storage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:81b::2010
Malicious Activity!
Public Scan
Effective URL: https://storage.googleapis.com/ageomagnetist-139041970/login.html?dwmwxnpgze=bEbm1bQ1kUnzNk6S&kaiv=XCIzaJPmA91otxlZX&xxph=hBmxg...
Submission: On November 09 via manual from AU
Summary
TLS certificate: Issued by GTS CA 1O1 on October 20th 2020. Valid for: 3 months.
This is the only time storage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:1450:400... 2a00:1450:4001:81b::2010 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2606:4700:303... 2606:4700:3035::6812:3760 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
6 | 3 |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
trasactionsmtp.com
trasactionsmtp.com |
881 KB |
2 |
googleapis.com
storage.googleapis.com |
154 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com |
30 KB |
6 | 3 |
Domain | Requested by | |
---|---|---|
3 | trasactionsmtp.com |
storage.googleapis.com
|
2 | storage.googleapis.com |
storage.googleapis.com
|
1 | ajax.aspnetcdn.com |
storage.googleapis.com
|
6 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.storage.googleapis.com GTS CA 1O1 |
2020-10-20 - 2021-01-12 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-09-06 - 2021-09-06 |
a year | crt.sh |
*.vo.msecnd.net Microsoft IT TLS CA 2 |
2020-03-18 - 2022-03-18 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://storage.googleapis.com/ageomagnetist-139041970/login.html?dwmwxnpgze=bEbm1bQ1kUnzNk6S&kaiv=XCIzaJPmA91otxlZX&xxph=hBmxgcq1VdTPqrU&qmr=M5xLd8H1cceHjpU5pf&aoc=eaL3UFkM2yKiGvOG1&uflqek=4QiU55znNHRdrtqPxE&plm=moGk9vfFNm9kRSQwa93uSsc&ynbvfhljns=XuTgJECsSLEDzHjErFkKlZ2&lavsn=D3lbhqroMXS1CTEvJMzjq5xpsq&tlnc=WVJZxldqXc3FExlhyy934dyPZX
Frame ID: 427091A3572B32536A3E1A499DD45C79
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://storage.googleapis.com/ageomagnetist-139041970/index.html Page URL
- https://storage.googleapis.com/ageomagnetist-139041970/login.html?dwmwxnpgze=bEbm1bQ1kUnzNk6S&kaiv=XCIzaJPm... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://storage.googleapis.com/ageomagnetist-139041970/index.html Page URL
- https://storage.googleapis.com/ageomagnetist-139041970/login.html?dwmwxnpgze=bEbm1bQ1kUnzNk6S&kaiv=XCIzaJPmA91otxlZX&xxph=hBmxgcq1VdTPqrU&qmr=M5xLd8H1cceHjpU5pf&aoc=eaL3UFkM2yKiGvOG1&uflqek=4QiU55znNHRdrtqPxE&plm=moGk9vfFNm9kRSQwa93uSsc&ynbvfhljns=XuTgJECsSLEDzHjErFkKlZ2&lavsn=D3lbhqroMXS1CTEvJMzjq5xpsq&tlnc=WVJZxldqXc3FExlhyy934dyPZX Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
index.html
storage.googleapis.com/ageomagnetist-139041970/ |
75 KB 75 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.html
storage.googleapis.com/ageomagnetist-139041970/ |
78 KB 78 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
trasactionsmtp.com/email-list/office365-22/ |
157 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
trasactionsmtp.com/email-list/office365-22/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
trasactionsmtp.com/email-list/office365-22/ |
849 KB 851 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| _0x297f function| _0x4e12 object| Zlib function| $ function| jQuery function| randomInteger function| randomString function| getdomainpartofemail function| get_email_hash function| validateEmail function| geturlparameter function| get_rand_url_pars0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
storage.googleapis.com
trasactionsmtp.com
152.199.19.160
2606:4700:3035::6812:3760
2a00:1450:4001:81b::2010
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
222600f6c756552b31567adda71ed5468a88ac3e44efc5353f0187922f84c596
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
9e2e83800813c59b8e17142e51c6f79bbf8cfe408c3e83d225aacb9d4a1b440e
a63dac245930f5e7040058cc658e94d584b649aebfa2cae913c918ffaebe2fd7
cd632bc9ea36185cc0f7fdc4238167535348e47aa0404be91c3067aa40bc45cd