urlscan.io logo urlscan.io
SecurityTrails logo

app-storage-jzd.s3.us-west-000.backblazeb2.com Open in urlscan Pro
206.190.208.254  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Submission: On March 06 via api from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 4 countries across 8 domains to perform 12 HTTP transactions. The main IP is 206.190.208.254, located in United States and belongs to UNWIRED, US. The main domain is app-storage-jzd.s3.us-west-000.backblazeb2.com.
TLS certificate: Issued by R3 on February 17th 2021. Valid for: 3 months.
This is the only time app-storage-jzd.s3.us-west-000.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

IP Address AS Autonomous System
1 206.190.208.254 32354 (UNWIRED)
2 185.189.112.202 9009 (M247)
1 1 151.101.60.193 54113 (FASTLY)
1 151.101.112.193 54113 (FASTLY)
2 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
12 8
1    206.190.208.254 (United States)

ASN32354 (UNWIRED, US)
app-storage-jzd.s3.us-west-000.backblazeb2.com
2    185.189.112.202 (Frankfurt am Main, Germany)

ASN9009 (M247, GB)
kbokogroup.com
1    151.101.60.193 (London, United Kingdom)

ASN54113 (FASTLY, US)
imgur.com
1    151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
i.imgur.com
2    2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Domain Requested by
2 fonts.gstatic.com fonts.googleapis.com
2 code.jquery.com app-storage-jzd.s3.us-west-000.backblazeb2.com
2 kbokogroup.com app-storage-jzd.s3.us-west-000.backblazeb2.com
kbokogroup.com
1 fonts.googleapis.com kbokogroup.com
1 maxcdn.bootstrapcdn.com app-storage-jzd.s3.us-west-000.backblazeb2.com
1 stackpath.bootstrapcdn.com app-storage-jzd.s3.us-west-000.backblazeb2.com
1 cdnjs.cloudflare.com app-storage-jzd.s3.us-west-000.backblazeb2.com
1 i.imgur.com app-storage-jzd.s3.us-west-000.backblazeb2.com
1 imgur.com 1 redirects
1 app-storage-jzd.s3.us-west-000.backblazeb2.com
12 10

This site contains no links.

Subject Issuer Validity Valid
backblazeb2.com
R3		 2021-02-17 -
2021-05-18		 3 months crt.sh
kbokogroup.com
cPanel, Inc. Certification Authority		 2020-12-24 -
2021-03-24		 3 months crt.sh
*.imgur.com
DigiCert SHA2 Secure Server CA		 2020-01-15 -
2022-03-16		 2 years crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-02-17 -
2021-05-12		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2021-02-17 -
2021-05-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Frame ID: AB32858AA24BF719EAE27911B578DC2D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

12
Requests

100 %
HTTPS

56 %
IPv6

8
Domains

10
Subdomains

8
IPs

4
Countries

269 kB
Transfer

439 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://imgur.com/GVimfOn.png HTTP 301
  • https://i.imgur.com/GVimfOn.png

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request excelfirebase.htm
app-storage-jzd.s3.us-west-000.backblazeb2.com/ 		3 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
206.190.208.254 , United States, ASN32354 (UNWIRED, US),
Reverse DNS
Software
/
Resource Hash
0ffa847c2549f9258e83f4e2ce6f994fe50368126345998f12014b882a9e046c

Request headers

Host
app-storage-jzd.s3.us-west-000.backblazeb2.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Cache-Control
max-age=0, no-cache, no-store
Accept-Ranges
bytes
Last-Modified
Tue, 02 Mar 2021 22:46:50 GMT
ETag
"17969c459a5fe07f9a58a89660959271"
x-amz-meta-src_last_modified_millis
1614725152301
x-amz-request-id
77bba9d83a77184f
x-amz-id-2
aYQYy8TGtZag2YTMzYtZk82Y/NCkxXTDz
Content-Type
text/html
Content-Length
3357
Date
Sat, 06 Mar 2021 04:29:29 GMT
Keep-Alive
timeout=5
Connection
keep-alive
styles.css
kbokogroup.com/pg/pge/Project/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kbokogroup.com/pg/pge/Project/css/styles.css
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.189.112.202 Frankfurt am Main, Germany, ASN9009 (M247, GB),
Reverse DNS
Software
Apache /
Resource Hash
66f05abca65a210dccfffc1c7e444c7e01bfb6f12f9d8bf7a281efb739dea9d7

Request headers

Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 06 Mar 2021 04:29:29 GMT
Last-Modified
Mon, 05 Nov 2018 02:12:00 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3314
GVimfOn.png
i.imgur.com/
Redirect Chain
  • https://imgur.com/GVimfOn.png
  • https://i.imgur.com/GVimfOn.png
8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/GVimfOn.png
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Mar 2021 04:29:30 GMT
x-content-type-options
nosniff
age
336762
x-cache
HIT, HIT
content-length
8180
x-served-by
cache-bwi5174-BWI, cache-hhn4061-HHN
last-modified
Tue, 02 Mar 2021 06:56:48 GMT
server
cat factory 1.0
x-timer
S1615004970.098205,VS0,VE1
etag
"4292d595f45db8cc84bac8a325ae1afc"
strict-transport-security
max-age=300
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1

Redirect headers

date
Sat, 06 Mar 2021 04:29:29 GMT
server
cat factory 1.0
x-timer
S1615004970.900069,VS0,VE0
x-frame-options
DENY
x-cache
HIT
location
https://i.imgur.com/GVimfOn.png
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
false
x-cache-hits
0
strict-transport-security
max-age=300
accept-ranges
bytes
access-control-allow-origin
https://imgur.com
content-length
0
retry-after
0
x-served-by
cache-lhr7378-LHR
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Mar 2021 04:29:29 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1538f"
vary
Accept-Encoding
x-hw
1615004969.dop224.fr8.t,1615004969.cds201.fr8.hc,1615004969.cds002.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30288
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://app-storage-jzd.s3.us-west-000.backblazeb2.com
Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Mar 2021 04:29:29 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2612554
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6458
cf-request-id
08a765433300000eabbca38000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-500f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oiUJoASUpXwmAZfXCPR56uc2el3JGO39wFbbSTe%2F6UdY0UvZ6lIpmQ1xawo3yXlncMBeDm96NJ4tzGCBDLEuuV91IbVbkZQY%2Fvqd6%2B0nwkuWDnvsEXedPpkUWAWrEyHibw%3D%3D"}]}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
62b8d7e518cd0eab-FRA
expires
Thu, 24 Feb 2022 04:29:29 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ 		49 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Origin
https://app-storage-jzd.s3.us-west-000.backblazeb2.com
Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Mar 2021 04:29:29 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
cdn-edgestorageid
601, 718
age
16241
cdn-cachedat
2021-03-04 16:03:02
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08a765433500004abd7da97000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:05 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
314e34310925eb12a89c73a81ba3d316
cf-ray
62b8d7e52a8b4abd-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Origin
https://app-storage-jzd.s3.us-west-000.backblazeb2.com
Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Mar 2021 04:29:29 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1111d"
vary
Accept-Encoding
x-hw
1615004969.dop243.fr8.t,1615004969.cds259.fr8.hc,1615004969.cds274.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24038
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: app-storage-jzd.s3.us-west-000.backblazeb2.com
URL: https://app-storage-jzd.s3.us-west-000.backblazeb2.com/excelfirebase.htm?&email=jameschong%40dbs.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Origin
https://app-storage-jzd.s3.us-west-000.backblazeb2.com
Referer
https://app-storage-jzd.s3.us-west-000.backblazeb2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Mar 2021 04:29:29 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
16241
cdn-cachedat
2021-03-04 14:40:35
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08a76543330000e0032688b000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
5c8fcb928e6db5704b1a783792b89493
cf-ray
62b8d7e51843e003-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
css
fonts.googleapis.com/ 		2 KB
602 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=PT+Sans:400,700
Requested by
Host: kbokogroup.com
URL: https://kbokogroup.com/pg/pge/Project/css/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
089822305b9af8e8bf8797060fa68e6d18068b4fd7e8938f30b125ab6f61a2b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://kbokogroup.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 06 Mar 2021 03:24:38 GMT
server
ESF
date
Sat, 06 Mar 2021 04:29:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 06 Mar 2021 04:29:29 GMT
pdf.png
kbokogroup.com/pg/pge/Project/img/ 		73 KB
73 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kbokogroup.com/pg/pge/Project/img/pdf.png
Requested by
Host: kbokogroup.com
URL: https://kbokogroup.com/pg/pge/Project/css/styles.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.189.112.202 Frankfurt am Main, Germany, ASN9009 (M247, GB),
Reverse DNS
Software
Apache /
Resource Hash
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf

Request headers

Referer
https://kbokogroup.com/pg/pge/Project/css/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 06 Mar 2021 04:29:29 GMT
Last-Modified
Mon, 05 Nov 2018 02:12:56 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
74994
jizfRExUiTo99u79B_mh0O6tLQ.woff2
fonts.gstatic.com/s/ptsans/v12/ 		46 KB
46 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://app-storage-jzd.s3.us-west-000.backblazeb2.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 01 Mar 2021 18:13:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:11 GMT
server
sffe
age
382531
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46988
x-xss-protection
0
expires
Tue, 01 Mar 2022 18:13:58 GMT
jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v12/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://app-storage-jzd.s3.us-west-000.backblazeb2.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 01 Mar 2021 18:34:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:20 GMT
server
sffe
age
381302
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
45416
x-xss-protection
0
expires
Tue, 01 Mar 2022 18:34:27 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap

0 Cookies