f004.backblazeb2.com Open in urlscan Pro
149.137.128.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://3s0h.short.gy/XxbAje
Effective URL:
https://f004.backblazeb2.com/file/logengdrive/authengdrive.html
Submission: On March 28 via manual (March 28th 2022, 5:32:49 pm UTC) from CA — Scanned from CA

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 149.137.128.16, located in United States and belongs to BACKBLAZE, US. The main domain is f004.backblazeb2.com.
TLS certificate: Issued by R3 on February 8th 2022. Valid for: 3 months.

This is the only time f004.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.2.56.64 52.2.56.64	14618 (AMAZON-AES) (AMAZON-AES)
10	149.137.128.16 149.137.128.16	40401 (BACKBLAZE) (BACKBLAZE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (STACKPATH...) (STACKPATH-CDN)
2	2606:4700:303... 2606:4700:3032::6815:1e29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	4

1 52.2.56.64 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: us-ip-2.short.io

3s0h.short.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 149.137.128.16 (United States)

ASN40401 (BACKBLAZE, US)
PTR: f004.backblazeb2.com

f004.backblazeb2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3032::6815:1e29 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	backblazeb2.com f004.backblazeb2.com	536 KB
2	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 5770	18 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 882	30 KB
1	short.gy 1 redirects 3s0h.short.gy	405 B
13	4

	Domain	Requested by
10	f004.backblazeb2.com	f004.backblazeb2.com
2	ka-f.fontawesome.com	f004.backblazeb2.com
1	code.jquery.com	f004.backblazeb2.com
1	3s0h.short.gy	1 redirects
13	4

This site contains no links.

Subject Issuer	Validity	Valid
backblazeb2.com R3	`2022-02-08` - `2022-05-09`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-12` - `2022-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html
Frame ID: EBFA9EEF86DFB537316614189AC90C13
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Share Point Online

Page URL History Show full URLs

https://3s0h.short.gy/XxbAje HTTP 302
https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

583 kB
Transfer

744 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://3s0h.short.gy/XxbAje HTTP 302
https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request authengdrive.html Show response f004.backblazeb2.com/file/logengdrive/ Redirect Chain https://3s0h.short.gy/XxbAje https://f004.backblazeb2.com/file/logengdrive/authengdrive.html	160 KB 161 KB	412ms 126ms	Document text/html	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `1a1cc82a3be56c0a8df2f60e5a2f4b8339e51bdaaabbfc0a43d8f9fcf91b5f8e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Accept-Language en-CA,en;q=0.9 Response headers x-bz-file-name authengdrive.html x-bz-file-id 4_z874d7820742fc5f571f7041b_f108daa98a3b8e13e_d20220328_m073613_c004_v0402003_t0014_u01648452973745 x-bz-content-sha1 517c3d51e609209ab700c39fc36793f4d0860aed X-Bz-Upload-Timestamp 1648452973745 Accept-Ranges bytes x-bz-info-src_last_modified_millis 1648452793035 Content-Type text/html Content-Length 164060 Date Mon, 28 Mar 2022 17:32:43 GMT Keep-Alive timeout=5 Connection keep-alive Redirect headers x-ratelimit-limit 50 x-ratelimit-remaining 49 x-ratelimit-reset 60 connection close content-type text/html; charset=utf-8 x-powered-by Short.io link shortener cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache location https://f004.backblazeb2.com/file/logengdrive/authengdrive.html content-length 0 Date Mon, 28 Mar 2022 17:32:43 GMT
GET H/1.1	200	jquery.min.js.download Show response f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	84 KB 84 KB	395ms 124ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/jquery.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:43 GMT X-Bz-Upload-Timestamp 1648452908384 x-bz-file-id 4_z874d7820742fc5f571f7041b_f112c04eefa06638d_d20220328_m073508_c004_v0402000_t0057_u01648452908384 x-bz-content-sha1 69bb69e25ca7d5ef0935317584e6153f3fd9a88c Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/jquery.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 85578 x-bz-info-src_last_modified_millis 1642319286000
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	82ms 28ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Mon, 28 Mar 2022 17:32:44 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-152b5" vary Accept-Encoding x-hw 1648488764.dop059.dc2.t,1648488764.cds088.dc2.hn,1648488764.cds197.dc2.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H/1.1	200	bootstrap.min.css f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	141 KB 142 KB	345ms 104ms	Stylesheet text/css	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/bootstrap.min.css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d` Request headers Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Origin https://f004.backblazeb2.com Accept-Language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:43 GMT X-Bz-Upload-Timestamp 1648452903955 x-bz-file-id 4_z874d7820742fc5f571f7041b_f10009035cacbf3b4_d20220328_m073503_c004_v0402003_t0049_u01648452903955 x-bz-content-sha1 895125a4522a3b10ee7ada06ee6503587cbf95c5 Content-Type text/css x-bz-file-name Share+Point+Online_files/bootstrap.min.css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 144877 x-bz-info-src_last_modified_millis 1642319336000
GET H/1.1	200	css f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	1 KB 2 KB	359ms 90ms	Stylesheet application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `f0cfe475d2d7e5829f34880b0311485f08940c0403567ecf54ddd024894ecfef` Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:44 GMT X-Bz-Upload-Timestamp 1648452906687 x-bz-file-id 4_z874d7820742fc5f571f7041b_f101bcb7dbb0bbcc7_d20220328_m073506_c004_v0402000_t0026_u01648452906687 x-bz-content-sha1 fff5f7c1e8a024ea906e1344f9042e22fdf00eb0 Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 1185 x-bz-info-src_last_modified_millis 1642319338000
GET H/1.1	200	585b051251.js.download Show response f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	11 KB 11 KB	469ms 133ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/585b051251.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4` Request headers Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Origin https://f004.backblazeb2.com Accept-Language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:43 GMT X-Bz-Upload-Timestamp 1648452901256 x-bz-file-id 4_z874d7820742fc5f571f7041b_f106f8754a1a9a4a1_d20220328_m073501_c004_v0402003_t0056_u01648452901256 x-bz-content-sha1 add67ddd5f4ede50dcea8d89ea55f253f8c42990 Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/585b051251.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 11026 x-bz-info-src_last_modified_millis 1642319338000
GET H/1.1	404	hover.css f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	0 0	181ms 94ms	Stylesheet application/json	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/hover.css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:44 GMT Cache-Control max-age=0, no-cache, no-store Connection keep-alive Keep-Alive timeout=5 Content-Length 94 Content-Type application/json;charset=utf-8
GET H/1.1	404	gmail.png f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	94 B 94 B	89ms 88ms	Image application/json	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Show image Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/gmail.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `a87ef7b2a413f234985afa048f77baf7911825ddda1a8b3610fecdd2c3093272` Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:44 GMT Cache-Control max-age=0, no-cache, no-store Connection keep-alive Keep-Alive timeout=5 Content-Length 94 Content-Type application/json;charset=utf-8
GET H/1.1	200	jquery-3.2.1.slim.min.js.download Show response f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	68 KB 68 KB	146ms 145ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/jquery-3.2.1.slim.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398` Request headers Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Origin https://f004.backblazeb2.com Accept-Language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:43 GMT X-Bz-Upload-Timestamp 1648452910133 x-bz-file-id 4_z874d7820742fc5f571f7041b_f1003310279bfa90b_d20220328_m073510_c004_v0402006_t0042_u01648452910133 x-bz-content-sha1 9e89d1515bc4c371b86f4cb1002fd8e377c1829f Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/jquery-3.2.1.slim.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 69597 x-bz-info-src_last_modified_millis 1642319340000
GET H/1.1	200	popper.min.js.download Show response f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	19 KB 19 KB	101ms 100ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/popper.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66` Request headers Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Origin https://f004.backblazeb2.com Accept-Language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:43 GMT X-Bz-Upload-Timestamp 1648452911495 x-bz-file-id 4_z874d7820742fc5f571f7041b_f1056bb8260d25d2f_d20220328_m073511_c004_v0402004_t0028_u01648452911495 x-bz-content-sha1 c3b977aa4b8dfb69d651e07015031d385ded964b Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/popper.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 19188 x-bz-info-src_last_modified_millis 1642319340000
GET H/1.1	200	bootstrap.min.js.download Show response f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/	48 KB 48 KB	100ms 100ms	Script application/octet-stream	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/bootstrap.min.js.download Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b` Request headers Referer https://f004.backblazeb2.com/file/logengdrive/authengdrive.html Origin https://f004.backblazeb2.com Accept-Language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Mon, 28 Mar 2022 17:32:44 GMT X-Bz-Upload-Timestamp 1648452905356 x-bz-file-id 4_z874d7820742fc5f571f7041b_f1061a101ae535b9d_d20220328_m073505_c004_v0402006_t0013_u01648452905356 x-bz-content-sha1 a9545831803b1359cfeed47e3b4d6bae68e40e99 Content-Type application/octet-stream x-bz-file-name Share+Point+Online_files/bootstrap.min.js.download Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 48944 x-bz-info-src_last_modified_millis 1642319340000
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	59 KB 13 KB	64ms 25ms	Fetch text/css	2606:4700:3032::6815:1e29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251 Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/585b051251.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:1e29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda` Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Mon, 28 Mar 2022 17:32:44 GMT via 1.1 00a6901a148285ca8b56f0d0c1104a48.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 45920 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VxYWHD9gn1KmQeiM5iaAK24%2FLYG%2B2315YpudYBWoPhYDsolSbR%2FfnL431Py7fyq2iwxHaVsD0wGRbCBckIdvCRMd6dC5jpIGhSdpC59mQ2eUORBLGexHz3SvFAH40DWpaCD2sBOsbTYRH2Ki2ixwWfpsxg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 x-amz-cf-pop EWR52-C4 cf-ray 6f321b5cecb3ca57-YUL access-control-allow-headers fa-kit-token x-amz-cf-id G4dbv-HofVn0F7rNGyM1RalCpqU2cUb6CZARfOFp1iXV8oovS4t0vw==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.4/css/	26 KB 4 KB	67ms 28ms	Fetch text/css	2606:4700:3032::6815:1e29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/585b051251.js.download Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:1e29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8` Request headers Accept-Language en-CA,en;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Mon, 28 Mar 2022 17:32:44 GMT via 1.1 f5a11ff9652a64f1fcf7e2671d944f46.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 45920 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 04 Aug 2021 18:53:09 GMT server cloudflare etag W/"76f34b71fc9fb641507ff6a822cc07f5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4VyNanoVSl6hkqbJcBY6%2Fdtg11DxsdL7nYYCTIFpJMzs8XmvfCY63UAp2kuvW2eFT%2FENlJmhAOMxyGiWJYKm3WIR1XN%2FyCkjF3jZQoQoyHeX2TGJ0nQXdsG0jlgdbdL1aP2BE1tCsKWhlfSVkre9S5fiA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 x-amz-cf-pop EWR52-C4 cf-ray 6f321b5cecb5ca57-YUL access-control-allow-headers fa-kit-token x-amz-cf-id u-skZQk1-igcWgAxxM_E5XHKh2oaaUjGClvVguV9fw7RMJD4gu29mA==
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `03850575e0f0bdf2eb1ce94575dba52fe70d7a674cf29748a6c6d8ebd578de7f` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	16 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `85362655d77973d4744a9fb627969dce486bf5c6dd95273c292a110174f089dc` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	876 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `000d9bd3fb15bc689eafcfb3ad6574d33c8a8b7d31d234ecc7b62b9ac44c6054` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `88924ba2935d1144ba7636fa5f8720fd6c4a189ab0d2d07c97fd70ae0362bfef` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	894 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `235da3a6f9d23c6ed313077ae8e0d60734825e1c2d2fdae1d49ed597111bea16` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `aeefd15375df211e06606381bd07fc3b70c4ff3bb5201d5db284a508a14f80f5` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	18 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d7f6c8ea089a5d68b4a8bb5047dcaccc6c9480aae7f579b4293481217f5b6915` Request headers Accept-Language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Content-Type image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/hover.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://f004.backblazeb2.com/file/logengdrive/Share%20Point%20Online_files/gmail.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3s0h.short.gy
code.jquery.com
f004.backblazeb2.com
ka-f.fontawesome.com
149.137.128.16
2001:4de0:ac18::1:a:2b
2606:4700:3032::6815:1e29
52.2.56.64
000d9bd3fb15bc689eafcfb3ad6574d33c8a8b7d31d234ecc7b62b9ac44c6054
03850575e0f0bdf2eb1ce94575dba52fe70d7a674cf29748a6c6d8ebd578de7f
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1a1cc82a3be56c0a8df2f60e5a2f4b8339e51bdaaabbfc0a43d8f9fcf91b5f8e
235da3a6f9d23c6ed313077ae8e0d60734825e1c2d2fdae1d49ed597111bea16
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
85362655d77973d4744a9fb627969dce486bf5c6dd95273c292a110174f089dc
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
88924ba2935d1144ba7636fa5f8720fd6c4a189ab0d2d07c97fd70ae0362bfef
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a87ef7b2a413f234985afa048f77baf7911825ddda1a8b3610fecdd2c3093272
aeefd15375df211e06606381bd07fc3b70c4ff3bb5201d5db284a508a14f80f5
cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4
d7f6c8ea089a5d68b4a8bb5047dcaccc6c9480aae7f579b4293481217f5b6915
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f0cfe475d2d7e5829f34880b0311485f08940c0403567ecf54ddd024894ecfef
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

f004.backblazeb2.com Open in urlscan Pro 149.137.128.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

583 kBTransfer

744 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

f004.backblazeb2.com Open in urlscan Pro
149.137.128.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

583 kB
Transfer

744 kB
Size

0
Cookies

13 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!