instor.ir Open in urlscan Pro
217.144.104.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://instor.ir/portal.html
Submission: On September 13 via manual (September 13th 2024, 5:22:50 am UTC) from MX — Scanned from DE

Summary HTTP 22 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 22 HTTP transactions. The main IP is 217.144.104.114, located in Iran, Islamic Republic Of and belongs to NETMIHAN, IR. The main domain is instor.ir.
TLS certificate: Issued by R11 on September 10th 2024. Valid for: 3 months.

This is the only time instor.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	217.144.104.114 217.144.104.114	204213 (NETMIHAN) (NETMIHAN)
14	81.198.164.193 81.198.164.193	12578 (APOLLO-AS...) (APOLLO-AS Latvia)
1	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
22	4

3 217.144.104.114 (Iran, Islamic Republic Of)

ASN204213 (NETMIHAN, IR)
PTR: cp35.mihanvps.com

instor.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 81.198.164.193 (Latvia)

ASN12578 (APOLLO-AS Latvia, LV)
PTR: smtp.online.lv

mail.online.lv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

acctcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	online.lv mail.online.lv	724 KB
3	instor.ir instor.ir	10 KB
1	msftauth.net acctcdn.msftauth.net — Cisco Umbrella Rank: 6854	2 KB
22	3

	Domain	Requested by
14	mail.online.lv	instor.ir mail.online.lv
3	instor.ir	instor.ir
1	acctcdn.msftauth.net	instor.ir
22	3

This site contains links to these domains. Also see Links.

Domain
tet.lv

Subject Issuer	Validity	Valid
cpanel.instor.ir R11	`2024-09-10` - `2024-12-09`	3 months	crt.sh
*.online.lv RapidSSL TLS RSA CA G1	`2024-01-15` - `2025-01-22`	a year	crt.sh
identitycdn.msauth.net Microsoft Azure RSA TLS Issuing CA 04	`2024-06-07` - `2025-06-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://instor.ir/portal.html
Frame ID: 088A75B260EBF99D85953FD313AA3FA8
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Continue

Detected technologies

ExtJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

ext-base\.js

Page Statistics

22
Requests

82 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

736 kB
Transfer

1323 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://tet.lv/uznemumiem/programmatura/e-pasta-kastite

Search URL Search Domain Scan URL

URL: https://tet.lv/palidziba/lv/palidziba_majai/internets/epasts

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request portal.html Show response
instor.ir/ 46 KB
9 KB 966ms
133ms Document
text/html 217.144.104.114
NETMIHAN

General

Check archive.org

Show headers Download Go to

Full URL: https://instor.ir/portal.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 217.144.104.114 , Iran, Islamic Republic Of, ASN204213 (NETMIHAN, IR),
Reverse DNS: cp35.mihanvps.com
Software: nginx /
Resource Hash: 9ac8cfed66a01c524b527e8449ce337003ecc7076346f13419f8433bb78ce28b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 9021
content-type: text/html
date: Fri, 13 Sep 2024 05:22:45 GMT
last-modified: Thu, 12 Sep 2024 16:41:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 404 i18n_t.js
instor.ir/ 0
0 141ms
139ms Script
text/html 217.144.104.114
NETMIHAN

General

Check archive.org

Show headers Download Go to

Full URL: https://instor.ir/i18n_t.js
Requested by: Host: instor.ir
URL: https://instor.ir/portal.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 217.144.104.114 , Iran, Islamic Republic Of, ASN204213 (NETMIHAN, IR),
Reverse DNS: cp35.mihanvps.com
Software: nginx /
Resource Hash

Request headers

Referer: https://instor.ir/portal.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2024 05:22:45 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
server: nginx
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 708
content-type: text/html

GET
H/1.1 200
OK ext-all.css
mail.online.lv/private/ajax/Libraries/Ext/resources/css/ 78 KB
13 KB 189ms
46ms Stylesheet
text/css 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Libraries/Ext/resources/css/ext-all.css?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

2f49b192440d69cafeac01ade4c670b45f0f1b7570132a5ba3fe4c31ff42b884

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:19 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Connection: Keep-Alive
Content-Length: 13050
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK axi-custom-scrollbar.css
mail.online.lv/private/ajax/Resources/css/ 432 B
714 B 183ms
40ms Stylesheet
text/css 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Resources/css/axi-custom-scrollbar.css?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

a8fe8c3c6fc487521ed9c59b6e2b2cdbfc0430c41ba05bc11f1a038936850dd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:19 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Connection: Keep-Alive
Content-Length: 203
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK axigen-web-fonts.css
mail.online.lv/css/ 2 KB
818 B 181ms
38ms Stylesheet
text/css 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/css/axigen-web-fonts.css?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

c4a2f3bcf1eaec004f97e830b184cd4f7429fde1af1bc5e6824133aa97c12637

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Tue, 5 Mar 2024 11:12:22 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Connection: Keep-Alive
Content-Length: 307
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK style_ajax.css
mail.online.lv/css/ 31 KB
5 KB 188ms
45ms Stylesheet
text/css 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/css/style_ajax.css?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

5f86b755a96d3e0cf3220ba3c8f139757997888ebb25898418ed901374bf8262

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Tue, 5 Mar 2024 11:12:22 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Connection: Keep-Alive
Content-Length: 4993
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK style_ajax_breeze.css
mail.online.lv/css/ 6 KB
2 KB 182ms
38ms Stylesheet
text/css 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/css/style_ajax_breeze.css?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

95d9da4323bcdc2a28bcaa08aa687de82d5b33b354aa156a377125e926b601b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Tue, 5 Mar 2024 11:12:22 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Connection: Keep-Alive
Content-Length: 1056
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK lib_login.js Show response
mail.online.lv/js/ 7 KB
3 KB 185ms
42ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/js/lib_login.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

ec1f1e869db0c3808738937365087a460f8ff902dafa018836663a60883ec360

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 2424
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H2 200 microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
acctcdn.msftauth.net/images/ 4 KB
2 KB 93ms
15ms Image
image/svg+xml 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Requested by: Host: instor.ir
URL: https://instor.ir/portal.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/48A8) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 13 Sep 2024 05:22:45 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 435182
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 06 Sep 2024 23:42:28 GMT
server: ECAcc (ama/48A8)
etag: 0x8DCCECD915DE8DF
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8919cc8b-801e-0021-15a7-0170b5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK ext-base.js Show response
mail.online.lv/private/ajax/Libraries/Ext/adapter/ext/ 33 KB
11 KB 46ms
44ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Libraries/Ext/adapter/ext/ext-base.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

861e2454175200623d67aba0f898978af7fd3b28299d81b9ecb31340b60f3f65

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 10546
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK ext-all.js Show response
mail.online.lv/private/ajax/Libraries/Ext/ 517 KB
138 KB 91ms
89ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Libraries/Ext/ext-all.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

f66cedc791b747ef162aa19bb0de83a6a2de47ddd67d2715685ab6e72165a63c

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 141214
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK ext-fixes.js Show response
mail.online.lv/private/ajax/Libraries/Axi/ 26 KB
8 KB 39ms
38ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Libraries/Axi/ext-fixes.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

30eb8c689079b4e5a9c24a805d8b188c0a050d60a4442b27a12b42f30770270d

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 8131
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK FormLayout.js Show response
mail.online.lv/private/ajax/Libraries/Axi/Ext/widgets/layout/ 2 KB
1 KB 37ms
37ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Libraries/Axi/Ext/widgets/layout/FormLayout.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

07fdcec52ae75b15593b6ac8aedad9ca534cdb68ccf7872daf8641d562a0cd63

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:19 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 845
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK Messenger.js Show response
mail.online.lv/private/ajax/Classes/ 3 KB
2 KB 39ms
39ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Classes/Messenger.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

214acb465662759602470ac8e4a268c1e862f129bc57ad75efb87b6505c8d10a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 1186
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK Axi.js Show response
mail.online.lv/private/ajax/Libraries/Axi/ 32 KB
11 KB 44ms
43ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/private/ajax/Libraries/Axi/Axi.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

411d98c4a310d462eacff821993bbc0f448254e165e5804339e11efca9031bae

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 10554
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK CSP.js Show response
mail.online.lv/js/CSP/ 534 B
665 B 37ms
36ms Script
text/javascript 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.online.lv/js/CSP/CSP.js?v=1033630

Requested by

Host: instor.ir
URL: https://instor.ir/portal.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

0f6b571b9a0bceb5f58c46e24a1b600ddc9cdedc0fcbcd572c8339b693782ab5

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://instor.ir/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:18 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Connection: Keep-Alive
Content-Length: 291
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET
H/1.1 200
OK loading-bg-breeze-rpeast-morespace.png
mail.online.lv/private/ajax/Resources/images/theme-breeze/ 535 KB
528 KB 119ms
91ms Image
image/png 81.198.164.193
APOLLO-AS Latvia

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.online.lv/private/ajax/Resources/images/theme-breeze/loading-bg-breeze-rpeast-morespace.png

Requested by

Host: mail.online.lv
URL: https://mail.online.lv/css/style_ajax_breeze.css?v=1033630

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

81.198.164.193 , Latvia, ASN12578 (APOLLO-AS Latvia, LV),

Reverse DNS

smtp.online.lv

Software

Axigen-Webproxy /

Resource Hash

9c58e15555dc90abba5267a854147d03eb2d824aaaa49d39139e7ac3c7851c0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://mail.online.lv/css/style_ajax_breeze.css?v=1033630
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Fri, 13 Sep 2024 05:22:45 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400; includeSubDomains
Last-Modified: Mon, 4 Mar 2024 13:29:19 GMT
Server: Axigen-Webproxy
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/png; charset=utf-8
Connection: Keep-Alive
Content-Length: 540677
Expires: Fri, 20 Sep 2024 05:22:45 GMT

GET Source_Sans_Pro_400.woff2
mail.online.lv/fonts/ 0
0

GET Source_Sans_Pro_200.woff2
mail.online.lv/fonts/ 0
0

GET Source_Sans_Pro_400.woff
mail.online.lv/fonts/ 0
0

GET Source_Sans_Pro_200.woff
mail.online.lv/fonts/ 0
0

GET
H2 404 favicon-32x32.png
instor.ir/ 708 B
1 KB 135ms
135ms Other
text/html 217.144.104.114
NETMIHAN

General

Check archive.org

Show headers Download Go to

Full URL: https://instor.ir/favicon-32x32.png?v=1033630
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 217.144.104.114 , Iran, Islamic Republic Of, ASN204213 (NETMIHAN, IR),
Reverse DNS: cp35.mihanvps.com
Software: nginx /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

Referer: https://instor.ir/portal.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 13 Sep 2024 05:22:46 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
server: nginx
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 708
content-type: text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mail.online.lv
URL: https://mail.online.lv/fonts/Source_Sans_Pro_400.woff2

Domain: mail.online.lv
URL: https://mail.online.lv/fonts/Source_Sans_Pro_200.woff2

Domain: mail.online.lv
URL: https://mail.online.lv/fonts/Source_Sans_Pro_400.woff

Domain: mail.online.lv
URL: https://mail.online.lv/fonts/Source_Sans_Pro_200.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://instor.ir/i18n_t.js Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://instor.ir/portal.html Message: Access to font at 'https://mail.online.lv/fonts/Source_Sans_Pro_400.woff2' from origin 'https://instor.ir' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://mail.online.lv/fonts/Source_Sans_Pro_400.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://instor.ir/portal.html Message: Access to font at 'https://mail.online.lv/fonts/Source_Sans_Pro_200.woff2' from origin 'https://instor.ir' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://mail.online.lv/fonts/Source_Sans_Pro_200.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://instor.ir/portal.html Message: Access to font at 'https://mail.online.lv/fonts/Source_Sans_Pro_400.woff' from origin 'https://instor.ir' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://mail.online.lv/fonts/Source_Sans_Pro_400.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://instor.ir/portal.html Message: Access to font at 'https://mail.online.lv/fonts/Source_Sans_Pro_200.woff' from origin 'https://instor.ir' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://mail.online.lv/fonts/Source_Sans_Pro_200.woff Message: Failed to load resource: net::ERR_FAILED
recommendation	verbose	URL: https://instor.ir/portal.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://instor.ir/portal.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://instor.ir/favicon-32x32.png?v=1033630 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acctcdn.msftauth.net
instor.ir
mail.online.lv
mail.online.lv
217.144.104.114
2606:2800:233:1cb7:261b:1f9c:2074:3c
81.198.164.193
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
07fdcec52ae75b15593b6ac8aedad9ca534cdb68ccf7872daf8641d562a0cd63
0f6b571b9a0bceb5f58c46e24a1b600ddc9cdedc0fcbcd572c8339b693782ab5
214acb465662759602470ac8e4a268c1e862f129bc57ad75efb87b6505c8d10a
2f49b192440d69cafeac01ade4c670b45f0f1b7570132a5ba3fe4c31ff42b884
30eb8c689079b4e5a9c24a805d8b188c0a050d60a4442b27a12b42f30770270d
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
411d98c4a310d462eacff821993bbc0f448254e165e5804339e11efca9031bae
5f86b755a96d3e0cf3220ba3c8f139757997888ebb25898418ed901374bf8262
861e2454175200623d67aba0f898978af7fd3b28299d81b9ecb31340b60f3f65
95d9da4323bcdc2a28bcaa08aa687de82d5b33b354aa156a377125e926b601b8
9ac8cfed66a01c524b527e8449ce337003ecc7076346f13419f8433bb78ce28b
9c58e15555dc90abba5267a854147d03eb2d824aaaa49d39139e7ac3c7851c0e
a8fe8c3c6fc487521ed9c59b6e2b2cdbfc0430c41ba05bc11f1a038936850dd9
c4a2f3bcf1eaec004f97e830b184cd4f7429fde1af1bc5e6824133aa97c12637
ec1f1e869db0c3808738937365087a460f8ff902dafa018836663a60883ec360
f66cedc791b747ef162aa19bb0de83a6a2de47ddd67d2715685ab6e72165a63c

instor.ir Open in urlscan Pro 217.144.104.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

22 Requests

82 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

736 kBTransfer

1323 kBSize

0 Cookies

2 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

0 Cookies

12 Console Messages

Indicators

instor.ir Open in urlscan Pro
217.144.104.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

82 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

736 kB
Transfer

1323 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!