f000.backblazeb2.com Open in urlscan Pro
104.153.233.177 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u19996642.ct.sendgrid.net/ls/click?upn=fOMdKautWS5AZPRJxNodHNWO11pUX-2BRBoWv9cCL8lLktcHugzKsflmUvp-2FBa1pM5WH-2F4ABGARNIQ3...
Effective URL:
https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Submission: On February 16 via api (February 16th 2021, 8:26:05 pm UTC) from US

Summary HTTP 20 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 20 HTTP transactions. The main IP is 104.153.233.177, located in United States and belongs to UNWIRED, US. The main domain is f000.backblazeb2.com.
TLS certificate: Issued by R3 on December 9th 2020. Valid for: 3 months.

This is the only time f000.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Charles Schwab (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.118.28 167.89.118.28	11377 (SENDGRID) (SENDGRID)
3	104.153.233.177 104.153.233.177	32354 (UNWIRED) (UNWIRED)
8	2606:4700:303... 2606:4700:3033::ac43:82ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
2	23.79.147.199 23.79.147.199	16625 (AKAMAI-AS) (AKAMAI-AS)
20	5

1 167.89.118.28 (Las Vegas, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789118x28.outbound-mail.sendgrid.net

u19996642.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.153.233.177 (United States)

ASN32354 (UNWIRED, US)

f000.backblazeb2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:3033::ac43:82ba (United States)

ASN13335 (CLOUDFLARENET, US)

jupitersmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.147.199 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-147-199.deploy.static.akamaitechnologies.com

content.schwab.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	jupitersmt.com jupitersmt.com	223 KB
3	backblazeb2.com f000.backblazeb2.com	84 KB
2	schwab.com content.schwab.com client.schwab.com Failed	64 KB
1	aspnetcdn.com ajax.aspnetcdn.com	30 KB
1	sendgrid.net 1 redirects u19996642.ct.sendgrid.net	272 B
20	5

	Domain	Requested by
8	jupitersmt.com	f000.backblazeb2.com jupitersmt.com
3	f000.backblazeb2.com	f000.backblazeb2.com
2	content.schwab.com	jupitersmt.com
1	ajax.aspnetcdn.com	f000.backblazeb2.com
1	u19996642.ct.sendgrid.net	1 redirects
0	client.schwab.com Failed	jupitersmt.com
20	6

This site contains links to these domains. Also see Links.

Domain
www.schwab.com
client.schwab.com
lms-mgmt.schwab.com
lms.schwab.com
brokercheck.finra.org
www.sipc.org
www.schwab-global.com

Subject Issuer	Validity	Valid
backblazeb2.com R3	`2020-12-09` - `2021-03-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-11-01` - `2021-10-31`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2020-11-16` - `2021-11-10`	a year	crt.sh
content.schwab.com DigiCert SHA2 Extended Validation Server CA	`2020-07-07` - `2021-07-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Frame ID: 5242F67CCBF40759B5B18C03AC47FDBB
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u19996642.ct.sendgrid.net/ls/click?upn=fOMdKautWS5AZPRJxNodHNWO11pUX-2BRBoWv9cCL8lLktcHugzKsflmUvp-2FB... HTTP 302
https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html Page URL

Page Statistics

20
Requests

70 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

400 kB
Transfer

785 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.schwab.com/
Title:

Search URL Search Domain Scan URL

URL: https://client.schwab.com/public/schwab/nn/legal_compliance/schwabsafe
Title: SchwabSafe®

Search URL Search Domain Scan URL

URL: https://client.schwab.com/public/schwab/nn/legal_compliance/schwabsafe/security_guarantee.html
Title: The Schwab Security Guarantee

Search URL Search Domain Scan URL

URL: http://www.schwab.com/
Title: Schwab Homepage

Search URL Search Domain Scan URL

URL: https://lms-mgmt.schwab.com/ar/home?clientID=schwab
Title: Forgot login ID or password?

Search URL Search Domain Scan URL

URL: https://lms.schwab.com/credential/new?clientid=schwab-clwe
Title: New user?

Search URL Search Domain Scan URL

URL: https://client.schwab.com/MobileWeb/#access/login
Title: Log in to mobile

Search URL Search Domain Scan URL

URL: http://www.schwab.com/public/schwab/nn/customer_service/browsers.html
Title: Web Browser Information

Search URL Search Domain Scan URL

URL: https://brokercheck.finra.org/
Title: FINRA's BrokerCheck

Search URL Search Domain Scan URL

URL: http://www.sipc.org/
Title: member SIPC

Search URL Search Domain Scan URL

URL: http://www.schwab-global.com/public/schwab-gcb-en
Title: non-U.S. residents

Search URL Search Domain Scan URL

URL: https://www.schwab.com/public/schwab/nn/public-security-tips-popup.html
Title: Learn more >

Search URL Search Domain Scan URL

URL: https://www.schwab.com/public/schwab/investing/why_choose_schwab/compare_us?lid=login_slot1_static_zero_commissions

Search URL Search Domain Scan URL

URL: http://www.schwab.com/public/schwab/investing/accounts_products/credit_cards?ENTRY_POINT=IIAH
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u19996642.ct.sendgrid.net/ls/click?upn=fOMdKautWS5AZPRJxNodHNWO11pUX-2BRBoWv9cCL8lLktcHugzKsflmUvp-2FBa1pM5WH-2F4ABGARNIQ3u-2BeUf9oUdJOmhzN6nMoLyNXN35EOnk-3DT9cv_kfW53qwhHYQ17-2FAO-2Fz0b4O0ON1tNwEU0MpJYREPETeXeICUlnGZnH7uwBSABB6dCWWd1rMaEZnpJ09wxYTHLgXQ8sCML0bKEIynFUk-2Fd5GURTnVhU1sKN22cUbolB-2FwM2jmc40uMW1EWNdkAiWsZZ84ALViSscVxtMaKbgA7BNBkr6epVEosSUAfutyb-2FSxyUK6JODHj4KcaxvzEciW33-2Fics0C2rIK7uCZt3No-2B30w-3D HTTP 302
https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200

Primary Request index.html Show response
f000.backblazeb2.com/file/dragons-provide-831e594e/
Redirect Chain

https://u19996642.ct.sendgrid.net/ls/click?upn=fOMdKautWS5AZPRJxNodHNWO11pUX-2BRBoWv9cCL8lLktcHugzKsflmUvp-2FBa1pM5WH-2F4ABGARNIQ3u-2BeUf9oUdJOmhzN6nMoLyNXN35EOnk-3DT9cv_kfW53qwhHYQ17-2FAO-2Fz0b4O0...
https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html

83 KB
84 KB

1050ms
526ms

Document
text/html

104.153.233.177
UNWIRED

General

Check archive.org

Show headers Download Go to

Full URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.153.233.177 , United States, ASN32354 (UNWIRED, US),
Reverse DNS
Software: /
Resource Hash: 6ddbb8ef07ff58fb04bcab1ebfcd2a785eaedf80d706bcea2fb7b95559445b69

Request headers

Host: f000.backblazeb2.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Cache-Control: max-age=0, no-cache, no-store
x-bz-file-name: index.html
x-bz-file-id: 4_zae25f994e2ee7cd67470021a_f1055bcf24897b8dc_d20210207_m191921_c000_v0001158_t0005
x-bz-content-sha1: dc69b8eda170833e76e081584174a7a6a82fa613
X-Bz-Upload-Timestamp: 1612725561000
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 85206
Date: Tue, 16 Feb 2021 20:25:47 GMT
Keep-Alive: timeout=5
Connection: keep-alive

Redirect headers

Server: nginx
Date: Tue, 16 Feb 2021 20:25:47 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 92
Connection: keep-alive
Location: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
X-Robots-Tag: noindex, nofollow

GET
H2 200 layoutf86f.css
jupitersmt.com/email-list/schwab/css/ 121 KB
20 KB 163ms
130ms Stylesheet
text/css 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jupitersmt.com/email-list/schwab/css/layoutf86f.css?v=19.19
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c43819a6148d57b994b8840eeb6ece04e8bfb19898771febb644a31e237b4074

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 07:50:00 GMT
server: cloudflare
etag: W/"600e7828-1e5e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WLxOT41miWnGWDkFYJZgc1%2Bzf2tL5zVOERtYYWEF4hkS%2FJB6miKPxSvkdigSTTSbKExD%2FAMtO%2FfdODkYkMsM8vRXhPVWhkE%2FIKXHoqS3sl5N6LiDUx6y1qLw0w%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=315360000
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 622a0000fa962bf2-FRA
cf-request-id: 084e1e549700002bf2a7039000000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 contentf86f.css
jupitersmt.com/email-list/schwab/css/ 41 KB
6 KB 121ms
88ms Stylesheet
text/css 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jupitersmt.com/email-list/schwab/css/contentf86f.css?v=19.19
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4128f7e0469a7c17a238524efe6ef384aa36f303f662cd38ab6484806e738840

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 07:50:01 GMT
server: cloudflare
etag: W/"600e7829-a4aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7I%2FSYPK8suwjQbStMudSS2W7OMkdrF10pGSBsWNyWHZXSAq5HUg34R70uV1urEhwQov9WnBIjOmHlHttDdHa6DdPJV7pfWZfehXxboue863%2FvuGfJXqAus6bAQ%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=315360000
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 622a0000fa992bf2-FRA
cf-request-id: 084e1e549700002bf2bd2ff000000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 masterf86f.css
jupitersmt.com/email-list/schwab/css/ 120 KB
22 KB 169ms
136ms Stylesheet
text/css 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jupitersmt.com/email-list/schwab/css/masterf86f.css?v=19.19
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d11d92322c0adc2bd5ba1acc1c26b4158fe89c90fa6544f8d998a569941d2f14

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 07:50:01 GMT
server: cloudflare
etag: W/"600e7829-1e161"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GSxXm1LxhEQ7L55F9vZY4eF2bc48ZdMEKNjXxyE8itUX4etP2cYbV3vLqQy09n03T8zjV8H3a1RbUfXXSrISlx8%2Bt2fx8G%2B21SUpyvpl8xaVTd1L6PVPtTgN5g%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=315360000
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 622a0000fa9a2bf2-FRA
cf-request-id: 084e1e549700002bf2eca91000000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ps.css
jupitersmt.com/email-list/schwab/css/ 85 KB
15 KB 156ms
123ms Stylesheet
text/css 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jupitersmt.com/email-list/schwab/css/ps.css
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3519e15519d8d5907d23f987d4ee35366f6c50b201200d1db91f5db5902f1a80

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 07:49:59 GMT
server: cloudflare
etag: W/"600e7827-154d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lHti%2B7Ev80ENJmbRpB7O161V6BkBEhWIWHVxicUvS3w63Cyjzy%2B%2BXD5FMcWJ5Y1O%2F60YDB9uoHL2TmkBwcWztjPSkSLDfpfJpX4ZrrTNTYjlebb1DqT639IGHg%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=315360000
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 622a0000fa9b2bf2-FRA
cf-request-id: 084e1e549700002bf2e2a34000000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 file68b6.css
jupitersmt.com/email-list/schwab/css/ 26 KB
7 KB 117ms
85ms Stylesheet
text/css 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jupitersmt.com/email-list/schwab/css/file68b6.css?cmsid=LOGIN-STYLES&filename=main.css
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e87107962df2fa9db2bfb003dcb609f364cc8964242f1a7f8af98239e44ca472

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 07:50:00 GMT
server: cloudflare
etag: W/"600e7828-683c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tr0iLxvtOI5QiUoYnEfmpQqYzTFerELgXBDfi6MwESIUwr0iQ9hFOclCd423TS8vQ1yKgkbPK8foCR6c5%2FLR615M9SSzuuQZTEd1zoeY4nPNqxzz6qpq8MiN1Q%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=315360000
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 622a0000fa9c2bf2-FRA
cf-request-id: 084e1e549700002bf29f08f000000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
jupitersmt.com/email-list/schwab/css/ 4 KB
1 KB 116ms
84ms Stylesheet
text/css 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jupitersmt.com/email-list/schwab/css/style.css
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9735741384abae44bb29f9da6df9a3a285e68928c44e055dd431fef269c1cbb1

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Jan 2021 07:50:01 GMT
server: cloudflare
etag: W/"600e7829-f6d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sh8XrWx5vKCAyCuD6y1dTOUsxco6V%2BVmhnRMdhUnAHq%2B6YSPHwQQY%2FYZB4Bj%2Bo3KQ2%2BQ51s8j95aTyOjjEmVeNPFHxjD2K%2BzSUXZWDmpP3KEV6rLZpcxeU0SYQ%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=315360000
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 622a0000fa9e2bf2-FRA
cf-request-id: 084e1e549700002bf20b008000000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 404 login-component-responsive-secondary
f000.backblazeb2.com/bundles/styles/lib/ 0
0 165ms
165ms Stylesheet
application/json 104.153.233.177
UNWIRED

General

Check archive.org

Show headers Download Go to

Full URL: https://f000.backblazeb2.com/bundles/styles/lib/login-component-responsive-secondary?v=_jdeAevgOU6R2aUByCuKsDl9p63BfFtUVM2tGcqdz8Y1
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.153.233.177 , United States, ASN32354 (UNWIRED, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Date: Tue, 16 Feb 2021 20:25:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 86
Content-Type: application/json;charset=UTF-8

GET
H2 200 jquery-3.3.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 85 KB
30 KB 83ms
20ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js

Requested by

Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/8B0D) /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 16 Feb 2021 20:25:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15784179
x-cache: HIT
content-length: 30394
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jan 2018 19:27:49 GMT
server: ECAcc (ama/8B0D)
etag: "80288516b793d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 SMART_BANNER_ICON_BACKGROUND_COLOR_Copy.png
jupitersmt.com/email-list/schwab/images/ 16 KB
16 KB 121ms
114ms Image
image/png 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jupitersmt.com/email-list/schwab/images/SMART_BANNER_ICON_BACKGROUND_COLOR_Copy.png
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f380d4dbff23ca3aa1acba5c7683e1541e9e7b7ba7028f45693d5f000e02738

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
cf-cache-status: MISS
nel: {"max_age":604800,"report_to":"cf-nel"}
content-length: 16350
cf-request-id: 084e1e549800002bf2ff165000000001
last-modified: Mon, 25 Jan 2021 07:50:03 GMT
server: cloudflare
etag: "600e782b-3fde"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ny1FIM4n32BUJ5kSHNFMuohw1I2ZaKHxLSfLHNr6NTqJ2pSFXm3b7Uwg3lYmXZejaG4so%2FHqGL4HQnAEUhu%2FL0aXTpqHW0vqVtrELiZwa0gKF9rPvuDktd%2F8%2Fw%3D%3D"}],"group":"cf-nel"}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 622a0000faa02bf2-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 loginlogoutpsd7308.png
jupitersmt.com/email-list/schwab/images/ 134 KB
135 KB 181ms
174ms Image
image/png 2606:4700:3033::ac43:82ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jupitersmt.com/email-list/schwab/images/loginlogoutpsd7308.png
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:82ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6253665cb203eb7b241ad30a4146d4692b3157649e634eba22c1daaedd57c25

Request headers

Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 16 Feb 2021 20:25:49 GMT
cf-cache-status: MISS
nel: {"max_age":604800,"report_to":"cf-nel"}
content-length: 137678
cf-request-id: 084e1e549800002bf2c90c0000000001
last-modified: Mon, 25 Jan 2021 07:50:07 GMT
server: cloudflare
etag: "600e782f-219ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tAWNzD3dwN4Z1Kl5TS0ZR%2BH3f5W6kVdZEuSqoL4dgbyDd9dFy90aWG24mYSDuK2Lk4z2%2B8aPmW%2BIMawA8kvEfPeNU4VVldOj5RVqxIK9eCHZiZC70NvjINF1uw%3D%3D"}],"group":"cf-nel"}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 622a0000faa32bf2-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 404 Schwab-Icon-Font.ttf
f000.backblazeb2.com/fonts/ 0
0 326ms
165ms Font
application/json 104.153.233.177
UNWIRED

General

Check archive.org

Show headers Download Go to

Full URL: https://f000.backblazeb2.com/fonts/Schwab-Icon-Font.ttf
Requested by: Host: f000.backblazeb2.com
URL: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.153.233.177 , United States, ASN32354 (UNWIRED, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Origin: https://f000.backblazeb2.com
Referer: https://f000.backblazeb2.com/file/dragons-provide-831e594e/index.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Date: Tue, 16 Feb 2021 20:25:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 86
Content-Type: application/json;charset=UTF-8

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ccc4d3be744a29473fefe2f313fdae488f460b85a47e8427f748358a54ba048

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK schwabsafe_logo.svg
content.schwab.com/web/login/ 2 KB
2 KB 115ms
29ms Image
image/svg+xml 23.79.147.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.schwab.com/web/login/schwabsafe_logo.svg
Requested by: Host: jupitersmt.com
URL: https://jupitersmt.com/email-list/schwab/css/file68b6.css?cmsid=LOGIN-STYLES&filename=main.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.147.199 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-147-199.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0c1f7d2d3fa4ed7ec3cf2519cd017ddb5bc8de757e00ed8f84cd8991059a0631

Request headers

Referer: https://jupitersmt.com/email-list/schwab/css/file68b6.css?cmsid=LOGIN-STYLES&filename=main.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Date: Tue, 16 Feb 2021 20:25:49 GMT
Last-Modified: Tue, 20 Jun 2017 20:14:24 GMT
Server: AkamaiNetStorage
ETag: "7449c161258eba54600debcbd1229b1d:1497989664"
Content-Type: image/svg+xml
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2058

GET
H/1.1 200
OK background_image_exblur_dev2b.jpg
content.schwab.com/web/login/ 61 KB
61 KB 129ms
44ms Image
image/jpeg 23.79.147.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.schwab.com/web/login/background_image_exblur_dev2b.jpg
Requested by: Host: jupitersmt.com
URL: https://jupitersmt.com/email-list/schwab/css/file68b6.css?cmsid=LOGIN-STYLES&filename=main.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.147.199 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-147-199.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 689137464c584b5cc1afb209ecf7e0ef9b0ac8648b0d0945561edaf46f650c40

Request headers

Referer: https://jupitersmt.com/email-list/schwab/css/file68b6.css?cmsid=LOGIN-STYLES&filename=main.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

Response headers

Date: Tue, 16 Feb 2021 20:25:49 GMT
Last-Modified: Mon, 19 Jun 2017 20:55:41 GMT
Server: AkamaiNetStorage
ETag: "b7e11a480b99f556a48bb74e6060071c:1497905741"
Content-Type: image/jpeg
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 62595

GET CharlesModern-Light.woff
client.schwab.com/fonts/ 0
0

GET CharlesModern-Regular.woff
client.schwab.com/fonts/ 0
0

GET CharlesModern-Light.ttf
client.schwab.com/fonts/ 0
0

GET CharlesModern-Regular.ttf
client.schwab.com/fonts/ 0
0

GET Schwab-Icon-Font.woff
jupitersmt.com/email-list/schwab/css/fonts/ 0
0

GET Schwab-Icon-Font.ttf
jupitersmt.com/email-list/schwab/css/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: client.schwab.com
URL: https://client.schwab.com/fonts/CharlesModern-Light.woff?v=1.0.0

Domain: client.schwab.com
URL: https://client.schwab.com/fonts/CharlesModern-Regular.woff?v=1.0.0

Domain: client.schwab.com
URL: https://client.schwab.com/fonts/CharlesModern-Light.ttf?v=1.0.0

Domain: client.schwab.com
URL: https://client.schwab.com/fonts/CharlesModern-Regular.ttf?v=1.0.0

Domain: jupitersmt.com
URL: https://jupitersmt.com/email-list/schwab/css/fonts/Schwab-Icon-Font.woff?51abjd

Domain: jupitersmt.com
URL: https://jupitersmt.com/email-list/schwab/css/fonts/Schwab-Icon-Font.ttf?51abjd

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Charles Schwab (Financial)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
client.schwab.com
content.schwab.com
f000.backblazeb2.com
jupitersmt.com
u19996642.ct.sendgrid.net
client.schwab.com
jupitersmt.com
104.153.233.177
152.199.19.160
167.89.118.28
23.79.147.199
2606:4700:3033::ac43:82ba
0c1f7d2d3fa4ed7ec3cf2519cd017ddb5bc8de757e00ed8f84cd8991059a0631
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2ccc4d3be744a29473fefe2f313fdae488f460b85a47e8427f748358a54ba048
3519e15519d8d5907d23f987d4ee35366f6c50b201200d1db91f5db5902f1a80
4128f7e0469a7c17a238524efe6ef384aa36f303f662cd38ab6484806e738840
4f380d4dbff23ca3aa1acba5c7683e1541e9e7b7ba7028f45693d5f000e02738
689137464c584b5cc1afb209ecf7e0ef9b0ac8648b0d0945561edaf46f650c40
6ddbb8ef07ff58fb04bcab1ebfcd2a785eaedf80d706bcea2fb7b95559445b69
9735741384abae44bb29f9da6df9a3a285e68928c44e055dd431fef269c1cbb1
c43819a6148d57b994b8840eeb6ece04e8bfb19898771febb644a31e237b4074
d11d92322c0adc2bd5ba1acc1c26b4158fe89c90fa6544f8d998a569941d2f14
e87107962df2fa9db2bfb003dcb609f364cc8964242f1a7f8af98239e44ca472
f6253665cb203eb7b241ad30a4146d4692b3157649e634eba22c1daaedd57c25

f000.backblazeb2.com Open in urlscan Pro 104.153.233.177 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

20 Requests

70 %HTTPS

20 %IPv6

5 Domains

6 Subdomains

5 IPs

2 Countries

400 kBTransfer

785 kBSize

0 Cookies

14 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

Indicators

f000.backblazeb2.com Open in urlscan Pro
104.153.233.177 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

70 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

400 kB
Transfer

785 kB
Size

0
Cookies

20 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!