storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:81d::2010 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://storage.googleapis.com/odo1/ind.html
Effective URL:
https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Submission Tags: @jcybersec_
Submission: On June 12 via api (June 12th 2020, 7:48:09 pm UTC) from GB

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2a00:1450:4001:81d::2010, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is storage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on May 26th 2020. Valid for: 3 months.

This is the only time storage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2a00:1450:400... 2a00:1450:4001:81d::2010	15169 (GOOGLE) (GOOGLE)
1	163.44.187.14 163.44.187.14	7506 (INTERQ GM...) (INTERQ GMO Internet)
6	2606:4700:303... 2606:4700:3032::681b:af6f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
10	4

2 2a00:1450:4001:81d::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.44.187.14 (Tokyo, Japan)

ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: www1.conoha.ne.jp

okusen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:3032::681b:af6f (United States)

ASN13335 (CLOUDFLARENET, US)

josmtp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	josmtp.com josmtp.com	20 KB
2	googleapis.com storage.googleapis.com	17 KB
1	aspnetcdn.com ajax.aspnetcdn.com	30 KB
1	okusen.com okusen.com	354 B
10	4

	Domain	Requested by
6	josmtp.com	storage.googleapis.com
2	storage.googleapis.com
1	ajax.aspnetcdn.com	storage.googleapis.com
1	okusen.com
10	4

This site contains links to these domains. Also see Links.

Domain
outdatedbrowser.com

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
okusen.com Let's Encrypt Authority X3	`2020-06-03` - `2020-09-01`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-05-08` - `2020-10-09`	5 months	crt.sh
*.vo.msecnd.net Microsoft IT TLS CA 2	`2020-03-18` - `2022-03-18`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Frame ID: 15A4DE3E24B99F01C981D72BC6BC399B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://storage.googleapis.com/odo1/ind.html Page URL
https://okusen.com/odo.html Page URL
https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html Page URL

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

68 kB
Transfer

187 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://outdatedbrowser.com/
Title: Update my browser now

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://storage.googleapis.com/odo1/ind.html Page URL
https://okusen.com/odo.html Page URL
https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 ind.html Show response
storage.googleapis.com/odo1/ 120 B
761 B 28ms
7ms Document
text/html 2a00:1450:4001:81d::2010
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/odo1/ind.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81d::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 946aea83ac9e227e9aa9ed281b7bac119e8c260e62693e7c110dc000ddcfeb85

Request headers

:method: GET
:authority: storage.googleapis.com
:scheme: https
:path: /odo1/ind.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
x-guploader-uploadid: AAANsUkGk2SDTJy1x8qpqt_Sx6b3XGyqUq_JHf2aQbdLiqkv5kfZ_yZPB5spBy0GbnaGA5YRdyKdWUrOsd0WOX1IgQ
expires: Fri, 12 Jun 2020 20:34:41 GMT
date: Fri, 12 Jun 2020 19:34:41 GMT
last-modified: Wed, 10 Jun 2020 22:08:05 GMT
etag: "dfbefbba4d51baf334b60f968646fa89"
x-goog-generation: 1591826885869801
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 120
content-type: text/html
x-goog-hash: crc32c=sG4jVw== md5=3777uk1RuvM0tg+Whkb6iQ==
x-goog-storage-class: NEARLINE
accept-ranges: bytes
content-length: 120
server: UploadServer
cache-control: public, max-age=3600
age: 793
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 odo.html Show response
okusen.com/ 171 B
354 B 902ms
240ms Document
text/html 163.44.187.14
INTERQ GMO Internet

General

Check archive.org

Show headers Download Go to

Full URL

https://okusen.com/odo.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

163.44.187.14 Tokyo, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),

Reverse DNS

www1.conoha.ne.jp

Software

nginx /

Resource Hash

0557ec12d33237b69430de6d3ad988ce4a541fb8e1b319b4e5c4919e24bf8754

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: okusen.com
:scheme: https
:path: /odo.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://storage.googleapis.com/odo1/ind.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://storage.googleapis.com/odo1/ind.html

Response headers

status: 200
server: nginx
date: Fri, 12 Jun 2020 19:47:55 GMT
content-type: text/html; charset=UTF-8
last-modified: Wed, 10 Jun 2020 21:08:33 GMT
etag: W/"ab-5a7c13f2c2e87"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip

GET
H2 200 Primary Request index.html Show response
storage.googleapis.com/aoutlook-superindependence-988939402/ 16 KB
16 KB 7ms
7ms Document
text/html 2a00:1450:4001:81d::2010
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81d::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 7112b820ca02ac849ccb557b95d3386f65a43c59aac1f722fc8b00d90e01aed5

Request headers

:method: GET
:authority: storage.googleapis.com
:scheme: https
:path: /aoutlook-superindependence-988939402/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://okusen.com/odo.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://okusen.com/odo.html

Response headers

status: 200
x-guploader-uploadid: AAANsUl9oPuggNSZFIN17JerSZzOot9azIiMQiBTNw1cHTJd-cZQh-8ohEPITQGytn-g9EEG-6KlrHwyiuCwaEMh6Q
expires: Fri, 12 Jun 2020 20:34:42 GMT
date: Fri, 12 Jun 2020 19:34:42 GMT
last-modified: Wed, 10 Jun 2020 19:59:49 GMT
etag: "90273c11806ca7420c66ebd1fd9d542f"
x-goog-generation: 1591819189888803
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 16304
content-type: text/html
x-goog-hash: crc32c=nicJlA== md5=kCc8EYBsp0IMZuvR/Z1ULw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 16304
server: UploadServer
cache-control: public, max-age=3600
age: 793
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 1dba3111b0418d6d209e83024863b800nbr1572797879.css
josmtp.com/email-list/outlook-web-app/css/ 2 KB
961 B 58ms
17ms Stylesheet
text/css 2606:4700:3032::681b:af6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://josmtp.com/email-list/outlook-web-app/css/1dba3111b0418d6d209e83024863b800nbr1572797879.css
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:af6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eab089b97d39b8bec02d3efe0b3a5333b43a62e1b9a8aebdb2bb27830449ce19

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 07 Feb 2020 12:51:28 GMT
server: cloudflare
age: 207595
etag: W/"5e3d5d50-61d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000
cf-ray: 5a26161f5b62d729-FRA
cf-request-id: 034bac279b0000d72999afd200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ba5ecdd16c000176c18fb0f77113c442nbr1572797879.css
josmtp.com/email-list/outlook-web-app/css/ 70 KB
6 KB 66ms
25ms Stylesheet
text/css 2606:4700:3032::681b:af6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://josmtp.com/email-list/outlook-web-app/css/ba5ecdd16c000176c18fb0f77113c442nbr1572797879.css
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:af6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f873a895fdb5d88e660e1be9023185264ecfcc49557b81f04796c3b9a6fc42e

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 07 Feb 2020 12:51:56 GMT
server: cloudflare
age: 207595
etag: W/"5e3d5d6c-118c1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000
cf-ray: 5a26161f5b63d729-FRA
cf-request-id: 034bac279b0000d72999afe200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ii.png
josmtp.com/email-list/outlook-web-app/imgs/ 2 KB
3 KB 59ms
19ms Image
image/png 2606:4700:3032::681b:af6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://josmtp.com/email-list/outlook-web-app/imgs/ii.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:af6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
cf-cache-status: HIT
age: 207595
status: 200
content-length: 2503
cf-request-id: 034bac279b0000d72999b00200000001
last-modified: Fri, 07 Feb 2020 12:52:03 GMT
server: cloudflare
etag: "5e3d5d73-9c7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5a26161f5b66d729-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 i.png
josmtp.com/email-list/outlook-web-app/imgs/ 4 KB
4 KB 58ms
18ms Image
image/png 2606:4700:3032::681b:af6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://josmtp.com/email-list/outlook-web-app/imgs/i.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:af6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
cf-cache-status: HIT
age: 207595
status: 200
content-length: 3595
cf-request-id: 034bac279b0000d72999aff200000001
last-modified: Fri, 07 Feb 2020 12:52:02 GMT
server: cloudflare
etag: "5e3d5d72-e0b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5a26161f5b65d729-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 owa.png
josmtp.com/email-list/outlook-web-app/imgs/ 6 KB
6 KB 60ms
20ms Image
image/png 2606:4700:3032::681b:af6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://josmtp.com/email-list/outlook-web-app/imgs/owa.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:af6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
cf-cache-status: HIT
age: 207595
status: 200
content-length: 5856
cf-request-id: 034bac279b0000d72999b02200000001
last-modified: Fri, 07 Feb 2020 12:52:03 GMT
server: cloudflare
etag: "5e3d5d73-16e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5a26161f5b69d729-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 owa2.png
josmtp.com/email-list/outlook-web-app/imgs/ 1 KB
2 KB 59ms
20ms Image
image/png 2606:4700:3032::681b:af6f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://josmtp.com/email-list/outlook-web-app/imgs/owa2.png
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:af6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
cf-cache-status: HIT
age: 207595
status: 200
content-length: 1441
cf-request-id: 034bac279b0000d72999b01200000001
last-modified: Fri, 07 Feb 2020 12:52:04 GMT
server: cloudflare
etag: "5e3d5d74-5a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5a26161f5b67d729-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-3.4.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 86 KB
30 KB 25ms
23ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.1.min.js

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (paa/6F49) /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://storage.googleapis.com/aoutlook-superindependence-988939402/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Jun 2020 19:47:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19608350
x-cache: HIT
status: 200
content-length: 30737
x-xss-protection: 1; mode=block
last-modified: Thu, 02 May 2019 18:32:11 GMT
server: ECAcc (paa/6F49)
etag: "808705b151d51:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
josmtp.com
okusen.com
storage.googleapis.com
152.199.19.160
163.44.187.14
2606:4700:3032::681b:af6f
2a00:1450:4001:81d::2010
0557ec12d33237b69430de6d3ad988ce4a541fb8e1b319b4e5c4919e24bf8754
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
7112b820ca02ac849ccb557b95d3386f65a43c59aac1f722fc8b00d90e01aed5
8f873a895fdb5d88e660e1be9023185264ecfcc49557b81f04796c3b9a6fc42e
946aea83ac9e227e9aa9ed281b7bac119e8c260e62693e7c110dc000ddcfeb85
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
eab089b97d39b8bec02d3efe0b3a5333b43a62e1b9a8aebdb2bb27830449ce19

storage.googleapis.com Open in urlscan Pro 2a00:1450:4001:81d::2010 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

68 kBTransfer

187 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:81d::2010 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

68 kB
Transfer

187 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!