oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud
Open in
urlscan Pro
159.8.199.241
Malicious Activity!
Public Scan
Effective URL: https://oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud/misfond/index.html
Submission: On September 07 via manual from US
Summary
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on November 18th 2020. Valid for: a year.
This is the only time oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.115.121 167.89.115.121 | 11377 (SENDGRID) (SENDGRID) | |
1 | 159.8.199.241 159.8.199.241 | 36351 (SOFTLAYER) (SOFTLAYER) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
8 | 2606:4700:303... 2606:4700:3034::6815:5490 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 4 |
ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
u17218225.ct.sendgrid.net |
ASN36351 (SOFTLAYER, US)
PTR: s3.ams03.objectstorage.softlayer.net
oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
canonsmtp.com
canonsmtp.com |
30 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
appdomain.cloud
oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud |
78 KB |
1 |
sendgrid.net
1 redirects
u17218225.ct.sendgrid.net |
289 B |
19 | 4 |
Domain | Requested by | |
---|---|---|
8 | canonsmtp.com |
oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud
|
1 | ajax.googleapis.com |
oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud
|
1 | oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud | |
1 | u17218225.ct.sendgrid.net | 1 redirects |
19 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.ams03.cloud-object-storage.appdomain.cloud DigiCert TLS RSA SHA256 2020 CA1 |
2020-11-18 - 2021-12-19 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-08-12 - 2022-08-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud/misfond/index.html
Frame ID: 909870FE07E478ECA8DCD8DC0E59D381
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
Dropbox - Get your files anytime anywherePage URL History Show full URLs
-
https://u17218225.ct.sendgrid.net/ls/click?upn=AjxCuJM4o2nhAbMhPA6yTSiU1APKaQriGArhHKnEOWjOwYPzV92H6q2Na-2Fxcn...
HTTP 302
https://oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud/misfond/index.html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u17218225.ct.sendgrid.net/ls/click?upn=AjxCuJM4o2nhAbMhPA6yTSiU1APKaQriGArhHKnEOWjOwYPzV92H6q2Na-2FxcnILGBB7a-2Bg7XRTysBaAoiomHxe8rz1p-2BJyG-2BvbXcw5pbqi-2FkK46sya-2FyhiAhPM-2BOwaNjtRrE_QrUn-2BLF0-2FZQF3z-2F1mmtfzFC5wMNQzX1SE17qCZ6I4ltWyByH1aifXaBXLJ8K327aoEeaG-2FnSTJurktQUYakYc1XDOdedIq3dlRbdxoXtEHGkX9h3u12-2BIbRx1Z6KQMm-2BlTKLW7LtoImoXUYQK4i-2F-2FLFPpH5-2FgltBUlk27PihJq9WJYeqG9mNX3vtraoTty-2BJmi8TA-2F9t4Vj45-2Bt60Q5kYIwxfBGVRAxRVq7B9gzu894-3D
HTTP 302
https://oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud/misfond/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud/misfond/ Redirect Chain
|
78 KB 78 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo.png
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
outlook.svg
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
1 KB 1017 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office.svg
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
1 KB 937 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol.png
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
608 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
search.svg
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other.png
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Atlas%20Grotesk%20Web%20Bold%20Regular.woff2
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Atlas%20Grotesk%20Web%20Light%20Regular.woff2
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
source-sans-pro-v14-latin-600.woff2
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Atlas%20Grotesk%20Web%20Light%20Regular.woff
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Atlas%20Grotesk%20Web%20Bold%20Regular.woff
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
source-sans-pro-v14-latin-600.woff
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
source-sans-pro-v14-latin-600.ttf
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Atlas%20Grotesk%20Web%20Light%20Regular.ttf
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Atlas%20Grotesk%20Web%20Bold%20Regular.ttf
canonsmtp.com/email-list/dropboxyteyt25/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/Atlas%20Grotesk%20Web%20Bold%20Regular.woff2
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff2
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/source-sans-pro-v14-latin-600.woff2
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/Atlas%20Grotesk%20Web%20Light%20Regular.woff
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/Atlas%20Grotesk%20Web%20Bold%20Regular.woff
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/source-sans-pro-v14-latin-600.woff
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/source-sans-pro-v14-latin-600.ttf
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/Atlas%20Grotesk%20Web%20Light%20Regular.ttf
- Domain
- canonsmtp.com
- URL
- https://canonsmtp.com/email-list/dropboxyteyt25/assets/Atlas%20Grotesk%20Web%20Bold%20Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _0x317e function| _0x27a5 object| Zlib function| templatePage function| $ function| jQuery function| window_opener_xc function| get_extra_data0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
canonsmtp.com
oauthbuk6024.s3.ams03.cloud-object-storage.appdomain.cloud
u17218225.ct.sendgrid.net
canonsmtp.com
159.8.199.241
167.89.115.121
2606:4700:3034::6815:5490
2a00:1450:4001:829::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f4ea5e61266b9cf8a513de2bab68553c98f697e77b695065a75f24c27fb6c72
38e64fbeb524b7748d30fcf0c0e1a52f2994cbe0c036b3f2c2d1cdcf55219689
79f1125dcdb1f9194d515a1da5fcd62db3cd89e4d50c5aa29fb7e10a293ac127
83bc60f68ff2202282149424847f87a2437d6ddcd5fa4fd5d35d85550f9cd328
96b781dc1002a753ddff78a23bc776f4db3c7f4f433a9df39ba516f40b3f72c7
a61dfcb8de64f6f9b74156ca950291f133a867a325c8616b408b977a3f19caa2
cab58d8b45a1a683e1e9ee76208fd2b842d6f78f9140c9d438eb35b58453e70a
f4b303a7ed2422acd6a453103a4de290078485b90a0e214d5216a7411934e2e7
f4da43a481337329754a6c275c58b8844098975e740f20f2eba941e3bc564a59