storage.googleapis.com

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 2a00:1450:4001:820::2010, located in Ireland and belongs to GOOGLE - Google LLC, US. The main domain is storage.googleapis.com.
TLS certificate: Issued by Google Internet Authority G3 on June 12th 2018. Valid for: 2 months.

This is the only time storage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:820::2010	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2620:100:6022... 2620:100:6022:1::a27d:4201	19679 (DROPBOX) (DROPBOX - Dropbox)
3	2001:4802:7a0... 2001:4802:7a01:10::7	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
1	81.177.24.62 81.177.24.62	8342 (RTCOMM-AS) (RTCOMM-AS)
6	4

1 2a00:1450:4001:820::2010 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:6022:1::a27d:4201 (United States)

ASN19679 (DROPBOX - Dropbox, Inc., US)

www.dropbox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4802:7a01:10::7 (United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

cp.rackspace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.177.24.62 (Russian Federation)

ASN8342 (RTCOMM-AS, RU)
PTR: s15.in-solve.ru

buildinggroup.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	rackspace.com cp.rackspace.com	4 KB
1	buildinggroup.pro buildinggroup.pro	29 KB
1	dropbox.com www.dropbox.com	4 KB
1	googleapis.com storage.googleapis.com	5 KB
6	4

	Domain	Requested by
3	cp.rackspace.com	storage.googleapis.com
1	buildinggroup.pro	storage.googleapis.com
1	www.dropbox.com	storage.googleapis.com
1	storage.googleapis.com
6	4

This site contains no links.

Subject Issuer	Validity	Valid
*.storage.googleapis.com Google Internet Authority G3	`2018-06-12` - `2018-08-21`	2 months	crt.sh

This page contains 1 frames:

Primary Page: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
Frame ID: E38686C9E830588550DE441E1FA63D2B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

6
Requests

17 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

41 kB
Transfer

47 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request dropbox-style1.html Show response
storage.googleapis.com/dropbox-paradiseinae-295733961/ 5 KB
5 KB 292ms
268ms Document
text/html 2a00:1450:4001:820::2010
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:820::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 75306ef2eeefc8430d23dc86bb14f82ac58e8641e7190668e4ac67422b75bb54

Request headers

:method: GET
:authority: storage.googleapis.com
:scheme: https
:path: /dropbox-paradiseinae-295733961/dropbox-style1.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: E38686C9E830588550DE441E1FA63D2B

Response headers

status: 200
x-guploader-uploadid: AEnB2UpL4EoUUb8O57npkknBaalH5z_kpk_spiIwtKap9hlSGYyUKF5kGHaeD-B_NnWB7woTm8GIXtBLidd9uihPeSaFl44zdQ
expires: Thu, 28 Jun 2018 22:37:30 GMT
date: Thu, 28 Jun 2018 21:37:30 GMT
cache-control: public, max-age=3600
last-modified: Tue, 12 Jun 2018 01:59:18 GMT
etag: "fccf5bbfdb9c4d91d526cbf4c6f86abd"
x-goog-generation: 1528768758165113
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4642
content-type: text/html
x-goog-hash: crc32c=Yy2Ueg== md5=/M9bv9ucTZHVJsv0xvhqvQ==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 4642
server: UploadServer
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"

GET
S 200 wordmark--business-vfl9WSvMr.svg
www.dropbox.com/static/images/arbor/logos/ 11 KB
4 KB 181ms
160ms Image
image/svg+xml 2620:100:6022:1::a27d:4201
Dropbox

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dropbox.com/static/images/arbor/logos/wordmark--business-vfl9WSvMr.svg

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html

Protocol

SPDY

Server

2620:100:6022:1::a27d:4201 , United States, ASN19679 (DROPBOX - Dropbox, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

8941d23e7405deebbe3585493ce676fd7414d14a5d25c5ac3906812d9253a9ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 28 Jun 2018 21:37:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 28 Jun 2018 20:03:17 GMT
server: nginx
status: 200
etag: W/"5b353f05-2ca2"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=315360000, public, immutable
x-dropbox-request-id: 0b49653122f2b9644a601095e5252005
strict-transport-security: max-age=15552000; includeSubDomains
timing-allow-origin: https://www.dropbox.com
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK help.png
cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/ 269 B
540 B 437ms
105ms Image
image/png 2001:4802:7a01:10::7
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/help.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
Protocol: HTTP/1.1
Server: 2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: a3ab3524c3fd32d8dfa693c462f7033fd2682d50034cd00b38db48fa319ca44b

Request headers

Referer: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 28 Jun 2018 21:37:30 GMT
Last-Modified: Tue, 23 Feb 2010 02:31:18 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "09f3b4730b4ca1:0"
Content-Type: image/png
Cache-Control: no-cache
Accept-Ranges: bytes
Content-Length: 269

GET
H/1.1 200
OK point.png
cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/ 370 B
642 B 437ms
104ms Image
image/png 2001:4802:7a01:10::7
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/point.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
Protocol: HTTP/1.1
Server: 2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 84a43aa2221a01befbf027facade3174f752530c1ef34a21f9ded44b77e94639

Request headers

Referer: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 28 Jun 2018 21:37:30 GMT
Last-Modified: Tue, 23 Feb 2010 02:31:29 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "8016ca4d30b4ca1:0"
Content-Type: image/png
Cache-Control: no-cache
Accept-Ranges: bytes
Content-Length: 370

GET
H/1.1 200
OK email-all.png
buildinggroup.pro/layouts/ 28 KB
29 KB 198ms
61ms Image
image/png 81.177.24.62
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://buildinggroup.pro/layouts/email-all.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
Protocol: HTTP/1.1
Server: 81.177.24.62 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: s15.in-solve.ru
Software: Apache /
Resource Hash: b0df4b1c0d52c674b29f8c7fa229c536fb9f70e0dda563faa30b8ece1beb679b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 28 Jun 2018 21:37:31 GMT
Last-Modified: Thu, 08 Jun 2017 09:14:01 GMT
Server: Apache
ETag: "86c7e021-716f-5516f45fe25d6"
Content-Type: image/png
Cache-Control: max-age=3600
Accept-Ranges: bytes
Content-Length: 29039
Expires: Thu, 28 Jun 2018 22:37:31 GMT

GET
H/1.1 200
OK background-unbrand.png
cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/ 2 KB
2 KB 557ms
122ms Image
image/png 2001:4802:7a01:10::7
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/background-unbrand.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
Protocol: HTTP/1.1
Server: 2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 18187433f721f58f44065ffe2cb17805a7ec8820811574d65dce184505de5029

Request headers

Referer: https://storage.googleapis.com/dropbox-paradiseinae-295733961/dropbox-style1.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 28 Jun 2018 21:37:30 GMT
Last-Modified: Tue, 23 Feb 2010 02:31:10 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "0eb764230b4ca1:0"
Content-Type: image/png
Cache-Control: no-cache
Accept-Ranges: bytes
Content-Length: 2268

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buildinggroup.pro
cp.rackspace.com
storage.googleapis.com
www.dropbox.com
2001:4802:7a01:10::7
2620:100:6022:1::a27d:4201
2a00:1450:4001:820::2010
81.177.24.62
18187433f721f58f44065ffe2cb17805a7ec8820811574d65dce184505de5029
75306ef2eeefc8430d23dc86bb14f82ac58e8641e7190668e4ac67422b75bb54
84a43aa2221a01befbf027facade3174f752530c1ef34a21f9ded44b77e94639
8941d23e7405deebbe3585493ce676fd7414d14a5d25c5ac3906812d9253a9ab
a3ab3524c3fd32d8dfa693c462f7033fd2682d50034cd00b38db48fa319ca44b
b0df4b1c0d52c674b29f8c7fa229c536fb9f70e0dda563faa30b8ece1beb679b

storage.googleapis.com Open in urlscan Pro 2a00:1450:4001:820::2010 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

6 Requests

17 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

41 kBTransfer

47 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:820::2010 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

17 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

41 kB
Transfer

47 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!