objectstorage.me-dubai-1.oraclecloud.com Open in urlscan Pro
134.70.148.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://r20.rs6.net/tn.jsp?t=qcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http%3A%2F%2Fbernie.colpitts.updatemygpsdevi...
Effective URL:
https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Submission Tags: falconsandbox
Submission: On June 21 via api (June 21st 2022, 9:12:18 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 8 HTTP transactions. The main IP is 134.70.148.1, located in Dubai, United Arab Emirates and belongs to ORACLE-BMC-31898, US. The main domain is objectstorage.me-dubai-1.oraclecloud.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 1st 2021. Valid for: a year.

This is the only time objectstorage.me-dubai-1.oraclecloud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	208.75.122.11 208.75.122.11	40444 (ASN-CC) (ASN-CC)
1	139.59.36.205 139.59.36.205	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	134.70.148.1 134.70.148.1	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2620:1ec:40::45 2620:1ec:40::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (STACKPATH...) (STACKPATH-CDN)
8	5

1 208.75.122.11 (United States) 1 redirects

ASN40444 (ASN-CC, US)
PTR: rs6.net

r20.rs6.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.59.36.205 (Bengaluru, India)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: server.digiplanetary.com

bernie.colpitts.updatemygpsdevice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.70.148.1 (Dubai, United Arab Emirates)

ASN31898 (ORACLE-BMC-31898, US)

objectstorage.me-dubai-1.oraclecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:40::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1309	4 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 686	30 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 444	8 KB
1	oraclecloud.com objectstorage.me-dubai-1.oraclecloud.com	108 KB
1	updatemygpsdevice.com bernie.colpitts.updatemygpsdevice.com	2 KB
1	rs6.net 1 redirects r20.rs6.net — Cisco Umbrella Rank: 6913	392 B
8	6

	Domain	Requested by
4	aadcdn.msauth.net	objectstorage.me-dubai-1.oraclecloud.com
1	code.jquery.com	objectstorage.me-dubai-1.oraclecloud.com
1	cdn.jsdelivr.net	objectstorage.me-dubai-1.oraclecloud.com
1	objectstorage.me-dubai-1.oraclecloud.com	bernie.colpitts.updatemygpsdevice.com
1	bernie.colpitts.updatemygpsdevice.com
1	r20.rs6.net	1 redirects
8	6

This site contains no links.

Subject Issuer	Validity	Valid
objectstorage.me-dubai-1.oraclecloud.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-01` - `2022-07-20`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Frame ID: BED67747FD472F9D7D4BF4E3FFF056D1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

https://r20.rs6.net/tn.jsp?t=qcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http%3A%2F%2Fbernie.colp... HTTP 302
http://bernie.colpitts.updatemygpsdevice.com/?id=bernie.colpitts@onsemi.com Page URL
https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

8
Requests

88 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

152 kB
Transfer

222 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://r20.rs6.net/tn.jsp?t=qcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http%3A%2F%2Fbernie.colpitts.updatemygpsdevice.com%3Fid%3Dbernie.colpitts%40onsemi.com HTTP 302
http://bernie.colpitts.updatemygpsdevice.com/?id=bernie.colpitts@onsemi.com Page URL
https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://r20.rs6.net/tn.jsp?t=qcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http%3A%2F%2Fbernie.colpitts.updatemygpsdevice.com%3Fid%3Dbernie.colpitts%40onsemi.com HTTP 302
http://bernie.colpitts.updatemygpsdevice.com/?id=bernie.colpitts@onsemi.com

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
bernie.colpitts.updatemygpsdevice.com/
Redirect Chain

https://r20.rs6.net/tn.jsp?t=qcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http%3A%2F%2Fbernie.colpitts.updatemygpsdevice.com%3Fid%3Dbernie.colpitts%40onsemi.com
http://bernie.colpitts.updatemygpsdevice.com/?id=bernie.colpitts@onsemi.com

7 KB
2 KB

1584ms
418ms

Document
text/html

139.59.36.205
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://bernie.colpitts.updatemygpsdevice.com/?id=bernie.colpitts@onsemi.com
Protocol: HTTP/1.1
Server: 139.59.36.205 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: server.digiplanetary.com
Software: Apache /
Resource Hash: da5c50281a5ed7357d21ea2bde761f143870fdbe93137e648680960282619dd4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1963
Content-Type: text/html; charset=UTF-8
Date: Tue, 21 Jun 2022 21:12:13 GMT
Expires: Tue, 21 Jun 2022 21:12:13 GMT
Keep-Alive: timeout=10
Server: Apache
Vary: Accept-Encoding

Redirect headers

Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate, no-cache="Set-Cookie"
Connection: close
Content-Length: 0
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 21 Jun 2022 21:12:12 GMT
Location: http://bernie.colpitts.updatemygpsdevice.com?id=bernie.colpitts@onsemi.com
P3P: CP="CAO DSP TAIa OUR NOR UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 200
OK Primary Request recovery.html Show response
objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/ 107 KB
108 KB 643ms
160ms Document
text/html 134.70.148.1
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Requested by: Host: bernie.colpitts.updatemygpsdevice.com
URL: http://bernie.colpitts.updatemygpsdevice.com/?id=bernie.colpitts@onsemi.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.70.148.1 Dubai, United Arab Emirates, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: /
Resource Hash: 16c1163ede6c87d270602c7a0f2a0bf13848618a9a81c4a47953380de710ac73

Request headers

Referer: http://bernie.colpitts.updatemygpsdevice.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 109514
Content-Type: text/html
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-methods: POST,PUT,GET,HEAD,DELETE,OPTIONS
access-control-allow-origin: *
access-control-expose-headers: accept-ranges,access-control-allow-credentials,access-control-allow-methods,access-control-allow-origin,content-length,content-md5,content-type,date,etag,last-modified,opc-client-info,opc-request-id,storage-tier,version-id,x-api-id
content-md5: DpvcA6xolZbe4sAwhaO2Fg==
date: Tue, 21 Jun 2022 21:12:14 GMT
etag: 2b7db78a-b221-423d-be27-fc2086a9864d
last-modified: Tue, 21 Jun 2022 11:53:35 GMT
opc-request-id: dxb-1:67muxLKtMkisA4aJvMViPvWLVy2wjcULL21sFdA8dPRm39MzDgY4Oxmpnkag0DcU
storage-tier: Standard
version-id: 2557adc9-d608-41f7-aeb9-71ddf45f68ab
x-api-id: native

GET
H2 200 axios.min.js Show response
cdn.jsdelivr.net/npm/axios/dist/ 20 KB
8 KB 39ms
21ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Requested by

Host: objectstorage.me-dubai-1.oraclecloud.com
URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://objectstorage.me-dubai-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 21:12:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12668
x-jsd-version: 0.27.2
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19173-FRA, cache-iad-kiad7000140-IAD
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"511b-FCNxITHKHBRxCXquG/QTMqrMtJE"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3dRKhX4ywPs4HmZw1OD6pr1VvcOB08fEh8ak75fgmigSh74%2FzruYlBppNbn5ipqTGKvcI5NXwwlMTtMOPQhDKt3ZaPM6R4puWAx8nyuq9OmXj%2FlMmG0kzDNK8cd0aYAoxgabyAMcH2twEJ%2F8a%2Bc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 71efbdc4fabc690f-FRA
access-control-expose-headers: *

GET
H2 200 microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
aadcdn.msauth.net/ests/2.1/content/images/ 1 KB
1 KB 78ms
9ms Image
image/png 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
Requested by: Host: objectstorage.me-dubai-1.oraclecloud.com
URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://objectstorage.me-dubai-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 21 Jun 2022 21:12:14 GMT
x-azure-ref-originshield: 0YyOyYgAAAABj9NEVoLyQRqYrN1B3AYluRlJBMjMxMDUwNDE4MDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5: 7ZyesNzhfXUr7eprWs2m2Q==
x-cache: TCP_HIT
content-length: 1057
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:31 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D641015620C409
x-azure-ref: 0LzSyYgAAAADFX2CFuXoSTJMUGl8US3DWRlJBMjMxMDUwNDIwMDIzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 32b3053f-501e-0066-5056-838f5d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
aadcdn.msauth.net/ests/2.1/content/images/ 240 B
900 B 77ms
9ms Image
image/png 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
Requested by: Host: objectstorage.me-dubai-1.oraclecloud.com
URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://objectstorage.me-dubai-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 21 Jun 2022 21:12:14 GMT
x-azure-ref-originshield: 0ZCOyYgAAAACOiA95dCd3QbJFeHDi9zA9RlJBMjMxMDUwNDE4MDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5: fMCW2mqi26P4H8wcgmIVfA==
x-cache: TCP_HIT
content-length: 240
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:10 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D64101494D74DC
x-azure-ref: 0LzSyYgAAAAAmfPNaUZD2TJ3nFiylovX7RlJBMjMxMDUwNDIwMDIzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: ebb0691a-801e-001b-0d47-81a246000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
aadcdn.msauth.net/ests/2.1/content/images/ 207 B
542 B 78ms
10ms Image
image/png 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
Requested by: Host: objectstorage.me-dubai-1.oraclecloud.com
URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://objectstorage.me-dubai-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 21 Jun 2022 21:12:14 GMT
x-azure-ref-originshield: 0ZCOyYgAAAADap6OiBi0MQIOGG2ce/zlMRlJBMjMxMDUwNDE4MDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5: CtQwhIAP2LUKJXa1FzdG/g==
x-cache: TCP_HIT
content-length: 207
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:24 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D6410151EBB082
x-azure-ref: 0LzSyYgAAAAAfihugTJ2uR4jF45EPWI8wRlJBMjMxMDUwNDIwMDIzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 16590338-f01e-0040-0556-83e462000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 67ms
22ms Script
application/javascript 2001:4de0:ac18::1:a:3b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: objectstorage.me-dubai-1.oraclecloud.com
URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://objectstorage.me-dubai-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Tue, 21 Jun 2022 21:12:15 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-152b5"
vary: Accept-Encoding
x-hw: 1655845935.dop117.am5.t,1655845935.cds256.am5.hn,1655845935.cds215.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30070

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/ests/2.1/content/images/backgrounds/ 2 KB
1 KB 77ms
11ms Image
image/svg+xml 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: objectstorage.me-dubai-1.oraclecloud.com
URL: https://objectstorage.me-dubai-1.oraclecloud.com/n/ax163p6wpz8g/b/bucket-20220621-1341/o/recovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://objectstorage.me-dubai-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 21 Jun 2022 21:12:14 GMT
content-encoding: gzip
x-azure-ref-originshield: 04LOwYgAAAACyGtjlUhU4T5398mZ7jLRwRlJBMjMxMDUwNDE3MDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5: DhdidjYrlCeaRJJRG/y9mA==
x-cache: TCP_HIT
content-length: 673
x-ms-lease-status: unlocked
last-modified: Thu, 13 Feb 2020 02:05:12 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D7B0292911C366
x-azure-ref: 0LzSyYgAAAAB2KG3ol8/iS7qEladgGpPiRlJBMjMxMDUwNDIwMDIzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: dcc6e0ce-c01e-000f-0b1c-81be6c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
bernie.colpitts.updatemygpsdevice.com
cdn.jsdelivr.net
code.jquery.com
objectstorage.me-dubai-1.oraclecloud.com
r20.rs6.net
134.70.148.1
139.59.36.205
2001:4de0:ac18::1:a:3b
208.75.122.11
2606:4700::6810:5614
2620:1ec:40::45
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
16c1163ede6c87d270602c7a0f2a0bf13848618a9a81c4a47953380de710ac73
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
da5c50281a5ed7357d21ea2bde761f143870fdbe93137e648680960282619dd4
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

objectstorage.me-dubai-1.oraclecloud.com Open in urlscan Pro 134.70.148.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

50 %IPv6

6 Domains

6 Subdomains

5 IPs

4 Countries

152 kBTransfer

222 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

0 Cookies

Indicators

objectstorage.me-dubai-1.oraclecloud.com Open in urlscan Pro
134.70.148.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

152 kB
Transfer

222 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!