driveproxyservery923a.z19.web.core.windows.net
Open in
urlscan Pro
52.239.151.161
Malicious Activity!
Public Scan
Submission: On April 16 via manual from IN
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 01 on February 15th 2021. Valid for: a year.
This is the only time driveproxyservery923a.z19.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.239.151.161 52.239.151.161 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
7 14 | 2620:100:6021... 2620:100:6021:15::a27d:410f | 19679 (DROPBOX) (DROPBOX) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
13 | 5 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
driveproxyservery923a.z19.web.core.windows.net |
ASN19679 (DROPBOX, US)
dl.dropbox.com | |
dl.dropboxusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
dropboxusercontent.com
dl.dropboxusercontent.com |
91 KB |
7 |
dropbox.com
7 redirects
dl.dropbox.com |
1 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
35 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
windows.net
driveproxyservery923a.z19.web.core.windows.net |
12 KB |
13 | 5 |
Domain | Requested by | |
---|---|---|
7 | dl.dropboxusercontent.com |
driveproxyservery923a.z19.web.core.windows.net
dl.dropboxusercontent.com |
7 | dl.dropbox.com | 7 redirects |
2 | maxcdn.bootstrapcdn.com |
driveproxyservery923a.z19.web.core.windows.net
|
1 | ajax.googleapis.com |
driveproxyservery923a.z19.web.core.windows.net
|
1 | driveproxyservery923a.z19.web.core.windows.net | |
13 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.dropbox.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft RSA TLS CA 01 |
2021-02-15 - 2022-02-15 |
a year | crt.sh |
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-01-19 - 2022-02-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-01 - 2022-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-03-23 - 2021-06-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://driveproxyservery923a.z19.web.core.windows.net/
Frame ID: 45F249B46A6C9C9A37269796F9D2EA11
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
Microsoft HTTPAPI (Web Servers) ExpandDetected patterns
- headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://dl.dropbox.com/s/iyph1sp6n9karsz/login_or_register-vflAJk0Kd.css HTTP 302
- https://dl.dropboxusercontent.com/s/iyph1sp6n9karsz/login_or_register-vflAJk0Kd.css
- https://dl.dropbox.com/s/c3wnon2zes3ra1d/base-vflequooz.css HTTP 302
- https://dl.dropboxusercontent.com/s/c3wnon2zes3ra1d/base-vflequooz.css
- https://dl.dropbox.com/s/167c10jxugzyukm/font_atlas_grotesk-vfldINMge.css HTTP 302
- https://dl.dropboxusercontent.com/s/167c10jxugzyukm/font_atlas_grotesk-vfldINMge.css
- https://dl.dropbox.com/s/zy865wtegesilce/login_or_register-vflZ9ry5P.css HTTP 302
- https://dl.dropboxusercontent.com/s/zy865wtegesilce/login_or_register-vflZ9ry5P.css
- https://dl.dropbox.com/s/sxedeas0tuit0nc/css.css HTTP 302
- https://dl.dropboxusercontent.com/s/sxedeas0tuit0nc/css.css
- https://dl.dropbox.com/s/077pp7rapudg9i4/logo.png HTTP 302
- https://dl.dropboxusercontent.com/s/077pp7rapudg9i4/logo.png
- https://dl.dropbox.com/s/r5m2k4w3a3tqnue/74.jpg HTTP 302
- https://dl.dropboxusercontent.com/s/r5m2k4w3a3tqnue/74.jpg
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
driveproxyservery923a.z19.web.core.windows.net/ |
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_or_register-vflAJk0Kd.css
dl.dropboxusercontent.com/s/iyph1sp6n9karsz/ Redirect Chain
|
1 KB 853 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base-vflequooz.css
dl.dropboxusercontent.com/s/c3wnon2zes3ra1d/ Redirect Chain
|
23 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font_atlas_grotesk-vfldINMge.css
dl.dropboxusercontent.com/s/167c10jxugzyukm/ Redirect Chain
|
2 KB 717 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_or_register-vflZ9ry5P.css
dl.dropboxusercontent.com/s/zy865wtegesilce/ Redirect Chain
|
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
dl.dropboxusercontent.com/s/sxedeas0tuit0nc/ Redirect Chain
|
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/ |
59 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
dl.dropboxusercontent.com/s/077pp7rapudg9i4/ Redirect Chain
|
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
74.jpg
dl.dropboxusercontent.com/s/r5m2k4w3a3tqnue/ Redirect Chain
|
41 KB 41 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Medium-webfont-vflGvvuWg.woff2
dl.dropboxusercontent.com/static/fonts/roboto/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Medium-webfont-vflmx1vK6.ttf
dl.dropboxusercontent.com/static/fonts/roboto/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dl.dropboxusercontent.com
- URL
- https://dl.dropboxusercontent.com/static/fonts/roboto/Roboto-Medium-webfont-vflGvvuWg.woff2
- Domain
- dl.dropboxusercontent.com
- URL
- https://dl.dropboxusercontent.com/static/fonts/roboto/Roboto-Medium-webfont-vflmx1vK6.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
dl.dropbox.com
dl.dropboxusercontent.com
driveproxyservery923a.z19.web.core.windows.net
maxcdn.bootstrapcdn.com
dl.dropboxusercontent.com
2606:4700::6812:acf
2620:100:6021:15::a27d:410f
2a00:1450:4001:828::200a
52.239.151.161
1683bf67bf7e9ed81d1b1d42e95f3c58d7c292e0e20e88b101f7dde8ce3a9799
466892c00b39ade716214243e88839feab181776d1d932127901e95dfb281fb4
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6709dc71c4fdbf9151399e86a6388432e28e7dcf0ac56b6b391ecd9008d7f7eb
6ae62cd87949feb085e901e1beaee9f3d2f9f34da2ee835f315b56e772eaac9c
72863dacbd76512a770f8914ed3f46fa8c8ea967ce3505efd79b1733e0a15d37
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
8006a0fab538a2d6d61e20630da5289ca252f0964b8861f17547110e3ab0269b
953355434379fb10cb2c01eaa17b5357f71291b368fe0c107f91ff453a2c0913
ada476bd3f81aeea547d596df2ea963aa72d1e48d863a79e9c1833733c456dd0
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d