ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com Open in urlscan Pro
159.138.16.166 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://picky.is/jl9DVO/UT
Effective URL:
https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPHSNMSEAR9JTIL&Expires...
Submission: On February 01 via manual (February 1st 2023, 1:57:00 pm UTC) from IN — Scanned from IS

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 7 domains to perform 9 HTTP transactions. The main IP is 159.138.16.166, located in Central, Hong Kong and belongs to HWCLOUDS-AS-AP HUAWEI CLOUDS, HK. The main domain is ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on March 8th 2022. Valid for: a year.

This is the only time ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	15.165.65.49 15.165.65.49	16509 (AMAZON-02) (AMAZON-02)
1	159.138.16.166 159.138.16.166	136907 (HWCLOUDS-...) (HWCLOUDS-AS-AP HUAWEI CLOUDS)
9	2

1 15.165.65.49 (Incheon, Korea, Republic Of) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-15-165-65-49.ap-northeast-2.compute.amazonaws.com

picky.is	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.138.16.166 (Central, Hong Kong)

ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK)
PTR: ecs-159-138-16-166.compute.hwclouds-dns.com

ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	myhuaweicloud.com ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com	638 KB
1	picky.is 1 redirects picky.is	265 B
0	googleapis.com Failed ajax.googleapis.com Failed
0	bootstrapcdn.com Failed maxcdn.bootstrapcdn.com Failed stackpath.bootstrapcdn.com Failed
0	cloudflare.com Failed cdnjs.cloudflare.com Failed
0	jquery.com Failed code.jquery.com Failed
0	github.io Failed lipis.github.io Failed
9	7

	Domain	Requested by
1	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
1	picky.is	1 redirects
0	stackpath.bootstrapcdn.com Failed	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
0	ajax.googleapis.com Failed	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
0	maxcdn.bootstrapcdn.com Failed	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
0	cdnjs.cloudflare.com Failed	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
0	code.jquery.com Failed	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
0	lipis.github.io Failed	ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
9	8

This site contains no links.

Subject Issuer	Validity	Valid
obs.ap-southeast-1.myhuaweicloud.com GlobalSign RSA OV SSL CA 2018	`2022-03-08` - `2023-04-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPHSNMSEAR9JTIL&Expires=1677009096&Signature=UcL0JF/1C6dOilr%2BGJHUDunGYVQ%3D
Frame ID: 32DDB4E2DE2A6FFA6F54B4C3E17727C3
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dr1ve

Page URL History Show full URLs

https://picky.is/jl9DVO/UT HTTP 301
https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPH... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

9
Requests

11 %
HTTPS

0 %
IPv6

7
Domains

8
Subdomains

2
IPs

2
Countries

638 kB
Transfer

922 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://picky.is/jl9DVO/UT HTTP 301
https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPHSNMSEAR9JTIL&Expires=1677009096&Signature=UcL0JF/1C6dOilr%2BGJHUDunGYVQ%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html Show response ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/ Redirect Chain https://picky.is/jl9DVO/UT https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPHSNMSEAR9JTIL&Expires=167...	638 KB 638 KB	3249ms 333ms	Document text/html	159.138.16.166 HWCLOUDS-AS-AP HU...
General Check archive.org Show headers Download Go to Full URL https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPHSNMSEAR9JTIL&Expires=1677009096&Signature=UcL0JF/1C6dOilr%2BGJHUDunGYVQ%3D Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 159.138.16.166 Central, Hong Kong, ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK), Reverse DNS ecs-159-138-16-166.compute.hwclouds-dns.com Software OBS / Resource Hash `9638c8b988d6c5e3764c0ee1ee72c6c89ca5b9066ae40ecf76240a6b34b3272b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language is-IS,is;q=0.9 Response headers Accept-Ranges bytes Content-Length 653101 Content-Type text/html Date Wed, 01 Feb 2023 13:56:54 GMT ETag "34c732a9592f3f2bbf2d6cb379fce5d3" Last-Modified Sun, 22 Jan 2023 15:32:05 GMT Server OBS x-amz-id-2 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSOVvP0mWIJflu2UPa2R2jo7eJErO6U5 x-amz-request-id 000001860D4422B240086BD688A4887C x-amz-restore ongoing-request="false", expiry-date="Wed, 22 Feb 2023 00:00:00 GMT" x-amz-storage-class GLACIER x-amz-tagging-count 0 x-reserved amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc Redirect headers content-type text/plain; charset=utf-8 date Wed, 01 Feb 2023 13:56:51 GMT location https://ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com:443/68ki-0klv4rnyb-093erjkf-049h6yt-09gjr-0g9h-0ggf.html?AWSAccessKeyId=SQATBGPHSNMSEAR9JTIL&Expires=1677009096&Signature=UcL0JF/1C6dOilr%2BGJHUDunGYVQ%3D server uvicorn
GET		font-awesome.css lipis.github.io/bootstrap-social/assets/css/	0 0

GET DATA	200 OK	truncated /	20 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cf5916e86bb18875db4e12ee5e799cce7b23bc1cd1ad721fb65d3879de629bec` Request headers accept-language is-IS,is;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	263 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `46ca51fa88bcacd0a640d4411aabf06b8a6fe90980868d29431864168f9af03a` Request headers accept-language is-IS,is;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	334 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dea34f261a8f1665528217ef9040fc6e4ed0517be859fe25c8e440f02c10ac0a` Request headers accept-language is-IS,is;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Content-Type image/png
GET		jquery-3.2.1.slim.min.js code.jquery.com/	0 0

GET		popper.min.js cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	0 0

GET		bootstrap.min.js maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	0 0

GET		jquery.min.js ajax.googleapis.com/ajax/libs/jquery/2.2.4/	0 0

GET		bootstrap.min.js stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	0 0

GET		socket.io.js cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/	0 0

GET		jquery.min.js cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lipis.github.io
URL: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css

Domain: code.jquery.com
URL: https://code.jquery.com/jquery-3.2.1.slim.min.js

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Domain: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Domain: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Domain: stackpath.bootstrapcdn.com
URL: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/socket.io.js

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/socket.io.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://code.jquery.com/jquery-3.2.1.slim.min.js Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Message: Failed to load resource: net::ERR_CONNECTION_RESET

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
lipis.github.io
maxcdn.bootstrapcdn.com
picky.is
stackpath.bootstrapcdn.com
ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
lipis.github.io
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
15.165.65.49
159.138.16.166
46ca51fa88bcacd0a640d4411aabf06b8a6fe90980868d29431864168f9af03a
9638c8b988d6c5e3764c0ee1ee72c6c89ca5b9066ae40ecf76240a6b34b3272b
cf5916e86bb18875db4e12ee5e799cce7b23bc1cd1ad721fb65d3879de629bec
dea34f261a8f1665528217ef9040fc6e4ed0517be859fe25c8e440f02c10ac0a

ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com Open in urlscan Pro 159.138.16.166 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

11 %HTTPS

0 %IPv6

7 Domains

8 Subdomains

2 IPs

2 Countries

638 kBTransfer

922 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

ve45rt-0wrj-g9fhw-e9fgj-wer0hbfg-wdjnmf-v08wehf-0hf.obs.ap-southeast-1.myhuaweicloud.com Open in urlscan Pro
159.138.16.166 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

11 %
HTTPS

0 %
IPv6

7
Domains

8
Subdomains

2
IPs

2
Countries

638 kB
Transfer

922 kB
Size

0
Cookies

9 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!