orodelsele.com
Open in
urlscan Pro
80.88.87.160
Malicious Activity!
Public Scan
URL:
https://orodelsele.com/cplfile/outlook/mapped.php?authe=4UY432
Submission: On October 26 via api from CA — Scanned from IT
Submission: On October 26 via api from CA — Scanned from IT
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 10 HTTP transactions.
The main IP is 80.88.87.160, located in
Arezzo, Italy and
belongs to ARUBA-ASN, IT.
The main domain is orodelsele.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 24th 2022. Valid for: 3 months.
This is the only time orodelsele.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 24th 2022. Valid for: 3 months.
This is the only time orodelsele.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 80.88.87.160 80.88.87.160 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
| 10 | 1 |
10
80.88.87.160
(Arezzo, Italy)
ASN31034 (ARUBA-ASN, IT)
PTR: linc061.arubabusiness.it
ASN31034 (ARUBA-ASN, IT)
PTR: linc061.arubabusiness.it
| orodelsele.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
orodelsele.com
orodelsele.com |
646 KB |
| 10 | 1 |
| Domain | Requested by | |
|---|---|---|
| 10 | orodelsele.com |
orodelsele.com
|
| 10 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| orodelsele.com cPanel, Inc. Certification Authority |
2022-10-24 - 2023-01-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://orodelsele.com/cplfile/outlook/mapped.php?authe=4UY432
Frame ID: 3E496CF7E24846660A08241051E27161
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Login into your Outlook Webapp AccountDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
mapped.php
orodelsele.com/cplfile/outlook/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
orodelsele.com/cplfile/outlook/vendor/bootstrap/css/ |
138 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.css
orodelsele.com/cplfile/outlook/font-awesome/css/ |
69 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
orodelsele.com/cplfile/outlook/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
outlook.png
orodelsele.com/cplfile/outlook/ |
47 KB 48 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-2.2.3.min.js
orodelsele.com/cplfile/outlook/vendor/jquery/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
orodelsele.com/cplfile/outlook/vendor/bootstrap/js/ |
50 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.js
orodelsele.com/cplfile/outlook/font-awesome/js/ |
1 MB 427 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
data.js
orodelsele.com/cplfile/outlook/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-solid-900.woff2
orodelsele.com/cplfile/outlook/font-awesome/webfonts/ |
74 KB 75 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| email object| password number| counter0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
orodelsele.com
80.88.87.160
05b29e731ac5a3e11c7b0fcde0785296c564342bcd8831c9c9206ca967224d88
2c3097237d60f42e800ebe4009c9af144bb19e5581e1c0501c7b259eee7e210c
2d9df312028db60989b9d2067b550fe36692f99dd75e7730a8757c769346ff21
52dc127d5e6245dd9b1f1ff1c75448817a69b5cc1bc6b64f6c0ee82b81e84cfa
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6b6de0d4db7876d1183a3edb47ebd3bbbf93f153f5de1ba6645049348628109a
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
9ae91a98a60159391ac5fdb2d0a1c3279e01d4e389ff19914e41256570fca637
ea470c3755ab03df351ecd688c7a30dd0f98be3bcdb60df5a410c8ba582fc220
f3c8ccac95cb1dfdcb72f5addf1d0042ff1de141904ed5e2e2e9797e2abd2861