![](/screenshots/2bcef4c3-3fe4-43a2-9b75-555e6cb3bbb2.png)
xcel.sgp1.digitaloceanspaces.com
Open in
urlscan Pro
103.253.144.208
Malicious Activity!
Public Scan
Submission: On June 24 via api from US — Scanned from SG
Summary
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on December 1st 2023. Valid for: a year.
This is the only time xcel.sgp1.digitaloceanspaces.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 103.253.144.208 103.253.144.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2606:4700:440... 2606:4700:4400::ac40:9257 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2404:6800:400... 2404:6800:4003:c1c::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:19a3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:2800:247... 2606:2800:247:1cb7:261b:1f9c:2074:3c | 15133 (EDGECAST) (EDGECAST) | |
1 | 2600:1417:3f:... 2600:1417:3f:7a6::523 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
7 | 6 |
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: sgp1.digitaloceanspaces.com
xcel.sgp1.digitaloceanspaces.com |
ASN13335 (CLOUDFLARENET, US)
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
digitaloceanspaces.com
xcel.sgp1.digitaloceanspaces.com |
822 B |
1 |
cloudinary.com
res.cloudinary.com — Cisco Umbrella Rank: 3546 |
330 KB |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1065 |
752 B |
1 |
gyazo.com
i.gyazo.com — Cisco Umbrella Rank: 90946 |
33 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 469 |
31 KB |
1 |
w3s.link
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link |
197 KB |
7 | 6 |
Domain | Requested by | |
---|---|---|
2 | xcel.sgp1.digitaloceanspaces.com | |
1 | res.cloudinary.com |
xcel.sgp1.digitaloceanspaces.com
|
1 | aadcdn.msftauth.net |
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link
|
1 | i.gyazo.com |
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link
|
1 | ajax.googleapis.com |
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link
|
1 | bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link |
xcel.sgp1.digitaloceanspaces.com
|
7 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.sgp1.digitaloceanspaces.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-12-01 - 2024-12-17 |
a year | crt.sh |
w3s.link E1 |
2024-05-16 - 2024-08-14 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
gyazo.com E1 |
2024-06-01 - 2024-08-30 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2024-05-25 - 2025-05-25 |
a year | crt.sh |
*.cloudinary.com Go Daddy Secure Certificate Authority - G2 |
2023-12-18 - 2025-01-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://xcel.sgp1.digitaloceanspaces.com/downchtkal.html
Frame ID: 964223F639560A7D228CCA913143EC77
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
downchtkal.html
xcel.sgp1.digitaloceanspaces.com/ |
144 B 458 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
myscr349556.js
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link/ |
894 KB 197 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
78c24d6313b46234ef3d411883c0aa32.png
i.gyazo.com/ |
32 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
513 B 752 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SOA_Due_Invoice_Balances_azmehx.png
res.cloudinary.com/dvkrrftb5/image/upload/v1689743994/ |
330 KB 330 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
xcel.sgp1.digitaloceanspaces.com/ |
239 B 364 B |
Other
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| erp string| em number| tmp function| $ function| jQuery function| isBase64 function| showEl function| hideEl2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.w3s.link/ | Name: __cf_bm Value: IzM9lYPc9Z1GE5Qhj53dVLzcwo53_HsueVnQ4Up.rzo-1719212639-1.0.1.1-odNITl2GBiditspdQ4VSokM5YinCe0I42W_ycJHGs_K6Ia66Yu0C_YERNGdymBnwI04xSJsG1UIDgyeabJ7vLA |
|
i.gyazo.com/ | Name: Gyazo_cfwoker Value: i |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15552000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
ajax.googleapis.com
bafybeih3ybgomodg3336rwqaat2g6qrcenjrnh3tjp4hxaiyytyzgi3fqu.ipfs.w3s.link
i.gyazo.com
res.cloudinary.com
xcel.sgp1.digitaloceanspaces.com
103.253.144.208
2404:6800:4003:c1c::5f
2600:1417:3f:7a6::523
2606:2800:247:1cb7:261b:1f9c:2074:3c
2606:4700:4400::ac40:9257
2606:4700::6812:19a3
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
610725cce70c642a485616ca2913a8ffb0a7e5f58a021e16a8b5d672498d6859
6b0942148e330bb32b2d694ed79859b4dd3b51d167ecdfa5f2bcbe119b25bbbe
a15cff52b29aeb1be0906559df5239a0686d1170cb826b5d315e8334d8ea2d3d
a16936648326c111c845cfe1ab29cbbcb44d6ba6f4b1094c1dc78d7f4a7f07d0
bc466b8df7ef1aa3ba572e4979175a9d732f11b4d4e1a0f8a9d6854893232bae
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d