urlscan.io logo urlscan.io
SecurityTrails logo

ia601501.us.archive.org Open in urlscan Pro
207.241.227.111  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ia601501.us.archive.org/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/index.htm?c=@@@1@08a@2@020a@0@00a@1@015a@...
Submission: On February 16 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 207.241.227.111, located in San Francisco, United States and belongs to INTERNET-ARCHIVE, US. The main domain is ia601501.us.archive.org.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on December 23rd 2019. Valid for: 2 years.
This is the only time ia601501.us.archive.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 207.241.227.111 7941 (INTERNET-...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
2 3
Apex Domain
Subdomains		 Transfer
1 jquery.com
code.jquery.com
30 KB
1 archive.org
ia601501.us.archive.org
335 KB
0 Failed
function sub() { [native code] }. Failed
2 3
Domain Requested by
1 code.jquery.com ia601501.us.archive.org
1 ia601501.us.archive.org
0 truncated Failed ia601501.us.archive.org
2 3

This site contains no links.

Subject Issuer Validity Valid
*.us.archive.org
Go Daddy Secure Certificate Authority - G2		 2019-12-23 -
2022-02-21		 2 years crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ia601501.us.archive.org/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/index.htm?c=@@@1@08a@2@020a@0@00a@1@015a@05a.@08a@1@02a@02a@019a@@@@011a@2@1@02a@09a@3@010a@015a.@3@013a@04a
Frame ID: 7166BC42B6DCABBD626C482A0EFB2D94
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

364 kB
Transfer

645 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.htm
ia601501.us.archive.org/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/ 		554 KB
335 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ia601501.us.archive.org/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/index.htm?c=@@@1@08a@2@020a@0@00a@1@015a@05a.@08a@1@02a@02a@019a@@@@011a@2@1@02a@09a@3@010a@015a.@3@013a@04a
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.241.227.111 San Francisco, United States, ASN7941 (INTERNET-ARCHIVE, US),
Reverse DNS
ia601501.us.archive.org
Software
nginx/1.16.1 (Ubuntu) /
Resource Hash
ca50efe0ca3fbdda587fd5f2da4e48d11214b5a8a21ad7280aff2229356b2d4c
Security Headers
Name Value
Strict-Transport-Security max-age=15724800

Request headers

:method
GET
:authority
ia601501.us.archive.org
:scheme
https
:path
/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/index.htm?c=@@@1@08a@2@020a@0@00a@1@015a@05a.@08a@1@02a@02a@019a@@@@011a@2@1@02a@09a@3@010a@015a.@3@013a@04a
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx/1.16.1 (Ubuntu)
date
Tue, 16 Feb 2021 21:23:51 GMT
content-type
text/html; charset=utf-8
last-modified
Tue, 16 Feb 2021 20:22:19 GMT
etag
W/"602c297b-8a7a7"
strict-transport-security
max-age=15724800
expires
Wed, 17 Feb 2021 03:23:51 GMT
cache-control
max-age=21600
content-encoding
gzip
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		513 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		0
0
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: ia601501.us.archive.org
URL: https://ia601501.us.archive.org/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/index.htm?c=@@@1@08a@2@020a@0@00a@1@015a@05a.@08a@1@02a@02a@019a@@@@011a@2@1@02a@09a@3@010a@015a.@3@013a@04a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer
https://ia601501.us.archive.org/14/items/oauthdMJd9nO7DsZduz_wisMyzzvzzaUiEgxFLAq0zOPN/index.htm?c=@@@1@08a@2@020a@0@00a@1@015a@05a.@08a@1@02a@02a@019a@@@@011a@2@1@02a@09a@3@010a@015a.@3@013a@04a
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 16 Feb 2021 21:23:52 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1538f"
vary
Accept-Encoding
x-hw
1613510632.dop210.fr8.t,1613510632.cds260.fr8.hc,1613510632.cds002.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30288
truncated
/ 		915 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		915 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
truncated
URL
data:truncated

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery string| $c string| $current_email function| decodeCustom function| isValidEmail function| getUrlParameter string| currentEmail object| ListEntries number| passwordAttempts function| handleFormSubmit function| login function| validateEmail function| isValidPassword function| toggleUsernameError function| togglePasswordError function| strRandom function| getValidatorUrl string| $i

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800