storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:817::2010 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://storage.googleapis.com/aemperor-105613063/index.html
Submission: On August 24 via manual (August 24th 2020, 7:31:04 pm UTC) from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 2a00:1450:4001:817::2010, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is storage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on August 11th 2020. Valid for: 3 months.

This is the only time storage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2a00:1450:400... 2a00:1450:4001:817::2010	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
10	2606:4700:303... 2606:4700:3031::681b:a3a6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	3

2 2a00:1450:4001:817::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700:3031::681b:a3a6 (United States)

ASN13335 (CLOUDFLARENET, US)

foxsmtp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	foxsmtp.com foxsmtp.com	1 MB
3	googleapis.com storage.googleapis.com ajax.googleapis.com	182 KB
13	2

	Domain	Requested by
10	foxsmtp.com	storage.googleapis.com foxsmtp.com
2	storage.googleapis.com	ajax.googleapis.com
1	ajax.googleapis.com	storage.googleapis.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-01` - `2021-08-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://storage.googleapis.com/aemperor-105613063/index.html
Frame ID: 7613FC9B8EDD602EFCBF5E1831F0DBE9
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

1552 kB
Transfer

1706 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.html Show response
storage.googleapis.com/aemperor-105613063/ 75 KB
76 KB 27ms
7ms Document
text/html 2a00:1450:4001:817::2010
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:817::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: ae8646f1a1441584b0a62c620cf9944fe5ca91612999ae680605e1f6f1cb6c4c

Request headers

:method: GET
:authority: storage.googleapis.com
:scheme: https
:path: /aemperor-105613063/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
x-guploader-uploadid: AAANsUk7nhZSqIgoTRMUNFuVa0UouIRJfYS6g1lvhtivB93zrFqyoAtWpo7LitymrJA3unW7vSN2Nwv_meCnUDc3_W4
expires: Mon, 24 Aug 2020 20:07:47 GMT
date: Mon, 24 Aug 2020 19:07:47 GMT
last-modified: Mon, 17 Aug 2020 20:13:29 GMT
etag: "973ebe4dc7fef2e2cfd2c90a31f70c18"
x-goog-generation: 1597695209893591
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 77168
content-type: text/html
x-goog-hash: crc32c=Pw1tzA== md5=lz6+Tcf+8uLP0skKMfcMGA==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 77168
server: UploadServer
cache-control: public, max-age=3600
age: 1380
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 24 Aug 2020 09:03:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37615
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 Aug 2021 09:03:52 GMT

GET
H/2+Q/46 200 index-home.html Show response
storage.googleapis.com/aemperor-105613063/ 75 KB
76 KB 28ms
14ms XHR
text/html 2a00:1450:4001:817::2010
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/aemperor-105613063/index-home.html
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Protocol: HTTP/2+QUIC/46
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:817::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 97c3fe72e89d7a83d216001673a7138507cb38776eceaaec8253a14f39884fde

Request headers

Accept: */*
Referer: https://storage.googleapis.com/aemperor-105613063/index.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:07:48 GMT
age: 1379
x-guploader-uploadid: AAANsUkEmJ_8RL-f48yMcHhBE_tUvBOfLvCWp2VQa4t3lPzdzkS60mHHPiIVGdCsLERTnPE4ViS1UjE6LAQAFaMnNuU
x-goog-storage-class: STANDARD
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77300
last-modified: Mon, 17 Aug 2020 20:13:25 GMT
server: UploadServer
etag: "e12965b82235779d485b87698406c6b4"
x-goog-hash: crc32c=BberQw==, md5=4SlluCI1d51IW4dphAbGtA==
x-goog-generation: 1597695205782216
cache-control: public, max-age=3600
x-goog-stored-content-length: 77300
accept-ranges: bytes
content-type: text/html
expires: Mon, 24 Aug 2020 20:07:48 GMT

GET
H2 200 bootstrap.min.css
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 118 KB
18 KB 148ms
118ms Stylesheet
text/css 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/bootstrap.min.css
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 19 Apr 2019 14:06:32 GMT
server: cloudflare
etag: W/"5cb9d5e8-1d970"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000
cf-ray: 5c7f7d658d3805b7-FRA
cf-request-id: 04c38cb374000005b75b2c5200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 3 KB
692 B 107ms
77ms Stylesheet
text/css 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/style.css
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec41aee3fddb28cb6b70f4fce0b89e32263c636d0fccfc6b4fb1ba41137e2355

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 15 Aug 2020 18:15:28 GMT
server: cloudflare
etag: W/"5f382640-a28"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000
cf-ray: 5c7f7d658d3c05b7-FRA
cf-request-id: 04c38cb374000005b75b2c6200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Docusign%202%20Logo.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 26 KB
26 KB 153ms
124ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Docusign%202%20Logo.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c8e81290ef1e7d2851ed87a0e7a353015d30554c0e8973b924da4c9514832b7

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-6952"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d4805b7-FRA
content-length: 26962
cf-request-id: 04c38cb374000005b75b2ca200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Logo%201.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 12 KB
13 KB 105ms
76ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Logo%201.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a3d619d874c49c309442cc4dba165fb797ac3198b56e21b4b578ce57b6f0c88a

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-31d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d4905b7-FRA
content-length: 12761
cf-request-id: 04c38cb374000005b75b2cb200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Logo%202.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 12 KB
12 KB 111ms
82ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Logo%202.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca9b3402c936fc40eea5978b3e593af1fb805704a283f1906abbe3a7a08b8bef

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-2e0a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d4c05b7-FRA
content-length: 11786
cf-request-id: 04c38cb374000005b75b2cc200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Logo%203.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 13 KB
13 KB 113ms
84ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Logo%203.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74b87ddec1458cf1353eaf71af5cd149bcce85bf5026be94ae709dc55438c8ca

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-350a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d4d05b7-FRA
content-length: 13578
cf-request-id: 04c38cb375000005b75b2cd200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Logo%204.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 13 KB
13 KB 97ms
78ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Logo%204.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f396cdda8414d9950500224b9d532c1ba5de41ece779d6e23e4d88d44d81fe7

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-3554"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d4405b7-FRA
content-length: 13652
cf-request-id: 04c38cb374000005b75b2c9200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Logo%205.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 12 KB
12 KB 101ms
81ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Logo%205.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afb8411c445e283357e8cb99dac08eae53bfc0801fd99f16bb1dfd27fd3e3438

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-300e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d3e05b7-FRA
content-length: 12302
cf-request-id: 04c38cb374000005b75b2c7200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Logo%206.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 17 KB
17 KB 126ms
107ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Logo%206.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aemperor-105613063/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9321a2cdde06bc8baaef7eea44f99102191f018214f1b8e8fbb8309042a39eb

Request headers

Referer: https://storage.googleapis.com/aemperor-105613063/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-4247"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d658d4205b7-FRA
content-length: 16967
cf-request-id: 04c38cb374000005b75b2c8200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Docusign%201.png
foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/ 1 MB
1 MB 178ms
177ms Image
image/png 2606:4700:3031::681b:a3a6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/Docusign%201.png
Requested by: Host: foxsmtp.com
URL: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a3a6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5806a6e435c9d9b2065e003790f285f648d990befb6232e68d9869acdab1693

Request headers

Referer: https://foxsmtp.com/1/aaa-all/extf/ducosign-files/style10/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 19:30:47 GMT
cf-cache-status: MISS
last-modified: Wed, 13 Feb 2019 18:22:58 GMT
server: cloudflare
etag: "5c646082-136e27"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5c7f7d660edf05b7-FRA
content-length: 1273383
cf-request-id: 04c38cb3c7000005b75b2d4200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
foxsmtp.com
storage.googleapis.com
2606:4700:3031::681b:a3a6
2a00:1450:4001:809::200a
2a00:1450:4001:817::2010
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
3f396cdda8414d9950500224b9d532c1ba5de41ece779d6e23e4d88d44d81fe7
74b87ddec1458cf1353eaf71af5cd149bcce85bf5026be94ae709dc55438c8ca
7c8e81290ef1e7d2851ed87a0e7a353015d30554c0e8973b924da4c9514832b7
97c3fe72e89d7a83d216001673a7138507cb38776eceaaec8253a14f39884fde
a3d619d874c49c309442cc4dba165fb797ac3198b56e21b4b578ce57b6f0c88a
a5806a6e435c9d9b2065e003790f285f648d990befb6232e68d9869acdab1693
a9321a2cdde06bc8baaef7eea44f99102191f018214f1b8e8fbb8309042a39eb
ae8646f1a1441584b0a62c620cf9944fe5ca91612999ae680605e1f6f1cb6c4c
afb8411c445e283357e8cb99dac08eae53bfc0801fd99f16bb1dfd27fd3e3438
ca9b3402c936fc40eea5978b3e593af1fb805704a283f1906abbe3a7a08b8bef
ec41aee3fddb28cb6b70f4fce0b89e32263c636d0fccfc6b4fb1ba41137e2355
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

storage.googleapis.com Open in urlscan Pro 2a00:1450:4001:817::2010 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

1552 kBTransfer

1706 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:817::2010 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

1552 kB
Transfer

1706 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!