stamentof401k.us-east-1.linodeobjects.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe6e:ce1a  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request humanresourcessendsout123jhbdgudjdbidhkhdd.html Show response stamentof401k.us-east-1.linodeobjects.com/	83 KB 83 KB	132ms 48ms	Document text/html	2600:3c03::f03c:92ff:fe6e:ce1a AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://stamentof401k.us-east-1.linodeobjects.com/humanresourcessendsout123jhbdgudjdbidhkhdd.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:3c03::f03c:92ff:fe6e:ce1a Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash 4794ec3ce420b6dca28a99dfafd6181a3ca9e5197ab0a28a190ea8e4ba85f597 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 84818 Content-Type text/html Date Thu, 21 Sep 2023 19:25:46 GMT ETag "a58f1cf6c9a01c4e1c990fed09e83fd5" Last-Modified Thu, 21 Sep 2023 16:01:31 GMT x-amz-request-id tx00000b03f18343ba25d00-00650c98ba-48b0d692-default x-rgw-object-type Normal
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	127ms 29ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: stamentof401k.us-east-1.linodeobjects.com URL: https://stamentof401k.us-east-1.linodeobjects.com/humanresourcessendsout123jhbdgudjdbidhkhdd.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers accept-language en-US,en;q=0.9 Referer https://stamentof401k.us-east-1.linodeobjects.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Thu, 21 Sep 2023 19:25:46 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 523744 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-nyc-kteb1890066-NYC last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1695324346.424145,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 77, 1949
POST H2	200	4a9666a.php Show response additionalsingsrateds.com/action/	330 KB 71 KB	1246ms 1065ms	XHR text/html	2606:4700:3037::6815:4837 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://additionalsingsrateds.com/action/4a9666a.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:4837 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c50fe673ec7ce45dc33d1981df7b921289c7f9af620b1f7e11b45360ca985db8 Request headers Accept */* Referer https://stamentof401k.us-east-1.linodeobjects.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Thu, 21 Sep 2023 19:25:47 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 pragma no-cache server cloudflare vary Accept-Encoding access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS content-type text/html; charset=UTF-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bH0tmLZv%2FI7vVla2vbiuCm3pJVI0%2Fu1fgK%2BAE6cfoKoGmSnpAbn6DmcTfbVB0EpsKyPxUClq6dIhkLm152mbvO1mlZpUMWe86JY8lnWatEnBKPj2o%2F64WwA1OasZnHWX3m%2BuM8C9D7XVUYw6kNhtEMgGRR4Gp4ni"}],"group":"cf-nel","max_age":604800} cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true cf-ray 80a4b22ea8324bc3-BUF expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 6 KB	152ms 37ms	Stylesheet text/css	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: stamentof401k.us-east-1.linodeobjects.com URL: https://stamentof401k.us-east-1.linodeobjects.com/humanresourcessendsout123jhbdgudjdbidhkhdd.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://stamentof401k.us-east-1.linodeobjects.com/ Origin https://stamentof401k.us-east-1.linodeobjects.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers date Thu, 21 Sep 2023 19:25:48 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 4456639 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5872 last-modified Thu, 22 Jun 2023 11:02:18 GMT server cloudflare cf-cdnjs-via cfworker/r2 etag "64942a3a-16f0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rXwdi%2BZL8NFYqvWMp7DYbTQ8GhCNSe7bhvC5ztsRzsJBklVTncxNycXU49XrUN2uIgiQltbzhM0jIT1vIBOj4G%2BfT6WF9jKI1b0RTIFq%2F7lqXzpJfr66uY%2FNHg3ij4RW7lBZ4GylnYHhd7p5EX8KzVjb"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 80a4b2373d294bd3-BUF expires Tue, 10 Sep 2024 19:25:48 GMT
GET H2	200	picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg aadcdn.msauth.net/shared/1.0/content/images/	250 B 514 B	210ms 41ms	Image image/svg+xml	2620:1ec:29:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg Requested by Host: stamentof401k.us-east-1.linodeobjects.com URL: https://stamentof401k.us-east-1.linodeobjects.com/humanresourcessendsout123jhbdgudjdbidhkhdd.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904 Request headers accept-language en-US,en;q=0.9 Referer https://stamentof401k.us-east-1.linodeobjects.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Sep 2023 19:25:47 GMT content-encoding gzip x-azure-ref-originshield 0zhMLZQAAAAA4CKvWBTe4SLRHrK1VL2HfTU5aMjIxMDYwNjExMDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 Ibdh8rH9N/WH1yIgI7CSdg== x-cache TCP_HIT content-length 199 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B8374CE7F93 x-azure-ref 0vJgMZQAAAAA+JlzGSEg5Ro912iqsKT3nTU5aMjIxMDYwNjEzMDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type image/svg+xml access-control-allow-origin * x-ms-request-id d79883ea-c01e-004b-39d9-ebc175000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg aadcdn.msauth.net/shared/1.0/content/images/	3 KB 2 KB	208ms 39ms	Image image/svg+xml	2620:1ec:29:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg Requested by Host: stamentof401k.us-east-1.linodeobjects.com URL: https://stamentof401k.us-east-1.linodeobjects.com/humanresourcessendsout123jhbdgudjdbidhkhdd.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1 Request headers accept-language en-US,en;q=0.9 Referer https://stamentof401k.us-east-1.linodeobjects.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Sep 2023 19:25:47 GMT content-encoding gzip x-azure-ref-originshield 0tzwLZQAAAAC1G/2WrMfXQo5HzBMtgWHBTU5aMjIxMDYwNjExMDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 XHrPYKKsqlxUvysuxtSE2A== x-cache TCP_HIT content-length 1173 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B83749623C9 x-azure-ref 0vJgMZQAAAACBhGeLcNg0S7NiVxI7fUO6TU5aMjIxMDYwNjEzMDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type image/svg+xml access-control-allow-origin * x-ms-request-id 28ec2b39-101e-008e-10f1-ebc23b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg aadcdn.msauth.net/shared/1.0/content/images/	7 KB 3 KB	208ms 40ms	Image image/svg+xml	2620:1ec:29:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg Requested by Host: stamentof401k.us-east-1.linodeobjects.com URL: https://stamentof401k.us-east-1.linodeobjects.com/humanresourcessendsout123jhbdgudjdbidhkhdd.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8 Request headers accept-language en-US,en;q=0.9 Referer https://stamentof401k.us-east-1.linodeobjects.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Sep 2023 19:25:47 GMT content-encoding gzip x-azure-ref-originshield 07AMLZQAAAAAbIwFdYsBhQJpP5ToH45JqTU5aMjIxMDYwNjExMDUxADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 nTculR1Fom7eLci0F6rk+A== x-cache TCP_HIT content-length 2407 x-ms-lease-status unlocked last-modified Fri, 11 Mar 2022 11:11:29 GMT etag 0x8DA034FE445C10D x-azure-ref 0vJgMZQAAAACy1uv1BPf1SI3Sl7h8LiN4TU5aMjIxMDYwNjEzMDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type image/svg+xml access-control-allow-origin * x-ms-request-id ecf7ae06-101e-0072-0ff3-e69377000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| _0x22c0a8 function| _0x4876b9 function| _0x527943 function| _0x44ac06 function| _0x34a683 object| scr string| stc function| _0x5804 function| _0x1057 function| $ function| jQuery string| em string| ur

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
additionalsingsrateds.com
cdnjs.cloudflare.com
code.jquery.com
stamentof401k.us-east-1.linodeobjects.com
2600:3c03::f03c:92ff:fe6e:ce1a
2606:4700:3037::6815:4837
2606:4700::6811:190e
2620:1ec:29:1::40
2a04:4e42:600::649
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
4794ec3ce420b6dca28a99dfafd6181a3ca9e5197ab0a28a190ea8e4ba85f597
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
c50fe673ec7ce45dc33d1981df7b921289c7f9af620b1f7e11b45360ca985db8