urlscan.io logo urlscan.io
SecurityTrails logo

a.123data.top Open in urlscan Pro
2400:cb00:2048:1::6812:2efe  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://ow.ly/oBci30dKrFI
Effective URL: https://a.123data.top/eynpbf.html
Submission: On August 07 via manual from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 2400:cb00:2048:1::6812:2efe, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is a.123data.top.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on July 21st 2017. Valid for: 6 months.
This is the only time a.123data.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2400:cb00:204... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2620:100:6022... 19679 (DROPBOX)
3 2001:4802:7a0... 27357 (RACKSPACE)
1 81.177.24.64 8342 (RTCOMM-AS)
8 6
1    2400:cb00:2048:1::6812:2efe (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)
a.123data.top
1    2a00:1450:4001:825::2010 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
storage.googleapis.com
1    2620:100:6022:1::a27d:4201 (United States)

ASN19679 (DROPBOX - Dropbox, Inc., US)
www.dropbox.com
3    2001:4802:7a01:10::7 (United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)
cp.rackspace.com
1    81.177.24.64 (Russian Federation)

ASN8342 (RTCOMM-AS, RU)
PTR: s15.in-solve.ru
buildinggroup.pro
Domain Requested by
3 cp.rackspace.com a.123data.top
text
1 buildinggroup.pro a.123data.top
1 www.dropbox.com a.123data.top
1 storage.googleapis.com a.123data.top
1 a.123data.top
8 5

This site contains no links.

Subject Issuer Validity Valid
sni177085.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2017-07-21 -
2018-01-27		 6 months crt.sh
*.storage.googleapis.com
Google Internet Authority G2		 2017-07-25 -
2017-10-17		 3 months crt.sh
www.dropbox.com
DigiCert SHA2 Extended Validation Server CA		 2015-12-10 -
2017-12-13		 2 years crt.sh
cp.rackspace.com
thawte Extended Validation SHA256 SSL CA		 2016-06-14 -
2018-06-14		 2 years crt.sh

This page contains 2 frames:

Frame: https://storage.googleapis.com/axiomatic-empire-9185/xfasd/raph.html
Frame ID: 24346.1
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: 24373.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

8
Requests

75 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

27 kB
Transfer

49 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request eynpbf.html
a.123data.top/
Redirect Chain
  • http://ow.ly/oBci30dKrFI
  • https://a.123data.top/eynpbf.html
 		1 KB
750 B 		Document
General
Check archive.org
Download Go to
Full URL
https://a.123data.top/eynpbf.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6812:2efe , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
408e3ba5203993203378948f4ba3f569794943b176df74a5edc9ec19d2905c73

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Mon, 07 Aug 2017 05:43:29 GMT
content-encoding
gzip
last-modified
Wed, 19 Jul 2017 12:02:45 GMT
server
cloudflare-nginx
vary
Accept-Encoding
content-type
text/html
status
200
cf-ray
38a7eb26ca21278c-FRA

Redirect headers

Location
https://a.123data.top/eynpbf.html
Connection
close
Content-Length
0
raph.html
storage.googleapis.com/axiomatic-empire-9185/xfasd/ 		0
0
raph.html
storage.googleapis.com/axiomatic-empire-9185/xfasd/ Frame 2437 		20 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/axiomatic-empire-9185/xfasd/raph.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:825::2010 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
UploadServer /
Resource Hash
c2610e922e1648cc5b511f21670067650c9e6d2862398a4442102c942bfa3585

Request headers

Upgrade-Insecure-Requests
1
Referer
https://a.123data.top/eynpbf.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Mon, 07 Aug 2017 05:43:30 GMT
x-guploader-uploadid
AEnB2UrWu7I1mn9eJbutmfiJ-O2Aevpto5nGsXr81qV_2yqhgbl64LZOTDfwuGfpi2-h3GjYP_kYFXuw-Xsz3dH64SrB1qDYKA
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
20285
last-modified
Wed, 19 Jul 2017 11:59:04 GMT
server
UploadServer
etag
"a339fcea964c22dde49c7a0600801f62"
x-goog-hash
crc32c=g0V0BQ==, md5=ozn86pZMIt3knHoGAIAfYg==
x-goog-generation
1500465545014801
cache-control
public, max-age=3600
x-goog-stored-content-length
20285
accept-ranges
bytes
content-type
text/html
expires
Mon, 07 Aug 2017 06:43:30 GMT
truncated
/ Frame 2437 		14 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3693c10c683473c38803a978f5a9e3eab28f5f9763c4a193df026549863fc413

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Content-Type
text/html;charset=utf-8
wordmark--business-vfl9WSvMr.svg
www.dropbox.com/static/images/arbor/logos/ Frame 2437 		11 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.dropbox.com/static/images/arbor/logos/wordmark--business-vfl9WSvMr.svg
Requested by
Host: a.123data.top
URL: https://a.123data.top/eynpbf.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:100:6022:1::a27d:4201 , United States, ASN19679 (DROPBOX - Dropbox, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
8941d23e7405deebbe3585493ce676fd7414d14a5d25c5ac3906812d9253a9ab
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Mon, 07 Aug 2017 05:43:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Jul 2017 22:01:18 GMT
server
nginx
status
200
etag
W/"5967edae-2ca2"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=315360000, public, immutable
x-dropbox-request-id
28a675415a0a35c7db13c43ab5f9fbb5
strict-transport-security
max-age=15552000; includeSubDomains
timing-allow-origin
https://www.dropbox.com
expires
Thu, 31 Dec 2037 23:55:55 GMT
help.png
cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/ Frame 2437 		269 B
269 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/help.png
Requested by
Host: a.123data.top
URL: https://a.123data.top/eynpbf.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
a3ab3524c3fd32d8dfa693c462f7033fd2682d50034cd00b38db48fa319ca44b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Mon, 07 Aug 2017 05:43:31 GMT
Last-Modified
Tue, 23 Feb 2010 02:31:18 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"09f3b4730b4ca1:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
269
point.png
cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/ Frame 2437 		370 B
370 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/point.png
Requested by
Host: a.123data.top
URL: https://a.123data.top/eynpbf.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
84a43aa2221a01befbf027facade3174f752530c1ef34a21f9ded44b77e94639

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Mon, 07 Aug 2017 05:43:30 GMT
Last-Modified
Tue, 23 Feb 2010 02:31:29 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"8016ca4d30b4ca1:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
370
email-all.png
buildinggroup.pro/layouts/ Frame 2437 		219 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://buildinggroup.pro/layouts/email-all.png
Requested by
Host: a.123data.top
URL: https://a.123data.top/eynpbf.html
Protocol
HTTP/1.1
Server
81.177.24.64 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
s15.in-solve.ru
Software
Apache /
Resource Hash
2360c9279fa10ee84b3783a30e5b47bec8f6ffe2e2780b60ab74965675a634e2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Mon, 07 Aug 2017 05:43:31 GMT
Server
Apache
Content-Length
219
Content-Type
text/html; charset=iso-8859-1
background-unbrand.png
cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/ Frame 2437 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/outlook_emailsrvr_com/images/background-unbrand.png
Requested by
Host: text
URL: data:text/html;truncated
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
18187433f721f58f44065ffe2cb17805a7ec8820811574d65dce184505de5029

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Mon, 07 Aug 2017 05:43:30 GMT
Last-Modified
Tue, 23 Feb 2010 02:31:10 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0eb764230b4ca1:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
2268

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
storage.googleapis.com
URL
https://storage.googleapis.com/axiomatic-empire-9185/xfasd/raph.html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies