f004.backblazeb2.com Open in urlscan Pro
149.137.128.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rebrand.ly/n6f91vh
Effective URL:
https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html
Submission: On April 07 via manual (April 7th 2022, 10:50:10 am UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 13 HTTP transactions. The main IP is 149.137.128.16, located in United States and belongs to BACKBLAZE, US. The main domain is f004.backblazeb2.com.
TLS certificate: Issued by R3 on February 8th 2022. Valid for: 3 months.

This is the only time f004.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.208.195.82 54.208.195.82	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.184.197.212 18.184.197.212	16509 (AMAZON-02) (AMAZON-02)
10	149.137.128.16 149.137.128.16	40401 (BACKBLAZE) (BACKBLAZE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
2	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	4

1 54.208.195.82 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-195-82.compute-1.amazonaws.com

rebrand.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.184.197.212 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: eu-ip-2.short.io

3rtk.short.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 149.137.128.16 (United States)

ASN40401 (BACKBLAZE, US)
PTR: f004.backblazeb2.com

f004.backblazeb2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3120::7 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	backblazeb2.com f004.backblazeb2.com	536 KB
2	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 3473	18 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 647	30 KB
1	short.gy 1 redirects 3rtk.short.gy	409 B
1	rebrand.ly 1 redirects rebrand.ly — Cisco Umbrella Rank: 76949	288 B
13	5

	Domain	Requested by
10	f004.backblazeb2.com	f004.backblazeb2.com
2	ka-f.fontawesome.com	f004.backblazeb2.com
1	code.jquery.com	f004.backblazeb2.com
1	3rtk.short.gy	1 redirects
1	rebrand.ly	1 redirects
13	5

This site contains no links.

Subject Issuer	Validity	Valid
backblazeb2.com R3	`2022-02-08` - `2022-05-09`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-12` - `2022-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html
Frame ID: 1F93E1AB6EA20A2BDD210A792DC6DC63
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Share Point Online

Page URL History Show full URLs

https://rebrand.ly/n6f91vh HTTP 301
https://3rtk.short.gy/n0pFbt HTTP 302
https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

583 kB
Transfer

744 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rebrand.ly/n6f91vh HTTP 301
https://3rtk.short.gy/n0pFbt HTTP 302
https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request logonben-drive.html Show response f004.backblazeb2.com/file/authsig-drive/ Redirect Chain https://rebrand.ly/n6f91vh https://3rtk.short.gy/n0pFbt https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html	160 KB 161 KB	786ms 326ms	Document text/html	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `719ac828ba448fd15c819c64f76cb1bb9839c565ca4c2fcb9fb788bf7bd737d9` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 164058 Content-Type text/html Date Thu, 07 Apr 2022 10:50:03 GMT Keep-Alive timeout=5 X-Bz-Upload-Timestamp 1648451771737 x-bz-content-sha1 d18ca9073d05cb5ee7040c1772f94a944e935814 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f10888133111900ad_d20220328_m071611_c004_v0402002_t0005_u01648451771737 x-bz-file-name logonben-drive.html x-bz-info-src_last_modified_millis 1648451566531 Redirect headers Date Thu, 07 Apr 2022 10:50:03 GMT cache-control no-cache, no-store, max-age=0, must-revalidate connection close content-length 0 content-type text/html; charset=utf-8 location https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html pragma no-cache x-powered-by Short.io link shortener x-ratelimit-limit 50 x-ratelimit-remaining 49 x-ratelimit-reset 60
GET H/1.1	200	jquery.min.js.download Show response f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	84 KB 84 KB	804ms 354ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/jquery.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:04 GMT X-Bz-Upload-Timestamp 1648451748868 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f118766bd7c93a49c_d20220328_m071548_c004_v0402006_t0053_u01648451748868 x-bz-content-sha1 69bb69e25ca7d5ef0935317584e6153f3fd9a88c Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/jquery.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 85578 x-bz-info-src_last_modified_millis 1642319286000
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	56ms 18ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Thu, 07 Apr 2022 10:50:04 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-152b5" vary Accept-Encoding x-hw 1649328604.dop239.am5.t,1649328604.cds317.am5.hn,1649328604.cds114.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H/1.1	200	bootstrap.min.css f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	141 KB 142 KB	634ms 248ms	Stylesheet text/css	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/bootstrap.min.css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d` Request headers Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Origin https://f004.backblazeb2.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:04 GMT X-Bz-Upload-Timestamp 1648451745394 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f1037f6d10a03a465_d20220328_m071545_c004_v0402001_t0014_u01648451745394 x-bz-content-sha1 895125a4522a3b10ee7ada06ee6503587cbf95c5 Content-Type text/css x-bz-file-name Share+Point+Online_files/bootstrap.min.css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 144877 x-bz-info-src_last_modified_millis 1642319336000
GET H/1.1	200	css f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	1 KB 2 KB	675ms 227ms	Stylesheet application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `f0cfe475d2d7e5829f34880b0311485f08940c0403567ecf54ddd024894ecfef` Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:04 GMT X-Bz-Upload-Timestamp 1648451747477 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f118b36690a6b06cd_d20220328_m071547_c004_v0402001_t0024_u01648451747477 x-bz-content-sha1 fff5f7c1e8a024ea906e1344f9042e22fdf00eb0 Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 1185 x-bz-info-src_last_modified_millis 1642319338000
GET H/1.1	200	585b051251.js.download Show response f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	11 KB 11 KB	716ms 262ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/585b051251.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4` Request headers Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Origin https://f004.backblazeb2.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:04 GMT X-Bz-Upload-Timestamp 1648451742775 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f103109c5aa3332e5_d20220328_m071542_c004_v0402006_t0026_u01648451742775 x-bz-content-sha1 add67ddd5f4ede50dcea8d89ea55f253f8c42990 Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/585b051251.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 11026 x-bz-info-src_last_modified_millis 1642319338000
GET H/1.1	404	hover.css f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	0 0	317ms 149ms	Stylesheet application/json	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/hover.css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:04 GMT Cache-Control max-age=0, no-cache, no-store Connection keep-alive Keep-Alive timeout=5 Content-Length 94 Content-Type application/json;charset=utf-8
GET H/1.1	404	gmail.png f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	94 B 94 B	147ms 147ms	Image application/json	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Show image Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/gmail.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `a87ef7b2a413f234985afa048f77baf7911825ddda1a8b3610fecdd2c3093272` Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:04 GMT Cache-Control max-age=0, no-cache, no-store Connection keep-alive Keep-Alive timeout=5 Content-Length 94 Content-Type application/json;charset=utf-8
GET H/1.1	200	jquery-3.2.1.slim.min.js.download Show response f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	68 KB 68 KB	312ms 312ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/jquery-3.2.1.slim.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398` Request headers Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Origin https://f004.backblazeb2.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:05 GMT X-Bz-Upload-Timestamp 1648451750439 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f11818fd595d51582_d20220328_m071551_c004_v0402003_t0040_u01648451750439 x-bz-content-sha1 9e89d1515bc4c371b86f4cb1002fd8e377c1829f Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/jquery-3.2.1.slim.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 69597 x-bz-info-src_last_modified_millis 1642319340000
GET H/1.1	200	popper.min.js.download Show response f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	19 KB 19 KB	251ms 251ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/popper.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66` Request headers Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Origin https://f004.backblazeb2.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:05 GMT X-Bz-Upload-Timestamp 1648451752452 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f108284a49dc05f5c_d20220328_m071552_c004_v0402006_t0010_u01648451752452 x-bz-content-sha1 c3b977aa4b8dfb69d651e07015031d385ded964b Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/popper.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 19188 x-bz-info-src_last_modified_millis 1642319340000
GET H/1.1	200	bootstrap.min.js.download Show response f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/	48 KB 48 KB	312ms 312ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/bootstrap.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b` Request headers Referer https://f004.backblazeb2.com/file/authsig-drive/logonben-drive.html Origin https://f004.backblazeb2.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 10:50:05 GMT X-Bz-Upload-Timestamp 1648451746469 x-bz-file-id 4_z056c961f670ccdfd7fff0610_f1112be3c061c5d8f_d20220328_m071546_c004_v0402002_t0056_u01648451746469 x-bz-content-sha1 a9545831803b1359cfeed47e3b4d6bae68e40e99 Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/bootstrap.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 48944 x-bz-info-src_last_modified_millis 1642319340000
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	59 KB 13 KB	68ms 35ms	Fetch text/css	2a06:98c1:3120::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251 Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/585b051251.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda` Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Thu, 07 Apr 2022 10:50:05 GMT via 1.1 5db4f6b1c04035a37ba6548e89b362be.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 245223 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GlSFyLrasBPG3vYUrjVA2UBsJgfwhdMq4dshCKkiJ5U2SsK8eYGg7hq7K6%2BVhszAnnRWl1s1wJbH%2BFxpN%2ByK06gJHK3OOtV8AGGcCd5jThpeUDBlgbMCvgTctJ70vPKMM%2B8uCCVOJVx2iOVU3rzAJ%2F4XXg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 x-amz-cf-pop DUS51-P2 cf-ray 6f82334a08b99b86-FRA access-control-allow-headers fa-kit-token x-amz-cf-id 8_Ft6c8Yr9MeQ6ezXXxeZ-7lGeYP-67mcKzZPBjKHrylsDcFghK2Yw==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	26 KB 5 KB	162ms 130ms	Fetch text/css	2a06:98c1:3120::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/585b051251.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8` Request headers accept-language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Thu, 07 Apr 2022 10:50:05 GMT via 1.1 5c2d36b0430d7877f1609d99fe01caa8.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop ARN54-C1 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"76f34b71fc9fb641507ff6a822cc07f5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=McUZ09F6qKc%2Bdt46DQID4ejIVLUysepcJZ2LwZME3h1D1DAytZVmd07HMem9vqGv%2BNfdIDuhn8UX4hOfrUsZn1i%2Bl15iK2HPNlWa00vLnXwiMM1d9qEFYCS48A6TI9pKx8zsEsLD%2FhTgrvsIqINvGPsKag%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 6f82334a18bb9b86-FRA access-control-allow-headers fa-kit-token x-amz-cf-id TEnYeVpT4q9ZAw8fv04CMJ7In-086vRWlkUV8-3RFaQfuw6m6QHIKg==
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `03850575e0f0bdf2eb1ce94575dba52fe70d7a674cf29748a6c6d8ebd578de7f` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	16 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `85362655d77973d4744a9fb627969dce486bf5c6dd95273c292a110174f089dc` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	876 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `000d9bd3fb15bc689eafcfb3ad6574d33c8a8b7d31d234ecc7b62b9ac44c6054` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `88924ba2935d1144ba7636fa5f8720fd6c4a189ab0d2d07c97fd70ae0362bfef` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	894 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `235da3a6f9d23c6ed313077ae8e0d60734825e1c2d2fdae1d49ed597111bea16` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `aeefd15375df211e06606381bd07fc3b70c4ff3bb5201d5db284a508a14f80f5` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	18 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d7f6c8ea089a5d68b4a8bb5047dcaccc6c9480aae7f579b4293481217f5b6915` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/hover.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://f004.backblazeb2.com/file/authsig-drive/Share%20Point%20Online_files/gmail.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3rtk.short.gy
code.jquery.com
f004.backblazeb2.com
ka-f.fontawesome.com
rebrand.ly
149.137.128.16
18.184.197.212
2001:4de0:ac18::1:a:3a
2a06:98c1:3120::7
54.208.195.82
000d9bd3fb15bc689eafcfb3ad6574d33c8a8b7d31d234ecc7b62b9ac44c6054
03850575e0f0bdf2eb1ce94575dba52fe70d7a674cf29748a6c6d8ebd578de7f
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
235da3a6f9d23c6ed313077ae8e0d60734825e1c2d2fdae1d49ed597111bea16
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
719ac828ba448fd15c819c64f76cb1bb9839c565ca4c2fcb9fb788bf7bd737d9
85362655d77973d4744a9fb627969dce486bf5c6dd95273c292a110174f089dc
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
88924ba2935d1144ba7636fa5f8720fd6c4a189ab0d2d07c97fd70ae0362bfef
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a87ef7b2a413f234985afa048f77baf7911825ddda1a8b3610fecdd2c3093272
aeefd15375df211e06606381bd07fc3b70c4ff3bb5201d5db284a508a14f80f5
cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4
d7f6c8ea089a5d68b4a8bb5047dcaccc6c9480aae7f579b4293481217f5b6915
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f0cfe475d2d7e5829f34880b0311485f08940c0403567ecf54ddd024894ecfef
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

f004.backblazeb2.com Open in urlscan Pro 149.137.128.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

4 IPs

3 Countries

583 kBTransfer

744 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

f004.backblazeb2.com Open in urlscan Pro
149.137.128.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

583 kB
Transfer

744 kB
Size

0
Cookies

13 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!