urlscan.io logo urlscan.io
SecurityTrails logo

f005.backblazeb2.com Open in urlscan Pro
149.137.136.16  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Submission: On July 08 via manual from AR — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 149.137.136.16, located in United States and belongs to BACKBLAZE, US. The main domain is f005.backblazeb2.com. The Cisco Umbrella rank of the primary domain is 368444.
TLS certificate: Issued by R11 on June 10th 2024. Valid for: 3 months.
This is the only time f005.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 149.137.136.16 40401 (BACKBLAZE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a04:4e42:200... 54113 (FASTLY)
1 34.117.186.192 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
7 6
2    149.137.136.16 (United States)

ASN40401 (BACKBLAZE, US)
PTR: f005.backblazeb2.com
f005.backblazeb2.com
1    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    34.117.186.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.186.117.34.bc.googleusercontent.com
ipinfo.io
1    2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 423
57 KB
2 backblazeb2.com
f005.backblazeb2.com — Cisco Umbrella Rank: 368444
120 KB
1 gstatic.com
fonts.gstatic.com
133 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 5522
472 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 108
792 B
7 5
Domain Requested by
2 cdn.jsdelivr.net f005.backblazeb2.com
2 f005.backblazeb2.com f005.backblazeb2.com
1 fonts.gstatic.com fonts.googleapis.com
1 ipinfo.io f005.backblazeb2.com
1 fonts.googleapis.com f005.backblazeb2.com
7 5

This site contains no links.

Subject Issuer Validity Valid
backblazeb2.com
R11		 2024-06-10 -
2024-09-08		 3 months crt.sh
upload.video.google.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
ipinfo.io
R3		 2024-06-03 -
2024-09-01		 3 months crt.sh
*.gstatic.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Frame ID: 27E9957E9D679BA99F1BBB136BC25A2F
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Zimbra Web Client Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

7
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

312 kB
Transfer

562 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request zimbra-.html
f005.backblazeb2.com/file/cbzimtoda/ 		119 KB
119 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
149.137.136.16 , United States, ASN40401 (BACKBLAZE, US),
Reverse DNS
f005.backblazeb2.com
Software
nginx /
Resource Hash
70c0b4c9db0a22166d8fbfa4f509b4a49f39f2e80ceab39cc35dbc1b3f5bdb83
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
121525
Content-Type
text/html
Date
Mon, 08 Jul 2024 10:22:14 GMT
Server
nginx
Strict-Transport-Security
max-age=63072000
X-Bz-Client-Unauthorized-To-Read
X-Bz-File-Retention-Mode,X-Bz-File-Retention-Retain-Until-Timestamp,X-Bz-File-Legal-Hold
X-Bz-Server-Side-Encryption
AES256
X-Bz-Upload-Timestamp
1719403049635
x-bz-content-sha1
edbdd7b327575a3e7b85882f3743eff33594fe59
x-bz-file-id
4_zead353926a5654489c0e0a10_f10354fbb5a8e790c_d20240626_m115729_c005_v0501000_t0015_u01719403049635
x-bz-file-name
zimbra-.html
x-bz-info-src_last_modified_millis
1718494611454
config.js
f005.backblazeb2.com/file/cbzimtoda/ 		303 B
975 B 		Script
General
Check archive.org
Download Go to
Full URL
https://f005.backblazeb2.com/file/cbzimtoda/config.js
Requested by
Host: f005.backblazeb2.com
URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
149.137.136.16 , United States, ASN40401 (BACKBLAZE, US),
Reverse DNS
f005.backblazeb2.com
Software
nginx /
Resource Hash
ab3eb80ba318a38b7825c2ea5230e05bf713526d2dbd285530c4b235482432f5
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Referer
https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Mon, 08 Jul 2024 10:22:15 GMT
Strict-Transport-Security
max-age=63072000
X-Bz-Upload-Timestamp
1719403046120
Server
nginx
x-bz-file-id
4_zead353926a5654489c0e0a10_f11907b4cfb06e71e_d20240626_m115726_c005_v0501020_t0009_u01719403046120
X-Bz-Client-Unauthorized-To-Read
X-Bz-File-Retention-Mode,X-Bz-File-Retention-Retain-Until-Timestamp,X-Bz-File-Legal-Hold
x-bz-content-sha1
46b520d21acd6ee130117e7a1c78b356a4ab7a92
Content-Type
application/javascript
x-bz-file-name
config.js
Connection
keep-alive
Accept-Ranges
bytes
X-Bz-Server-Side-Encryption
AES256
Content-Length
303
x-bz-info-src_last_modified_millis
1719403029296
icon
fonts.googleapis.com/ 		600 B
792 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/icon?family=Material+Icons+Sharp
Requested by
Host: f005.backblazeb2.com
URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4999eede56af5233889aa38d6c26d966dc2734b67b2db14f00d7c0bcb12ae37d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://f005.backblazeb2.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 08 Jul 2024 10:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 08 Jul 2024 10:22:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 08 Jul 2024 10:22:15 GMT
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/ 		227 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css
Requested by
Host: f005.backblazeb2.com
URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3017df4a76db5f01c2b99b603d88b03106df13bcfe18e67b7c13c2341d3a67df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://f005.backblazeb2.com/
Origin
https://f005.backblazeb2.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 08 Jul 2024 10:22:15 GMT
x-content-type-options
nosniff
content-encoding
br
age
1656337
x-jsd-version
5.3.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
34902
x-served-by
cache-fra-etou8220083-FRA, cache-cph2320037-CPH
x-jsd-version-type
version
etag
W/"38df4-HxOZgbm0enZu+gphu3ito1HxbEs"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/ 		79 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js
Requested by
Host: f005.backblazeb2.com
URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
82f64f62bb03c1bc1824b0f9c9e05f70dba33e146818e63cdf5c306c8cf3dedd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://f005.backblazeb2.com/
Origin
https://f005.backblazeb2.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 08 Jul 2024 10:22:15 GMT
x-content-type-options
nosniff
content-encoding
br
age
174448
x-jsd-version
5.3.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
22772
x-served-by
cache-fra-etou8220085-FRA, cache-cph2320037-CPH
x-jsd-version-type
version
etag
W/"13b17-9/0PPchLLPk7+B6DJQWmc/NU4KM"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
json
ipinfo.io/ 		253 B
472 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ipinfo.io/json
Requested by
Host: f005.backblazeb2.com
URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.186.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.186.117.34.bc.googleusercontent.com
Software
nginx/1.24.0 /
Resource Hash
8f3e3d0f53b8345939ec8376f2727798443d0ff67621dca1f9677747c162c318
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://f005.backblazeb2.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 08 Jul 2024 10:22:16 GMT
via
1.1 google
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
server
nginx/1.24.0
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-envoy-upstream-service-time
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
253
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8db258b55ceabeb5c9c8bf41f59a2743c579cfcee58c34cacc945ad9c01d6ef1

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
oPWQ_lt5nv4pWNJpghLP75WiFR4kLh3kvmvR.woff2
fonts.gstatic.com/s/materialiconssharp/v109/ 		133 KB
133 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/materialiconssharp/v109/oPWQ_lt5nv4pWNJpghLP75WiFR4kLh3kvmvR.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons+Sharp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d31bfb81d56e790e0d9e2fa00b83df8f7159f9063114cdc014859b1d483956c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://f005.backblazeb2.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 04 Jul 2024 10:33:07 GMT
x-content-type-options
nosniff
age
344949
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
135984
x-xss-protection
0
last-modified
Tue, 07 Mar 2023 20:41:24 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 04 Jul 2025 10:33:07 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| uidEvent object| bootstrap function| _0x37f06f function| _0x9e7ac8 function| _0x1aad function| _0x26ede9 function| _0x3775 function| _0x175975 function| _0x537411 function| _0x2daf1f function| _0x3fa923 function| _0x3716f1 function| _0x4bfe61 function| _0x122847 function| _0x2ddd68 function| _0x1c8a function| _0x5ab8 function| _0x42dd3c string| ipAddress string| country string| city

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://f005.backblazeb2.com/file/cbzimtoda/zimbra-.html
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000