objectstorage.ap-osaka-1.oraclecloud.com Open in urlscan Pro
134.70.112.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://119293.119293.a4.com.tr/.119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9DdW1taW5zI2FubmEubmVl...
Effective URL:
https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Submission: On January 14 via automatic, source openphish (January 14th 2022, 1:29:23 am UTC) — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 7 domains to perform 10 HTTP transactions. The main IP is 134.70.112.3, located in Osaka, Japan and belongs to ORACLE-BMC-31898, US. The main domain is objectstorage.ap-osaka-1.oraclecloud.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on October 11th 2021. Valid for: a year.

This is the only time objectstorage.ap-osaka-1.oraclecloud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	193.36.63.25 193.36.63.25	201086 (SERVERPLUS) (SERVERPLUS)
1 2	45.158.12.7 45.158.12.7	211871 (ODEAWEB) (ODEAWEB)
1	134.70.112.3 134.70.112.3	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
4	2620:1ec:bdf::44 2620:1ec:bdf::44	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	54.91.59.199 54.91.59.199	14618 (AMAZON-AES) (AMAZON-AES)
1	109.169.71.112 109.169.71.112	20860 (IOMART-AS) (IOMART-AS)
10	7

1 193.36.63.25 (Turkey)

ASN201086 (SERVERPLUS, TR)
PTR: cloud.serverplus.com.tr

119293.119293.a4.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 45.158.12.7 (Izmir, Turkey) 1 redirects

ASN211871 (ODEAWEB, TR)
PTR: saturn.odeaweb.com

torbalinakliyat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.torbalinakliyat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.70.112.3 (Osaka, Japan)

ASN31898 (ORACLE-BMC-31898, US)

objectstorage.ap-osaka-1.oraclecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:bdf::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.91.59.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-91-59-199.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.169.71.112 (Catterick, United Kingdom)

ASN20860 (IOMART-AS, GB)

smtpjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1212	4 KB
2	torbalinakliyat.com 1 redirects torbalinakliyat.com www.torbalinakliyat.com	718 B
1	smtpjs.com smtpjs.com — Cisco Umbrella Rank: 89269	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 3301	219 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 541	30 KB
1	oraclecloud.com objectstorage.ap-osaka-1.oraclecloud.com	109 KB
1	a4.com.tr 119293.119293.a4.com.tr	843 B
10	7

	Domain	Requested by
4	aadcdn.msauth.net	objectstorage.ap-osaka-1.oraclecloud.com
1	smtpjs.com	objectstorage.ap-osaka-1.oraclecloud.com
1	api.ipify.org	objectstorage.ap-osaka-1.oraclecloud.com
1	code.jquery.com	objectstorage.ap-osaka-1.oraclecloud.com
1	objectstorage.ap-osaka-1.oraclecloud.com	www.torbalinakliyat.com
1	www.torbalinakliyat.com	119293.119293.a4.com.tr
1	torbalinakliyat.com	1 redirects
1	119293.119293.a4.com.tr
10	8

This site contains no links.

Subject Issuer	Validity	Valid
torbalinakliyat.com ZeroSSL RSA Domain Secure Site CA	`2021-11-27` - `2022-02-25`	3 months	crt.sh
objectstorage.ap-osaka-1.oraclecloud.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2021-10-11` - `2022-10-12`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2021-07-08` - `2022-07-08`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2021-01-19` - `2022-02-19`	a year	crt.sh
smtpjs.com R3	`2021-12-20` - `2022-03-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Frame ID: B3FE20231BDDD3C3A4DA6C656F87B317
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

http://119293.119293.a4.com.tr/.119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9D... Page URL
https://torbalinakliyat.com/.wp/119293/anna.neese/Cummins HTTP 301
https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins Page URL
https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdr... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

29 %
IPv6

7
Domains

8
Subdomains

7
IPs

5
Countries

145 kB
Transfer

198 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://119293.119293.a4.com.tr/.119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9DdW1taW5zI2FubmEubmVlc2VAY3VtbWlucy5jb20 Page URL
https://torbalinakliyat.com/.wp/119293/anna.neese/Cummins HTTP 301
https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins Page URL
https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://torbalinakliyat.com/.wp/119293/anna.neese/Cummins HTTP 301
https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK .119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9DdW1taW5zI2FubmEubmVlc2VAY3VtbWlucy5jb20
119293.119293.a4.com.tr/ 661 B
843 B 192ms
41ms Document
text/html 193.36.63.25
SERVERPLUS

General

Check archive.org

Show headers Download Go to

Full URL: http://119293.119293.a4.com.tr/.119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9DdW1taW5zI2FubmEubmVlc2VAY3VtbWlucy5jb20
Protocol: HTTP/1.1
Server: 193.36.63.25 , Turkey, ASN201086 (SERVERPLUS, TR),
Reverse DNS: cloud.serverplus.com.tr
Software: nginx/1.21.4 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx/1.21.4
Date: Fri, 14 Jan 2022 01:29:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2

404

Cummins
www.torbalinakliyat.com/.wp/119293/anna.neese/
Redirect Chain

https://torbalinakliyat.com/.wp/119293/anna.neese/Cummins
https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins

523 B
364 B

303ms
140ms

Document
text/html

45.158.12.7
ODEAWEB

General

Check archive.org

Show headers Download Go to

Full URL

https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins

Requested by

Host: 119293.119293.a4.com.tr
URL: http://119293.119293.a4.com.tr/.119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9DdW1taW5zI2FubmEubmVlc2VAY3VtbWlucy5jb20

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.158.12.7 Izmir, Turkey, ASN211871 (ODEAWEB, TR),

Reverse DNS

saturn.odeaweb.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://119293.119293.a4.com.tr/.119293.aHR0cHM6Ly90b3JiYWxpbmFrbGl5YXQuY29tLy53cC8xMTkyOTMvYW5uYS5uZWVzZS9DdW1taW5zI2FubmEubmVlc2VAY3VtbWlucy5jb20

Response headers

content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://www.torbalinakliyat.com/.wp/wp-json/>; rel="https://api.w.org/"
content-length: 251
content-encoding: br
vary: Accept-Encoding
date: Fri, 14 Jan 2022 01:29:16 GMT
server: LiteSpeed
x-content-type-options: nosniff

Redirect headers

content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
x-redirect-by: WordPress
location: https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins
content-length: 0
date: Fri, 14 Jan 2022 01:29:16 GMT
server: LiteSpeed
x-content-type-options: nosniff
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H/1.1 200
OK Primary Request ant-wapr-retain-pwdrecovery.html Show response
objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ 108 KB
109 KB 1031ms
267ms Document
text/html 134.70.112.3
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Requested by: Host: www.torbalinakliyat.com
URL: https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.70.112.3 Osaka, Japan, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: /
Resource Hash: a73ff6a70200b8053ddc133b05206e1a8115c644b33f28558e73dcf8378e50ac

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.torbalinakliyat.com/

Response headers

accept-ranges: bytes
Content-Length: 110427
content-md5: TBfSs4px5lzve15LWqb+Jw==
last-modified: Mon, 10 Jan 2022 14:21:30 GMT
etag: b97b0bb3-8cc8-44de-aed6-2b2bcda16b88
version-id: e07fca7a-9740-4385-afbc-68e482e159dc
storage-tier: Standard
Content-Type: text/html
date: Fri, 14 Jan 2022 01:29:17 GMT
opc-request-id: kix-1:1Yx-S64VespNStM0efrM0JbLmOAgADCqvEhhDCrW0pvUJq1r1-SQQzx4W_i5cdqh
x-api-id: native
access-control-allow-origin: *
access-control-allow-methods: POST,PUT,GET,HEAD,DELETE,OPTIONS
access-control-allow-credentials: true
access-control-expose-headers: accept-ranges,access-control-allow-credentials,access-control-allow-methods,access-control-allow-origin,content-length,content-md5,content-type,date,etag,last-modified,opc-client-info,opc-request-id,storage-tier,version-id,x-api-id

GET
H2 200 microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
aadcdn.msauth.net/ests/2.1/content/images/ 1 KB
1 KB 82ms
15ms Image
image/png 2620:1ec:bdf::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 14 Jan 2022 01:29:18 GMT
x-azure-ref-originshield: 0DW3gYQAAAAAm2YWVtT1nR6oAMrHF50v9QU1TMDRFREdFMTgwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: 7ZyesNzhfXUr7eprWs2m2Q==
x-cache: TCP_HIT
content-length: 1057
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:31 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D641015620C409
x-azure-ref: 07tHgYQAAAAD4viJY6HfzRYqiTR86EaEuRlJBMzFFREdFMDkwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: cac01b03-101e-000a-753b-083966000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
aadcdn.msauth.net/ests/2.1/content/images/ 240 B
892 B 82ms
15ms Image
image/png 2620:1ec:bdf::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 14 Jan 2022 01:29:18 GMT
x-azure-ref-originshield: 06G3fYQAAAAATi2scP78VT7Ap3p+R/QOUTE9OMjFFREdFMDEwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: fMCW2mqi26P4H8wcgmIVfA==
x-cache: TCP_HIT
content-length: 240
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:10 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D64101494D74DC
x-azure-ref: 07tHgYQAAAABYrRu7HEd1TLOn7V0ZHLtiRlJBMzFFREdFMDkwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 0bb214d3-201e-0045-6e05-086368000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
aadcdn.msauth.net/ests/2.1/content/images/ 207 B
550 B 116ms
49ms Image
image/png 2620:1ec:bdf::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 14 Jan 2022 01:29:18 GMT
x-azure-ref-originshield: 07tHgYQAAAAA9JThKbBNmTK1Hjb+H7DGFQU1TMDRFREdFMTkxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: CtQwhIAP2LUKJXa1FzdG/g==
x-cache: TCP_REMOTE_HIT
content-length: 207
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:24 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D6410151EBB082
x-azure-ref: 07tHgYQAAAADbU/LaWU3YT6hrMGkakoBsRlJBMzFFREdFMDkwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 0f7b1cba-301e-0060-782f-087551000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 58ms
17ms Script
application/javascript 2001:4de0:ac18::1:a:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 01:29:18 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2016 22:32:34 GMT
server: nginx
etag: W/"57e45c02-152b5"
vary: Accept-Encoding
x-hw: 1642123758.dop202.am5.t,1642123758.cds209.am5.hn,1642123758.cds114.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30070

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/ests/2.1/content/images/backgrounds/ 2 KB
1 KB 75ms
15ms Image
image/svg+xml 2620:1ec:bdf::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 14 Jan 2022 01:29:18 GMT
content-encoding: gzip
x-azure-ref-originshield: 0dVXfYQAAAABGGfLjtbRRT5x3M93ZwSZXTE9OMjFFREdFMDEwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: DhdidjYrlCeaRJJRG/y9mA==
x-cache: TCP_HIT
content-length: 673
x-ms-lease-status: unlocked
last-modified: Thu, 13 Feb 2020 02:05:12 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D7B0292911C366
x-azure-ref: 07tHgYQAAAACPHVPuFf4lQoiA3k5V8zBjRlJBMzFFREdFMDkwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 444fb540-001e-0057-5203-08854e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

GET
H/1.1 200
OK / Show response
api.ipify.org/ 35 B
219 B 288ms
93ms Script
application/javascript 54.91.59.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=getPublic
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.91.59.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-91-59-199.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 12e6559ef9e3c52ee0c0347fa75d64e7c56e43c21706e269afa498098430f05a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 01:29:18 GMT
Via: 1.1 vegur
Server: Cowboy
Connection: keep-alive
Content-Length: 35
Vary: Origin
Content-Type: application/javascript

GET
H2 200 smtp.js Show response
smtpjs.com/v3/ 871 B
1 KB 73ms
25ms Script
application/javascript 109.169.71.112
IOMART-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://smtpjs.com/v3/smtp.js
Requested by: Host: objectstorage.ap-osaka-1.oraclecloud.com
URL: https://objectstorage.ap-osaka-1.oraclecloud.com/n/axk9ldrhoas2/b/retain-passwordds-now-20220105-45829/o/ant-wapr-retain-pwdrecovery.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 109.169.71.112 Catterick, United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://objectstorage.ap-osaka-1.oraclecloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 01:29:18 GMT
last-modified: Tue, 10 Nov 2020 17:17:51 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "162f436b85b7d61:0"
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 871

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.torbalinakliyat.com/.wp/119293/anna.neese/Cummins#anna.neese@cummins.com#undefined Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

119293.119293.a4.com.tr
aadcdn.msauth.net
api.ipify.org
code.jquery.com
objectstorage.ap-osaka-1.oraclecloud.com
smtpjs.com
torbalinakliyat.com
www.torbalinakliyat.com
109.169.71.112
134.70.112.3
193.36.63.25
2001:4de0:ac18::1:a:3b
2620:1ec:bdf::44
45.158.12.7
54.91.59.199
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
12e6559ef9e3c52ee0c0347fa75d64e7c56e43c21706e269afa498098430f05a
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
a73ff6a70200b8053ddc133b05206e1a8115c644b33f28558e73dcf8378e50ac
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

objectstorage.ap-osaka-1.oraclecloud.com Open in urlscan Pro 134.70.112.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

29 %IPv6

7 Domains

8 Subdomains

7 IPs

5 Countries

145 kBTransfer

198 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

objectstorage.ap-osaka-1.oraclecloud.com Open in urlscan Pro
134.70.112.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

29 %
IPv6

7
Domains

8
Subdomains

7
IPs

5
Countries

145 kB
Transfer

198 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!