officeauthy.us-south.cf.appdomain.cloud Open in urlscan Pro
169.62.254.82 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ansteel.co/daum/h.php/?email=IG5vY
Effective URL:
https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Submission: On December 03 via manual (December 3rd 2020, 7:33:11 am UTC) from JP

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 12 HTTP transactions. The main IP is 169.62.254.82, located in United States and belongs to SOFTLAYER, US. The main domain is officeauthy.us-south.cf.appdomain.cloud.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on August 27th 2020. Valid for: a year.

This is the only time officeauthy.us-south.cf.appdomain.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	68.65.122.211 68.65.122.211	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	169.62.254.82 169.62.254.82	36351 (SOFTLAYER) (SOFTLAYER)
10 20	2620:100:6022... 2620:100:6022:15::a27d:420f	19679 (DROPBOX) (DROPBOX)
12	3

1 68.65.122.211 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server173-5.web-hosting.com

ansteel.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.62.254.82 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 52.fe.3ea9.ip4.static.sl-reverse.com

officeauthy.us-south.cf.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2620:100:6022:15::a27d:420f (United States) 10 redirects

ASN19679 (DROPBOX, US)

dl.dropbox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	dropboxusercontent.com dl.dropboxusercontent.com	592 KB
10	dropbox.com 10 redirects dl.dropbox.com	1 KB
1	appdomain.cloud officeauthy.us-south.cf.appdomain.cloud	2 KB
1	ansteel.co ansteel.co	329 B
12	4

	Domain	Requested by
10	dl.dropboxusercontent.com	officeauthy.us-south.cf.appdomain.cloud
10	dl.dropbox.com	10 redirects
1	officeauthy.us-south.cf.appdomain.cloud	ansteel.co
1	ansteel.co
12	4

This site contains no links.

Subject Issuer	Validity	Valid
ansteel.co Sectigo RSA Domain Validation Secure Server CA	`2020-07-22` - `2021-07-22`	a year	crt.sh
*.us-south.cf.appdomain.cloud DigiCert SHA2 Secure Server CA	`2020-08-27` - `2021-09-01`	a year	crt.sh
*.dl.dropboxusercontent.com DigiCert SHA2 High Assurance Server CA	`2020-01-30` - `2022-04-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Frame ID: 9CB1792E5F6986A55FC326219206A406
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://ansteel.co/daum/h.php/?email=IG5vY Page URL
https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

595 kB
Transfer

811 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ansteel.co/daum/h.php/?email=IG5vY Page URL
https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://dl.dropbox.com/s/26j5wefij3mu8hv/9898878766.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/26j5wefij3mu8hv/9898878766.js.download?dl=0

Request Chain 2

https://dl.dropbox.com/s/kp9o5oem2zzbif5/009877666.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/kp9o5oem2zzbif5/009877666.js.download?dl=0

Request Chain 3

https://dl.dropbox.com/s/zvdxeo24vnf6x3i/bootstrap.min.css?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/zvdxeo24vnf6x3i/bootstrap.min.css?dl=0

Request Chain 4

https://dl.dropbox.com/s/8kuav40pietd5b2/logo_bkl.css?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/8kuav40pietd5b2/logo_bkl.css?dl=0

Request Chain 5

https://dl.dropbox.com/s/azci6fxi2sggd47/off.png?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/azci6fxi2sggd47/off.png?dl=0

Request Chain 6

https://dl.dropbox.com/s/hwkwm6t27pbbp96/arrow.jpg?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/hwkwm6t27pbbp96/arrow.jpg?dl=0

Request Chain 7

https://dl.dropbox.com/s/seyl9jbezhwpj80/G6D.svg?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/seyl9jbezhwpj80/G6D.svg?dl=0

Request Chain 8

https://dl.dropbox.com/s/ewps8fg1086wzbc/jquery.min.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/ewps8fg1086wzbc/jquery.min.js.download?dl=0

Request Chain 9

https://dl.dropbox.com/s/52fvwoff4xppuoh/jquery-1.8.2.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/52fvwoff4xppuoh/jquery-1.8.2.js.download?dl=0

Request Chain 10

https://dl.dropbox.com/s/kegpfj8ltyjjh24/00.png?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/kegpfj8ltyjjh24/00.png?dl=0

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
ansteel.co/daum/h.php/ 289 B
329 B 539ms
183ms Document
text/html 68.65.122.211
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ansteel.co/daum/h.php/?email=IG5vY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.65.122.211 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server173-5.web-hosting.com
Software: Apache / PHP/5.2.17
Resource Hash: 7525a4451f16d87d02d0ffd8d6a952127adf9be90a7c136bd9f09391f2bed563

Request headers

:method: GET
:authority: ansteel.co
:scheme: https
:path: /daum/h.php/?email=IG5vY
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Dec 2020 07:32:52 GMT
server: Apache
x-powered-by: PHP/5.2.17
vary: Accept-Encoding
content-encoding: gzip
content-length: 198
content-type: text/html

GET
H/1.1 200
OK Primary Request / Show response
officeauthy.us-south.cf.appdomain.cloud/ 4 KB
2 KB 587ms
157ms Document
text/html 169.62.254.82
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Requested by: Host: ansteel.co
URL: https://ansteel.co/daum/h.php/?email=IG5vY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: 52.fe.3ea9.ip4.static.sl-reverse.com
Software: Apache /
Resource Hash: 6988e52797682e2058734395aad82f1f12dbdb20711ba427b89e6a928e705f50

Request headers

Host: officeauthy.us-south.cf.appdomain.cloud
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://ansteel.co/daum/h.php/?email=IG5vY
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://ansteel.co/daum/h.php/?email=IG5vY

Response headers

X-Backside-Transport: OK OK
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 03 Dec 2020 07:32:52 GMT
Server: Apache
Vary: Accept-Encoding
X-Global-Transaction-ID: 027fcd6f5fc894a425806ecf

GET
H2

200

9898878766.js.download Show response
dl.dropboxusercontent.com/s/26j5wefij3mu8hv/
Redirect Chain

https://dl.dropbox.com/s/26j5wefij3mu8hv/9898878766.js.download?dl=0
https://dl.dropboxusercontent.com/s/26j5wefij3mu8hv/9898878766.js.download?dl=0

0
0

953ms
953ms

Script
text/plain

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/26j5wefij3mu8hv/9898878766.js.download?dl=0
Requested by: Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:53 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/26j5wefij3mu8hv/9898878766.js.download?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: d740861e8a9248a1b60d959745257f43

GET
H2

200

009877666.js.download Show response
dl.dropboxusercontent.com/s/kp9o5oem2zzbif5/
Redirect Chain

https://dl.dropbox.com/s/kp9o5oem2zzbif5/009877666.js.download?dl=0
https://dl.dropboxusercontent.com/s/kp9o5oem2zzbif5/009877666.js.download?dl=0

0
0

630ms
630ms

Script
text/plain

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/kp9o5oem2zzbif5/009877666.js.download?dl=0
Requested by: Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:52 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/kp9o5oem2zzbif5/009877666.js.download?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 29c3f4b86cea4895bbe528499f797f7a

GET
H2

200

bootstrap.min.css
dl.dropboxusercontent.com/s/zvdxeo24vnf6x3i/
Redirect Chain

https://dl.dropbox.com/s/zvdxeo24vnf6x3i/bootstrap.min.css?dl=0
https://dl.dropboxusercontent.com/s/zvdxeo24vnf6x3i/bootstrap.min.css?dl=0

118 KB
25 KB

707ms
705ms

Stylesheet
text/css

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/zvdxeo24vnf6x3i/bootstrap.min.css?dl=0

Requested by

Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 03 Dec 2020 07:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: envoy
x-server-response-time: 595
vary: Accept-Encoding
content-type: text/css; charset=utf-8
x-dropbox-request-id: 6610bf35a48449ffbfc71cdea492945a
content-disposition: inline; filename="bootstrap.min.css"; filename*=UTF-8''bootstrap.min.css
cache-control: max-age=60
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:52 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/zvdxeo24vnf6x3i/bootstrap.min.css?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 40ddfbbbb256465db81e3e506f480b21

GET
H2

200

logo_bkl.css
dl.dropboxusercontent.com/s/8kuav40pietd5b2/
Redirect Chain

https://dl.dropbox.com/s/8kuav40pietd5b2/logo_bkl.css?dl=0
https://dl.dropboxusercontent.com/s/8kuav40pietd5b2/logo_bkl.css?dl=0

150 KB
30 KB

676ms
674ms

Stylesheet
text/css

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/8kuav40pietd5b2/logo_bkl.css?dl=0

Requested by

Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

bc7ab1e5973a4cd2e0860dba8f5e65a79182becbcbc60f97cbb3c6d904faa837

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 03 Dec 2020 07:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: envoy
x-server-response-time: 559
vary: Accept-Encoding
content-type: text/css; charset=utf-8
x-dropbox-request-id: 1b2a793f74d34b148068e50a00e78af1
content-disposition: inline; filename="logo_bkl.css"; filename*=UTF-8''logo_bkl.css
cache-control: max-age=60
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:52 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/8kuav40pietd5b2/logo_bkl.css?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: c7306a32f3dd436f95f24c3e577cd031

GET
H2

200

off.png
dl.dropboxusercontent.com/s/azci6fxi2sggd47/
Redirect Chain

https://dl.dropbox.com/s/azci6fxi2sggd47/off.png?dl=0
https://dl.dropboxusercontent.com/s/azci6fxi2sggd47/off.png?dl=0

36 KB
36 KB

764ms
763ms

Image
image/png

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/azci6fxi2sggd47/off.png?dl=0

Requested by

Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

6d6d501fa6ee092b755fd24fff5e5b6b0ae4ae502e5053f03b5cc264c52ca294

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 03 Dec 2020 07:32:55 GMT
x-content-type-options: nosniff
server: envoy
etag: 1605189841828755n
x-server-response-time: 653
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: image/png
x-dropbox-request-id: 10fc00aba82a43e2b8c1a90b21315f4f
content-disposition: inline; filename="off.png"; filename*=UTF-8''off.png
cache-control: max-age=60
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
content-length: 36607

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:54 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/azci6fxi2sggd47/off.png?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: dfaff1be3f214baea7400a1092b72319

GET
H2

200

arrow.jpg
dl.dropboxusercontent.com/s/hwkwm6t27pbbp96/
Redirect Chain

https://dl.dropbox.com/s/hwkwm6t27pbbp96/arrow.jpg?dl=0
https://dl.dropboxusercontent.com/s/hwkwm6t27pbbp96/arrow.jpg?dl=0

8 KB
8 KB

959ms
958ms

Image
image/jpeg

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/hwkwm6t27pbbp96/arrow.jpg?dl=0

Requested by

Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

a1628cef037d3930abed04e0db3eaa1fe2eeedfd60e843da356ada1ff9d0d432

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 03 Dec 2020 07:32:55 GMT
x-content-type-options: nosniff
server: envoy
etag: 1605190235738731n
x-server-response-time: 847
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: image/jpeg
x-dropbox-request-id: de97c76be4a5470880cdd3340b98366e
content-disposition: inline; filename="arrow.jpg"; filename*=UTF-8''arrow.jpg
cache-control: max-age=60
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
content-length: 7948

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:54 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/hwkwm6t27pbbp96/arrow.jpg?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 1d0f8e43edac4f0d9d9526657ee0aea8

GET
H2

200

G6D.svg
dl.dropboxusercontent.com/s/seyl9jbezhwpj80/
Redirect Chain

https://dl.dropbox.com/s/seyl9jbezhwpj80/G6D.svg?dl=0
https://dl.dropboxusercontent.com/s/seyl9jbezhwpj80/G6D.svg?dl=0

4 KB
2 KB

871ms
870ms

Image
image/svg+xml

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/seyl9jbezhwpj80/G6D.svg?dl=0

Requested by

Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
Content-Security-Policy	sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Security-Policy	sandbox
X-Content-Type-Options	nosniff

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Dec 2020 07:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dropbox-request-id: bb052eeb6a7c4b08accbe2fdb7dc289b
content-disposition: attachment; filename=G6D.svg
vary: Accept-Encoding
pragma: public
server: envoy
x-server-response-time: 761
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=60
content-security-policy: sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-webkit-csp: sandbox
x-content-security-policy: sandbox

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:54 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/seyl9jbezhwpj80/G6D.svg?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 6a470fab80d94452bab6947838a49bf5

GET
H2

200

jquery.min.js.download Show response
dl.dropboxusercontent.com/s/ewps8fg1086wzbc/
Redirect Chain

https://dl.dropbox.com/s/ewps8fg1086wzbc/jquery.min.js.download?dl=0
https://dl.dropboxusercontent.com/s/ewps8fg1086wzbc/jquery.min.js.download?dl=0

0
0

607ms
607ms

Script
text/plain

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/ewps8fg1086wzbc/jquery.min.js.download?dl=0
Requested by: Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:53 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/ewps8fg1086wzbc/jquery.min.js.download?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 5749da340c4e4d468a62b6021033fe10

GET
H2

200

jquery-1.8.2.js.download Show response
dl.dropboxusercontent.com/s/52fvwoff4xppuoh/
Redirect Chain

https://dl.dropbox.com/s/52fvwoff4xppuoh/jquery-1.8.2.js.download?dl=0
https://dl.dropboxusercontent.com/s/52fvwoff4xppuoh/jquery-1.8.2.js.download?dl=0

0
0

791ms
790ms

Script
text/plain

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/52fvwoff4xppuoh/jquery-1.8.2.js.download?dl=0
Requested by: Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:54 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/52fvwoff4xppuoh/jquery-1.8.2.js.download?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 4db08ab7787243c488aefa4b4f6b7203

GET
H2

200

00.png
dl.dropboxusercontent.com/s/kegpfj8ltyjjh24/
Redirect Chain

https://dl.dropbox.com/s/kegpfj8ltyjjh24/00.png?dl=0
https://dl.dropboxusercontent.com/s/kegpfj8ltyjjh24/00.png?dl=0

491 KB
492 KB

770ms
769ms

Image
image/png

2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/kegpfj8ltyjjh24/00.png?dl=0

Requested by

Host: officeauthy.us-south.cf.appdomain.cloud
URL: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

07e4a81f6d8d46168779eb10e9b882dd2ce70ed1ec39f75617c321e5a3f72d43

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://officeauthy.us-south.cf.appdomain.cloud/?email=IG5vY
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 03 Dec 2020 07:32:55 GMT
x-content-type-options: nosniff
server: envoy
etag: 1605804973735254n
x-server-response-time: 659
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: image/png
x-dropbox-request-id: 1f14025ce41a41b7aa1482f8da749c2d
content-disposition: inline; filename="00.png"; filename*=UTF-8''00.png
cache-control: max-age=60
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
content-length: 503048

Redirect headers

pragma: no-cache
date: Thu, 03 Dec 2020 07:32:54 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/kegpfj8ltyjjh24/00.png?dl=0
cache-control: no-cache
content-security-policy: sandbox
x-robots-tag: noindex, nofollow, noimageindex, noindex, nofollow, noimageindex
x-dropbox-request-id: 09ce4d56c2524f77b00cc1a29d599e84

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ansteel.co
dl.dropbox.com
dl.dropboxusercontent.com
officeauthy.us-south.cf.appdomain.cloud
169.62.254.82
2620:100:6022:15::a27d:420f
68.65.122.211
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
07e4a81f6d8d46168779eb10e9b882dd2ce70ed1ec39f75617c321e5a3f72d43
6988e52797682e2058734395aad82f1f12dbdb20711ba427b89e6a928e705f50
6d6d501fa6ee092b755fd24fff5e5b6b0ae4ae502e5053f03b5cc264c52ca294
7525a4451f16d87d02d0ffd8d6a952127adf9be90a7c136bd9f09391f2bed563
a1628cef037d3930abed04e0db3eaa1fe2eeedfd60e843da356ada1ff9d0d432
bc7ab1e5973a4cd2e0860dba8f5e65a79182becbcbc60f97cbb3c6d904faa837
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

officeauthy.us-south.cf.appdomain.cloud Open in urlscan Pro 169.62.254.82 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

595 kBTransfer

811 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

officeauthy.us-south.cf.appdomain.cloud Open in urlscan Pro
169.62.254.82 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

595 kB
Transfer

811 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!