peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com
Open in
urlscan Pro
149.137.129.254
Malicious Activity!
Public Scan
Effective URL: https://peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com/index.html
Submission: On January 23 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on November 30th 2021. Valid for: 3 months.
This is the only time peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 169.46.118.100 169.46.118.100 | 36351 (SOFTLAYER) (SOFTLAYER) | |
1 | 142.251.41.10 142.251.41.10 | 15169 (GOOGLE) (GOOGLE) | |
4 | 172.67.139.197 172.67.139.197 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 149.137.129.254 149.137.129.254 | 40401 (BACKBLAZE) (BACKBLAZE) | |
1 | 69.16.175.42 69.16.175.42 | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 152.199.4.33 152.199.4.33 | 15133 (EDGECAST) (EDGECAST) | |
9 | 6 |
ASN36351 (SOFTLAYER, US)
PTR: 64.76.2ea9.ip4.static.sl-reverse.com
yjpigbukl4.s3.us-south.objectstorage.softlayer.net |
ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f10.1e100.net
ajax.googleapis.com |
ASN40401 (BACKBLAZE, US)
PTR: s3.us-west-004.backblazeb2.com
peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
minesmtp.com
minesmtp.com |
7 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 740 |
38 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 584 |
30 KB |
1 |
backblazeb2.com
peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com |
79 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 293 |
31 KB |
1 |
softlayer.net
yjpigbukl4.s3.us-south.objectstorage.softlayer.net |
75 KB |
9 | 6 |
Domain | Requested by | |
---|---|---|
4 | minesmtp.com |
ajax.googleapis.com
yjpigbukl4.s3.us-south.objectstorage.softlayer.net peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com |
1 | ajax.aspnetcdn.com |
yjpigbukl4.s3.us-south.objectstorage.softlayer.net
|
1 | code.jquery.com |
yjpigbukl4.s3.us-south.objectstorage.softlayer.net
|
1 | peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com |
yjpigbukl4.s3.us-south.objectstorage.softlayer.net
|
1 | ajax.googleapis.com |
yjpigbukl4.s3.us-south.objectstorage.softlayer.net
|
1 | yjpigbukl4.s3.us-south.objectstorage.softlayer.net | |
9 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.us-south.cloud-object-storage.appdomain.cloud DigiCert TLS RSA SHA256 2020 CA1 |
2021-11-09 - 2022-11-08 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-12-27 - 2022-03-21 |
3 months | crt.sh |
*.minesmtp.com R3 |
2021-12-08 - 2022-03-08 |
3 months | crt.sh |
backblazeb2.com R3 |
2021-11-30 - 2022-02-28 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2021-08-06 - 2022-08-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com/index.html
Frame ID: 45BDA7421FB5B73D90E72252A6A0DBBD
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
WebmailPage URL History Show full URLs
- https://yjpigbukl4.s3.us-south.objectstorage.softlayer.net/squirreltail/index.html?key=02b22d80137f1fff76ab6a3df92a5db7fe0a5abe&url_01=... Page URL
- https://peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com/index.html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://yjpigbukl4.s3.us-south.objectstorage.softlayer.net/squirreltail/index.html?key=02b22d80137f1fff76ab6a3df92a5db7fe0a5abe&url_01=https://peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com/index.html&url_02=https://fearsome-physoclistic-rubbernecked.s3.us-west-004.backblazeb2.com/index.html&url_03=https://anamniote-degratia-fabiform.s3.eu-central-003.backblazeb2.com/index.html&url_04=https://drug-roentgenization-rugbies.s3.us-west-004.backblazeb2.com/index.html&url_05=https://damoetas-downtimes-hedgehoggy.s3.eu-central-003.backblazeb2.com/index.html&redirect=https://www.amazon.com Page URL
- https://peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
yjpigbukl4.s3.us-south.objectstorage.softlayer.net/squirreltail/ |
75 KB 75 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redirect-to-url.php
minesmtp.com/email-list/__vendor/ |
86 B 610 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com/ |
78 KB 79 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webmail-logo.svg
minesmtp.com/email-list/gwebml8/assets/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webmail-login.svg
minesmtp.com/email-list/gwebml8/assets/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
view.png
minesmtp.com/email-list/gwebml8/assets/ |
563 B 865 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _0xbaa7 function| _0x1f7f object| Zlib function| $ function| jQuery function| randomInteger function| randomString function| getdomainpartofemail function| get_email_hash function| validateEmail function| geturlparameter function| get_rand_url_pars0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
ajax.googleapis.com
code.jquery.com
minesmtp.com
peacocking-shaliest-unconclusiveness.s3.us-west-004.backblazeb2.com
yjpigbukl4.s3.us-south.objectstorage.softlayer.net
142.251.41.10
149.137.129.254
152.199.4.33
169.46.118.100
172.67.139.197
69.16.175.42
10419bab3a1ebcc742515d1ac572828bf771e38cdd877fb3e47e841ea65a2838
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
5023cb5986b21ffc8da54cc95663b7706f337337021babedab9022cf750dfd5d
8549b30036605e1d28140a76adbaf0f691d2495fcaf72b9a931897ac62184bec
989d7f2d255342d535f6d38bc5bfffcdbdbd91ba23ab892b7875d212fa0c5409
ce2d0dd8af7c4734b90978efd9a3413478a288b41e6519c88db292ad2af9ba99
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e