urlscan.io logo urlscan.io
SecurityTrails logo

storage.googleapis.com Open in urlscan Pro
142.250.181.251  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://storage.googleapis.com/hasales/hasles.html#?Z289MSZzMT0xOTM1MDI0JnMyPTE0Nzk0MTg0OCZzMz1QVA==
Effective URL: https://storage.googleapis.com/hasales/hasles.html
Submission: On August 10 via manual from PT — Scanned from PT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 142.250.181.251, located in United States and belongs to GOOGLE, US. The main domain is storage.googleapis.com. The Cisco Umbrella rank of the primary domain is 492.
TLS certificate: Issued by WR2 on July 30th 2024. Valid for: 3 months.
This is the only time storage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 142.250.181.251 15169 (GOOGLE)
2 2
Apex Domain
Subdomains		 Transfer
1 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 492
724 B
0 ynitialpont.com Failed
ynitialpont.com Failed
2 2
Domain Requested by
1 storage.googleapis.com
0 ynitialpont.com Failed storage.googleapis.com
2 2

This site contains no links.

Subject Issuer Validity Valid
storage.googleapis.com
WR2		 2024-07-30 -
2024-10-22		 3 months crt.sh

This page contains 1 frames:

Frame: https://ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/147941848_456037_2
Frame ID: 9C7CADA4C36EFDF0A446A89378D71A84
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://185.34.52.250/??Z289MSZzMT0xOTM1MDI0JnMyPTE0Nzk0MTg0OCZzMz1QVA== HTTP 307
  • https://185.34.52.250/??Z289MSZzMT0xOTM1MDI0JnMyPTE0Nzk0MTg0OCZzMz1QVA== HTTP 302
  • http://185.34.52.250/public/?:nav=default::index&go=1&s1=1935024&s2=147941848 HTTP 307
  • https://185.34.52.250/public/?:nav=default::index&go=1&s1=1935024&s2=147941848 HTTP 302
  • http://185.34.52.250/?var=Om5hdj1jbGljazo6dHJhY2tlciZkZXBsb3k9MTkzNTAyNCZ1c2VyPWZzcGlub2xhODUlNDBnbWFpbC5jb20mZW1haWxfaWQ9MTQ3OTQxODQ4JnVybD1hSFIwY0hNNkx5OTVibWwwYVdGc2NHOXVkQzVqYjIwdk1DOHdMekF2WVRZeU5XRXhNRGRqTWpWbFlXRTFZVFEyWkdReVl6VmhaRGcyWkdZek5tVXZNVGt6TlRBeU5DMUJURXhmU0VGTlJVeENYMU5hWDBkTlFVbE1YMUJVTFRRMU5qQXhOeTh4TkRjNU5ERTRORGhmTkRVMk1ETTNYekk9 HTTP 307
  • https://185.34.52.250/?var=Om5hdj1jbGljazo6dHJhY2tlciZkZXBsb3k9MTkzNTAyNCZ1c2VyPWZzcGlub2xhODUlNDBnbWFpbC5jb20mZW1haWxfaWQ9MTQ3OTQxODQ4JnVybD1hSFIwY0hNNkx5OTVibWwwYVdGc2NHOXVkQzVqYjIwdk1DOHdMekF2WVRZeU5XRXhNRGRqTWpWbFlXRTFZVFEyWkdReVl6VmhaRGcyWkdZek5tVXZNVGt6TlRBeU5DMUJURXhmU0VGTlJVeENYMU5hWDBkTlFVbE1YMUJVTFRRMU5qQXhOeTh4TkRjNU5ERTRORGhmTkRVMk1ETTNYekk9 HTTP 302
  • https://185.34.52.250/public/?:nav=click::tracker&deploy=1935024&user=fspinola85%40gmail.com&email_id=147941848&url=aHR0cHM6Ly95bml0aWFscG9udC5jb20vMC8wLzAvYTYyNWExMDdjMjVlYWE1YTQ2ZGQyYzVhZDg2ZGYzNmUvMTkzNTAyNC1BTExfSEFNRUxCX1NaX0dNQUlMX1BULTQ1NjAxNy8xNDc5NDE4NDhfNDU2MDM3XzI= HTTP 302
  • https://ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/147941848_456037_2 HTTP 307
  • http://185.34.52.250/?var=Om5hdj1jbGljazo6dHJhY2tlciZkZXBsb3k9MTkzNTAyNCZ1c2VyPWZzcGlub2xhODUlNDBnbWFpbC5jb20mZW1haWxfaWQ9MTQ3OTQxODQ4JnVybD1hSFIwY0hNNkx5OTVibWwwYVdGc2NHOXVkQzVqYjIwdk1DOHdMekF2WVRZeU5XRXhNRGRqTWpWbFlXRTFZVFEyWkdReVl6VmhaRGcyWkdZek5tVXZNVGt6TlRBeU5DMUJURXhmU0VGTlJVeENYMU5hWDBkTlFVbE1YMUJVTFRRMU5qQXhOeTh4TkRjNU5ERTRORGhmTkRVMk1ETTNYekk9 HTTP 302
  • http://185.34.52.250/public/?:nav=click::tracker&deploy=1935024&user=fspinola85%40gmail.com&email_id=147941848&url=aHR0cHM6Ly95bml0aWFscG9udC5jb20vMC8wLzAvYTYyNWExMDdjMjVlYWE1YTQ2ZGQyYzVhZDg2ZGYzNmUvMTkzNTAyNC1BTExfSEFNRUxCX1NaX0dNQUlMX1BULTQ1NjAxNy8xNDc5NDE4NDhfNDU2MDM3XzI= HTTP 302
  • https://ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/147941848_456037_2

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request hasles.html
storage.googleapis.com/hasales/ 		244 B
724 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/hasales/hasles.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.251 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f27.1e100.net
Software
UploadServer /
Resource Hash
c4ae61bef77bcec2ab6dc88864e046b7b699f1a734fa946a2b0b40af0e6c8b8e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-length
244
content-type
text/html
date
Sat, 10 Aug 2024 22:34:46 GMT
etag
"c1d9b67157192314396a68642d3096ae"
expires
Sat, 10 Aug 2024 23:34:46 GMT
last-modified
Fri, 19 Jul 2024 21:32:26 GMT
server
UploadServer
x-goog-generation
1721424746851787
x-goog-hash
crc32c=2ITnnQ== md5=wdm2cVcZIxQ5amhkLTCWrg==
x-goog-metageneration
1
x-goog-storage-class
STANDARD
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
244
x-guploader-uploadid
AHxI1nOMTtJ9yAXxruhPwcHL7_USqfaXrESAYT3SorKs-OevZnhTSDNhDLLP6jll9hcM-hKeeNiPANk9lQ
147941848_456037_2
ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/
Redirect Chain
  • http://185.34.52.250/??Z289MSZzMT0xOTM1MDI0JnMyPTE0Nzk0MTg0OCZzMz1QVA==
  • https://185.34.52.250/??Z289MSZzMT0xOTM1MDI0JnMyPTE0Nzk0MTg0OCZzMz1QVA==
  • http://185.34.52.250/public/?:nav=default::index&go=1&s1=1935024&s2=147941848
  • https://185.34.52.250/public/?:nav=default::index&go=1&s1=1935024&s2=147941848
  • http://185.34.52.250/?var=Om5hdj1jbGljazo6dHJhY2tlciZkZXBsb3k9MTkzNTAyNCZ1c2VyPWZzcGlub2xhODUlNDBnbWFpbC5jb20mZW1haWxfaWQ9MTQ3OTQxODQ4JnVybD1hSFIwY0hNNkx5OTVibWwwYVdGc2NHOXVkQzVqYjIwdk1DOHdMekF2WVR...
  • https://185.34.52.250/?var=Om5hdj1jbGljazo6dHJhY2tlciZkZXBsb3k9MTkzNTAyNCZ1c2VyPWZzcGlub2xhODUlNDBnbWFpbC5jb20mZW1haWxfaWQ9MTQ3OTQxODQ4JnVybD1hSFIwY0hNNkx5OTVibWwwYVdGc2NHOXVkQzVqYjIwdk1DOHdMekF2WV...
  • https://185.34.52.250/public/?:nav=click::tracker&deploy=1935024&user=fspinola85%40gmail.com&email_id=147941848&url=aHR0cHM6Ly95bml0aWFscG9udC5jb20vMC8wLzAvYTYyNWExMDdjMjVlYWE1YTQ2ZGQyYzVhZDg2ZGYzN...
  • https://ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/147941848_456037_2
  • http://185.34.52.250/?var=Om5hdj1jbGljazo6dHJhY2tlciZkZXBsb3k9MTkzNTAyNCZ1c2VyPWZzcGlub2xhODUlNDBnbWFpbC5jb20mZW1haWxfaWQ9MTQ3OTQxODQ4JnVybD1hSFIwY0hNNkx5OTVibWwwYVdGc2NHOXVkQzVqYjIwdk1DOHdMekF2WVR...
  • http://185.34.52.250/public/?:nav=click::tracker&deploy=1935024&user=fspinola85%40gmail.com&email_id=147941848&url=aHR0cHM6Ly95bml0aWFscG9udC5jb20vMC8wLzAvYTYyNWExMDdjMjVlYWE1YTQ2ZGQyYzVhZDg2ZGYzNm...
  • https://ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/147941848_456037_2
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ynitialpont.com
URL
https://ynitialpont.com/0/0/0/a625a107c25eaa5a46dd2c5ad86df36e/1935024-ALL_HAMELB_SZ_GMAIL_PT-456017/147941848_456037_2

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on August 10th 2024, 10:40:42 pm UTC — From Portugal

Threats: Brand Impersonation Scam
Brands: CTT Correios PT
Comment: Effective URL to multiple phishing campaigns. It is a redirect URL to the phishing pages from various domains. Impersonates several brands. Tricks the user into paying a delivery fee and steals credit card information.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| tarcking_param string| srv_ip

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

storage.googleapis.com
ynitialpont.com
ynitialpont.com
142.250.181.251
c4ae61bef77bcec2ab6dc88864e046b7b699f1a734fa946a2b0b40af0e6c8b8e