urlscan.io logo urlscan.io
SecurityTrails logo

s3-api.us-geo.objectstorage.softlayer.net Open in urlscan Pro
67.228.254.193  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bit.ly/2QmOihR
Effective URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Submission: On November 08 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 67.228.254.193, located in Dallas, United States and belongs to SOFTLAYER - SoftLayer Technologies Inc., US. The main domain is s3-api.us-geo.objectstorage.softlayer.net.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 17th 2018. Valid for: a year.
This is the only time s3-api.us-geo.objectstorage.softlayer.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 395224 (BITLY-AS)
1 1 206.189.125.60 14061 (DIGITALOC...)
1 2606:4700:30:... 13335 (CLOUDFLAR...)
2 67.228.254.193 36351 (SOFTLAYER)
4 2a00:1450:400... 15169 (GOOGLE)
7 3
1    67.199.248.11 (United States)

ASN395224 (BITLY-AS - Bitly Inc, US)
PTR: bit.ly
bit.ly
1    206.189.125.60 (New York, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: ubuntu-linkshorten-jomstat.bid
aweurl.us
1    2606:4700:30::681c:f6d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
a.seclink.us
2    67.228.254.193 (Dallas, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: s3-api.us-geo.objectstorage.softlayer.net
s3-api.us-geo.objectstorage.softlayer.net
4    2a00:1450:4001:825::2010 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
storage.googleapis.com
Apex Domain
Subdomains		 Transfer
4 googleapis.com
storage.googleapis.com
335 KB
2 softlayer.net
s3-api.us-geo.objectstorage.softlayer.net
40 KB
1 seclink.us
a.seclink.us
1 KB
1 aweurl.us
aweurl.us
1 KB
1 bit.ly
bit.ly
415 B
7 5
Domain Requested by
4 storage.googleapis.com s3-api.us-geo.objectstorage.softlayer.net
2 s3-api.us-geo.objectstorage.softlayer.net a.seclink.us
s3-api.us-geo.objectstorage.softlayer.net
1 a.seclink.us
1 aweurl.us 1 redirects
1 bit.ly 1 redirects
7 5

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2018-10-31 -
2019-10-31		 a year crt.sh
s3-api.us-geo.objectstorage.softlayer.net
GeoTrust RSA CA 2018		 2018-04-17 -
2019-07-29		 a year crt.sh
*.storage.googleapis.com
Google Internet Authority G3		 2018-10-23 -
2019-01-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Frame ID: DC2150309039D928042094C601C89C0F
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://bit.ly/2QmOihR HTTP 301
    http://aweurl.us/EiktQ HTTP 301
    https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14 Page URL
  2. https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Page Statistics

7
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

377 kB
Transfer

375 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/2QmOihR HTTP 301
    http://aweurl.us/EiktQ HTTP 301
    https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14 Page URL
  2. https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/2QmOihR HTTP 301
  • http://aweurl.us/EiktQ HTTP 301
  • https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
fhfvkh.html
a.seclink.us/
Redirect Chain
  • https://bit.ly/2QmOihR
  • http://aweurl.us/EiktQ
  • https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:f6d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82c330793dbaebd8d35d5856aca6b61060ad712f5338cf1b99e84ec0c38f0e79

Request headers

:method
GET
:authority
a.seclink.us
:scheme
https
:path
/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Thu, 08 Nov 2018 16:08:57 GMT
content-type
text/html
set-cookie
__cfduid=d88502cc95ff5ea8d6846930f12273a161541693337; expires=Fri, 08-Nov-19 16:08:57 GMT; path=/; domain=.seclink.us; HttpOnly
last-modified
Tue, 06 Nov 2018 21:47:26 GMT
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
47694d200c126505-FRA
content-encoding
gzip

Redirect headers

Date
Thu, 08 Nov 2018 16:08:57 GMT
Server
Apache/2.4.18 (Ubuntu)
Cache-Control
no-cache
Location
https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14
Set-Cookie
XSRF-TOKEN=eyJpdiI6Im0xWXF3eVVnVjBXeWpKa0FLRzNCbGc9PSIsInZhbHVlIjoidFRHYncxcDJBaDR4OHY0YmlhNzlXaXR3cG91YXZ2dzJEdjltdzEwdzBOQzNsU1VGNmZ2WVdVSmRmT05maTFCQ1I4QXhTaWZrYzVPeDBpRlA2TjFudUE9PSIsIm1hYyI6Ijk1NjIwYmEzMDEwNTRhMTg0NTFlYWMxZjdiNjdkOTE4ZTY5NjI5ZDkzMjZkNDU0MTUxN2I5OGZjMjBmY2M5NjEifQ%3D%3D; expires=Thu, 08-Nov-2018 18:08:57 GMT; Max-Age=7200; path=/ laravel_session=eyJpdiI6Ik9SN2hkN2crYVdTTUo2ZXZMc2hmSFE9PSIsInZhbHVlIjoiWkp2ZlptNGUxaUNuMXZNSEVCbGdCbzVhOFRCK3VzQU9nQllGMXkxM0VTZkFLZEZhVW5ueWJKd0tTc29CVUFrajJKalZidkV2RVY5R3VpQWJWcXBzSXc9PSIsIm1hYyI6IjRlMDQ1MzY4ZmQwZDZlMjkzMmIyNzk3ZjhlMGRiMmRmM2FiOTBhNTMzNjIwZGU5NDk2NDMwMzViMGRhMTk1ZDYifQ%3D%3D; expires=Thu, 08-Nov-2018 18:08:57 GMT; Max-Age=7200; path=/; HttpOnly
Content-Length
528
Connection
close
Content-Type
text/html; charset=UTF-8
Primary Request OFFICE.html
s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/ 		20 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Requested by
Host: a.seclink.us
URL: https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
67.228.254.193 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
s3-api.us-geo.objectstorage.softlayer.net
Software
3.13.6.44 /
Resource Hash
d032608410d79778fe8c51008e595de3958ddc82f4376bf1af4104c7762cb4da

Request headers

Host
s3-api.us-geo.objectstorage.softlayer.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://a.seclink.us/fhfvkh.html?a=29a81a51-ce7c-4081-b7c1-0ca550409d14

Response headers

Date
Thu, 08 Nov 2018 16:08:59 GMT
X-Clv-Request-Id
6fd60f80-ec41-4263-a203-8829b660302e
Server
3.13.6.44
X-Clv-S3-Version
2.5
Accept-Ranges
bytes
x-amz-request-id
6fd60f80-ec41-4263-a203-8829b660302e
ETag
"87af13e73f6ee951b25df74f3445b0c0"
Content-Type
text/html
Last-Modified
Tue, 06 Nov 2018 21:47:25 GMT
Content-Length
20418
Converged_v22057.css
storage.googleapis.com/office-company-page/images/ 		92 KB
92 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/office-company-page/images/Converged_v22057.css
Requested by
Host: s3-api.us-geo.objectstorage.softlayer.net
URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:825::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
4e9e7c1c2df9e91cf271a7afe529360d199cdff23a721473062ee1ebabd6821f

Request headers

Referer
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 16:08:59 GMT
x-guploader-uploadid
AEnB2UqrG7GFOYNiCGJXiGEpwwIWyy4InegSrBtTHHwpMamk3snWXayHDDj5B0b0tNzocIuDPXdOgti7ikL2rp45rtZU79159A
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
93795
last-modified
Wed, 19 Sep 2018 22:01:57 GMT
server
UploadServer
etag
"41551e56a355ca53b7fb3d4cbebd5433"
x-goog-hash
crc32c=bAjJtA==, md5=QVUeVqNVylO3+z1Mvr1UMw==
x-goog-generation
1537394517000800
cache-control
private, max-age=0
x-goog-stored-content-length
93795
accept-ranges
bytes
content-type
text/css
expires
Thu, 08 Nov 2018 16:08:59 GMT
office365.png
storage.googleapis.com/office-company-page/images/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/office-company-page/images/office365.png
Requested by
Host: s3-api.us-geo.objectstorage.softlayer.net
URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:825::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
8ae79a4d18eea420af0fd562d43879b569bbd2c622da6deba79f6c202e385361

Request headers

Referer
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 16:08:59 GMT
x-guploader-uploadid
AEnB2UqV-x6tDrywiiBwh9TB-KJg49RmAu9TGCjXwN62SwY1VZAk8Y-MaPsjhY7pXKkU2PkX0IPUVinxcyaR_4-CMlAFXpLEIg
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
25171
last-modified
Wed, 19 Sep 2018 21:36:33 GMT
server
UploadServer
etag
"95e1d221f4f2f485c900d7c69d5f8049"
x-goog-hash
crc32c=SRWDMA==, md5=leHSIfTy9IXJANfGnV+ASQ==
x-goog-generation
1537392993635200
cache-control
private, max-age=0
x-goog-stored-content-length
25171
accept-ranges
bytes
content-type
image/png
expires
Thu, 08 Nov 2018 16:08:59 GMT
OFFICE.html
s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Requested by
Host: s3-api.us-geo.objectstorage.softlayer.net
URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
67.228.254.193 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
s3-api.us-geo.objectstorage.softlayer.net
Software
3.13.6.44 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
s3-api.us-geo.objectstorage.softlayer.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Connection
keep-alive
Cache-Control
no-cache
Referer
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 08 Nov 2018 16:08:59 GMT
Last-Modified
Tue, 06 Nov 2018 21:47:25 GMT
Server
3.13.6.44
x-amz-request-id
6cb23ed1-a106-4ad3-8bf1-f18b6e6f0fbb
ETag
"87af13e73f6ee951b25df74f3445b0c0"
Content-Type
text/html
X-Clv-Request-Id
6cb23ed1-a106-4ad3-8bf1-f18b6e6f0fbb
X-Clv-S3-Version
2.5
Accept-Ranges
bytes
Content-Length
20418
bgoffice.jpg
storage.googleapis.com/office-company-page/images/ 		218 KB
218 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/office-company-page/images/bgoffice.jpg
Requested by
Host: s3-api.us-geo.objectstorage.softlayer.net
URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:825::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
aa675d8529ae96398122a352b927022cc2adebb580c7dca024f7004bcacbb6c1

Request headers

Referer
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 16:08:59 GMT
x-guploader-uploadid
AEnB2Uq-T9-cev31a7uOP8hYEod0G_dQnjSPZT72RaVhnmVFfLTtsDqh9MoHRuCZ22snZy2t-I71nTFNC42lf9GfdUEbr78cRA
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
222753
last-modified
Wed, 19 Sep 2018 21:28:40 GMT
server
UploadServer
etag
"19fa43714e73ca224c3de9852066c250"
x-goog-hash
crc32c=RCJMBg==, md5=GfpDcU5zyiJMPemFIGbCUA==
x-goog-generation
1537392520076644
cache-control
private, max-age=0
x-goog-stored-content-length
222753
accept-ranges
bytes
content-type
image/jpeg
expires
Thu, 08 Nov 2018 16:08:59 GMT
0-smaill.jpg
storage.googleapis.com/office-company-page/images/ 		0
477 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/office-company-page/images/0-smaill.jpg
Requested by
Host: s3-api.us-geo.objectstorage.softlayer.net
URL: https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:825::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://s3-api.us-geo.objectstorage.softlayer.net/aoffice365-unperfected-92358478/aoffice365-unperfected-92358478/OFFICE.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-type
application/xml; charset=UTF-8
cache-control
private, max-age=0
expires
Thu, 08 Nov 2018 16:08:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies