storage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:81c::2010
Malicious Activity!
Public Scan
Effective URL: https://storage.googleapis.com/adropbox-lysogenize-529203044/index.html
Submission: On November 04 via manual from US
Summary
TLS certificate: Issued by GTS CA 1O1 on October 10th 2019. Valid for: 3 months.
This is the only time storage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID - SendGrid) | |
1 | 107.180.4.78 107.180.4.78 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
13 | 2a00:1450:400... 2a00:1450:4001:81c::2010 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:818::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
6 | 2a00:1450:400... 2a00:1450:4001:821::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
23 | 5 |
ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u13260839.ct.sendgrid.net |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-4-78.ip.secureserver.net
ascendo.com |
ASN15169 (GOOGLE - Google LLC, US)
storage.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
googleapis.com
storage.googleapis.com fonts.googleapis.com ajax.googleapis.com |
264 KB |
6 |
gstatic.com
fonts.gstatic.com |
62 KB |
1 |
ascendo.com
ascendo.com |
329 B |
1 |
sendgrid.net
1 redirects
u13260839.ct.sendgrid.net |
256 B |
23 | 4 |
Domain | Requested by | |
---|---|---|
13 | storage.googleapis.com |
storage.googleapis.com
|
6 | fonts.gstatic.com |
storage.googleapis.com
|
2 | fonts.googleapis.com |
storage.googleapis.com
|
1 | ajax.googleapis.com |
storage.googleapis.com
|
1 | ascendo.com | |
1 | u13260839.ct.sendgrid.net | 1 redirects |
23 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ascendo.com Go Daddy Secure Certificate Authority - G2 |
2019-08-26 - 2020-08-26 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2019-10-10 - 2020-01-02 |
3 months | crt.sh |
*.googleapis.com GTS CA 1O1 |
2019-10-10 - 2020-01-02 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2019-10-10 - 2020-01-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://storage.googleapis.com/adropbox-lysogenize-529203044/index.html
Frame ID: C103B68C9A002B4B68AE6113E141522A
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u13260839.ct.sendgrid.net/wf/click?upn=Zsn-2BxQCgZhu-2FLRYW1zjyH7RgQxMhpPxqTqp5eQnQmnH2typo1yRG9x6TIwg...
HTTP 302
https://ascendo.com/vcard/sTwinn/refresh.html Page URL
- https://storage.googleapis.com/adropbox-lysogenize-529203044/index.html Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u13260839.ct.sendgrid.net/wf/click?upn=Zsn-2BxQCgZhu-2FLRYW1zjyH7RgQxMhpPxqTqp5eQnQmnH2typo1yRG9x6TIwgEmMOKkIlrvfIXQpl-2BDsy7XrxKHA-3D-3D_6llu-2FIWmEG0mpsawjLOHp-2FFh26TnRfhb7olxdr1iwTX0hWY5U91om7Qs0zxC113fsNaAXNT-2BaMNLeU0aAFtFCjsqvx27cwmPtFOKNVyX3RmH2hLp74l8jkDbkfA9erhv3e3Cv4EAHyXNIKOmrdgextXuN01FDGSzjyQucRXWgypJKpoYk0Oc7RnZ9F-2BGD7f8LcRlP7IlQtK-2BJYs-2FS4afGw-3D-3D
HTTP 302
https://ascendo.com/vcard/sTwinn/refresh.html Page URL
- https://storage.googleapis.com/adropbox-lysogenize-529203044/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u13260839.ct.sendgrid.net/wf/click?upn=Zsn-2BxQCgZhu-2FLRYW1zjyH7RgQxMhpPxqTqp5eQnQmnH2typo1yRG9x6TIwgEmMOKkIlrvfIXQpl-2BDsy7XrxKHA-3D-3D_6llu-2FIWmEG0mpsawjLOHp-2FFh26TnRfhb7olxdr1iwTX0hWY5U91om7Qs0zxC113fsNaAXNT-2BaMNLeU0aAFtFCjsqvx27cwmPtFOKNVyX3RmH2hLp74l8jkDbkfA9erhv3e3Cv4EAHyXNIKOmrdgextXuN01FDGSzjyQucRXWgypJKpoYk0Oc7RnZ9F-2BGD7f8LcRlP7IlQtK-2BJYs-2FS4afGw-3D-3D HTTP 302
- https://ascendo.com/vcard/sTwinn/refresh.html
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
refresh.html
ascendo.com/vcard/sTwinn/ Redirect Chain
|
166 B 329 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
storage.googleapis.com/adropbox-lysogenize-529203044/ |
4 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
139 KB 139 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
49 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
8 KB 721 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link1.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link2.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link3.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link4.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link5.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
link6.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.png
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
storage.googleapis.com/adropbox-lysogenize-529203044/officeurl/ |
36 KB 36 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.png
storage.googleapis.com/adropbox-lysogenize-529203044/img/ |
232 B 232 B |
Image
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2
fonts.gstatic.com/s/poppins/v9/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmYUtfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| jQuery1124098052744767240330 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
ascendo.com
fonts.googleapis.com
fonts.gstatic.com
storage.googleapis.com
u13260839.ct.sendgrid.net
107.180.4.78
167.89.123.16
2a00:1450:4001:818::200a
2a00:1450:4001:81c::2010
2a00:1450:4001:820::200a
2a00:1450:4001:821::2003
07b0f8d0b2b4386f99bef23feaf22ca2dc58de9ef0fc88143bc21f14181c4844
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0eb4756ca68ed2b19a5bb4ac87d82660bbe2f0a68f9aa4b56ab927cb05893a40
0fc76354d93e7c0240f341d7c551d793dc383da6106ac79186773598e629f8d4
1b6863771c330f7b6a857dbfee3959d8e8c61c0e34f1e9ba5f6f38268d05573d
254e06c2b9a0f916080de80948211c468daa0022c057b9de10e8eb041f72666f
2836d8beb3d60eed5fbe193a5b9ea1644495fc6bc0253827ea1561afaa97577f
3153348c8fc62f737cb1e8f39faf1de39ac183ff2c05129cde11989e56c17661
4a3ae417c448741c4c172e47c8c6beff0392bf76f5a3f38cadd3d0f53dc196ef
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
53a18bcf5066d69c7703be74748b175f1d1548d4a894f3ca4fd9c2ae85f65510
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7acfb29eafa00db3cd27880c24afc9aa75e8182a017bed59fd0feecf3a382e58
8af5a0f142b9f1d33828aa4f5e444663ef494be4d26ea5bdc0c65e32a7aceb12
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
baff5a78ffaab8c91d8b8e1793b4c6d6af88cc82374fc0940c506b95cddcb570
bdaace8f6703cd1d36e0a74f91e2007935c44bee59862f3eb7c10eeb8377b6b0
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d34c7dfb31a485518c27a55eb41e6109e25f1c5c053b9a0936ff96af22199489
e2f1e08380060d6493762dbb06f6130a46e548a486f5d079321ada3440be6d05
f9e450ccc454e0c2124df3828ceb540bc235b2b7927605261fd2dd173e5f9f38
fab32ccef85408b763c899ad7c0b910c96c76dc9ed7158ce304fdcd3c0bf8388