-encryption
AES256
x-cache
HIT, HIT
content-length
178166
x-amz-id-2
6KzZg11mpAGAVMB476/s+5yR7ilEOdtU2WpToZDXeUplX1/FmwnvxmVWcLB9nTWJJ5/f/volzho=
x-served-by
cache-iad-kiad7000134-IAD, cache-mia-kmia1760068-MIA
last-modified
Thu, 21 Dec 2023 16:27:58 GMT
server
AmazonS3
x-timer
S1725696467.414903,VS0,VE0
etag
"2be243eaa597e9442b712456427c25d2"
access-control-allow-methods
GET, HEAD, POST
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
33076, 0
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: oneindex1.archive.us-east-1.oortech.com
URL: https://oneindex1.archive.us-east-1.oortech.com/dobe34
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://oneindex1.archive.us-east-1.oortech.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 07 Sep 2024 08:07:47 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
3714213
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
content-length
30875
x-served-by
cache-lga21931-LGA, cache-mia-kmia1760045-MIA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1725696467.405561,VS0,VE0
etag
W/"28feccc0-15d9d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
25, 261746
Adobe.png
firebasestorage.googleapis.com/v0/b/png-images-481bb.appspot.com/o/ 		117 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://firebasestorage.googleapis.com/v0/b/png-images-481bb.appspot.com/o/Adobe.png?alt=media&token=a3813f1f-169a-48a6-8172-22d091f87e7c
Requested by
Host: oneindex1.archive.us-east-1.oortech.com
URL: https://oneindex1.archive.us-east-1.oortech.com/dobe34
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
c6a474bcc89bf85d1ccaa821fb3d9c8fca16b18a6a5ba8d217c4e3166dec80e1

Request headers

Referer
https://oneindex1.archive.us-east-1.oortech.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sat, 07 Sep 2024 08:07:47 GMT
x-guploader-uploadid
AD-8lju4yObUyR9YPboE7w_nq6j4bJkIexLbzogXC8JjgXPCMBTZ2BwblFLNN8AIvgI14QnkLA
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''Adobe.png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
119844
last-modified
Wed, 10 Apr 2024 11:51:57 GMT
server
UploadServer
etag
"c657d7e769a257c2ed86980292fe4ddc"
x-goog-generation
1712749917474086
content-type
image/png
x-goog-hash
crc32c=sw/mPA==, md5=xlfX52miV8LthpgCkv5N3A==
cache-control
private, max-age=0
x-goog-stored-content-length
119844
x-goog-meta-firebasestoragedownloadtokens
a3813f1f-169a-48a6-8172-22d091f87e7c
accept-ranges
bytes
expires
Sat, 07 Sep 2024 08:07:47 GMT
pdf-logo.png
cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/ 		174 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
https://cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/pdf-logo.png?v=1703176079035
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.132 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327
Security Headers
Name Value
Content-Security-Policy script-src 'none'

Request headers

Referer
https://oneindex1.archive.us-east-1.oortech.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy
script-src 'none'
via
1.1 varnish, 1.1 varnish
date
Sat, 07 Sep 2024 08:07:47 GMT
x-amz-request-id
P611PTNE2K64CFD3
age
2775104
x-amz-server-side-encryption
AES256
x-cache
HIT, HIT
content-length
178166
x-amz-id-2
6KzZg11mpAGAVMB476/s+5yR7ilEOdtU2WpToZDXeUplX1/FmwnvxmVWcLB9nTWJJ5/f/volzho=
x-served-by
cache-iad-kiad7000134-IAD, cache-mia-kmia1760068-MIA
last-modified
Thu, 21 Dec 2023 16:27:58 GMT
server
AmazonS3
x-timer
S1725696467.414903,VS0,VE0
etag
"2be243eaa597e9442b712456427c25d2"
access-control-allow-methods
GET, HEAD, POST
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
33076, 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://oneindex1.archive.us-east-1.oortech.com/dobe34
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block