siasky.net Open in urlscan Pro
167.160.90.90  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://orders.co.jp/pl.html?email Page URL
2. https://siasky.net/CABH89cwGbOkh9Xzr-D5RBar_zj_xoYS7UQ1JHzMn5VKPA/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	pl.html orders.co.jp/	595 B 881 B	21ms 3ms	Document text/html	153.122.152.52 GMOCL GMO GlobalS...
General Check archive.org Show headers Download Go to Full URL http://orders.co.jp/pl.html?email Protocol HTTP/1.1 Server 153.122.152.52 , Japan, ASN131921 (GMOCL GMO GlobalSign Holdings K.K., JP), Reverse DNS Software Apache/2.0.64 (Unix) / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 595 Content-Type text/html Date Wed, 07 Sep 2022 13:50:06 GMT ETag "760008-253-ec7ff4c0" Keep-Alive timeout=15, max=100 Last-Modified Sat, 07 May 2022 21:47:39 GMT Server Apache/2.0.64 (Unix)
GET H2	200	Primary Request / Show response siasky.net/CABH89cwGbOkh9Xzr-D5RBar_zj_xoYS7UQ1JHzMn5VKPA/	7 KB 3 KB	2408ms 2194ms	Document text/html	167.160.90.90 DEDICATED
General Check archive.org Show headers Download Go to Full URL https://siasky.net/CABH89cwGbOkh9Xzr-D5RBar_zj_xoYS7UQ1JHzMn5VKPA/ Requested by Host: orders.co.jp URL: http://orders.co.jp/pl.html?email Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 167.160.90.90 Los Angeles, United States, ASN63018 (DEDICATED, US), Reverse DNS Software openresty/1.21.4.1 / Resource Hash 9e0ccae3e06545331a6eac5aa3c15acd27d6228447efa3bd17c191c61c569568 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers Referer http://orders.co.jp/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers DNT,User-Agent,X-Requested-With,If-Modified-Since,If-None-Match,Cache-Control,Content-Type,Range,X-HTTP-Method-Override,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location,Skynet-API-Key access-control-allow-methods GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE access-control-expose-headers Content-Length,Content-Range,ETag,Accept-Ranges,Skynet-File-Metadata,Skynet-Skylink,Skynet-Proof,Skynet-Portal-Api,Skynet-Server-Api,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location content-disposition inline; filename="indek.html" content-encoding gzip content-type text/html date Wed, 07 Sep 2022 13:50:08 GMT etag W/"4dea5649b73f17755a4a7f2b2e5cf27a859106d3038c188a5d003e3b57090378" server openresty/1.21.4.1 skynet-cache-ratio 1 skynet-portal-api https://siasky.net skynet-server-api https://us-la-2.siasky.net skynet-skylink CABH89cwGbOkh9Xzr-D5RBar_zj_xoYS7UQ1JHzMn5VKPA strict-transport-security max-age=63072000 vary Accept-Encoding
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	328ms 105ms	Script application/javascript	2001:4de0:ac18::1:a:3b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: siasky.net URL: https://siasky.net/CABH89cwGbOkh9Xzr-D5RBar_zj_xoYS7UQ1JHzMn5VKPA/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers accept-language jp-JP,jp;q=0.9 Referer https://siasky.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Wed, 07 Sep 2022 13:50:08 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15283" vary Accept-Encoding x-hw 1662558608.dop043.la3.t,1662558608.cds219.la3.hn,1662558608.cds045.la3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	31ms 11ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: siasky.net URL: https://siasky.net/CABH89cwGbOkh9Xzr-D5RBar_zj_xoYS7UQ1JHzMn5VKPA/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://siasky.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Wed, 07 Sep 2022 13:50:08 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 753, 617, 617 age 5917084 cdn-cachedat 2021-06-19 03:25:59 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 091569a016b5cc61e090d5815e862673 cf-ray 746fe967c9b5e053-NRT cdn-requestcountrycode AU cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
orders.co.jp
siasky.net
stackpath.bootstrapcdn.com
153.122.152.52
167.160.90.90
2001:4de0:ac18::1:a:3b
2606:4700::6812:acf
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9e0ccae3e06545331a6eac5aa3c15acd27d6228447efa3bd17c191c61c569568