![](/screenshots/b073d92f-c6e9-44a3-9fbe-513226319839.png)
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
Open in
urlscan Pro
2600:3c0e::f03c:93ff:fe9e:4558
Malicious Activity!
Public Scan
Effective URL: https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html
Submission: On August 13 via manual from US — Scanned from GB
Summary
TLS certificate: Issued by R11 on August 1st 2024. Valid for: 3 months.
This is the only time documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 3.225.254.154 3.225.254.154 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 52.6.56.188 52.6.56.188 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2606:4700:303... 2606:4700:3032::6815:38dc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2600:3c0e::f0... 2600:3c0e::f03c:93ff:fe9e:4558 | 63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700::68... 2606:4700::6812:5f29 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3031::6815:14be | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
11 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-254-154.compute-1.amazonaws.com
shared.outlook.inky.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-56-188.compute-1.amazonaws.com
urldefense.proofpoint.com |
ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
cloudflare.com
1 redirects
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 challenges.cloudflare.com — Cisco Umbrella Rank: 3877 |
30 KB |
3 |
linodeobjects.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
7 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
31 KB |
1 |
com.ru
novateche.com.ru |
128 KB |
1 |
hotellimaran.com
hotellimaran.com |
912 B |
1 |
proofpoint.com
1 redirects
urldefense.proofpoint.com — Cisco Umbrella Rank: 31639 |
235 B |
1 |
inky.com
1 redirects
shared.outlook.inky.com — Cisco Umbrella Rank: 391216 |
746 B |
0 |
google.com
Failed
google.com Failed |
|
11 | 8 |
Domain | Requested by | |
---|---|---|
3 | documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
hotellimaran.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com |
2 | challenges.cloudflare.com |
1 redirects
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | code.jquery.com |
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | novateche.com.ru |
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | cdnjs.cloudflare.com |
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
|
1 | hotellimaran.com | |
1 | urldefense.proofpoint.com | 1 redirects |
1 | shared.outlook.inky.com | 1 redirects |
0 | google.com Failed |
hotellimaran.com
|
11 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
hotellimaran.com WE1 |
2024-07-27 - 2024-10-25 |
3 months | crt.sh |
nl-ams-1.linodeobjects.com R11 |
2024-08-01 - 2024-10-30 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
novateche.com.ru WE1 |
2024-08-02 - 2024-10-31 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html
Frame ID: 11B730BD65CA7F97805C4012F428AA50
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/b073d92f-c6e9-44a3-9fbe-513226319839.png)
Page Title
quaverPage URL History Show full URLs
-
https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVkEtvozAUhf9KxYLVEIx5GCqhNiFNpt...
HTTP 303
https://urldefense.proofpoint.com/v2/url?u=https-3A__hotellimaran.com_tmp_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrw... HTTP 302
https://hotellimaran.com/tmp/ Page URL
- https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVkEtvozAUhf9KxYLVEIx5GCqhNiFNptOSx6RKaDfIwTYQDCbYIW2q-e8Tshhpdvfe7-gc3fOtnTqu3d9phVKtvDfN60ooo42ko7YTgrWibNQoE7XZwwE-nMKb1LDHaVoIRTkva9zhZtCkqm5TnYTTczzDaz0L6Wn-IVWG36ac92X9tPD36JB05-OSGb07TiPS5s2WlWUc6104SY-LC7qgbH7Ik32fS1CAjYri1c7hLwntDeod3DQDKRzrddj31mrxu_u5MxLIn4vklLxWbIXtsxdNYhSp5eLTY2vL_6z41HAqkWy2r9Dl0XMt1ruifNJlKAzaBvj9Mnc_Nl_2jPrVL0vmUy_a-tvga1mUR9i_LeVsomKdhtqPO60aumqoEl3OFEII2kFg5uz6f8VEpx7_TbghUjTy1pxFCPV8Zw-wBxAJMPMBCxwbMB8Ci0BgWlcfF3m25YwgHGLoLQbzq4N4xBdFM1zXg9cAyQD_O_75C-4tliU.MEUCIGCTUJYQT5-VanQzq1VIvFGhfyGZtavaJnUbdai61s34AiEA_BgUSURRBn4yGaiUonx_tjHhD3-L9hRZnt-UwOnBEKg
HTTP 303
https://urldefense.proofpoint.com/v2/url?u=https-3A__hotellimaran.com_tmp_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=B_qNz7z7cGjgXbvgs0h0StCMPW4lKXev-e6j5_c0_2A&m=vv1PNRrHW-X2lIhXuXLkfPa3w6CBM7CtONx6fQ18xklD-4koXSVL25lCImoQWhiE&s=o-ep9aYzG5ZSy3Fe8kJ1sgD6CV8V9yOhiq2vTOsFBtM&e= HTTP 302
https://hotellimaran.com/tmp/ Page URL
- https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVkEtvozAUhf9KxYLVEIx5GCqhNiFNptOSx6RKaDfIwTYQDCbYIW2q-e8Tshhpdvfe7-gc3fOtnTqu3d9phVKtvDfN60ooo42ko7YTgrWibNQoE7XZwwE-nMKb1LDHaVoIRTkva9zhZtCkqm5TnYTTczzDaz0L6Wn-IVWG36ac92X9tPD36JB05-OSGb07TiPS5s2WlWUc6104SY-LC7qgbH7Ik32fS1CAjYri1c7hLwntDeod3DQDKRzrddj31mrxu_u5MxLIn4vklLxWbIXtsxdNYhSp5eLTY2vL_6z41HAqkWy2r9Dl0XMt1ruifNJlKAzaBvj9Mnc_Nl_2jPrVL0vmUy_a-tvga1mUR9i_LeVsomKdhtqPO60aumqoEl3OFEII2kFg5uz6f8VEpx7_TbghUjTy1pxFCPV8Zw-wBxAJMPMBCxwbMB8Ci0BgWlcfF3m25YwgHGLoLQbzq4N4xBdFM1zXg9cAyQD_O_75C-4tliU.MEUCIGCTUJYQT5-VanQzq1VIvFGhfyGZtavaJnUbdai61s34AiEA_BgUSURRBn4yGaiUonx_tjHhD3-L9hRZnt-UwOnBEKg HTTP 303
- https://urldefense.proofpoint.com/v2/url?u=https-3A__hotellimaran.com_tmp_&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=B_qNz7z7cGjgXbvgs0h0StCMPW4lKXev-e6j5_c0_2A&m=vv1PNRrHW-X2lIhXuXLkfPa3w6CBM7CtONx6fQ18xklD-4koXSVL25lCImoQWhiE&s=o-ep9aYzG5ZSy3Fe8kJ1sgD6CV8V9yOhiq2vTOsFBtM&e= HTTP 302
- https://hotellimaran.com/tmp/
- https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
- https://challenges.cloudflare.com/turnstile/v0/b/cc21665cd7b9/api.js
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
hotellimaran.com/tmp/ Redirect Chain
|
881 B 912 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
google.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
challenges.cloudflare.com/turnstile/v0/b/cc21665cd7b9/ Redirect Chain
|
44 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
novateche.com.ru// |
169 KB 128 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
258 B 490 B |
Other
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
,
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
258 B 258 B |
Image
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
,
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
496 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
231 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- google.com
- URL
- https://google.com/
- Domain
- google.com
- URL
- https://google.com/
- Domain
- documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
- URL
- https://documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com/,
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| CryptoJS object| turnstile function| fabulous function| dairywoman function| $ function| jQuery function| gB string| faintly function| taken function| uF function| magazine function| mademoiselle function| quarto function| magic function| b2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
shared.outlook.inky.com/ | Name: AWSALB Value: yHq76+s10uuv0G8ynnexBUw90rG22tRYC0U8+hjLAjY6KobQy82AwxTarSUBgG5v1avv6MVhV0anKFTLipVF4ewjlemhc6mGSB0p6cUCPZQ0yxc33nj9+v2xZtVP |
|
shared.outlook.inky.com/ | Name: AWSALBCORS Value: yHq76+s10uuv0G8ynnexBUw90rG22tRYC0U8+hjLAjY6KobQy82AwxTarSUBgG5v1avv6MVhV0anKFTLipVF4ewjlemhc6mGSB0p6cUCPZQ0yxc33nj9+v2xZtVP |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
challenges.cloudflare.com
code.jquery.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
google.com
hotellimaran.com
novateche.com.ru
shared.outlook.inky.com
urldefense.proofpoint.com
documentreceivedvirtually-portal-preview.nl-ams-1.linodeobjects.com
google.com
2600:3c0e::f03c:93ff:fe9e:4558
2606:4700:3031::6815:14be
2606:4700:3032::6815:38dc
2606:4700::6811:190e
2606:4700::6812:5f29
2a04:4e42:600::649
3.225.254.154
52.6.56.188
09969ff98103700563d510b68eb73e8fc668f2d4005b58cd5f06dcb21817e140
18fb69e74d40c9203eb732e5ba423b45fcf1d2b48f6d38efe87a08bb686fd94e
4623ca999744624a837f54806a96901fb05352c84addb1208c382e12733bbe6f
4d88618abd8d28ca19625380b7ae28a1e1086063ce7c66fc3257464f5f5b4c71
550ccd009e382d9e54bc14bc36831d71bf0320cf517fa21ced47cc1147f475f7
6a5d79788fa75b6e05daf75d919699e8ce58c9120cf6959191c50cdadba92885
7026ce67fdd6c5d983d31906fa077143dd80801de9ef5b9920ca89bed078efab
7d0af1e30569825a75bc404b196903f9d5a8d10af41581df3d6dff01b716df97
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
906f71d6d2948b4ac632811cce156c73e0d73a9045ee83a42822824de2b0bb3f
e9e7b808d5f429a2f704eeb999d572fe2884ce9f763823c021723d7b3ac90fbc
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
fe4c1d8917b395d0f058f165778769d4dd7a214f2b3d226c50b992d593f602e7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e