![](/screenshots/ea76942c-3a22-4f94-9441-304ae2b4bfc3.png)
objectstorage.ap-osaka-1.oraclecloud.com
Open in
urlscan Pro
134.70.112.3
Malicious Activity!
Public Scan
Effective URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axlktnalkpdc/b/fgfdflk-ugfgxfdzdsz/o/hhkhlkjjljohgxds%5Csa%5Cdfxhojo%3Bpindex.html
Submission: On March 20 via manual from PH — Scanned from GB
Summary
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on October 11th 2021. Valid for: a year.
This is the only time objectstorage.ap-osaka-1.oraclecloud.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 31.22.4.229 31.22.4.229 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
1 | 134.70.112.3 134.70.112.3 | 31898 (ORACLE-BM...) (ORACLE-BMC-31898) | |
3 | 3 |
ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
PTR: sv61.ifastnet10.org
zrxtv1yczk.0941.funofunkaar.com |
ASN31898 (ORACLE-BMC-31898, US)
objectstorage.ap-osaka-1.oraclecloud.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
oraclecloud.com
objectstorage.ap-osaka-1.oraclecloud.com |
37 KB |
1 |
funofunkaar.com
zrxtv1yczk.0941.funofunkaar.com |
587 B |
0 |
hamomy1z.com
Failed
login.hamomy1z.com Failed |
|
3 | 3 |
Domain | Requested by | |
---|---|---|
1 | objectstorage.ap-osaka-1.oraclecloud.com |
zrxtv1yczk.0941.funofunkaar.com
|
1 | zrxtv1yczk.0941.funofunkaar.com | |
0 | login.hamomy1z.com Failed |
objectstorage.ap-osaka-1.oraclecloud.com
|
3 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
objectstorage.ap-osaka-1.oraclecloud.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2021-10-11 - 2022-10-12 |
a year | crt.sh |
This page contains 1 frames:
Frame:
https://login.hamomy1z.com/wpkBzXCL
Frame ID: 03F74B1F17BCB7374A1B34BB5D9DED91
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/ea76942c-3a22-4f94-9441-304ae2b4bfc3.png)
Page URL History Show full URLs
- http://zrxtv1yczk.0941.funofunkaar.com/.zrXTV1yCZk.aHR0cHM6Ly9vYmplY3RzdG9yYWdlLmFwLW9zYWthLTEub3JhY2xlY2xvdWQuY29t... Page URL
- https://objectstorage.ap-osaka-1.oraclecloud.com/n/axlktnalkpdc/b/fgfdflk-ugfgxfdzdsz/o/hhkhlkjjljohgxds%5Csa%5Cdfxhojo%3Bpin... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://zrxtv1yczk.0941.funofunkaar.com/.zrXTV1yCZk.aHR0cHM6Ly9vYmplY3RzdG9yYWdlLmFwLW9zYWthLTEub3JhY2xlY2xvdWQuY29tL24vYXhsa3RuYWxrcGRjL2IvZmdmZGZsay11Z2ZneGZkemRzei9vL2hoa2hsa2pqbGpvaGd4ZHMlNUNzYSU1Q2RmeGhvam8lM0JwaW5kZXguaHRtbCM4NzA2MTcyNjk3NDYxNDA2ODYxNzI2YzY1Nzk3MzZjNzQ2NDJlNjM2ZjZk Page URL
- https://objectstorage.ap-osaka-1.oraclecloud.com/n/axlktnalkpdc/b/fgfdflk-ugfgxfdzdsz/o/hhkhlkjjljohgxds%5Csa%5Cdfxhojo%3Bpindex.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
.zrXTV1yCZk.aHR0cHM6Ly9vYmplY3RzdG9yYWdlLmFwLW9zYWthLTEub3JhY2xlY2xvdWQuY29tL24vYXhsa3RuYWxrcGRjL2IvZmdmZGZsay11Z2ZneGZkemRzei9vL2hoa2hsa2pqbGpvaGd4ZHMlNUNzYSU1Q2RmeGhvam8lM0JwaW5kZXguaHRtbCM4NzA2M...
zrxtv1yczk.0941.funofunkaar.com/ |
661 B 587 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
hhkhlkjjljohgxds%5Csa%5Cdfxhojo%3Bpindex.html
objectstorage.ap-osaka-1.oraclecloud.com/n/axlktnalkpdc/b/fgfdflk-ugfgxfdzdsz/o/ |
37 KB 37 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
wpkBzXCL
login.hamomy1z.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.hamomy1z.com
- URL
- https://login.hamomy1z.com/wpkBzXCL
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.hamomy1z.com
objectstorage.ap-osaka-1.oraclecloud.com
zrxtv1yczk.0941.funofunkaar.com
login.hamomy1z.com
134.70.112.3
31.22.4.229
739b985c2ecdf3cdc6fc6348b9afe6d9f16ab2795d79153c07bbcfde2393f876
a00f7ed35be5bfea9cbbdcbeca07f536d9db6fb6391ca55ad38790eecb01ffeb