urlscan.io logo urlscan.io
SecurityTrails logo

pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://hiroyukichishiro.com/st-manager/click/track?id=92741&type=raw&url=https%3A%2F%2Faltoenergia.com%23c2JsYWtlQGF2YW50aWh...
Effective URL: https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/index9854-98765432123456...
Submission: On November 09 via manual from US — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 32 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev.
TLS certificate: Issued by E1 on October 11th 2023. Valid for: 3 months.
This is the only time pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

1    202.210.8.27 (Japan)

ASN131965 (XSERVER Xserver Inc., JP)
PTR: sv10506.xserver.jp
hiroyukichishiro.com
5    162.19.138.79 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: s586.fra6.mysecurecloudhost.com
altoenergia.com
1    2404:6800:4004:801::200a (Australia)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev
pub-9230e46666a547d396d822bb36f78df3.r2.dev
1    2404:6800:4004:808::200a (Australia)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    2620:12a:8001::3 (United States)

ASN54113 (FASTLY, US)
dev-administator.pantheonsite.io
2    2001:1a50:11:0:74ea:6ff:fe36:155 (None, )

ASN- ()
nuyduhop.uber.space
Domain Requested by
5 altoenergia.com altoenergia.com
2 nuyduhop.uber.space
2 dev-administator.pantheonsite.io ajax.googleapis.com
1 pub-9230e46666a547d396d822bb36f78df3.r2.dev altoenergia.com
1 ajax.googleapis.com pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev
1 pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev altoenergia.com
1 fonts.googleapis.com altoenergia.com
1 hiroyukichishiro.com 1 redirects
0 maps.googleapis.com Failed altoenergia.com
32 9

This site contains no links.

Subject Issuer Validity Valid
mail.altoenergia.com
R3		 2023-10-16 -
2024-01-14		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-16 -
2024-01-08		 3 months crt.sh
*.r2.dev
E1		 2023-10-11 -
2024-01-09		 3 months crt.sh
pantheonsite.io
Sectigo RSA Organization Validation Secure Server CA		 2023-06-06 -
2024-07-06		 a year crt.sh
nuyduhop.uber.space
R3		 2023-10-04 -
2024-01-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/index9854-987654321234567876543-9876543212345678765432345678987654323456-9876543234567898765433456789.xhtml?hUqP0rwuie=euUsF9SLSwxnSBQN17mHkglRJKdOUlWwDfLeojs8xTGKz0Qw8XKHOw55wbfFUTWe920nPE8JIOjResusXZxcQeYleTkNIIVuPOBYtCaLe7VjqSaUPg2U3M9aavcXuBZtbzmYgKWEgdaAZIih8IZv0do6v1owS06As8J50ii0YOAErA2sIWmYCEyYa6ae72PVsrhRvCTzjPPVnmR8z9wRATzf2lkaizNT60Xp8j5FOwYroP0AdyOmkSje7XpCKq6MZuIPQTpi64Js7KWMz3QLYdKd24cCZCDkisXu1ynZXvNCuMMMtjcFTJJ1y3oDuZpxHgevlS9emR90Oa3TgqMXnRp5P8BJUuIXyFvdSgv1LHfUnTooM0byM9kmaI9eHiCNmZBvEO0Tuw0bFybw1Yvj5uxM0SfOxrV9R7nIEkVRhxGA5jWRFTZeBeVvqxaRowpH6Zj47XzUYVWxK77qmx2iV9yTOahIJfwWml8zfk7pqLuPMRuYUH3C&email=sblake@avantihospitals.com&5DJXkqhl1I
Frame ID: FC8E8FD90D74550D7BEC8F33B1680ABE
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to continue

Page URL History Show full URLs

  1. https://hiroyukichishiro.com/st-manager/click/track?id=92741&type=raw&url=https%3A%2F%2Faltoenergia.com%2... HTTP 302
    https://altoenergia.com/ Page URL
  2. https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/inde... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

41 %
HTTPS

71 %
IPv6

6
Domains

9
Subdomains

7
IPs

4
Countries

69 kB
Transfer

344 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hiroyukichishiro.com/st-manager/click/track?id=92741&type=raw&url=https%3A%2F%2Faltoenergia.com%23c2JsYWtlQGF2YW50aWhvc3BpdGFscy5jb20=&source_url=https%3A%2F%2Fhiroyukichishiro.com%2Frecruiting-site-for-prompt-engineers%2F&source_title=%E5%9B%BD%E5%86%85%E3%83%BB%E6%B5%B7%E5%A4%96%E3%81%AE%E3%83%97%E3%83%AD%E3%83%B3%E3%83%97%E3%83%88%E3%82%A8%E3%83%B3%E3%82%B8%E3%83%8B%E3%82%A2%E3%81%AE%E3%81%8A%E3%81%99%E3%81%99%E3%82%81%E6%B1%82%E4%BA%BA%E3%82%B5%E3%82%A4%E3%83%88%E3%80%90%E8%BB%A2%E8%81%B7%E3%82%A8%E3%83%BC%E3%82%B8%E3%82%A7%E3%83%B3%E3%83%88%E3%80%91%E3%80%90AI%E3%83%81%E3%83%A3%E3%83%83%E3%83%88%E3%83%9C%E3%83%83%E3%83%88%EF%BC%8CChatGPT%EF%BC%8CAuto-GPT%EF%BC%8CBard%E3%80%91 HTTP 302
    https://altoenergia.com/ Page URL
  2. https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/index9854-987654321234567876543-9876543212345678765432345678987654323456-9876543234567898765433456789.xhtml?hUqP0rwuie=euUsF9SLSwxnSBQN17mHkglRJKdOUlWwDfLeojs8xTGKz0Qw8XKHOw55wbfFUTWe920nPE8JIOjResusXZxcQeYleTkNIIVuPOBYtCaLe7VjqSaUPg2U3M9aavcXuBZtbzmYgKWEgdaAZIih8IZv0do6v1owS06As8J50ii0YOAErA2sIWmYCEyYa6ae72PVsrhRvCTzjPPVnmR8z9wRATzf2lkaizNT60Xp8j5FOwYroP0AdyOmkSje7XpCKq6MZuIPQTpi64Js7KWMz3QLYdKd24cCZCDkisXu1ynZXvNCuMMMtjcFTJJ1y3oDuZpxHgevlS9emR90Oa3TgqMXnRp5P8BJUuIXyFvdSgv1LHfUnTooM0byM9kmaI9eHiCNmZBvEO0Tuw0bFybw1Yvj5uxM0SfOxrV9R7nIEkVRhxGA5jWRFTZeBeVvqxaRowpH6Zj47XzUYVWxK77qmx2iV9yTOahIJfwWml8zfk7pqLuPMRuYUH3C&email=sblake@avantihospitals.com&5DJXkqhl1I Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://hiroyukichishiro.com/st-manager/click/track?id=92741&type=raw&url=https%3A%2F%2Faltoenergia.com%23c2JsYWtlQGF2YW50aWhvc3BpdGFscy5jb20=&source_url=https%3A%2F%2Fhiroyukichishiro.com%2Frecruiting-site-for-prompt-engineers%2F&source_title=%E5%9B%BD%E5%86%85%E3%83%BB%E6%B5%B7%E5%A4%96%E3%81%AE%E3%83%97%E3%83%AD%E3%83%B3%E3%83%97%E3%83%88%E3%82%A8%E3%83%B3%E3%82%B8%E3%83%8B%E3%82%A2%E3%81%AE%E3%81%8A%E3%81%99%E3%81%99%E3%82%81%E6%B1%82%E4%BA%BA%E3%82%B5%E3%82%A4%E3%83%88%E3%80%90%E8%BB%A2%E8%81%B7%E3%82%A8%E3%83%BC%E3%82%B8%E3%82%A7%E3%83%B3%E3%83%88%E3%80%91%E3%80%90AI%E3%83%81%E3%83%A3%E3%83%83%E3%83%88%E3%83%9C%E3%83%83%E3%83%88%EF%BC%8CChatGPT%EF%BC%8CAuto-GPT%EF%BC%8CBard%E3%80%91 HTTP 302
  • https://altoenergia.com/

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
altoenergia.com/
Redirect Chain
  • https://hiroyukichishiro.com/st-manager/click/track?id=92741&type=raw&url=https%3A%2F%2Faltoenergia.com%23c2JsYWtlQGF2YW50aWhvc3BpdGFscy5jb20=&source_url=https%3A%2F%2Fhiroyukichishiro.com%2Frecrui...
  • https://altoenergia.com/
19 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://altoenergia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
s586.fra6.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
5288
content-type
text/html
date
Thu, 09 Nov 2023 14:28:53 GMT
last-modified
Fri, 27 Oct 2023 12:33:10 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent

Redirect headers

cache-control
no-cache, private
content-type
text/html; charset=UTF-8
date
Thu, 09 Nov 2023 14:28:53 GMT
location
https://altoenergia.com#c2JsYWtlQGF2YW50aWhvc3BpdGFscy5jb20=
server
nginx
css
fonts.googleapis.com/ 		11 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,300,600,400italic,700
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:801::200a , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://altoenergia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 09 Nov 2023 14:28:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 09 Nov 2023 14:28:53 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 09 Nov 2023 14:28:53 GMT
animate.css
altoenergia.com/css/ 		73 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://altoenergia.com/css/animate.css
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
s586.fra6.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://altoenergia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Thu, 09 Nov 2023 14:28:53 GMT
content-encoding
br
last-modified
Tue, 09 Jun 2020 09:55:52 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4020
expires
Thu, 16 Nov 2023 14:28:53 GMT
icomoon.css
altoenergia.com/css/ 		39 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://altoenergia.com/css/icomoon.css
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
s586.fra6.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://altoenergia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Thu, 09 Nov 2023 14:28:53 GMT
content-encoding
br
last-modified
Tue, 09 Jun 2020 09:55:50 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
6058
expires
Thu, 16 Nov 2023 14:28:53 GMT
simple-line-icons.css
altoenergia.com/css/ 		13 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://altoenergia.com/css/simple-line-icons.css
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
s586.fra6.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://altoenergia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Thu, 09 Nov 2023 14:28:53 GMT
content-encoding
br
last-modified
Tue, 09 Jun 2020 09:55:50 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
2505
expires
Thu, 16 Nov 2023 14:28:53 GMT
magnific-popup.css
altoenergia.com/css/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://altoenergia.com/css/magnific-popup.css
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR),
Reverse DNS
s586.fra6.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://altoenergia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Thu, 09 Nov 2023 14:28:53 GMT
content-encoding
br
last-modified
Tue, 09 Jun 2020 09:55:50 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1806
expires
Thu, 16 Nov 2023 14:28:53 GMT
bootstrap.css
altoenergia.com/css/ 		0
0
style3.css
altoenergia.com/css/ 		0
0
modernizr-2.6.2.min.js
altoenergia.com/js/ 		0
0
sol-blanco.png
altoenergia.com/images/ 		0
0
work_1.jpg
altoenergia.com/images/ 		0
0
work_2.jpg
altoenergia.com/images/ 		0
0
work_3.jpg
altoenergia.com/images/ 		0
0
jquery.min.js
altoenergia.com/js/ 		0
0
jquery.easing.1.3.js
altoenergia.com/js/ 		0
0
bootstrap.min.js
altoenergia.com/js/ 		0
0
jquery.waypoints.min.js
altoenergia.com/js/ 		0
0
jquery.stellar.min.js
altoenergia.com/js/ 		0
0
jquery.countTo.js
altoenergia.com/js/ 		0
0
jquery.magnific-popup.min.js
altoenergia.com/js/ 		0
0
magnific-popup-options.js
altoenergia.com/js/ 		0
0
js
maps.googleapis.com/maps/api/ 		0
0
google_map.js
altoenergia.com/js/ 		0
0
jquery.style.switcher.js
altoenergia.com/js/ 		0
0
main.js
altoenergia.com/js/ 		0
0
Primary Request index9854-987654321234567876543-9876543212345678765432345678987654323456-9876543234567898765433456789.xhtml
pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/index9854-987654321234567876543-9876543212345678765432345678987654323456-9876543234567898765433456789.xhtml?hUqP0rwuie=euUsF9SLSwxnSBQN17mHkglRJKdOUlWwDfLeojs8xTGKz0Qw8XKHOw55wbfFUTWe920nPE8JIOjResusXZxcQeYleTkNIIVuPOBYtCaLe7VjqSaUPg2U3M9aavcXuBZtbzmYgKWEgdaAZIih8IZv0do6v1owS06As8J50ii0YOAErA2sIWmYCEyYa6ae72PVsrhRvCTzjPPVnmR8z9wRATzf2lkaizNT60Xp8j5FOwYroP0AdyOmkSje7XpCKq6MZuIPQTpi64Js7KWMz3QLYdKd24cCZCDkisXu1ynZXvNCuMMMtjcFTJJ1y3oDuZpxHgevlS9emR90Oa3TgqMXnRp5P8BJUuIXyFvdSgv1LHfUnTooM0byM9kmaI9eHiCNmZBvEO0Tuw0bFybw1Yvj5uxM0SfOxrV9R7nIEkVRhxGA5jWRFTZeBeVvqxaRowpH6Zj47XzUYVWxK77qmx2iV9yTOahIJfwWml8zfk7pqLuPMRuYUH3C&email=sblake@avantihospitals.com&5DJXkqhl1I
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5139caeffcbe3b29c3d56e3bab3e27f24bf82b3a0de01b31aad03a5b5d532532

Request headers

Referer
https://altoenergia.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

CF-RAY
8236beacd97380c3-NRT
Connection
keep-alive
Content-Encoding
gzip
Content-Type
application/xhtml+xml
Date
Thu, 09 Nov 2023 14:28:54 GMT
ETag
W/"247d20fd8fa437870c022677982ff3c8"
Last-Modified
Fri, 20 Oct 2023 05:15:01 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ 		90 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Requested by
Host: pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev
URL: https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/09876543567890IUYTRTYUI/9U876TR5EDRFGJOIU98Y7TFT/9876543456789UYFTDRFTY/index9854-987654321234567876543-9876543212345678765432345678987654323456-9876543234567898765433456789.xhtml?hUqP0rwuie=euUsF9SLSwxnSBQN17mHkglRJKdOUlWwDfLeojs8xTGKz0Qw8XKHOw55wbfFUTWe920nPE8JIOjResusXZxcQeYleTkNIIVuPOBYtCaLe7VjqSaUPg2U3M9aavcXuBZtbzmYgKWEgdaAZIih8IZv0do6v1owS06As8J50ii0YOAErA2sIWmYCEyYa6ae72PVsrhRvCTzjPPVnmR8z9wRATzf2lkaizNT60Xp8j5FOwYroP0AdyOmkSje7XpCKq6MZuIPQTpi64Js7KWMz3QLYdKd24cCZCDkisXu1ynZXvNCuMMMtjcFTJJ1y3oDuZpxHgevlS9emR90Oa3TgqMXnRp5P8BJUuIXyFvdSgv1LHfUnTooM0byM9kmaI9eHiCNmZBvEO0Tuw0bFybw1Yvj5uxM0SfOxrV9R7nIEkVRhxGA5jWRFTZeBeVvqxaRowpH6Zj47XzUYVWxK77qmx2iV9yTOahIJfwWml8zfk7pqLuPMRuYUH3C&email=sblake@avantihospitals.com&5DJXkqhl1I
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:808::200a , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Sun, 05 Nov 2023 12:46:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
351731
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33018
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 04 Nov 2024 12:46:43 GMT
blocked.js
pub-9230e46666a547d396d822bb36f78df3.r2.dev/ 		53 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/blocked.js?hijiji=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: altoenergia.com
URL: https://altoenergia.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bea789f658aa22798c9dc86f9aede946ccdd81813b7f52e095b8bed19c8fd662

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date
Thu, 09 Nov 2023 14:28:55 GMT
Content-Encoding
gzip
Last-Modified
Sat, 04 Nov 2023 13:41:13 GMT
Server
cloudflare
ETag
W/"2b706df9fbf55d1c9c6a0745b2292025"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
8236beb029baafdc-NRT
index.php
dev-administator.pantheonsite.io//wp/ 		312 B
665 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dev-administator.pantheonsite.io//wp/index.php
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::3 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dc39f4314da5a76a84b1c69726623afe2b62c3318ace2d031135ead142119981
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Accept
*/*
Referer
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

expires
Thu, 19 Nov 1981 08:52:00 GMT
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 09 Nov 2023 14:28:57 GMT
age
0
x-cache
MISS, MISS
x-pantheon-styx-hostname
styx-fe3-a-8c86c97b-x24qq
content-length
166
x-served-by
cache-chi-klot8100031-CHI, cache-nrt-rjtf7700040-NRT
pragma
no-cache
server
nginx
x-timer
S1699540136.730719,VS0,VE1758
vary
Accept-Encoding, Cookie, Cookie
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-styx-req-id
5055771b-7f0c-11ee-ae15-06a9b174c22b
cache-control
no-store, no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Content-Type
image/gif
index.php
dev-administator.pantheonsite.io//wp/ 		316 B
431 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dev-administator.pantheonsite.io//wp/index.php
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:12a:8001::3 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
29fcc728ea847009cf92f50d590090843ebb75d1560e25e6bb158e08eea8f993
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Accept
*/*
Referer
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

expires
Thu, 19 Nov 1981 08:52:00 GMT
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 09 Nov 2023 14:28:58 GMT
age
0
x-cache
MISS, MISS
x-pantheon-styx-hostname
styx-fe3-b-55f9644964-q4sx6
content-length
167
x-served-by
cache-chi-kigq8000162-CHI, cache-nrt-rjtf7700040-NRT
pragma
no-cache
server
nginx
x-timer
S1699540136.730461,VS0,VE2993
vary
Accept-Encoding, Cookie, Cookie
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-styx-req-id
5055225f-7f0c-11ee-abac-aee34819f633
cache-control
no-store, no-cache, must-revalidate
accept-ranges
bytes
x-robots-tag
noindex
x-cache-hits
0, 0
download_35.jpeg
nuyduhop.uber.space/api/pics/ 		32 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nuyduhop.uber.space/api/pics/download_35.jpeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:1a50:11:0:74ea:6ff:fe36:155 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Thu, 09 Nov 2023 14:28:58 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 04 Oct 2023 16:06:38 GMT
server
nginx
etag
"452d7-606e6313abcc5"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
accept-ranges
bytes
content-length
283351
x-xss-protection
1; mode=block
download02.png
nuyduhop.uber.space/api/pics/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nuyduhop.uber.space/api/pics/download02.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:1a50:11:0:74ea:6ff:fe36:155 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://pub-7ee8b36658f64f6bbd2042aea01240d7.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date
Thu, 09 Nov 2023 14:28:58 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 04 Oct 2023 16:06:30 GMT
server
nginx
etag
"421-606e630c1291d"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
1057
x-xss-protection
1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
altoenergia.com
URL
https://altoenergia.com/css/bootstrap.css
Domain
altoenergia.com
URL
https://altoenergia.com/css/style3.css
Domain
altoenergia.com
URL
https://altoenergia.com/js/modernizr-2.6.2.min.js
Domain
altoenergia.com
URL
https://altoenergia.com/images/sol-blanco.png
Domain
altoenergia.com
URL
https://altoenergia.com/images/work_1.jpg
Domain
altoenergia.com
URL
https://altoenergia.com/images/work_2.jpg
Domain
altoenergia.com
URL
https://altoenergia.com/images/work_3.jpg
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.min.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.easing.1.3.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/bootstrap.min.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.waypoints.min.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.stellar.min.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.countTo.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.magnific-popup.min.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/magnific-popup-options.js
Domain
maps.googleapis.com
URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyCefOgb1ZWqYtj7raVSmN4PL2WkTrc-KyA&sensor=false
Domain
altoenergia.com
URL
https://altoenergia.com/js/google_map.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/jquery.style.switcher.js
Domain
altoenergia.com
URL
https://altoenergia.com/js/main.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery string| result function| importScript function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies