www.dropboxshared.xyz Open in urlscan Pro
185.5.250.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.dropboxshared.xyz/
Submission: On September 21 via automatic, source certstream-suspicious (September 21st 2020, 8:29:55 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 185.5.250.1, located in Russian Federation and belongs to IHOR-AS, RU. The main domain is www.dropboxshared.xyz.
TLS certificate: Issued by dropboxshared.xyz.secureuserfiles.xyz on September 21st 2020. Valid for: a year.

This is the only time www.dropboxshared.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
11	185.5.250.1 185.5.250.1		35196 (IHOR-AS) (IHOR-AS)
11	1

11 185.5.250.1 (Russian Federation)

ASN35196 (IHOR-AS, RU)
PTR: web02-cp.marosnet.net

www.dropboxshared.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	dropboxshared.xyz www.dropboxshared.xyz	293 KB
11	1

	Domain	Requested by
11	www.dropboxshared.xyz	www.dropboxshared.xyz
11	1

This site contains no links.

Subject Issuer	Validity	Valid
dropboxshared.xyz.secureuserfiles.xyz dropboxshared.xyz.secureuserfiles.xyz	`2020-09-21` - `2021-09-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.dropboxshared.xyz/
Frame ID: 9E89DDCF895DD6AA635A826DC40C6F07
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

293 kB
Transfer

556 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.dropboxshared.xyz/ 6 KB
1 KB 368ms
101ms Document
text/html 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dropboxshared.xyz/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),

Reverse DNS

web02-cp.marosnet.net

Software

nginx / PHP/5.6.40

Resource Hash

78a354bec18c77be9c32d82ea044ebe19424ae41471edef9d5b5fd000773ccd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.dropboxshared.xyz
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 21 Sep 2020 20:29:39 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/5.6.40
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: HIT
x-server-powered-by: Engintron
content-encoding: gzip

GET
H2 200 css.css
www.dropboxshared.xyz/styles/ 5 KB
2 KB 154ms
153ms Stylesheet
text/css 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/styles/css.css
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: f197d9da74ec12bcfeb42f4ace83d2b31b2dd06c70a60aa8f9d89c8f58efa9e3

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:39 GMT
content-encoding: gzip
last-modified: Sun, 09 Aug 2020 15:58:45 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Wed, 21 Oct 2020 20:29:39 GMT

GET
H2 200 checkbox.css
www.dropboxshared.xyz/styles/ 1 KB
716 B 175ms
174ms Stylesheet
text/css 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/styles/checkbox.css
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: ab96691d78536247ca2ab64aac5af744cf699926fa30d393ae859c9fa803b42c

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:39 GMT
content-encoding: gzip
last-modified: Fri, 07 Aug 2020 23:29:37 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Wed, 21 Oct 2020 20:29:39 GMT

GET
H2 200 all.css
www.dropboxshared.xyz/styles/ 71 KB
13 KB 288ms
287ms Stylesheet
text/css 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/styles/all.css
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: 530cb4c29b444dc89dd73a4e0812f803be98d3448a48edca8aafdbc55a0b97eb

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:39 GMT
content-encoding: gzip
last-modified: Sun, 09 Aug 2020 08:41:15 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Wed, 21 Oct 2020 20:29:39 GMT

GET
H2 200 jquery.js Show response
www.dropboxshared.xyz/js/ 281 KB
84 KB 331ms
331ms Script
application/javascript 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/js/jquery.js
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:39 GMT
content-encoding: gzip
last-modified: Sat, 27 Jun 2020 12:06:32 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Wed, 21 Oct 2020 20:29:39 GMT

GET
H2 200 pdf.png
www.dropboxshared.xyz/images/ 8 KB
8 KB 112ms
111ms Image
image/png 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.dropboxshared.xyz/images/pdf.png
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: 5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:40 GMT
last-modified: Fri, 07 Aug 2020 23:42:14 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 8183
expires: Fri, 20 Nov 2020 20:29:40 GMT

GET
H2 200 excel.png
www.dropboxshared.xyz/images/ 15 KB
15 KB 175ms
175ms Image
image/png 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.dropboxshared.xyz/images/excel.png
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: 7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:40 GMT
last-modified: Sat, 08 Aug 2020 00:12:49 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 14950
expires: Fri, 20 Nov 2020 20:29:40 GMT

GET
H2 200 main.js Show response
www.dropboxshared.xyz/js/ 2 KB
751 B 149ms
148ms Script
application/javascript 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/js/main.js
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: 351afcd3b05b9e473783bdaf2b6ce16c5607e8fe3cf566641627a38e454de5cd

Request headers

Referer: https://www.dropboxshared.xyz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:39 GMT
content-encoding: gzip
last-modified: Sun, 09 Aug 2020 16:30:32 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Wed, 21 Oct 2020 20:29:39 GMT

GET
H2 200 fa-brands-400.woff2
www.dropboxshared.xyz/webfonts/ 76 KB
76 KB 221ms
220ms Font
font/woff2 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/webfonts/fa-brands-400.woff2
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/styles/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: e98ae3ff936b4723cd8a2377d2c549a667ce87e81201ec4995cc01bd374c1288

Request headers

Origin: https://www.dropboxshared.xyz
Referer: https://www.dropboxshared.xyz/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:40 GMT
last-modified: Thu, 18 Jun 2020 18:52:30 GMT
server: nginx
content-type: font/woff2
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 77444
expires: Fri, 20 Nov 2020 20:29:40 GMT

GET
H2 200 fa-regular-400.woff2
www.dropboxshared.xyz/webfonts/ 13 KB
13 KB 280ms
279ms Font
font/woff2 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/webfonts/fa-regular-400.woff2
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/styles/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: de5fb40e0689f154902213527781c2fb83cddcbf8f622a1384f1e2a7e7693b21

Request headers

Origin: https://www.dropboxshared.xyz
Referer: https://www.dropboxshared.xyz/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:40 GMT
last-modified: Thu, 18 Jun 2020 18:52:30 GMT
server: nginx
content-type: font/woff2
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 13596
expires: Fri, 20 Nov 2020 20:29:40 GMT

GET
H2 200 fa-solid-900.woff2
www.dropboxshared.xyz/webfonts/ 78 KB
79 KB 339ms
338ms Font
font/woff2 185.5.250.1
IHOR-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dropboxshared.xyz/webfonts/fa-solid-900.woff2
Requested by: Host: www.dropboxshared.xyz
URL: https://www.dropboxshared.xyz/styles/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.5.250.1 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS: web02-cp.marosnet.net
Software: nginx /
Resource Hash: 0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc

Request headers

Origin: https://www.dropboxshared.xyz
Referer: https://www.dropboxshared.xyz/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 21 Sep 2020 20:29:40 GMT
last-modified: Thu, 18 Jun 2020 18:52:30 GMT
server: nginx
content-type: font/woff2
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 80328
expires: Fri, 20 Nov 2020 20:29:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.dropboxshared.xyz
185.5.250.1
0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc
351afcd3b05b9e473783bdaf2b6ce16c5607e8fe3cf566641627a38e454de5cd
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
530cb4c29b444dc89dd73a4e0812f803be98d3448a48edca8aafdbc55a0b97eb
5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309
7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943
78a354bec18c77be9c32d82ea044ebe19424ae41471edef9d5b5fd000773ccd8
ab96691d78536247ca2ab64aac5af744cf699926fa30d393ae859c9fa803b42c
de5fb40e0689f154902213527781c2fb83cddcbf8f622a1384f1e2a7e7693b21
e98ae3ff936b4723cd8a2377d2c549a667ce87e81201ec4995cc01bd374c1288
f197d9da74ec12bcfeb42f4ace83d2b31b2dd06c70a60aa8f9d89c8f58efa9e3

www.dropboxshared.xyz Open in urlscan Pro 185.5.250.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

293 kBTransfer

556 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.dropboxshared.xyz Open in urlscan Pro
185.5.250.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

293 kB
Transfer

556 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!