siliconoffice.biz - urlscan.io

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 108.178.4.234, located in United States and belongs to SINGLEHOP-LLC, US. The main domain is siliconoffice.biz.
TLS certificate: Issued by R11 on December 3rd 2024. Valid for: 3 months.

This is the only time siliconoffice.biz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	108.178.4.234 108.178.4.234	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
2	151.101.66.132 151.101.66.132	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4006:816::200a	15169 (GOOGLE) (GOOGLE)
5	4

1 108.178.4.234 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: viola.superdnssite.com

siliconoffice.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.66.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.glitch.global	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:816::200a (United States)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	glitch.global cdn.glitch.global — Cisco Umbrella Rank: 161832	175 KB
1	googleapis.com firebasestorage.googleapis.com — Cisco Umbrella Rank: 7004	118 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 847	31 KB
1	siliconoffice.biz siliconoffice.biz	3 KB
5	4

	Domain	Requested by
2	cdn.glitch.global	siliconoffice.biz
1	firebasestorage.googleapis.com	siliconoffice.biz
1	code.jquery.com	siliconoffice.biz
1	siliconoffice.biz
5	4

This site contains no links.

Subject Issuer	Validity	Valid
siliconoffice.biz R11	`2024-12-03` - `2025-03-03`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
cdn.glitch.global R10	`2024-11-26` - `2025-02-24`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://siliconoffice.biz/CHECK_PDF_Document.htm
Frame ID: D3CD64D87AFAE47FB71966D15F7BD644
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PDF ONLINE DOCUMENT

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

326 kB
Transfer

583 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request CHECK_PDF_Document.htm Show response
siliconoffice.biz/ 30 KB
3 KB 647ms
123ms Document
text/html 108.178.4.234
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://siliconoffice.biz/CHECK_PDF_Document.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.178.4.234 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: viola.superdnssite.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 9b96d424332d9a24abc14726b5c368030a6706218c2026fdf0104e03e978fa91

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 3387
content-type: text/html
date: Sat, 21 Dec 2024 06:02:32 GMT
etag: "076243f253ddb1:0"
last-modified: Fri, 22 Nov 2024 21:26:52 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 231ms
75ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: siliconoffice.biz
URL: https://siliconoffice.biz/CHECK_PDF_Document.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://siliconoffice.biz/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15d9d"
age: 3284243
x-cache: HIT, HIT
date: Sat, 21 Dec 2024 06:02:33 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 450316, 6064
x-served-by: cache-lga21931-LGA, cache-lax-kwhp1940102-LAX
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1734760953.032409,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30875
server: nginx

GET
H2 200 pdf-logo.png
cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/ 174 KB
175 KB 238ms
76ms Image
image/png 151.101.66.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/pdf-logo.png?v=1703176079035

Requested by

Host: siliconoffice.biz
URL: https://siliconoffice.biz/CHECK_PDF_Document.htm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://siliconoffice.biz/

Response headers

etag: "2be243eaa597e9442b712456427c25d2"
age: 1361465
access-control-allow-methods: GET, HEAD, POST
x-cache: HIT, HIT
date: Sat, 21 Dec 2024 06:02:33 GMT
last-modified: Thu, 21 Dec 2023 16:27:58 GMT
x-served-by: cache-iad-kiad7000134-IAD, cache-lax-kwhp1940073-LAX
x-cache-hits: 3235, 0
content-type: image/png
x-amz-id-2: HgoGnUSn4pyU7pG6ELoNo2JaOqWeQKONXxWa4WIchnL35qfrES80pDNMRYU5lsOMmPVY8kF2Vu7kN3+uhe//IprjwZVUW4bT/78WLuvyRS8=
content-security-policy: script-src 'none'
cache-control: max-age=31536000
x-timer: S1734760953.037724,VS0,VE1
via: 1.1 varnish, 1.1 varnish
x-amz-request-id: 04DW0RMVGH5HVEZX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 178166
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 Adobe.png
firebasestorage.googleapis.com/v0/b/png-images-481bb.appspot.com/o/ 117 KB
118 KB 693ms
396ms Image
image/png 2607:f8b0:4006:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firebasestorage.googleapis.com/v0/b/png-images-481bb.appspot.com/o/Adobe.png?alt=media&token=a3813f1f-169a-48a6-8172-22d091f87e7c
Requested by: Host: siliconoffice.biz
URL: https://siliconoffice.biz/CHECK_PDF_Document.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:816::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: c6a474bcc89bf85d1ccaa821fb3d9c8fca16b18a6a5ba8d217c4e3166dec80e1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://siliconoffice.biz/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=sw/mPA==, md5=xlfX52miV8LthpgCkv5N3A==
etag: "c657d7e769a257c2ed86980292fe4ddc"
x-goog-stored-content-encoding: identity
expires: Sat, 21 Dec 2024 06:02:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 119844
date: Sat, 21 Dec 2024 06:02:33 GMT
last-modified: Wed, 10 Apr 2024 11:51:57 GMT
content-type: image/png
content-disposition: inline; filename*=utf-8''Adobe.png
x-guploader-uploadid: AFiumC4-oCJfQpSlmAzfJuaBPokeKkOOwekNBlFVd_E_4iImC5kNkEAFLcpVWiEfwVgs2jjLLDmWQJE
cache-control: private, max-age=0
x-goog-storage-class: STANDARD
x-goog-meta-firebasestoragedownloadtokens: a3813f1f-169a-48a6-8172-22d091f87e7c
accept-ranges: bytes
x-goog-generation: 1712749917474086
content-length: 119844
server: UploadServer

GET
H2 200 pdf-logo.png
cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/ 174 KB
0 0ms
0ms Other
image/png 151.101.66.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/pdf-logo.png?v=1703176079035

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://siliconoffice.biz/

Response headers

etag: "2be243eaa597e9442b712456427c25d2"
age: 1361465
access-control-allow-methods: GET, HEAD, POST
x-cache: HIT, HIT
date: Sat, 21 Dec 2024 06:02:33 GMT
last-modified: Thu, 21 Dec 2023 16:27:58 GMT
x-served-by: cache-iad-kiad7000134-IAD, cache-lax-kwhp1940073-LAX
x-cache-hits: 3235, 0
content-type: image/png
x-amz-id-2: HgoGnUSn4pyU7pG6ELoNo2JaOqWeQKONXxWa4WIchnL35qfrES80pDNMRYU5lsOMmPVY8kF2Vu7kN3+uhe//IprjwZVUW4bT/78WLuvyRS8=
content-security-policy: script-src 'none'
cache-control: max-age=31536000
x-timer: S1734760953.037724,VS0,VE1
via: 1.1 varnish, 1.1 varnish
x-amz-request-id: 04DW0RMVGH5HVEZX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 178166
server: AmazonS3
x-amz-server-side-encryption: AES256

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://siliconoffice.biz/CHECK_PDF_Document.htm Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://siliconoffice.biz/CHECK_PDF_Document.htm Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	verbose	URL: https://siliconoffice.biz/CHECK_PDF_Document.htm Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.glitch.global
code.jquery.com
firebasestorage.googleapis.com
siliconoffice.biz
108.178.4.234
151.101.66.132
2607:f8b0:4006:816::200a
2a04:4e42:200::649
288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327
9b96d424332d9a24abc14726b5c368030a6706218c2026fdf0104e03e978fa91
c6a474bcc89bf85d1ccaa821fb3d9c8fca16b18a6a5ba8d217c4e3166dec80e1
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

siliconoffice.biz Open in urlscan Pro 108.178.4.234 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

326 kBTransfer

583 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

siliconoffice.biz Open in urlscan Pro
108.178.4.234 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

326 kB
Transfer

583 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!