homefile.archive.us-east-1.oortech.com

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 170.106.201.213, located in Ashburn, United States and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is homefile.archive.us-east-1.oortech.com.
TLS certificate: Issued by TrustAsia RSA DV TLS CA G2 on March 28th 2024. Valid for: a year.

This is the only time homefile.archive.us-east-1.oortech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	170.106.201.213 170.106.201.213	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
2	151.101.66.132 151.101.66.132	54113 (FASTLY) (FASTLY)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4006:81f::200a	15169 (GOOGLE) (GOOGLE)
5	4

1 170.106.201.213 (Ashburn, United States)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

homefile.archive.us-east-1.oortech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.66.132 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.glitch.global	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81f::200a (United States)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	glitch.global cdn.glitch.global — Cisco Umbrella Rank: 432012	175 KB
1	googleapis.com firebasestorage.googleapis.com — Cisco Umbrella Rank: 6369	118 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1211	30 KB
1	oortech.com homefile.archive.us-east-1.oortech.com	3 KB
5	4

	Domain	Requested by
2	cdn.glitch.global	homefile.archive.us-east-1.oortech.com
1	firebasestorage.googleapis.com	homefile.archive.us-east-1.oortech.com
1	code.jquery.com	homefile.archive.us-east-1.oortech.com
1	homefile.archive.us-east-1.oortech.com
5	4

This site contains no links.

Subject Issuer	Validity	Valid
*.archive.us-east-1.oortech.com TrustAsia RSA DV TLS CA G2	`2024-03-28` - `2025-03-28`	a year	crt.sh
cdn.glitch.global R11	`2024-07-29` - `2024-10-27`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
upload.video.google.com WR2	`2024-08-05` - `2024-10-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://homefile.archive.us-east-1.oortech.com/dobe?signature=8cbbf8b48fa92625966bc6210ca77e00e95e8dc13289375ff061bd73a353d6b61afccae2c0c2e17fbdfe10bfb1b886df6bb422e4524cb20ae21f922f5d43740597109cbae50c61ee42f7be3468c699796f3953801031d75d3605a193a2eb2996&provider=2
Frame ID: 113E5571A3E463EAFEA306CFF97ECE85
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PDF ONLINE DOCUMENT

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

326 kB
Transfer

563 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request dobe Show response
homefile.archive.us-east-1.oortech.com/ 10 KB
3 KB 346ms
140ms Document
text/html 170.106.201.213
TENCENT-NET-AP-CN...

General

Check archive.org

Show headers Download Go to

Full URL

https://homefile.archive.us-east-1.oortech.com/dobe?signature=8cbbf8b48fa92625966bc6210ca77e00e95e8dc13289375ff061bd73a353d6b61afccae2c0c2e17fbdfe10bfb1b886df6bb422e4524cb20ae21f922f5d43740597109cbae50c61ee42f7be3468c699796f3953801031d75d3605a193a2eb2996&provider=2

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.106.201.213 Ashburn, United States, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),

Reverse DNS

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

dfe39e44bbc72df109405c1336a7226623fe4582f4c222553c70c74faab54571

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Length, X-CSRF-Token, token, session, Accept, Origin, Host, Connection, Accept-Encoding, Accept-Language, DNT, X-CustomHeader, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type
access-control-allow-methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Content-Type, token, refresh_token
access-control-max-age: 3628800
content-disposition: inline; filename="dobe"
content-encoding: gzip
content-type: text/html
date: Tue, 03 Sep 2024 14:14:06 GMT
last-modified: Wed, 28 Aug 2024 14:11:48 GMT
server: nginx/1.18.0 (Ubuntu)
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 pdf-logo.png
cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/ 174 KB
175 KB 34ms
4ms Image
image/png 151.101.66.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/pdf-logo.png?v=1703176079035

Requested by

Host: homefile.archive.us-east-1.oortech.com
URL: https://homefile.archive.us-east-1.oortech.com/dobe?signature=8cbbf8b48fa92625966bc6210ca77e00e95e8dc13289375ff061bd73a353d6b61afccae2c0c2e17fbdfe10bfb1b886df6bb422e4524cb20ae21f922f5d43740597109cbae50c61ee42f7be3468c699796f3953801031d75d3605a193a2eb2996&provider=2

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://homefile.archive.us-east-1.oortech.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: script-src 'none'
via: 1.1 varnish, 1.1 varnish
date: Tue, 03 Sep 2024 14:14:06 GMT
x-amz-request-id: P611PTNE2K64CFD3
age: 86155
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 178166
x-amz-id-2: 6KzZg11mpAGAVMB476/s+5yR7ilEOdtU2WpToZDXeUplX1/FmwnvxmVWcLB9nTWJJ5/f/volzho=
x-served-by: cache-iad-kiad7000134-IAD, cache-lga21942-LGA
last-modified: Thu, 21 Dec 2023 16:27:58 GMT
server: AmazonS3
x-timer: S1725372846.292894,VS0,VE1
etag: "2be243eaa597e9442b712456427c25d2"
access-control-allow-methods: GET, HEAD, POST
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 852, 0

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 16ms
2ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: homefile.archive.us-east-1.oortech.com
URL: https://homefile.archive.us-east-1.oortech.com/dobe?signature=8cbbf8b48fa92625966bc6210ca77e00e95e8dc13289375ff061bd73a353d6b61afccae2c0c2e17fbdfe10bfb1b886df6bb422e4524cb20ae21f922f5d43740597109cbae50c61ee42f7be3468c699796f3953801031d75d3605a193a2eb2996&provider=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://homefile.archive.us-east-1.oortech.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 03 Sep 2024 14:14:06 GMT
content-encoding: gzip
via: 1.1 varnish
age: 1564952
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 30875
x-served-by: cache-lga21965-LGA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1725372846.276973,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 160348

GET
H2 200 Adobe.png
firebasestorage.googleapis.com/v0/b/png-images-481bb.appspot.com/o/ 117 KB
118 KB 304ms
215ms Image
image/png 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firebasestorage.googleapis.com/v0/b/png-images-481bb.appspot.com/o/Adobe.png?alt=media&token=a3813f1f-169a-48a6-8172-22d091f87e7c
Requested by: Host: homefile.archive.us-east-1.oortech.com
URL: https://homefile.archive.us-east-1.oortech.com/dobe?signature=8cbbf8b48fa92625966bc6210ca77e00e95e8dc13289375ff061bd73a353d6b61afccae2c0c2e17fbdfe10bfb1b886df6bb422e4524cb20ae21f922f5d43740597109cbae50c61ee42f7be3468c699796f3953801031d75d3605a193a2eb2996&provider=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81f::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: c6a474bcc89bf85d1ccaa821fb3d9c8fca16b18a6a5ba8d217c4e3166dec80e1

Request headers

Referer: https://homefile.archive.us-east-1.oortech.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 03 Sep 2024 14:14:06 GMT
x-guploader-uploadid: AD-8ljvKxxB8nO1QDdwn75b1fOx4BpHIdGzq4Qp5OKvdlGl-gFTsFUKEw3aJHpt-u9Q1bgKRpg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename*=utf-8''Adobe.png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119844
last-modified: Wed, 10 Apr 2024 11:51:57 GMT
server: UploadServer
etag: "c657d7e769a257c2ed86980292fe4ddc"
x-goog-generation: 1712749917474086
content-type: image/png
x-goog-hash: crc32c=sw/mPA==, md5=xlfX52miV8LthpgCkv5N3A==
cache-control: private, max-age=0
x-goog-stored-content-length: 119844
x-goog-meta-firebasestoragedownloadtokens: a3813f1f-169a-48a6-8172-22d091f87e7c
accept-ranges: bytes
expires: Tue, 03 Sep 2024 14:14:06 GMT

GET
H2 200 pdf-logo.png
cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/ 174 KB
0 0ms
0ms Other
image/png 151.101.66.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.glitch.global/30e3fd15-1595-4f62-8949-4a92dad3c744/pdf-logo.png?v=1703176079035

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.66.132 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

Referer: https://homefile.archive.us-east-1.oortech.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: script-src 'none'
via: 1.1 varnish, 1.1 varnish
date: Tue, 03 Sep 2024 14:14:06 GMT
x-amz-request-id: P611PTNE2K64CFD3
age: 86155
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 178166
x-amz-id-2: 6KzZg11mpAGAVMB476/s+5yR7ilEOdtU2WpToZDXeUplX1/FmwnvxmVWcLB9nTWJJ5/f/volzho=
x-served-by: cache-iad-kiad7000134-IAD, cache-lga21942-LGA
last-modified: Thu, 21 Dec 2023 16:27:58 GMT
server: AmazonS3
x-timer: S1725372846.292894,VS0,VE1
etag: "2be243eaa597e9442b712456427c25d2"
access-control-allow-methods: GET, HEAD, POST
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 852, 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://homefile.archive.us-east-1.oortech.com/dobe?signature=8cbbf8b48fa92625966bc6210ca77e00e95e8dc13289375ff061bd73a353d6b61afccae2c0c2e17fbdfe10bfb1b886df6bb422e4524cb20ae21f922f5d43740597109cbae50c61ee42f7be3468c699796f3953801031d75d3605a193a2eb2996&provider=2 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.glitch.global
code.jquery.com
firebasestorage.googleapis.com
homefile.archive.us-east-1.oortech.com
151.101.66.132
170.106.201.213
2607:f8b0:4006:81f::200a
2a04:4e42::649
288025fbee50a4305bbf24a0b43e82af28300f5087b7adc93e21d111354a7327
c6a474bcc89bf85d1ccaa821fb3d9c8fca16b18a6a5ba8d217c4e3166dec80e1
dfe39e44bbc72df109405c1336a7226623fe4582f4c222553c70c74faab54571
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

homefile.archive.us-east-1.oortech.com Open in urlscan Pro 170.106.201.213 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

326 kBTransfer

563 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

homefile.archive.us-east-1.oortech.com Open in urlscan Pro
170.106.201.213 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

326 kB
Transfer

563 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!