storage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:81d::2010
Malicious Activity!
Public Scan
Submission: On June 11 via manual from US
Summary
TLS certificate: Issued by GTS CA 1O1 on May 20th 2020. Valid for: 3 months.
This is the only time storage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a00:1450:400... 2a00:1450:4001:81d::2010 | 15169 (GOOGLE) (GOOGLE) | |
9 | 2606:4700:303... 2606:4700:3031::6818:6298 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:81e::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 5 |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
ghostsmtp.com
ghostsmtp.com |
218 KB |
3 |
gstatic.com
fonts.gstatic.com |
27 KB |
2 |
googleapis.com
storage.googleapis.com fonts.googleapis.com |
11 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com |
38 KB |
15 | 4 |
Domain | Requested by | |
---|---|---|
9 | ghostsmtp.com |
storage.googleapis.com
|
3 | fonts.gstatic.com |
storage.googleapis.com
|
1 | fonts.googleapis.com |
storage.googleapis.com
|
1 | ajax.aspnetcdn.com |
storage.googleapis.com
|
1 | storage.googleapis.com | |
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.storage.googleapis.com GTS CA 1O1 |
2020-05-20 - 2020-08-12 |
3 months | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-05-08 - 2020-10-09 |
5 months | crt.sh |
*.vo.msecnd.net Microsoft IT TLS CA 2 |
2020-03-18 - 2022-03-18 |
2 years | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-05-20 - 2020-08-12 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-05-26 - 2020-08-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://storage.googleapis.com/aexcel-hercynite-545653500/index.html
Frame ID: 1BE58059216B77F1C17931787EBD9634
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
storage.googleapis.com/aexcel-hercynite-545653500/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
ghostsmtp.com/email-list/excel5/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
ghostsmtp.com/email-list/excel5/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmail.png
ghostsmtp.com/email-list/excel5/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
outlook.png
ghostsmtp.com/email-list/excel5/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol-el.png
ghostsmtp.com/email-list/excel5/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office.png
ghostsmtp.com/email-list/excel5/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo.png
ghostsmtp.com/email-list/excel5/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mail.png
ghostsmtp.com/email-list/excel5/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
13 KB 964 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.jpg
ghostsmtp.com/email-list/excel5/images/ |
179 KB 180 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| validateEmail function| window_opener_xc function| get_extra_data function| GetURLParameter0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
fonts.googleapis.com
fonts.gstatic.com
ghostsmtp.com
storage.googleapis.com
152.199.19.160
2606:4700:3031::6818:6298
2a00:1450:4001:814::200a
2a00:1450:4001:81d::2010
2a00:1450:4001:81e::2003
1389ce073991b5dd4f76a7922d577a0f01526402481dfd48a863245bca92904c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
22e6645ebb24d54ab56ad09afc621f2a72aa6263451d45ab47b75708965eefd3
3c84c6a01e844c1a29e0a3ee63d5eb5f13fae24c6c9f3455e944394406d247b9
43383d39136a4e1ef4cbf15278efb0851a430b3f60d3986e6cbbee547e30ab68
4fd3e60902a4cc0387a40638316545102c2a12ef4fa0cb8105415ba47150c61b
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
77eb337530498e2d5c6a93905ece80e9f0cde33a6e8f4b3b622c67d47773d738
8739393ae7d356ee4f7e03814cdf2cef90f2f04e7cd4a68aedb67d8f53a0ba5d
9d301bbb4e8ced380c1975a2ca3890c0cc06a3c1c78ad6b36d45e652e7a0542d
9d98e41fc1f3f2227739b3cc59a3623a1f46790d1f9187335bfa658b15a0dd7c
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a90b5fa6d77d3b2afe97c72215abfebe27170f1b4307c71bb83c819fc0a27b6f
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
f0ed507810757b0fa96725b5ede8b0e72be4cbcfee70ca664924552b41de114d