![](/screenshots/0ff2383c-287c-4b03-a01b-7d7c2deb56a5.png)
aadobearmonica630383.blob.core.windows.net
Open in
urlscan Pro
52.239.214.132
Malicious Activity!
Public Scan
Effective URL: https://aadobearmonica630383.blob.core.windows.net/aadobearmonica630383/index.html
Submission: On February 22 via manual from US
Summary
TLS certificate: Issued by Microsoft IT TLS CA 5 on November 9th 2017. Valid for: 2 years.
This is the only time aadobearmonica630383.blob.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.11 67.199.248.11 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
1 1 | 206.189.125.60 206.189.125.60 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 1 | 72.249.130.36 72.249.130.36 | 30496 (AS-TIERP-...) (AS-TIERP-30496 - TierPoint) | |
1 | 2606:4700:30:... 2606:4700:30::681f:4092 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 52.239.214.132 52.239.214.132 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
13 | 31.28.167.85 31.28.167.85 | 15497 (COLOCALL ...) (COLOCALL Internet Data Center _ColoCALL_) | |
15 | 3 |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: ubuntu-linkshorten-jomstat.bid
secdl.us |
ASN30496 (AS-TIERP-30496 - TierPoint, LLC, US)
PTR: dfw1.danifer.com
vlt.me |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
a.bizdl.us |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
aadobearmonica630383.blob.core.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
us.
officeurl.us. |
496 KB |
1 |
windows.net
aadobearmonica630383.blob.core.windows.net |
4 KB |
1 |
bizdl.us
a.bizdl.us |
871 B |
1 |
vlt.me
1 redirects
vlt.me |
761 B |
1 |
secdl.us
1 redirects
secdl.us |
1020 B |
1 |
bit.ly
1 redirects
bit.ly |
414 B |
15 | 6 |
Domain | Requested by | |
---|---|---|
13 | officeurl.us. |
aadobearmonica630383.blob.core.windows.net
|
1 | aadobearmonica630383.blob.core.windows.net |
a.bizdl.us
|
1 | a.bizdl.us | |
1 | vlt.me | 1 redirects |
1 | secdl.us | 1 redirects |
1 | bit.ly | 1 redirects |
15 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-02-14 - 2020-02-14 |
a year | crt.sh |
*.blob.core.windows.net Microsoft IT TLS CA 5 |
2017-11-09 - 2019-11-09 |
2 years | crt.sh |
officeurl.us Let's Encrypt Authority X3 |
2019-02-09 - 2019-05-10 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://aadobearmonica630383.blob.core.windows.net/aadobearmonica630383/index.html
Frame ID: F191015DFEE5406D32CC98AFD1EE963C
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/0ff2383c-287c-4b03-a01b-7d7c2deb56a5.png)
Page URL History Show full URLs
-
https://bit.ly/2NeGP3E
HTTP 301
http://secdl.us/b07U0 HTTP 301
http://vlt.me/.2tj6d?a=6e7d2769-521a-44b6-bc14-fdbb5751e76c HTTP 302
https://a.bizdl.us/biqcgl.html Page URL
- https://aadobearmonica630383.blob.core.windows.net/aadobearmonica630383/index.html Page URL
Detected technologies
Detected patterns
- headers server /cloudflare/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/2NeGP3E
HTTP 301
http://secdl.us/b07U0 HTTP 301
http://vlt.me/.2tj6d?a=6e7d2769-521a-44b6-bc14-fdbb5751e76c HTTP 302
https://a.bizdl.us/biqcgl.html Page URL
- https://aadobearmonica630383.blob.core.windows.net/aadobearmonica630383/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bit.ly/2NeGP3E HTTP 301
- http://secdl.us/b07U0 HTTP 301
- http://vlt.me/.2tj6d?a=6e7d2769-521a-44b6-bc14-fdbb5751e76c HTTP 302
- https://a.bizdl.us/biqcgl.html
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
biqcgl.html
a.bizdl.us/ Redirect Chain
|
1 KB 871 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
aadobearmonica630383.blob.core.windows.net/aadobearmonica630383/ |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
officeurl.us./adobe-files/style-11/ |
139 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
officeurl.us./adobe-files/style-11/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
link1.png
officeurl.us./adobe-files/style-11/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
link2.png
officeurl.us./adobe-files/style-11/ |
72 KB 72 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
link3.png
officeurl.us./adobe-files/style-11/ |
65 KB 65 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
link4.png
officeurl.us./adobe-files/style-11/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
link5.png
officeurl.us./adobe-files/style-11/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
link6.png
officeurl.us./adobe-files/style-11/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot1.png
officeurl.us./adobe-files/style-11/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot2.png
officeurl.us./adobe-files/style-11/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot3.png
officeurl.us./adobe-files/style-11/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foot4.png
officeurl.us./adobe-files/style-11/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg2.png
officeurl.us./adobe-files/style-11/ |
199 KB 199 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Dropbox (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.bizdl.us
aadobearmonica630383.blob.core.windows.net
bit.ly
officeurl.us.
secdl.us
vlt.me
206.189.125.60
2606:4700:30::681f:4092
31.28.167.85
52.239.214.132
67.199.248.11
72.249.130.36
1ee31673c014526fd4549b382fba4ec6402fa9052a6b773dbcb0a4f9df393ef4
3153348c8fc62f737cb1e8f39faf1de39ac183ff2c05129cde11989e56c17661
37ac5510e9ee88f6cc41948675cd68d6d773bfe58c6a4c064f7b5e37002c9919
4d4ff61b0f62e9d452cf51b7f2d7314bf01dbd9ea03a5bd2ab36da69ad02cac5
5a821ec96b40392e08509cba6752cb8f030b3365bef25abd6ae8a7ed962e3064
68dcb8f6f06d04d2fd1b4848d30d4e4d1baa9d4b8c06843de7a425a7e0500c7c
772693b719f846636538548d315d6f3735e0b02e344d957c5919ffbbfff27f00
7a82f426e028d5e460b340e661b0ccd3fc4818885974424374a6611840a36bf5
97078b3a3ec81431b7ae19f733f25575c1e95871648e5a90ff3c597190304449
aef1be09c73940942d72005089be1e6ca0b1bbd29bc88d2af6571528b7aeb3da
bf9090ed7910ed5be5a4f414e803a5c0c11d2dec693e225e37761324bc3e3874
e372083583d6414fc9f1877859862d9d4d5760e5a1c1bc04cdee51d79db53441
e9c5e272ca9b1a1845b83619f665bcc76a3a910ad43f8d862b2ed8214978e7a6
faa69a98dfd74c16906dbab8cf7fd45996ff19751bcc4d7c4e8be94193e74937
fbe8559ad3b4307678250a671b8c259adf8ded119c8d133d1b706f0f4879a051