s3.us-south.cloud-object-storage.appdomain.cloud

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 169.46.118.100, located in Irving, United States and belongs to SOFTLAYER, US. The main domain is s3.us-south.cloud-object-storage.appdomain.cloud. The Cisco Umbrella rank of the primary domain is 171411.

This is the only time s3.us-south.cloud-object-storage.appdomain.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Box.com (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	169.46.118.100 169.46.118.100	36351 (SOFTLAYER) (SOFTLAYER)
1	152.199.4.33 152.199.4.33	15133 (EDGECAST) (EDGECAST)
2	2606:4700:303... 2606:4700:3034::6815:4d4c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	3

1 169.46.118.100 (Irving, United States)

ASN36351 (SOFTLAYER, US)
PTR: 64.76.2ea9.ip4.static.sl-reverse.com

s3.us-south.cloud-object-storage.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.4.33 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3034::6815:4d4c (United States)

ASN13335 (CLOUDFLARENET, US)

magicsmtps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	magicsmtps.com magicsmtps.com	41 KB
1	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 579	38 KB
1	appdomain.cloud s3.us-south.cloud-object-storage.appdomain.cloud — Cisco Umbrella Rank: 171411	93 KB
4	3

	Domain	Requested by
2	magicsmtps.com	s3.us-south.cloud-object-storage.appdomain.cloud
1	ajax.aspnetcdn.com	s3.us-south.cloud-object-storage.appdomain.cloud
1	s3.us-south.cloud-object-storage.appdomain.cloud
4	3

This site contains no links.

Subject Issuer	Validity	Valid
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2021-08-06` - `2022-08-06`	a year	crt.sh
*.magicsmtps.com R3	`2021-11-29` - `2022-02-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://s3.us-south.cloud-object-storage.appdomain.cloud/347xl1c0rk/yoho/OTHER.html
Frame ID: CB076D8512838EDA84DEA627BF788EAB
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Secure File Sharing, Storage and Collaboration | Box

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

173 kB
Transfer

218 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request OTHER.html Show response
s3.us-south.cloud-object-storage.appdomain.cloud/347xl1c0rk/yoho/ 93 KB
93 KB 114ms
53ms Document
text/html 169.46.118.100
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: http://s3.us-south.cloud-object-storage.appdomain.cloud/347xl1c0rk/yoho/OTHER.html
Protocol: HTTP/1.1
Server: 169.46.118.100 Irving, United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 64.76.2ea9.ip4.static.sl-reverse.com
Software: Cleversafe /
Resource Hash: 9b0713e4e38ab6e58bcbfe799d1782654806327379968d9e735898542ee4dfe0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-US,en;q=0.9

Response headers

Date: Sat, 08 Jan 2022 13:17:09 GMT
X-Clv-Request-Id: ec5cd795-767b-4f9a-b405-b5632ff53aee
Server: Cleversafe
X-Clv-S3-Version: 2.5
Accept-Ranges: bytes
x-amz-request-id: ec5cd795-767b-4f9a-b405-b5632ff53aee
ETag: "fe128404a102cf005607f69600987e7c"
Content-Type: text/html
Last-Modified: Tue, 21 Dec 2021 04:20:29 GMT
Content-Length: 95238

GET
H2 200 jquery-3.3.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 85 KB
38 KB 19ms
7ms Script
application/javascript 152.199.4.33
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js

Requested by

Host: s3.us-south.cloud-object-storage.appdomain.cloud
URL: http://s3.us-south.cloud-object-storage.appdomain.cloud/347xl1c0rk/yoho/OTHER.html

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

152.199.4.33 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nya/79D2) /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://s3.us-south.cloud-object-storage.appdomain.cloud/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sat, 08 Jan 2022 13:17:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12398987
x-cache: HIT
content-length: 38892
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jan 2018 19:27:49 GMT
server: ECAcc (nya/79D2)
etag: "af301a17b793d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 otherheader.png
magicsmtps.com/email-list/onedrive25/images/ 24 KB
24 KB 602ms
346ms Image
image/png 2606:4700:3034::6815:4d4c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://magicsmtps.com/email-list/onedrive25/images/otherheader.png
Requested by: Host: s3.us-south.cloud-object-storage.appdomain.cloud
URL: http://s3.us-south.cloud-object-storage.appdomain.cloud/347xl1c0rk/yoho/OTHER.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:4d4c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 42eaab7c7e0ef002daac51f16a1571de7bc75c0d59ed55aec863330fbd950953

Request headers

Accept-Language: en-US,en;q=0.9
Referer: http://s3.us-south.cloud-object-storage.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 13:17:10 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 24290
last-modified: Thu, 02 Dec 2021 06:12:53 GMT
server: cloudflare
etag: "61a863e5-5ee2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5hz%2FCglIdwmM3hYlv0PbC9BR3SS5DDCj%2BcLOcKRcl6cFq8G4G99FdAXn%2Brx8amyWECgolsHIOgVLPLQa43cfk1b0wNRF4GRK15z3%2Fc5BF0oNtZ4wLjnhSrzqfJ1O4EaHDn6IuJarVPQCB5HMqg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6ca5b45c8f641899-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 otherbutton.png
magicsmtps.com/email-list/onedrive25/images/ 16 KB
17 KB 598ms
343ms Image
image/png 2606:4700:3034::6815:4d4c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://magicsmtps.com/email-list/onedrive25/images/otherbutton.png
Requested by: Host: s3.us-south.cloud-object-storage.appdomain.cloud
URL: http://s3.us-south.cloud-object-storage.appdomain.cloud/347xl1c0rk/yoho/OTHER.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:4d4c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4162f1804f9b9f3051b2751002bec45ae366db48b601f2addadef690028bcaa8

Request headers

Accept-Language: en-US,en;q=0.9
Referer: http://s3.us-south.cloud-object-storage.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 08 Jan 2022 13:17:10 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 16808
last-modified: Thu, 02 Dec 2021 06:12:53 GMT
server: cloudflare
etag: "61a863e5-41a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VAN0lXglT4oX6N28LVjlEQDuLIQ3HhH%2FSWvZ5gxxiyGa6immZMvuVIWz50aLvrKHVQqFmFTA%2FGluC6wm2eh6tnOD3m047Jl3rCDV%2BiUzeLtB7jyWoHL%2BQC5EaAogoa2eslMni8ckOm3NZZZbmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6ca5b45c8f681899-EWR
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Box.com (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
magicsmtps.com
s3.us-south.cloud-object-storage.appdomain.cloud
152.199.4.33
169.46.118.100
2606:4700:3034::6815:4d4c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4162f1804f9b9f3051b2751002bec45ae366db48b601f2addadef690028bcaa8
42eaab7c7e0ef002daac51f16a1571de7bc75c0d59ed55aec863330fbd950953
9b0713e4e38ab6e58bcbfe799d1782654806327379968d9e735898542ee4dfe0

s3.us-south.cloud-object-storage.appdomain.cloud Open in urlscan Pro 169.46.118.100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

173 kBTransfer

218 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

s3.us-south.cloud-object-storage.appdomain.cloud Open in urlscan Pro
169.46.118.100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

173 kB
Transfer

218 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!