f003.backblazeb2.com Open in urlscan Pro
45.11.36.16  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Page URL
2. https://f003.backblazeb2.com/file/carding-slip-uninsinuative/index.html Page URL
3. https://f003.backblazeb2.com/file/carding-slip-uninsinuative/login.html?ktqchlrfm=mJ6HIjcrABWSjJlFr4&isule=nmQ3aYIQ4aOFGr8TCr8z&dcu=O2F7iUSSQWu7YeChoyPO8nAKZX&tnbrdtswhr=zdoSGbBLuDLmo38iF7pQSC76Qyupo&gsln=sYt2inNrr6QQFfGHy&bxl=FD3wcwKEfY688GtqApqIGo1lpsNNKP&hyxwwi=cwi26gBngsjXuNkzGlrmVzS&nutacq=CeXSzyl8Lk7WyjJ7 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.html Show response et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/	74 KB 75 KB	443ms 87ms	Document text/html	169.46.118.100 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.46.118.100 Irving, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 64.76.2ea9.ip4.static.sl-reverse.com Software Cleversafe / Resource Hash 186b638f0037a0e659e97edec8ecdbdc9e7a5e660cc1be4450554ad08624e915 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language en-US,en;q=0.9 Response headers Date Mon, 28 Feb 2022 16:23:50 GMT X-Clv-Request-Id 6e4d3bd5-5f01-4b83-9dd3-b815578e9d83 Server Cleversafe X-Clv-S3-Version 2.5 Accept-Ranges bytes x-amz-request-id 6e4d3bd5-5f01-4b83-9dd3-b815578e9d83 ETag "d9d7d74fa4677bb29a5b25a8e1c5a766" Content-Type text/html Last-Modified Fri, 28 Jan 2022 02:12:18 GMT Content-Length 76098
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	39ms 24ms	Script text/javascript	2607:f8b0:4006:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: et9io74qrl.s3.us-south.objectstorage.softlayer.net URL: https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80c::200a Queens, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/ Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 28 Feb 2022 06:02:11 GMT content-encoding gzip x-content-type-options nosniff age 37299 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 28 Feb 2023 06:02:11 GMT
GET H2	200	redirect-to-url.php discoversmtp.com/email-list/__vendor/	71 B 615 B	2063ms 1686ms	XHR text/html	2606:4700:3035::6815:2a46 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://discoversmtp.com/email-list/__vendor/redirect-to-url.php?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https%3A%2F%2Fwww.amazon.com&fragment= Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:2a46 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept */* Referer https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/ Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Mon, 28 Feb 2022 16:23:52 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dV8umhWKiNvBNKceGReE2wr4eDaKcPyQkvNUO0YmCvmLId7wf7XnV%2FbuoxoyDx09KNYzpcWMUY1s9qvYPSyrXI5JLHzqXtlnZdW7pOyPo7MC8AentWvWyYxxXzk9QGqKkg%2BvgkTuTveVt3mqpfph"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 access-control-allow-origin * cf-ray 6e4afff05dc932ca-EWR alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200	index.html Show response f003.backblazeb2.com/file/carding-slip-uninsinuative/	74 KB 75 KB	504ms 233ms	Document text/html	45.11.36.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f003.backblazeb2.com/file/carding-slip-uninsinuative/index.html Requested by Host: et9io74qrl.s3.us-south.objectstorage.softlayer.net URL: https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.11.36.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f003.backblazeb2.com Software / Resource Hash 51004017246bca999f8d6041f7aaadf84e6de2ca0e38a3fbc9546fba77ddcea1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language en-US,en;q=0.9 Referer https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/ Response headers x-bz-file-name index.html x-bz-file-id 4_z2095f346f83f31fd74f20113_f109ab128a098648e_d20220228_m105031_c003_v0312008_t0003 x-bz-content-sha1 e169e876dc41ece705df632529d2619c2c02d224 X-Bz-Upload-Timestamp 1646045431000 Accept-Ranges bytes Content-Type text/html Content-Length 76122 Date Mon, 28 Feb 2022 16:23:53 GMT Keep-Alive timeout=5 Connection keep-alive
GET H/1.1	200	Primary Request login.html Show response f003.backblazeb2.com/file/carding-slip-uninsinuative/	82 KB 83 KB	404ms 403ms	Document text/html	45.11.36.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f003.backblazeb2.com/file/carding-slip-uninsinuative/login.html?ktqchlrfm=mJ6HIjcrABWSjJlFr4&isule=nmQ3aYIQ4aOFGr8TCr8z&dcu=O2F7iUSSQWu7YeChoyPO8nAKZX&tnbrdtswhr=zdoSGbBLuDLmo38iF7pQSC76Qyupo&gsln=sYt2inNrr6QQFfGHy&bxl=FD3wcwKEfY688GtqApqIGo1lpsNNKP&hyxwwi=cwi26gBngsjXuNkzGlrmVzS&nutacq=CeXSzyl8Lk7WyjJ7 Requested by Host: et9io74qrl.s3.us-south.objectstorage.softlayer.net URL: https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.11.36.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f003.backblazeb2.com Software / Resource Hash 0385126e75101e21a0c97ddf05489fc68c20b59f98ef678dce3bbf529b671ffa Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language en-US,en;q=0.9 Referer https://f003.backblazeb2.com/file/carding-slip-uninsinuative/index.html Response headers x-bz-file-name login.html x-bz-file-id 4_z2095f346f83f31fd74f20113_f109ab128a098645c_d20220228_m105029_c003_v0312008_t0013 x-bz-content-sha1 fc7275b614cb70b67d7fe8b6215c6ac64d074609 X-Bz-Upload-Timestamp 1646045429000 Accept-Ranges bytes Content-Type text/html Content-Length 84154 Date Mon, 28 Feb 2022 16:23:53 GMT Keep-Alive timeout=5 Connection keep-alive
GET H2	200	jquery-3.3.1.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	85 KB 38 KB	22ms 10ms	Script application/javascript	152.199.4.33 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js Requested by Host: et9io74qrl.s3.us-south.objectstorage.softlayer.net URL: https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.4.33 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nya/79D2) / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://f003.backblazeb2.com/ Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 28 Feb 2022 16:23:53 GMT content-encoding gzip x-content-type-options nosniff age 16816590 x-cache HIT content-length 38892 x-xss-protection 1; mode=block last-modified Mon, 22 Jan 2018 19:27:49 GMT server ECAcc (nya/79D2) etag "af301a17b793d31:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	200	123.png i.ibb.co/0p5YqRd/	55 KB 55 KB	33ms 3ms	Image image/png	104.243.38.177 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/0p5YqRd/123.png Requested by Host: et9io74qrl.s3.us-south.objectstorage.softlayer.net URL: https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.243.38.177 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS disuanqi.dadongeng.cn Software nginx / Resource Hash 3f6c5949e99611b1a141502abceadec500c71dd838fe60b00e8fd4f6d307306a Request headers Accept-Language en-US,en;q=0.9 Referer https://f003.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Mon, 28 Feb 2022 16:23:54 GMT last-modified Fri, 12 Feb 2021 07:43:41 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 56516 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	321.png i.ibb.co/G9WKY4d/	6 KB 6 KB	33ms 3ms	Image image/png	104.243.38.177 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/G9WKY4d/321.png Requested by Host: et9io74qrl.s3.us-south.objectstorage.softlayer.net URL: https://et9io74qrl.s3.us-south.objectstorage.softlayer.net/fluted/index.html?key=c7b11bb143ad0ce8171db6b9effb8465&redirect=https://www.amazon.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.243.38.177 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS disuanqi.dadongeng.cn Software nginx / Resource Hash d9beef835a8541f5a47ab03af20772c57bf850418239b18aaec4465e6d910cd1 Request headers Accept-Language en-US,en;q=0.9 Referer https://f003.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Mon, 28 Feb 2022 16:23:54 GMT last-modified Fri, 12 Feb 2021 07:43:58 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 5738 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	invocie.jpg i.ibb.co/TmmgJv6/	30 KB 30 KB	38ms 9ms	Image image/jpeg	104.243.38.177 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/TmmgJv6/invocie.jpg Requested by Host: f003.backblazeb2.com URL: https://f003.backblazeb2.com/file/carding-slip-uninsinuative/login.html?ktqchlrfm=mJ6HIjcrABWSjJlFr4&isule=nmQ3aYIQ4aOFGr8TCr8z&dcu=O2F7iUSSQWu7YeChoyPO8nAKZX&tnbrdtswhr=zdoSGbBLuDLmo38iF7pQSC76Qyupo&gsln=sYt2inNrr6QQFfGHy&bxl=FD3wcwKEfY688GtqApqIGo1lpsNNKP&hyxwwi=cwi26gBngsjXuNkzGlrmVzS&nutacq=CeXSzyl8Lk7WyjJ7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.243.38.177 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS disuanqi.dadongeng.cn Software nginx / Resource Hash fcbc50f56e269846095736cb9b23f6e2f4f6fc37f6996ef633e840ce09f33e53 Request headers Accept-Language en-US,en;q=0.9 Referer https://f003.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Mon, 28 Feb 2022 16:23:54 GMT last-modified Fri, 12 Feb 2021 07:43:57 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30345 expires Thu, 31 Dec 2037 23:55:55 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| _0x4e02 function| _0x2412 object| Zlib function| unhideBody function| $ function| jQuery function| randomInteger function| randomString function| getdomainpartofemail function| get_email_hash function| validateEmail function| geturlparameter function| get_rand_url_pars

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
ajax.googleapis.com
discoversmtp.com
et9io74qrl.s3.us-south.objectstorage.softlayer.net
f003.backblazeb2.com
i.ibb.co
104.243.38.177
152.199.4.33
169.46.118.100
2606:4700:3035::6815:2a46
2607:f8b0:4006:80c::200a
45.11.36.16
0385126e75101e21a0c97ddf05489fc68c20b59f98ef678dce3bbf529b671ffa
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
186b638f0037a0e659e97edec8ecdbdc9e7a5e660cc1be4450554ad08624e915
3f6c5949e99611b1a141502abceadec500c71dd838fe60b00e8fd4f6d307306a
51004017246bca999f8d6041f7aaadf84e6de2ca0e38a3fbc9546fba77ddcea1
d9beef835a8541f5a47ab03af20772c57bf850418239b18aaec4465e6d910cd1
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fcbc50f56e269846095736cb9b23f6e2f4f6fc37f6996ef633e840ce09f33e53