pluto.eu-central-1.linodeobjects.com Open in urlscan Pro
172.104.141.98  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response pluto.eu-central-1.linodeobjects.com/	21 KB 21 KB	1149ms 384ms	Document text/html	172.104.141.98 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Full URL https://pluto.eu-central-1.linodeobjects.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 172.104.141.98 Frankfurt am Main, Germany, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS osproxy5-fra1.linode.com Software / Resource Hash b075c207fd498fc6ac29b7ba42175db0ed12daa093b18b77fc2251af894287b6 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 21106 Content-Type text/html Date Wed, 19 Apr 2023 19:58:30 GMT ETag "429800754b2cb1baf2cad4cd9729f82c" Last-Modified Wed, 12 Apr 2023 13:05:44 GMT x-amz-request-id tx000003bdcc3a2c5edb6d1-00644047e6-9286275-default x-rgw-object-type Normal
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	739ms 247ms	Script application/javascript	69.16.175.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: pluto.eu-central-1.linodeobjects.com URL: https://pluto.eu-central-1.linodeobjects.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS hwcdn.net Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers accept-language en-AU,en;q=0.9 Referer https://pluto.eu-central-1.linodeobjects.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Wed, 19 Apr 2023 19:58:31 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-152b5" vary Accept-Encoding x-hw 1681934311.dop024.la3.t,1681934311.cds107.la3.hn,1681934311.cds222.la3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
POST H/1.1	200 OK	13c3c6b.php Show response vantagemoblity.com/temp/	234 KB 235 KB	1634ms 829ms	XHR text/html	184.174.39.46 AS-COLOAM
General Check archive.org Show headers Download Go to Full URL https://vantagemoblity.com/temp/13c3c6b.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 184.174.39.46 Düsseldorf, Germany, ASN21769 (AS-COLOAM, US), Reverse DNS vmi1197263.contaboserver.net Software Apache / Resource Hash fcf382710cf80844e9f3b5a7a540dae094d9520eef8aca46c3518f0348c500cc Request headers Accept */* Referer https://pluto.eu-central-1.linodeobjects.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Wed, 19 Apr 2023 19:58:32 GMT Server Apache Transfer-Encoding chunked Access-Control-Allow-Methods GET, PUT, POST, DELETE, OPTIONS Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Keep-Alive timeout=5, max=100 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET		font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	0 0
GET		picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg aadcdn.msauth.net/shared/1.0/content/images/	0 0
GET		picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg aadcdn.msauth.net/shared/1.0/content/images/	0 0
GET		picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg aadcdn.msauth.net/shared/1.0/content/images/	0 0
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cdnjs.cloudflare.com

URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Domain

aadcdn.msauth.net

URL

https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg

Domain

aadcdn.msauth.net

URL

https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg

Domain

aadcdn.msauth.net

URL

https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| _0x22c0a8 function| _0x4876b9 function| _0x527943 function| _0x44ac06 function| _0x34a683 object| scr string| stc function| _0x5804 function| _0x1057 function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://pluto.eu-central-1.linodeobjects.com/index.html Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://pluto.eu-central-1.linodeobjects.com/index.html Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
cdnjs.cloudflare.com
code.jquery.com
pluto.eu-central-1.linodeobjects.com
vantagemoblity.com
aadcdn.msauth.net
cdnjs.cloudflare.com
172.104.141.98
184.174.39.46
69.16.175.10
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
b075c207fd498fc6ac29b7ba42175db0ed12daa093b18b77fc2251af894287b6
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
fcf382710cf80844e9f3b5a7a540dae094d9520eef8aca46c3518f0348c500cc