![](/screenshots/67812799-1424-43fd-90e0-d09a928dced3.png)
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
Open in
urlscan Pro
172.233.33.244
Malicious Activity!
Public Scan
Effective URL: https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html
Submission: On August 13 via api from US — Scanned from IT
Summary
TLS certificate: Issued by R11 on August 1st 2024. Valid for: 3 months.
This is the only time documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 3.233.34.230 3.233.34.230 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 52.71.28.102 52.71.28.102 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 172.67.156.31 172.67.156.31 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 172.233.33.244 172.233.33.244 | 63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 104.18.95.41 104.18.95.41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.67.194.21 172.67.194.21 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.2.137 151.101.2.137 | 54113 (FASTLY) (FASTLY) | |
11 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-233-34-230.compute-1.amazonaws.com
shared.outlook.inky.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-28-102.compute-1.amazonaws.com
urldefense.proofpoint.com |
ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: osproxy-5.ams2.nl.prod.linode.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
linodeobjects.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
7 KB |
3 |
cloudflare.com
1 redirects
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 challenges.cloudflare.com — Cisco Umbrella Rank: 3877 |
30 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
31 KB |
1 |
com.ru
novateche.com.ru |
124 KB |
1 |
hotellimaran.com
hotellimaran.com |
880 B |
1 |
proofpoint.com
1 redirects
urldefense.proofpoint.com — Cisco Umbrella Rank: 31639 |
235 B |
1 |
inky.com
1 redirects
shared.outlook.inky.com — Cisco Umbrella Rank: 391216 |
748 B |
0 |
google.com
Failed
google.com Failed |
|
11 | 8 |
Domain | Requested by | |
---|---|---|
4 | documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
hotellimaran.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
2 | challenges.cloudflare.com |
1 redirects
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | code.jquery.com |
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | novateche.com.ru |
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | cdnjs.cloudflare.com |
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | hotellimaran.com | |
1 | urldefense.proofpoint.com | 1 redirects |
1 | shared.outlook.inky.com | 1 redirects |
0 | google.com Failed |
hotellimaran.com
|
11 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
hotellimaran.com WE1 |
2024-07-27 - 2024-10-25 |
3 months | crt.sh |
nl-ams-1.linodeobjects.com R11 |
2024-08-01 - 2024-10-30 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
novateche.com.ru WE1 |
2024-08-02 - 2024-10-31 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html
Frame ID: 96D0A73A2DCF52CC350109A995729E82
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/67812799-1424-43fd-90e0-d09a928dced3.png)
Page Title
tailgaterPage URL History Show full URLs
-
https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVkEtvozAUhf9KxYLVEIx5GCqhNiFNpt...
HTTP 303
https://urldefense.proofpoint.com/v2/url?u=https-3A__hotellimaran.com_tmp_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrw... HTTP 302
https://hotellimaran.com/tmp/ Page URL
- https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVkEtvozAUhf9KxYLVEIx5GCqhNiFNptOSx6RKaDfIwTYQDCbYIW2q-e8Tshhpdvfe7-gc3fOtnTqu3d9phVKtvDfN60ooo42ko7YTgrWibNQoE7XZwwE-nMKb1LDHaVoIRTkva9zhZtCkqm5TnYTTczzDaz0L6Wn-IVWG36ac92X9tPD36JB05-OSGb07TiPS5s2WlWUc6104SY-LC7qgbH7Ik32fS1CAjYri1c7hLwntDeod3DQDKRzrddj31mrxu_u5MxLIn4vklLxWbIXtsxdNYhSp5eLTY2vL_6z41HAqkWy2r9Dl0XMt1ruifNJlKAzaBvj9Mnc_Nl_2jPrVL0vmUy_a-tvga1mUR9i_LeVsomKdhtqPO60aumqoEl3OFEII2kFg5uz6f8VEpx7_TbghUjTy1pxFCPV8Zw-wBxAJMPMBCxwbMB8Ci0BgWlcfF3m25YwgHGLoLQbzq4N4xBdFM1zXg9cAyQD_O_75C-4tliU.MEUCIGCTUJYQT5-VanQzq1VIvFGhfyGZtavaJnUbdai61s34AiEA_BgUSURRBn4yGaiUonx_tjHhD3-L9hRZnt-UwOnBEKg
HTTP 303
https://urldefense.proofpoint.com/v2/url?u=https-3A__hotellimaran.com_tmp_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=B_qNz7z7cGjgXbvgs0h0StCMPW4lKXev-e6j5_c0_2A&m=vv1PNRrHW-X2lIhXuXLkfPa3w6CBM7CtONx6fQ18xklD-4koXSVL25lCImoQWhiE&s=o-ep9aYzG5ZSy3Fe8kJ1sgD6CV8V9yOhiq2vTOsFBtM&e= HTTP 302
https://hotellimaran.com/tmp/ Page URL
- https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVkEtvozAUhf9KxYLVEIx5GCqhNiFNptOSx6RKaDfIwTYQDCbYIW2q-e8Tshhpdvfe7-gc3fOtnTqu3d9phVKtvDfN60ooo42ko7YTgrWibNQoE7XZwwE-nMKb1LDHaVoIRTkva9zhZtCkqm5TnYTTczzDaz0L6Wn-IVWG36ac92X9tPD36JB05-OSGb07TiPS5s2WlWUc6104SY-LC7qgbH7Ik32fS1CAjYri1c7hLwntDeod3DQDKRzrddj31mrxu_u5MxLIn4vklLxWbIXtsxdNYhSp5eLTY2vL_6z41HAqkWy2r9Dl0XMt1ruifNJlKAzaBvj9Mnc_Nl_2jPrVL0vmUy_a-tvga1mUR9i_LeVsomKdhtqPO60aumqoEl3OFEII2kFg5uz6f8VEpx7_TbghUjTy1pxFCPV8Zw-wBxAJMPMBCxwbMB8Ci0BgWlcfF3m25YwgHGLoLQbzq4N4xBdFM1zXg9cAyQD_O_75C-4tliU.MEUCIGCTUJYQT5-VanQzq1VIvFGhfyGZtavaJnUbdai61s34AiEA_BgUSURRBn4yGaiUonx_tjHhD3-L9hRZnt-UwOnBEKg HTTP 303
- https://urldefense.proofpoint.com/v2/url?u=https-3A__hotellimaran.com_tmp_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=B_qNz7z7cGjgXbvgs0h0StCMPW4lKXev-e6j5_c0_2A&m=vv1PNRrHW-X2lIhXuXLkfPa3w6CBM7CtONx6fQ18xklD-4koXSVL25lCImoQWhiE&s=o-ep9aYzG5ZSy3Fe8kJ1sgD6CV8V9yOhiq2vTOsFBtM&e= HTTP 302
- https://hotellimaran.com/tmp/
- https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
- https://challenges.cloudflare.com/turnstile/v0/b/cc21665cd7b9/api.js
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
hotellimaran.com/tmp/ Redirect Chain
|
881 B 880 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
challenges.cloudflare.com/turnstile/v0/b/cc21665cd7b9/ Redirect Chain
|
44 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
novateche.com.ru// |
164 KB 124 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
258 B 490 B |
Other
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
,
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
258 B 258 B |
Image
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
,
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
258 B 258 B |
Image
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
496 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
231 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- google.com
- URL
- https://google.com/
- Domain
- google.com
- URL
- https://google.com/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| CryptoJS object| turnstile function| fabulous function| dairywoman function| $ function| jQuery function| gB string| dandified function| ablate function| uF function| mafiosi function| quarrelsome function| laddie function| narcissus function| b2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
shared.outlook.inky.com/ | Name: AWSALB Value: qx7pUhPLxh9ijphTg3/evB2zlE8OT/at+29+uyHngbrI5ft10di+9yCPKTuErT/pA8xVAVN5MCw7CV1vqf+05zK2XX23GVLmon/FgBgluSt1SIuAkbKlXHBMz/pd |
|
shared.outlook.inky.com/ | Name: AWSALBCORS Value: qx7pUhPLxh9ijphTg3/evB2zlE8OT/at+29+uyHngbrI5ft10di+9yCPKTuErT/pA8xVAVN5MCw7CV1vqf+05zK2XX23GVLmon/FgBgluSt1SIuAkbKlXHBMz/pd |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
challenges.cloudflare.com
code.jquery.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
google.com
hotellimaran.com
novateche.com.ru
shared.outlook.inky.com
urldefense.proofpoint.com
google.com
104.17.25.14
104.18.95.41
151.101.2.137
172.233.33.244
172.67.156.31
172.67.194.21
3.233.34.230
52.71.28.102
06e3de6cef250d7b939ebd88b6adaaf60dea1d3f2ceda97b3745e4edb819d773
09969ff98103700563d510b68eb73e8fc668f2d4005b58cd5f06dcb21817e140
1005b6d8b77ade3a1d41110d0d7d5d8b7c78c67216674723e0c9ad50f202c879
18fb69e74d40c9203eb732e5ba423b45fcf1d2b48f6d38efe87a08bb686fd94e
3d158bbda3f62dc1fbc4286b6eb9b63f683f41fe974fc6dea2e0cbe84dcba98a
4623ca999744624a837f54806a96901fb05352c84addb1208c382e12733bbe6f
4d88618abd8d28ca19625380b7ae28a1e1086063ce7c66fc3257464f5f5b4c71
6a5d79788fa75b6e05daf75d919699e8ce58c9120cf6959191c50cdadba92885
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
906f71d6d2948b4ac632811cce156c73e0d73a9045ee83a42822824de2b0bb3f
e9e7b808d5f429a2f704eeb999d572fe2884ce9f763823c021723d7b3ac90fbc
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
f4eb87520f5ea0feaadaa6d7552f2456c4007271771df9a7930bf1ef4e7b5841
fe4c1d8917b395d0f058f165778769d4dd7a214f2b3d226c50b992d593f602e7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e