urlscan.io logo urlscan.io
SecurityTrails logo

orbitauk.com Open in urlscan Pro
91.238.164.172  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://orbitauk.com/Leg/C_Update.htm
Submission Tags: @phish_report
Submission: On January 24 via api from FI — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 91.238.164.172, located in United Kingdom and belongs to RACKSRV, GB. The main domain is orbitauk.com.
TLS certificate: Issued by R3 on December 12th 2023. Valid for: 3 months.
This is the only time orbitauk.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: TSB Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 91.238.164.172 52148 (RACKSRV)
1 198.23.238.241 36352 (AS-COLOCR...)
1 2a04:4e42:600... 54113 (FASTLY)
2 146.75.116.193 54113 (FASTLY)
5 4
Apex Domain
Subdomains		 Transfer
2 imgur.com
i.imgur.com — Cisco Umbrella Rank: 7298
137 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 760
30 KB
1 wajageneral.co.tz
wajageneral.co.tz
29 KB
1 orbitauk.com
orbitauk.com
900 B
5 4
Domain Requested by
2 i.imgur.com wajageneral.co.tz
1 code.jquery.com wajageneral.co.tz
1 wajageneral.co.tz orbitauk.com
1 orbitauk.com
5 4

This site contains no links.

Subject Issuer Validity Valid
orbitauk.com
R3		 2023-12-12 -
2024-03-11		 3 months crt.sh
wajageneral.co.tz
cPanel, Inc. Certification Authority		 2023-12-20 -
2024-03-19		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.imgur.com
Sectigo RSA Domain Validation Secure Server CA		 2023-03-13 -
2024-03-12		 a year crt.sh

This page contains 1 frames:

Primary Page: https://orbitauk.com/Leg/C_Update.htm
Frame ID: F1B3BF739A2122BD802956CD2A8DEB54
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

198 kB
Transfer

254 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request C_Update.htm
orbitauk.com/Leg/ 		1 KB
900 B 		Document
General
Check archive.org
Download Go to
Full URL
https://orbitauk.com/Leg/C_Update.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.238.164.172 , United Kingdom, ASN52148 (RACKSRV, GB),
Reverse DNS
cp164172.hpdns.net
Software
LiteSpeed /
Resource Hash
086f16b5d888f988df4f8f098c64d698a91c3a9edb1e423efb7aaecd963f1ae4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
646
content-type
text/html
date
Wed, 24 Jan 2024 13:46:41 GMT
last-modified
Sun, 24 Dec 2023 08:19:16 GMT
server
LiteSpeed
vary
Accept-Encoding
jquery.js
wajageneral.co.tz/.well-known/pki-validation/uk/newfd/ 		28 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js
Requested by
Host: orbitauk.com
URL: https://orbitauk.com/Leg/C_Update.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
198.23.238.241 Metuchen, United States, ASN36352 (AS-COLOCROSSING, CA),
Reverse DNS
ewh1-host1.enwebhost.com
Software
Apache /
Resource Hash
463d798739b11a3ad82e66714ded9badfe10a14dbae0dc29af6e4ce265874ef8

Request headers

Referer
https://orbitauk.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Wed, 24 Jan 2024 13:46:42 GMT
Last-Modified
Sat, 23 Dec 2023 08:20:54 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
29108
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: wajageneral.co.tz
URL: https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://orbitauk.com/
Origin
https://orbitauk.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 24 Jan 2024 13:46:42 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
5501386
x-cache
HIT, HIT
content-length
30875
x-served-by
cache-lga21931-LGA, cache-lcy-eglc8600037-LCY
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1706104003.719531,VS0,VE0
etag
W/"28feccc0-15d9d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
5, 2305193
ffTjWfv.png
i.imgur.com/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/ffTjWfv.png
Requested by
Host: wajageneral.co.tz
URL: https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
09a2748730d6feb7a146d76c6cdfedd2d5394d63f908058fa8adaf29810bf849
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://orbitauk.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 24 Jan 2024 13:46:42 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
JFK50-P6
age
4326009
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
1425
x-served-by
cache-iad-kjyo7100117-IAD, cache-fra-eddf8230050-FRA
last-modified
Sun, 03 Dec 2023 02:45:29 GMT
server
cat factory 1.0
x-timer
S1706104003.750638,VS0,VE1
etag
"9b61cfa60e3a5813c2e5312142dacb37"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
yyI07Ds5I_WbTU4w4_dM0bXcEQp6O-g2zt33lW6MvWJphqSChH7EfQ==
x-cache-hits
796, 1
4R3ihSa.png
i.imgur.com/ 		135 KB
136 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/4R3ihSa.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
ffdf9b07597e8a8b26abaa3574ce1fc102e6f9e26ddb0afba7a117ed78fc14f9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://orbitauk.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 24 Jan 2024 13:46:42 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
JFK50-P6
age
1742553
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
138577
x-served-by
cache-iad-kcgs7200114-IAD, cache-fra-eddf8230050-FRA
last-modified
Sun, 03 Dec 2023 02:50:05 GMT
server
cat factory 1.0
x-timer
S1706104003.824727,VS0,VE2
etag
"b8c8b56f2a2a026a4213e230a02ab134"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
yUzUvLD4SlkDJ6PsXlrwIkKnrQSxpFhXTAtaQHmkdR8gGPNLHdkh1A==
x-cache-hits
298, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TSB Bank (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x2ecb function| _0x4b388b function| _0x1195 string| btokenbot string| chatidchat string| queryControlBase64 function| _0x32d4 function| _0x20e3 function| $ function| jQuery function| _0x3868 function| _0x29c4 function| _0x3eb682

0 Cookies

4 Console Messages

Source Level URL
Text
javascript warning URL: https://orbitauk.com/Leg/C_Update.htm(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://orbitauk.com/Leg/C_Update.htm(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js(Line 4)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://wajageneral.co.tz/.well-known/pki-validation/uk/newfd/jquery.js(Line 4)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.