hsmtoolsagustina.standard.us-east-1.oortstorage.com
Open in
urlscan Pro
170.106.62.62
Malicious Activity!
Public Scan
Submission: On December 09 via automatic, source phishtank — Scanned from US
Summary
TLS certificate: Issued by TrustAsia RSA DV TLS CA G3 on October 8th 2024. Valid for: a year.
This is the only time hsmtoolsagustina.standard.us-east-1.oortstorage.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 170.106.62.62 170.106.62.62 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c1f::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:ba1f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 8 |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
hsmtoolsagustina.standard.us-east-1.oortstorage.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1255 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3370 |
29 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
13 KB |
2 |
oortstorage.com
hsmtoolsagustina.standard.us-east-1.oortstorage.com |
696 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318 |
2 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 415 |
30 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 847 |
24 KB |
9 | 6 |
Domain | Requested by | |
---|---|---|
2 | cdnjs.cloudflare.com |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
2 | hsmtoolsagustina.standard.us-east-1.oortstorage.com |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
1 | cdn.jsdelivr.net |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
1 | stackpath.bootstrapcdn.com |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
1 | ajax.googleapis.com |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
1 | maxcdn.bootstrapcdn.com |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
1 | code.jquery.com |
hsmtoolsagustina.standard.us-east-1.oortstorage.com
|
9 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.standard.us-east-1.oortstorage.com TrustAsia RSA DV TLS CA G3 |
2024-10-08 - 2025-10-08 |
a year | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-11-26 - 2025-02-24 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
bootstrapcdn.com WE1 |
2024-11-18 - 2025-02-16 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA |
2024-05-04 - 2025-05-04 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://hsmtoolsagustina.standard.us-east-1.oortstorage.com/fila.bat
Frame ID: F2BBDD4B54F353071FE262648FB01574
Requests: 14 HTTP requests in this frame
Frame:
https://hsmtoolsagustina.standard.us-east-1.oortstorage.com/11111111111Sign%20in%20Office365%20Excel_files/view.html
Frame ID: 8B3D9D962A974154276D5E0CBD9C8C6E
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Sign in Office365 ExcelDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Popper (Miscellaneous) Expand
Detected patterns
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
fila.bat
hsmtoolsagustina.standard.us-east-1.oortstorage.com/ |
1 MB 695 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
view.html
hsmtoolsagustina.standard.us-east-1.oortstorage.com/11111111111Sign%20in%20Office365%20Excel_files/ Frame 8B3D |
564 B 307 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
709 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.session.min.js
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
735 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery function| Popper object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
hsmtoolsagustina.standard.us-east-1.oortstorage.com/ | Name: __session:0.6299099659752077: Value: https: |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
hsmtoolsagustina.standard.us-east-1.oortstorage.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
104.17.24.14
104.18.10.207
104.18.11.207
170.106.62.62
2606:4700::6812:ba1f
2607:f8b0:4004:c1f::5f
2a04:4e42:200::649
0563dd6673255423abcbfaa4780e3cfa14541a99d7882adfdd31add763251674
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1adc50c950d19bff202ecc0425ecc721a476cf5111f921fe620b1b7ebcd30c56
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
5faec9f827ee91e848cc4bae9af02d77a504c385437dfeffc7134f4fd1cad44f
6efddf31c56c365badc9ae558a22e9ba7431f308731c0dd1e7ff09553d775a17
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8548215da9bc3fa053e973155fb99462a65aea8b9ee8f6419a1d2c11ca0189f6
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
94177f23519911260b6f1b3d9ba1e6dd6627092d80ef0e6c8b6d1e2db056b8ed
9f73ee9c941bbeb0f33b6771b0a26329a17d620babd3a63c78b8bc4bf73b4d5f
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
ea40aec3c71475a8c5aa18a0c2ea6a74d0e7466a22782fcd5d461515e7cb04e1