newheightswithstormy.com Open in urlscan Pro
192.185.14.120 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.jenie.in/jenie/
Effective URL:
https://newheightswithstormy.com/telecom/tolbox/
Submission Tags: 7445962
Submission: On February 17 via api (February 17th 2022, 12:20:06 am UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Links 45 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 15 HTTP transactions. The main IP is 192.185.14.120, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is newheightswithstormy.com.
TLS certificate: Issued by R3 on January 15th 2022. Valid for: 3 months.

This is the only time newheightswithstormy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Optus (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	178.128.92.166 178.128.92.166	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	108.167.168.22 108.167.168.22	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
10	192.185.14.120 192.185.14.120	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
2	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	6

1 178.128.92.166 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: sg12.tmd.cloud

www.jenie.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.167.168.22 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 108-167-168-22.unifiedlayer.com

kaplan.ind.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 192.185.14.120 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-14-120.unifiedlayer.com

newheightswithstormy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	newheightswithstormy.com newheightswithstormy.com	760 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 401	14 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 546	33 KB
1	kaplan.ind.br kaplan.ind.br	245 B
1	jenie.in www.jenie.in	296 B
15	5

	Domain	Requested by
10	newheightswithstormy.com	newheightswithstormy.com
2	cdn.jsdelivr.net	newheightswithstormy.com
1	code.jquery.com	newheightswithstormy.com
1	kaplan.ind.br
1	www.jenie.in
15	5

This site contains links to these domains. Also see Links.

Domain
www.optus.com.au
memberservices.optuszoo.com.au
webmail.optusnet.com.au
yescrowd.optus.com.au
sport.optus.com.au
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
plus.google.com
www.pinterest.com
instagram.com
www.singtel.com
offer.optus.com.au

Subject Issuer	Validity	Valid
jenie.in R3	`2022-01-29` - `2022-04-29`	3 months	crt.sh
*.kaplan.ind.br R3	`2022-01-30` - `2022-04-30`	3 months	crt.sh
newheightswithstormy.com R3	`2022-01-15` - `2022-04-15`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://newheightswithstormy.com/telecom/tolbox/
Frame ID: E968246A9A4BD0B39D060A4E5B09DC60
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

My Account Login - Optus

Page URL History Show full URLs

https://www.jenie.in/jenie/ Page URL
https://kaplan.ind.br/kaplan%20ind/ Page URL
https://newheightswithstormy.com/telecom/tolbox/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

15
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

807 kB
Transfer

4381 kB
Size

0
Cookies

45 Outgoing links

These are links going to different origins than the main page.

URL: https://www.optus.com.au/my-account-login?TYPE=100663297&REALMOID=06-8ddf53bb-43cf-4d85-9334-da38d3f555e9&GUID=1&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-qrO%2f7pv80kBPNdyFsh4xzrcFhAaZ5fTczH%2bJYZKe%2fnANBOvXuad%2b5m86DCkkpnnb&TARGET=-SM-HTTP%3a%2f%2fwww%2eoptus%2ecom%2eau%2fsecure%2fsm%2flogin%2eprocess%3ftarget%3dhttps-%3A-%2F-%2Fwww%2eoptus%2ecom%2eau-%2Fmy--account#nav-primary-level
Title: Skip to Primary Navigation

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/for-you
Title: For You

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/business
Title: For Business

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/enterprise
Title: For Enterprise

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/shoppingcart
Title: Cart

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/my-account
Title: My Account

Search URL Search Domain Scan URL

URL: https://memberservices.optuszoo.com.au/myaccount/
Title: Member Services

Search URL Search Domain Scan URL

URL: https://webmail.optusnet.com.au/
Title: Webmail

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/customercentre/rewards/login
Title: Optus Perks

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/customercentre/yescrowd/login
Title: Yes Crowd

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/yesbusiness

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/support/answer?id=8396&typeId=3&refId=1
Title: Register for My Account

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/support/answer?id=8395&typeId=3&refId=1
Title: My Account: Username & Password Help

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/support/answer?id=8394&typeId=3&refId=1
Title: My Account & Member Services: Eligibility & Benefits

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/support/answer?id=8397&typeId=3&refId=1
Title: Save card details in My Account

Search URL Search Domain Scan URL

URL: http://www.optus.com.au/shop/support
Title: Find more articles in Help and support

Search URL Search Domain Scan URL

URL: https://yescrowd.optus.com.au/t5/Android/Help-for-Order-Delivery-Activation-and-your-First-Bill/m-p/132374#M7007
Title: Help for Order Delivery, Activation and your First Bill

Search URL Search Domain Scan URL

URL: https://yescrowd.optus.com.au/t5/Mobile/How-to-unlock-Your-Prepaid-Mobile-Phone-or-Device/m-p/108228#M18462
Title: How to unlock Your Prepaid Mobile Phone or Device

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/customer-extras/mobile-apps/my-optus-app
Title: My Optus App

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/entertainment/hype
Title: Hype

Search URL Search Domain Scan URL

URL: https://sport.optus.com.au/
Title: Optus Sport

Search URL Search Domain Scan URL

URL: https://yescrowd.optus.com.au/
Title: Yes Crowd

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/support
Title: Support

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about/legal/privacy-and-security
Title: Privacy, Security and Safety

Search URL Search Domain Scan URL

URL: http://www.optus.com.au/about/legal#link/legal/0
Title: Standard Agreement

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/cis
Title: Critical Information Summaries

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/usageguides
Title: Optus Usage Guidelines

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about/legal/copyright
Title: Copyright

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about/inclusion-diversity/differing-abilities/disability-services
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/devicewarrtechinfo
Title: Device Warranties

Search URL Search Domain Scan URL

URL: http://www.facebook.com/optus
Title: ""

Search URL Search Domain Scan URL

URL: http://twitter.com/Optus
Title: ""

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/yesoptus
Title: ""

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/optus
Title: ""

Search URL Search Domain Scan URL

URL: http://plus.google.com/+optus/posts
Title: ""

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/optus
Title: ""

Search URL Search Domain Scan URL

URL: http://instagram.com/optus
Title: ""

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/stores
Title: Store Locator

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.singtel.com/about-us
Title: About Singtel

Search URL Search Domain Scan URL

URL: https://offer.optus.com.au/for-you/support/complaints1?sid=complaints:source:homepage
Title: Lodge a complaint

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.jenie.in/jenie/ Page URL
https://kaplan.ind.br/kaplan%20ind/ Page URL
https://newheightswithstormy.com/telecom/tolbox/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
www.jenie.in/jenie/ 146 B
296 B 1984ms
197ms Document
text/html 178.128.92.166
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jenie.in/jenie/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.128.92.166 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: sg12.tmd.cloud
Software: LiteSpeed / PHP/7.4.27
Resource Hash: 7c545c2abb626bf4317969817a4cb3b1c8af6581f76d91ed6a920dc74168f4ee

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

x-powered-by: PHP/7.4.27
content-type: text/html; charset=UTF-8
content-length: 115
content-encoding: br
vary: Accept-Encoding
date: Thu, 17 Feb 2022 00:20:01 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000

GET
H2 200 / Show response
kaplan.ind.br/kaplan%20ind/ 161 B
245 B 1490ms
263ms Document
text/html 108.167.168.22
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://kaplan.ind.br/kaplan%20ind/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.168.22 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 108-167-168-22.unifiedlayer.com
Software: Apache /
Resource Hash: 02dca8045737d67244cc3b98e09699dd098cd2afbb6c824bcddeaab6100b954c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.jenie.in/

Response headers

vary: Accept-Encoding
content-encoding: gzip
content-length: 148
content-type: text/html; charset=UTF-8
date: Thu, 17 Feb 2022 00:20:02 GMT
server: Apache

GET
H2 200 Primary Request / Show response
newheightswithstormy.com/telecom/tolbox/ 56 KB
13 KB 952ms
554ms Document
text/html 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: 2b155df0481933e79c7b80e1ba4808afd77c4fefc722ba8e8c8d9ace6e1e23a5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://kaplan.ind.br/

Response headers

vary: Accept-Encoding
content-encoding: gzip
content-length: 13438
content-type: text/html; charset=UTF-8
date: Thu, 17 Feb 2022 00:20:03 GMT
server: Apache

GET
H2 200 lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
newheightswithstormy.com/telecom/tolbox/files/ 493 KB
76 KB 154ms
154ms Stylesheet
text/css 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: bb56cea5f5f48414b5504b157a9420e6f159896a168ea9e6ff5e4ee9547de77a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newheightswithstormy.com/telecom/tolbox/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 lux.49c32e08060172d8b8758ebe235b7642.css
newheightswithstormy.com/telecom/tolbox/files/ 3 MB
415 KB 286ms
286ms Stylesheet
text/css 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.49c32e08060172d8b8758ebe235b7642.css
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: 682892b4c0711d6936022fe0f066d42e909e3824f60c2e47eaef7a92c451e321

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newheightswithstormy.com/telecom/tolbox/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 55ms
19ms Script
application/javascript 2001:4de0:ac18::1:a:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newheightswithstormy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-1762a"
vary: Accept-Encoding
x-hw: 1645057204.dop016.ml1.t,1645057204.cds203.ml1.hn,1645057204.cds019.ml1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 33202

GET
H2 200 jquery.validate.min.js Show response
cdn.jsdelivr.net/jquery.validation/1.16.0/ 23 KB
8 KB 40ms
17ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js

Requested by

Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newheightswithstormy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 271404
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19180-FRA
timing-allow-origin: *
server: cloudflare
etag: W/"5a1e-IUhhlLqiLrEVX+mL969jFOd3PMc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6dead906df479191-FRA

GET
H2 200 additional-methods.min.js Show response
cdn.jsdelivr.net/jquery.validation/1.16.0/ 17 KB
5 KB 53ms
30ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.validation/1.16.0/additional-methods.min.js

Requested by

Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newheightswithstormy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 271358
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19175-FRA
timing-allow-origin: *
server: cloudflare
etag: W/"4587-uIBUYLV1S+ixaiI99zfZV32kwYI"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6dead906df4a9191-FRA

GET
H2 200 login.js Show response
newheightswithstormy.com/telecom/tolbox/files/ 545 B
367 B 296ms
296ms Script
application/javascript 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/login.js
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: 37fa54090471f5b10ee622d15acf84bbda09b286defce156ec3952e399be0794

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://newheightswithstormy.com/telecom/tolbox/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 318

GET
H2 200 ee10f7196c1b125a3b8222341465bf5e.woff
newheightswithstormy.com/telecom/tolbox/files/ 65 KB
65 KB 151ms
151ms Font
font/woff 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/ee10f7196c1b125a3b8222341465bf5e.woff
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: 7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12

Request headers

Referer: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://newheightswithstormy.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
accept-ranges: bytes
content-length: 66552
content-type: font/woff

GET
H2 200 507b76aa0351c57ece90f02239b62ba3.woff
newheightswithstormy.com/telecom/tolbox/files/ 66 KB
67 KB 161ms
160ms Font
font/woff 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/507b76aa0351c57ece90f02239b62ba3.woff
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: 06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f

Request headers

Referer: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://newheightswithstormy.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
accept-ranges: bytes
content-length: 67824
content-type: font/woff

GET
H2 200 b7b268c962e2855acf62186c96a55466.woff
newheightswithstormy.com/telecom/tolbox/files/ 66 KB
67 KB 151ms
150ms Font
font/woff 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/b7b268c962e2855acf62186c96a55466.woff
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: 4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7

Request headers

Referer: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://newheightswithstormy.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
accept-ranges: bytes
content-length: 67808
content-type: font/woff

GET
H2 500 cdf06c294d7cc3d6664b0dc9edf2c7ea.woff
newheightswithstormy.com/telecom/tolbox/files/assets/fonts/lux-icons/ 0
0 275ms
275ms Font
text/html 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/assets/fonts/lux-icons/cdf06c294d7cc3d6664b0dc9edf2c7ea.woff
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.49c32e08060172d8b8758ebe235b7642.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://newheightswithstormy.com/telecom/tolbox/files/lux.49c32e08060172d8b8758ebe235b7642.css
Origin: https://newheightswithstormy.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:04 GMT
server: Apache
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 500 e1055008ac141ccf27da8fbe95009134.ttf
newheightswithstormy.com/telecom/tolbox/files/assets/fonts/lux-icons/ 0
0 249ms
249ms Font
text/html 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/assets/fonts/lux-icons/e1055008ac141ccf27da8fbe95009134.ttf
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://newheightswithstormy.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:05 GMT
server: Apache
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 cdf06c294d7cc3d6664b0dc9edf2c7ea.woff
newheightswithstormy.com/telecom/tolbox/files/ 56 KB
57 KB 138ms
138ms Font
font/woff 192.185.14.120
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://newheightswithstormy.com/telecom/tolbox/files/cdf06c294d7cc3d6664b0dc9edf2c7ea.woff
Requested by: Host: newheightswithstormy.com
URL: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.14.120 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-14-120.unifiedlayer.com
Software: Apache /
Resource Hash: abb2805631568056488332283a9cde15bb8fe0c2100d41963f673dba10d0fd8f

Request headers

Referer: https://newheightswithstormy.com/telecom/tolbox/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://newheightswithstormy.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 00:20:05 GMT
last-modified: Wed, 16 Feb 2022 22:43:25 GMT
server: Apache
accept-ranges: bytes
content-length: 57556
content-type: font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Optus (Telecommunication)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://newheightswithstormy.com/telecom/tolbox/files/assets/fonts/lux-icons/cdf06c294d7cc3d6664b0dc9edf2c7ea.woff Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://newheightswithstormy.com/telecom/tolbox/files/assets/fonts/lux-icons/e1055008ac141ccf27da8fbe95009134.ttf Message: Failed to load resource: the server responded with a status of 500 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
kaplan.ind.br
newheightswithstormy.com
www.jenie.in
108.167.168.22
178.128.92.166
192.185.14.120
2001:4de0:ac18::1:a:3b
2606:4700::6810:5714
02dca8045737d67244cc3b98e09699dd098cd2afbb6c824bcddeaab6100b954c
06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f
2b155df0481933e79c7b80e1ba4808afd77c4fefc722ba8e8c8d9ace6e1e23a5
37fa54090471f5b10ee622d15acf84bbda09b286defce156ec3952e399be0794
4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
682892b4c0711d6936022fe0f066d42e909e3824f60c2e47eaef7a92c451e321
7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12
7c545c2abb626bf4317969817a4cb3b1c8af6581f76d91ed6a920dc74168f4ee
8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8
abb2805631568056488332283a9cde15bb8fe0c2100d41963f673dba10d0fd8f
bb56cea5f5f48414b5504b157a9420e6f159896a168ea9e6ff5e4ee9547de77a
eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

newheightswithstormy.com Open in urlscan Pro 192.185.14.120 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

6 IPs

3 Countries

807 kBTransfer

4381 kBSize

0 Cookies

45 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

newheightswithstormy.com Open in urlscan Pro
192.185.14.120 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

807 kB
Transfer

4381 kB
Size

0
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!