dropmessageinboxjames.s3.us-east-005.backblazeb2.com
Open in
urlscan Pro
149.137.137.254
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On March 27 via api from FI — Scanned from US
Summary
TLS certificate: Issued by R3 on February 8th 2024. Valid for: 3 months.
This is the only time dropmessageinboxjames.s3.us-east-005.backblazeb2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 149.137.137.254 149.137.137.254 | 40401 (BACKBLAZE) (BACKBLAZE) | |
3 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
4 | 78.46.22.25 78.46.22.25 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2620:0:861:ed... 2620:0:861:ed1a::2:b | 14907 (WIKIMEDIA) (WIKIMEDIA) | |
11 | 6 |
ASN40401 (BACKBLAZE, US)
PTR: s3.us-east-005.backblazeb2.com
dropmessageinboxjames.s3.us-east-005.backblazeb2.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.25.22.46.78.clients.your-server.de
www.freepnglogos.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
freepnglogos.com
www.freepnglogos.com — Cisco Umbrella Rank: 213464 |
1 MB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
44 KB |
1 |
wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 2958 |
23 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 744 |
31 KB |
1 |
backblazeb2.com
dropmessageinboxjames.s3.us-east-005.backblazeb2.com |
40 KB |
0 |
jupiternets.com
Failed
jupiternets.com Failed |
|
11 | 6 |
Domain | Requested by | |
---|---|---|
4 | www.freepnglogos.com |
dropmessageinboxjames.s3.us-east-005.backblazeb2.com
|
3 | cdn.jsdelivr.net |
dropmessageinboxjames.s3.us-east-005.backblazeb2.com
|
1 | upload.wikimedia.org |
dropmessageinboxjames.s3.us-east-005.backblazeb2.com
|
1 | code.jquery.com |
dropmessageinboxjames.s3.us-east-005.backblazeb2.com
|
1 | dropmessageinboxjames.s3.us-east-005.backblazeb2.com | |
0 | jupiternets.com Failed |
dropmessageinboxjames.s3.us-east-005.backblazeb2.com
|
11 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
backblazeb2.com R3 |
2024-02-08 - 2024-05-08 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
freepnglogos.com R3 |
2024-03-12 - 2024-06-10 |
3 months | crt.sh |
*.wikipedia.org R3 |
2024-02-18 - 2024-05-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dropmessageinboxjames.s3.us-east-005.backblazeb2.com/plant.html
Frame ID: 021D37EB3FBA20C432E9B22B3C47C202
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Dropbox - Get your files anytime anywhereDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
plant.html
dropmessageinboxjames.s3.us-east-005.backblazeb2.com/ |
40 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.0.0/dist/css/ |
141 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transparent-outlook-icon-2.png
www.freepnglogos.com/uploads/logo-outlook/ |
82 KB 82 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft-office-2013-symbol-logo-png-6.png
www.freepnglogos.com/uploads/microsoft-office-png-logo/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1599px-AOL_logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/b/b6/AOL_logo.svg/ |
22 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo-logo-png-free-download-3.png
www.freepnglogos.com/uploads/yahoo-logo-png/ |
118 KB 118 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email-logo-png-33.png
www.freepnglogos.com/uploads/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.12.9/dist/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@4.0.0/dist/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bg.png
jupiternets.com/email-list/dropbx35/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jupiternets.com
- URL
- https://jupiternets.com/email-list/dropbx35/assets/bg.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal function| $ function| jQuery function| Popper object| bootstrap function| validateEmail0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
dropmessageinboxjames.s3.us-east-005.backblazeb2.com
jupiternets.com
upload.wikimedia.org
www.freepnglogos.com
jupiternets.com
149.137.137.254
2620:0:861:ed1a::2:b
2a04:4e42:400::485
2a04:4e42:400::649
78.46.22.25
1b0e467247b9dab100ff77807af502e4277f72f721241c3f5b2eb483971aa9fa
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
5dceec0355eda7880dead5e13d22d394b8a1e79101a93bf96447557997d93e86
7ea09b560f4ee78eef3bd17346ad544176f524866ebc3d4a954f554afa50d149
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
d1bbf64c348e841cd8042702d5a69a2443cc779a4d1c4c846e98a19ee0897002
d9a3473ec58a884a38a3356602b33d053692a1e821a3f14b5b6e27d97d575ff7
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
eb8487a513bc473ada8e9a2876531d18d81108d0982a81c1476484094c3a6aa6