siasky.net - urlscan.io

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 162.244.81.164, located in United States and belongs to SERVERROOM, US. The main domain is siasky.net. The Cisco Umbrella rank of the primary domain is 343578.
TLS certificate: Issued by R3 on September 6th 2022. Valid for: 3 months.

This is the only time siasky.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	162.244.81.164 162.244.81.164	19624 (SERVERROOM) (SERVERROOM)
1	2607:f8b0:400... 2607:f8b0:4006:81c::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2607:f8b0:400... 2607:f8b0:4006:81e::200a	15169 (GOOGLE) (GOOGLE)
4	5

2 162.244.81.164 (United States) 1 redirects

ASN19624 (SERVERROOM, US)
PTR: sreelakshmi.ananthapuri.com

siasky.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::200e (United States)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::200a (United States)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	siasky.net 1 redirects siasky.net — Cisco Umbrella Rank: 343578	27 KB
1	googleapis.com firebasestorage.googleapis.com — Cisco Umbrella Rank: 5172
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 665	30 KB
1	gstatic.com encrypted-tbn0.gstatic.com	2 KB
4	4

	Domain	Requested by
2	siasky.net	1 redirects
1	firebasestorage.googleapis.com	siasky.net
1	code.jquery.com	siasky.net
1	encrypted-tbn0.gstatic.com	siasky.net
4	4

This site contains links to these domains. Also see Links.

Domain
www.premierpawn.com

Subject Issuer	Validity	Valid
siasky.net R3	`2022-09-06` - `2022-12-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ
Frame ID: E7A65F06169ABA4196AF7B336F23A69B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign | SharePoint

Page URL History Show full URLs

http://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ HTTP 301
https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

59 kB
Transfer

150 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/passchallenge.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=uzohifeanyi@outlook.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#home
Title: SharePoint

Search URL Search Domain Scan URL

URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/passchallenge.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=uzohifeanyi@outlook.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#news
Title: DOC Q0017 - 3512C.Doc

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ HTTP 301
https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ Show response
siasky.net/
Redirect Chain

http://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ
https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ

40 KB
27 KB

2079ms
1975ms

Document
text/html

162.244.81.164
SERVERROOM

General

Check archive.org

Show headers Download Go to

Full URL

https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.244.81.164 , United States, ASN19624 (SERVERROOM, US),

Reverse DNS

sreelakshmi.ananthapuri.com

Software

openresty/1.21.4.1 /

Resource Hash

5e539df0d697592c1aa176c7b193ae633891424e213daee08979aa7a2b42e198

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,If-None-Match,Cache-Control,Content-Type,Range,X-HTTP-Method-Override,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location,Skynet-API-Key
access-control-allow-methods: GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE
access-control-expose-headers: Content-Length,Content-Range,ETag,Accept-Ranges,Skynet-File-Metadata,Skynet-Skylink,Skynet-Proof,Skynet-Portal-Api,Skynet-Server-Api,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location
content-disposition: inline; filename="shaspoint.html"
content-encoding: gzip
content-type: text/html
date: Sat, 29 Oct 2022 15:09:07 GMT
etag: W/"a68726daeed8027348e856fc1529163136768b916a2ac52cdddf40e7359bf969"
server: openresty/1.21.4.1
skynet-cache-ratio: 1
skynet-portal-api: https://siasky.net
skynet-server-api: https://us-va-3.siasky.net
skynet-skylink: JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ
strict-transport-security: max-age=63072000
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 175
Content-Type: text/html
Date: Sat, 29 Oct 2022 15:09:05 GMT
Location: https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ
Server: openresty/1.21.4.1
Skynet-Portal-Api: http://
Skynet-Server-Api: http://

GET
H2 200 images
encrypted-tbn0.gstatic.com/ 1 KB
2 KB 136ms
39ms Image
image/png 2607:f8b0:4006:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSWSjpDaJch7A32iI2FZVMbsXS35IpPPyHh5A&usqp=CAU

Requested by

Host: siasky.net
URL: https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86e4d0c65be1364f0a0e3d3ab7d514bf3c252a6001d5fc6712bf754732963fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://siasky.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 29 Oct 2022 04:45:26 GMT
x-content-type-options: nosniff
age: 37421
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1253
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 20:25:24 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sun, 29 Oct 2023 04:45:26 GMT

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 90ms
28ms Script
application/javascript 2001:4de0:ac18::1:a:2b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: siasky.net
URL: https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://siasky.net/
Origin: https://siasky.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 29 Oct 2022 15:09:07 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-15d84"
vary: Accept-Encoding
x-hw: 1667056147.dop229.ch4.t,1667056147.cds243.ch4.hn,1667056147.cds206.ch4.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H2 412 amazonjquery%2Fjquery.min.js
firebasestorage.googleapis.com/v0/b/awesomeowa.appspot.com/o/ 0
0 209ms
108ms Script
application/json 2607:f8b0:4006:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://firebasestorage.googleapis.com/v0/b/awesomeowa.appspot.com/o/amazonjquery%2Fjquery.min.js?alt=media&token=2c7d4583-2c10-455d-8396-3da8f57595a5
Requested by: Host: siasky.net
URL: https://siasky.net/JABvPGnogMKcS_wzdF7Qs4IvD73hiWxBM424oYc-DA10gQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://siasky.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://firebasestorage.googleapis.com/v0/b/awesomeowa.appspot.com/o/amazonjquery%2Fjquery.min.js?alt=media&token=2c7d4583-2c10-455d-8396-3da8f57595a5 Message: Failed to load resource: the server responded with a status of 412 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
encrypted-tbn0.gstatic.com
firebasestorage.googleapis.com
siasky.net
162.244.81.164
2001:4de0:ac18::1:a:2b
2607:f8b0:4006:81c::200e
2607:f8b0:4006:81e::200a
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4
5e539df0d697592c1aa176c7b193ae633891424e213daee08979aa7a2b42e198
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece
a86e4d0c65be1364f0a0e3d3ab7d514bf3c252a6001d5fc6712bf754732963fd
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

siasky.net Open in urlscan Pro 162.244.81.164 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

59 kBTransfer

150 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

siasky.net Open in urlscan Pro
162.244.81.164 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

59 kB
Transfer

150 kB
Size

0
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!