s3-api.us-geo.objectstorage.softlayer.net
Open in
urlscan Pro
67.228.254.193
Malicious Activity!
Public Scan
Effective URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-oouassa-557733120/aoffice365-oouassa-557733120/index-home.html
Submission: On November 14 via manual from US
Summary
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 17th 2018. Valid for: a year.
This is the only time s3-api.us-geo.objectstorage.softlayer.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Box.com (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:30:... 2606:4700:30::681b:85fb | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 67.228.254.193 67.228.254.193 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
14 | 2a00:1450:400... 2a00:1450:4001:81a::2010 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
16 | 3 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
a.filesdoc.us |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: s3-api.us-geo.objectstorage.softlayer.net
s3-api.us-geo.objectstorage.softlayer.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
googleapis.com
storage.googleapis.com |
547 KB |
1 |
softlayer.net
s3-api.us-geo.objectstorage.softlayer.net |
9 KB |
1 |
filesdoc.us
a.filesdoc.us |
1 KB |
16 | 3 |
Domain | Requested by | |
---|---|---|
14 | storage.googleapis.com |
s3-api.us-geo.objectstorage.softlayer.net
|
1 | s3-api.us-geo.objectstorage.softlayer.net |
a.filesdoc.us
|
1 | a.filesdoc.us | |
16 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
s3-api.us-geo.objectstorage.softlayer.net GeoTrust RSA CA 2018 |
2018-04-17 - 2019-07-29 |
a year | crt.sh |
*.storage.googleapis.com Google Internet Authority G3 |
2018-10-30 - 2019-01-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-oouassa-557733120/aoffice365-oouassa-557733120/index-home.html
Frame ID: 0A1BFAAE946066618755B0E90C6B87FB
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://a.filesdoc.us/yvjdlv.html?a=3c3ad4cc-247a-46c4-b28e-57c6bb787e30 Page URL
- https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-oouassa-557733120/aoffice365-oouassa-557733120/index-home.html Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://a.filesdoc.us/yvjdlv.html?a=3c3ad4cc-247a-46c4-b28e-57c6bb787e30 Page URL
- https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-oouassa-557733120/aoffice365-oouassa-557733120/index-home.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
yvjdlv.html
a.filesdoc.us/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index-home.html
s3-api.us-geo.objectstorage.softlayer.net/aoffice365-oouassa-557733120/aoffice365-oouassa-557733120/ |
8 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css.css
storage.googleapis.com/office-company-page/css/ |
202 KB 203 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
apps.png
storage.googleapis.com/office-company-page/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1000px-Google_G_Logo.png
storage.googleapis.com/office-company-page/images/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
2000px-Outlook.png
storage.googleapis.com/office-company-page/images/ |
65 KB 66 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
yahoo-social-media-logo-38959f083e2e7452-512x512.png
storage.googleapis.com/office-company-page/images/ |
23 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
latest.png
storage.googleapis.com/office-company-page/images/ |
38 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
email_PNG20.png
storage.googleapis.com/office-company-page/images/ |
36 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
AstraZeneca_0.png
storage.googleapis.com/office-company-page/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
PG_433x90.png
storage.googleapis.com/office-company-page/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
GE.png
storage.googleapis.com/office-company-page/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
Nationwide.png
storage.googleapis.com/office-company-page/images/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
Boston.png
storage.googleapis.com/office-company-page/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
Pandora.png
storage.googleapis.com/office-company-page/images/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
home_masthead_ipadonly.jpg
storage.googleapis.com/office-company-page/images/ |
84 KB 84 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Box.com (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.filesdoc.us
s3-api.us-geo.objectstorage.softlayer.net
storage.googleapis.com
2606:4700:30::681b:85fb
2a00:1450:4001:81a::2010
67.228.254.193
055f5bb06369181b392f18d59b1580ef839b56ec1bbebc96b223fab3f0fe2573
0f02fe13bdcd4c108ee064feeec84b358219ba380d4cf3cac2f7d279511a8caf
2693186aa9644890b9d6858c4b784ccde2de3d26207b7703201efcc714e913f9
27c2c6dd5f53843351c42c8aa0725cf4ea72a2aeeebc90b8f03af9cf021e82cf
3470e4402c0cbe8c6eecae0dbb06a28fab1e4ec7958fb9ed311e230bc1ade564
37ac5510e9ee88f6cc41948675cd68d6d773bfe58c6a4c064f7b5e37002c9919
56523a4e6fc8ee9f14f446454ddc34c476e2fe5d576059548d3de174d5f6d362
748195ac015cee91667a22f2e14e6f5b80985245f88c69f870cc757b517cfa21
818ba83870603d9695a9494b7215068689b7fe9153b8d57e9274fc46e72f975a
86a57a85f31ac7ee763d7f61891d5717db271799927d28481ded6a660ca4b4e6
944961358121e68879546ff9defcc0db811870eebbc2e2a3fee5b42628bd80ed
988e7ea05e4b996a604b5055500051b9021d763be5aea15ac1146d83469896d4
a1da35d55eeef596eb8cfb5eae897f76d72f4de34f39e609fd344a9b92b0c950
a80f6e04a6c9f0bd6349e8ffe05eeacae606ec98ccbecfa70c6312b5fa96f836
ea76ba933c6ad5a19fda67745a05b80948a739329528cf97bd407b8dfb1f61a2
ee30e10bb566e3ea31b546ed64c1f00fc2c0d86a7628da6f3b3be877ddbcdc50