urlscan.io logo urlscan.io
SecurityTrails logo

o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app Open in urlscan Pro
145.40.68.46  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://jinnahofficersschool.com/aut/zoom.html
Effective URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
Submission: On June 22 via manual from US — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 18 HTTP transactions. The main IP is 145.40.68.46, located in Amsterdam, Netherlands and belongs to PACKET, US. The main domain is o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app.
TLS certificate: Issued by R3 on May 13th 2022. Valid for: 3 months.
This is the only time o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 95.216.246.100 24940 (HETZNER-AS)
1 145.40.68.46 54825 (PACKET)
1 2a00:1450:400... 15169 (GOOGLE)
6 2a06:98c1:312... 13335 (CLOUDFLAR...)
18 5
Apex Domain
Subdomains		 Transfer
6 rosehostserv.com
rosehostserv.com — Cisco Umbrella Rank: 780147
111 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 307
30 KB
1 ic0.app
o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app
31 KB
1 jinnahofficersschool.com
jinnahofficersschool.com
866 B
18 4
Domain Requested by
6 rosehostserv.com jinnahofficersschool.com
o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app
1 ajax.googleapis.com jinnahofficersschool.com
1 o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app jinnahofficersschool.com
1 jinnahofficersschool.com
18 4

This site contains no links.

Subject Issuer Validity Valid
boundary.dfinity.network
R3		 2022-05-13 -
2022-08-11		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-06-06 -
2022-08-29		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-28 -
2023-05-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
Frame ID: 55EEC752185753614CB015AF0E238487
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Dropbox - Get your files anytime anywhere

Page URL History Show full URLs

  1. http://jinnahofficersschool.com/aut/zoom.html Page URL
  2. https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

44 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

174 kB
Transfer

270 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://jinnahofficersschool.com/aut/zoom.html Page URL
  2. https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
zoom.html
jinnahofficersschool.com/aut/ 		624 B
866 B 		Document
General
Check archive.org
Download Go to
Full URL
http://jinnahofficersschool.com/aut/zoom.html
Protocol
HTTP/1.1
Server
95.216.246.100 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
lin70.itlinks.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
624
Content-Type
text/html
Date
Wed, 22 Jun 2022 11:52:29 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 22 Jun 2022 09:54:35 GMT
Server
Apache
Primary Request /
o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/ 		74 KB
31 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
am6-bnm00
Software
nginx/1.21.3 /
Resource Hash
e463fc160a74e6556e43e033ff035afaaebac108d75cb971a17eba9059ce6fab

Request headers

Referer
http://jinnahofficersschool.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Cookie
access-control-allow-methods
GET, POST, HEAD, OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
content-encoding
gzip
content-type
text/html
date
Wed, 22 Jun 2022 11:52:31 GMT
ic-certificate
certificate=:2dn3o2R0cmVlgwGDAYMBgwJIY2FuaXN0ZXKDAYIEWCDNdT9NcH6jBxYeg42pLbA+scC1Ph41Hg179fGPi2GLvIMBgwGCBFggyLQ990Ij+8z28tPTtimRqC9oDA7g0ghnKmxRY+n1rGSDAYIEWCBllk2o12TxfCAPYu+yzJG3qH938FErJhvXkvDMdSw064MBggRYIFqukOqdVIED8cc6pIRNoK4f//1zSgO63GfWL8WYGv18gwGCBFgg4f99797D1KQKB7GBBWP/k3+HR9x5M8muLk19wBx9KVqDAYIEWCBa5DU5uKI1tSd5xxE4f1Wy63/coRTaLYnhynXuW7PkfoMBgwGDAYMBgwGCBFggC6v0Fvm+V44H48huab77xIbNwvP7QzVKt1CssbN+xayDAkoAAAAAAHAUpwEBgwGDAYMBgwJOY2VydGlmaWVkX2RhdGGCA1ggk0MpOs+uX7T69T/V/jHAZwe6Jo7iFkZyEl/xtcnbt12CBFggg8Vr8U3ePSjeZsaStfydl+ndmFtq1ysP5vhOio3z3LKCBFgg8EfmnxWp+PWFGccV7eB8HpifCS2756+gwIXVcnAcKJKCBFggX5bh9SaGNcugUZ0DO3dknV7wcBKJDsP/e+JlsywCGjCCBFggCDGprh/7Ndmmm7RqVEPVGscpAokNkglvv127xkkMkPOCBFggZvqo21vmtGHw9JgE+R93wE/aaWQZ99feHchVn2AoS0yCBFggXA9v9CP7jv7iiYDhqGSvfwQXtH4REyj4FyeAZCTIO56CBFggWKRN28QSn7tUDL+z+cX1FnOy/kXBafqXQYvulqXU6SuCBFggsZHpx9Qwz1aUDTr4U0yJ3X2sC9w9lWnHMej4V3zw45KCBFgg+Lj8Xf20NUOFs8+VZE6ttquWukfLYWSz6+Rt88oU+jaCBFgg1vHPLnNznyhLllyeyACRbJZgpJ2WTY+A1qontD9uquiDAYIEWCBOCwrvSakiyvk5jZrwWqTFrPJU/C4AYpVMTWnIfDmR04MCRHRpbWWCA0moxMPsteS7/RZpc2lnbmF0dXJlWDCmL5dVfaeLUEEP1jZlXMm4Q3GfgAT0sOwxnaAxJYn0SKscwI1xQsCRkW3Jjgpc3spqZGVsZWdhdGlvbqJpc3VibmV0X2lkWB1FF4tmpAek1ZwKTWczvaLOPzfBEbQlfsQZCPT4AmtjZXJ0aWZpY2F0ZVkCV9nZ96JkdHJlZYMBggRYIEpD/GDAeGdqnHe0+BgzOpHg8/NlWRWsjh/zCyKzXvW2gwGDAkZzdWJuZXSDAYMBgwGCBFgggtuQPXc6nyDAbFVZ/s7W4ar+syjvrRpIszFjoQd7hlyDAYIEWCBGanAobPms6YAcpT4ir27gWaCU/WBJhgbUhLaFQFgwfYMBggRYIGoM0IGyaIYIL+TFOrdNfqPyijOgj3fsUptSbaaAuJRngwGDAlgdRReLZqQHpNWcCk1nM72izj83wRG0JX7EGQj0+AKDAYMCT2NhbmlzdGVyX3Jhbmdlc4IDWBvZ2feBgkoAAAAAAHAAAAEBSgAAAAAAf///AQGDAkpwdWJsaWNfa2V5ggNYhTCBgjAdBg0rBgEEAYLcfAUDAQIBBgwrBgEEAYLcfAUDAgEDYQCVX1L3PC3sWaY3spTlC5NNtdbeKec7vPhOfYakrEG617U5+YF63okWlh2d1r+SVwENWFcVbo/mqvz2/QaHlecL0zmbNBEwDJzMjroNBowQ5M+29OJ9GVserXhdYY6zk7mCBFggAJvm6n+vrOj3wkveJVpH7krnQT1QHjO+2j9ytaHvTjaCBFggzEBn88CQlexgzd7VC/RDrSALqrLE79fOCn0Avpe4dj6CBFggLYVruntsgBcc6OXRIbt+RFCzVlpkTZE16f5YhCgcH7mDAkR0aW1lggNJ2JaEoaLNuP0WaXNpZ25hdHVyZVgwhIfh0MYejTZuiW0ofDefwRDW9oW6K6qdioCnvoJoF4YnUypTRDfJntjLfmgHJeUM:, tree=:2dn3gwJLaHR0cF9hc3NldHODAYMBgwGDAYMCRy8zNS5QTkeCBFggRyn1+V6z+NlupcVS4hFNiPRyGwBo0VIkqgRSGSQgijKCBFggaWbe8e3w6qwUxzt1PwIu4VSJXKVXzdRNeyJmG9vWhwiCBFggtJFjPkagUNYeBY6EE4xgEC1HPpa/de1xKP8bOBb7YnCCBFggX6l8uaJ/NKRRYQa2yP9Z9Q2VH3q3nzeGXcDH7ZlVXrCDAYIEWCDAGe33tNqlX1VGNin/kJaidAZVuyDNQuMAVb0vV8da8YMBggRYIDxHo7oNxabO2HgJbdsDYjZPZVaLu25lemHoJRzYZi2sgwGCBFggKy16f2hRqFQo9e9q59RA2okSlpmtjdJWJMFURK7ma/ODAYIEWCAIjzU8JrDzkpf8tYxkLQooEw2wJ4ULhrXxK3D6UwcqroMCSy9pbmRleC5odG1sggNYIORj/BYKdOZVbkPgM/8DWvquusEI11y5caF+upBZzm+r:
server
nginx/1.21.3
x-cache-status
MISS
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 22 Jun 2022 10:27:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5096
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30399
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 22 Jun 2023 10:27:35 GMT
outlook.svg
rosehostserv.com/email-list/dropbx35/assets/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rosehostserv.com/email-list/dropbx35/assets/outlook.svg
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d0754f8fc3d351f42c23fc4df2e4577acea627976321a0f57c321e4daa7a358

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 11:52:31 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 28 May 2022 05:51:40 GMT
server
cloudflare
etag
W/"6291b86c-5af"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hSEgY1i8%2BPf1Y19m2lozYtxbaZPkgu%2BG5VKr7%2FhP0ANB7DsTJQQNoJMEMLF5ahzvU3DI9BldWeSLDMmvSbj55SA8RWWQtiSFzIKWRr0EowVTzoJmkEV1zq8UvdDOrTGRUHWsSspZqLbgPKefObj5"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
71f4c73d5f8977bc-KBP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 31 Dec 2037 23:55:55 GMT
office.svg
rosehostserv.com/email-list/dropbx35/assets/ 		1 KB
965 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rosehostserv.com/email-list/dropbx35/assets/office.svg
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86392bba9268ae93d05cc2ad436f5a5796bcb7a7ecadf0ca3a54393fcd109afe

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 11:52:31 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 28 May 2022 05:51:41 GMT
server
cloudflare
etag
W/"6291b86d-4a2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ijIoBGGGX18kTiRZ4PRSC8k3q%2FkIA4WTFMdiM9gFYTfQ0ROsTVCVNoFISIfFhcdCGowOqetlpjoaTz3NOqXwVdZetzdQL%2BOE3rt3KQZ0rjrBqHvvJLNgrxIyJWh9QNfkwThuCKHYEYbeOPyLFJJF"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=315360000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
71f4c73d6f8c77bc-KBP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 31 Dec 2037 23:55:55 GMT
aol.png
rosehostserv.com/email-list/dropbx35/assets/ 		608 B
934 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rosehostserv.com/email-list/dropbx35/assets/aol.png
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38e64fbeb524b7748d30fcf0c0e1a52f2994cbe0c036b3f2c2d1cdcf55219689

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 11:52:31 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
608
last-modified
Sat, 28 May 2022 05:51:44 GMT
server
cloudflare
etag
"6291b870-260"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rbwdcWOoEINy5ND3jLN1GfwbYI%2FKM1asxCdMH9H3W1NFwephGTJwhWBRtB1Us%2F8LmYxFXYX7vX2GNDT07anvYIWy%2BB8wcAT%2B4CU29ZGS38yBteFmkOvLrwmFoBt6b13puBxe4Jzhr6AAp%2Fg%2BqoKk"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
71f4c73d6f8f77bc-KBP
expires
Thu, 31 Dec 2037 23:55:55 GMT
yahoo.png
rosehostserv.com/email-list/dropbx35/assets/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rosehostserv.com/email-list/dropbx35/assets/yahoo.png
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4b303a7ed2422acd6a453103a4de290078485b90a0e214d5216a7411934e2e7

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 11:52:31 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1025
last-modified
Sat, 28 May 2022 05:51:42 GMT
server
cloudflare
etag
"6291b86e-401"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I9j4vbBIeZc6h84YmKDSCswyoabFRunN8XdAEj%2BBNrG4TNHoBVh9AdJykM25abPmpZ5GNolaQN7D8xkH%2FiAb7FReJF9K5pbLvUn4AHywlLTatJMWpHbk8hvm6Dpa176fr9vBjIZw7TFaSJFL96qp"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
71f4c73d6ffe77bc-KBP
expires
Thu, 31 Dec 2037 23:55:55 GMT
other.png
rosehostserv.com/email-list/dropbx35/assets/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rosehostserv.com/email-list/dropbx35/assets/other.png
Requested by
Host: jinnahofficersschool.com
URL: http://jinnahofficersschool.com/aut/zoom.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79f1125dcdb1f9194d515a1da5fcd62db3cd89e4d50c5aa29fb7e10a293ac127

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 11:52:31 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1775
last-modified
Sat, 28 May 2022 05:51:47 GMT
server
cloudflare
etag
"6291b873-6ef"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BLSSlSQovenS58slI3bElTmWQuRj4aHlWLie7mEc8Aaz%2Bg6qVWp%2BhPABg6oXV%2FL4v1EeqKWC1zdG4d1vuhP0SOhoLhKh6ktnFfw%2BHgw4qQCZcTsbu2%2BSrxRZ0VuuiiITebHSkrCOfXv0hQvIk%2Bn0"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
71f4c73d6ff977bc-KBP
expires
Thu, 31 Dec 2037 23:55:55 GMT
bg.png
rosehostserv.com/email-list/dropbx35/assets/ 		105 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rosehostserv.com/email-list/dropbx35/assets/bg.png
Requested by
Host: o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app
URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2a15e51488724d9e4f137675ea587708200a0202639ce7699a14fd7894cb360

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 11:52:31 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
107012
last-modified
Sat, 28 May 2022 05:51:42 GMT
server
cloudflare
etag
"6291b86e-1a204"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LOvckWdD4cdhrttpMphDTV3ceu1tsIZLECXvkb98c3U8gR9YpB7bQtYKRh1vrw4HfOm9lOQ3lzplxZVQKIURWnk3IIZFdNXEoEbIeJtEtn3ZnIVJlHEl8o2jrkb2W8nlq8%2F%2ButdW6eKLzkRQzZWn"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
cf-ray
71f4c73d680377bc-KBP
expires
Thu, 31 Dec 2037 23:55:55 GMT
SharpGroteskDBMedium20-vflI3qtaE.woff2
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
Atlas%20Grotesk%20Web%20Light%20Regular.woff2
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
source-sans-pro-v14-latin-600.woff2
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
source-sans-pro-v14-latin-600.woff
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
Atlas%20Grotesk%20Web%20Light%20Regular.woff
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
SharpGroteskDBMedium20-vflXS-0WC.woff
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
Atlas%20Grotesk%20Web%20Light%20Regular.ttf
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
source-sans-pro-v14-latin-600.ttf
rosehostserv.com/email-list/dropbx35/assets/ 		0
0
SharpGroteskDBMedium20-vfls8l7-a.ttf
rosehostserv.com/email-list/dropbx35/assets/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vflI3qtaE.woff2
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff2
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.woff2
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.woff
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vflXS-0WC.woff
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.ttf
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.ttf
Domain
rosehostserv.com
URL
https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vfls8l7-a.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| _0x1e33 function| _0x1f3c object| Zlib function| templatePage function| $ function| jQuery function| window_opener_xc function| get_extra_data

0 Cookies

20 Console Messages

Source Level URL
Text
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.woff2' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff2' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vflI3qtaE.woff2' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vflI3qtaE.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.woff' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vflXS-0WC.woff' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vflXS-0WC.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.ttf' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/Atlas%20Grotesk%20Web%20Light%20Regular.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.ttf' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/source-sans-pro-v14-latin-600.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app/#undefined
Message:
Access to font at 'https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vfls8l7-a.ttf' from origin 'https://o4eae-qyaaa-aaaad-qcstq-cai.raw.ic0.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://rosehostserv.com/email-list/dropbx35/assets/SharpGroteskDBMedium20-vfls8l7-a.ttf
Message:
Failed to load resource: net::ERR_FAILED