storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:825::2010  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response storage.googleapis.com/apelviperitonitis-456420892/	86 KB 87 KB	26ms 7ms	Document text/html	2a00:1450:4001:825::2010 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://storage.googleapis.com/apelviperitonitis-456420892/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 44e006eac0b832b31e93f8bbcd884b782c199c5ca49e68ea2c2584e95b420297 Request headers :method GET :authority storage.googleapis.com :scheme https :path /apelviperitonitis-456420892/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 x-guploader-uploadid ABg5-UyysnS6NgB4yHrBC2kEMvPm_xMNOzrayTPQnhte9LjjXmgph7lEE3dGa1XzomI0DC-Xy3JzF1lLEkArUXrYkMVtj9ErYg expires Thu, 10 Sep 2020 16:29:10 GMT date Thu, 10 Sep 2020 15:29:10 GMT last-modified Tue, 08 Sep 2020 01:29:33 GMT etag "99cf9c4c37932d06e9f9a16cf3150d5a" x-goog-generation 1599528573637552 x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-stored-content-length 88524 content-type text/html x-goog-hash crc32c=QUdvLw== md5=mc+cTDeTLQbp+aFs8xUNWg== x-goog-storage-class STANDARD accept-ranges bytes content-length 88524 server UploadServer cache-control public, max-age=3600 age 2415 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Origin https://storage.googleapis.com Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/octet-stream
GET H3-Q050	200	microsoft_logo.svg storage.googleapis.com/apelviperitonitis-456420892/inf/	4 KB 4 KB	182ms 166ms	Image image/svg+xml	2a00:1450:4001:825::2010 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://storage.googleapis.com/apelviperitonitis-456420892/inf/microsoft_logo.svg Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/apelviperitonitis-456420892/index.html Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer https://storage.googleapis.com/apelviperitonitis-456420892/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 10 Sep 2020 16:09:25 GMT x-guploader-uploadid ABg5-Uxp82ieDRuerPyduxVjClU03IhRNJ32fynMt9wMYZJlNXxr03B2fc7wdAz-friCP5GFtKUvK4KIflsAcCt_Jpc-M9SMHQ x-goog-storage-class STANDARD status 200 x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3651 last-modified Tue, 08 Sep 2020 01:29:23 GMT server UploadServer etag "ee5c8d9fb6248c938fd0dc19370e90bd" x-goog-hash crc32c=c/EO4g==, md5=7lyNn7YkjJOP0NwZNw6QvQ== x-goog-generation 1599528563887764 cache-control public, max-age=3600 x-goog-stored-content-length 3651 accept-ranges bytes content-type image/svg+xml expires Thu, 10 Sep 2020 17:09:25 GMT
GET H/1.1	200 OK	voice-mail-icon.png www.unomaha.edu/information-technology-services/phones-and-conferencing/_doc/	9 KB 10 KB	614ms 159ms	Image image/png	23.21.105.121 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.unomaha.edu/information-technology-services/phones-and-conferencing/_doc/voice-mail-icon.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.21.105.121 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-23-21-105-121.compute-1.amazonaws.com Software Apache / Resource Hash b8363c7b14a6b7f4dc554c9cc6a5281c15dc8b8228c2604a63f7d6c046dc299f Request headers Referer https://storage.googleapis.com/apelviperitonitis-456420892/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 10 Sep 2020 16:09:26 GMT Last-Modified Fri, 01 Nov 2019 18:52:22 GMT Server Apache ETag "25ec-5964d77568253" Content-Type image/png Cache-control no-cache="set-cookie" Connection keep-alive Accept-Ranges bytes Content-Length 9708

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| _0x2c8e function| _0x24cc object| Zlib number| g_responseEnd object| FabricConfig function| setImageUrl function| _spBodyOnLoad function| templatePage number| g_duration number| g_iisLatency number| g_requireJSDone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

storage.googleapis.com
www.unomaha.edu
23.21.105.121
2a00:1450:4001:825::2010
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
44e006eac0b832b31e93f8bbcd884b782c199c5ca49e68ea2c2584e95b420297
b8363c7b14a6b7f4dc554c9cc6a5281c15dc8b8228c2604a63f7d6c046dc299f