mfa-files.firstcloudit.com Open in urlscan Pro
66.220.9.47 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://mfa-files.firstcloudit.com/
Effective URL:
https://mfa-files.firstcloudit.com/
Submission: On April 12 via api (April 12th 2024, 1:25:35 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 66.220.9.47, located in Salinas, United States and belongs to HURRICANE, US. The main domain is mfa-files.firstcloudit.com.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on September 1st 2023. Valid for: a year.

This is the only time mfa-files.firstcloudit.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	66.220.9.47 66.220.9.47	6939 (HURRICANE) (HURRICANE)
2	66.220.9.57 66.220.9.57	6939 (HURRICANE) (HURRICANE)
8	3

4 66.220.9.47 (Salinas, United States)

ASN6939 (HURRICANE, US)
PTR: www.firstcloudit.com

mfa-files.firstcloudit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.220.9.57 (Salinas, United States)

ASN6939 (HURRICANE, US)
PTR: www.drivehq.com

www.drivehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	firstcloudit.com mfa-files.firstcloudit.com	516 KB
2	drivehq.com www.drivehq.com — Cisco Umbrella Rank: 294898	44 KB
0	webhook.site Failed webhook.site Failed
8	3

	Domain	Requested by
4	mfa-files.firstcloudit.com	mfa-files.firstcloudit.com
2	www.drivehq.com	mfa-files.firstcloudit.com
0	webhook.site Failed	mfa-files.firstcloudit.com
8	3

This site contains links to these domains. Also see Links.

Domain
www.cameraftp.com
www.drivehq.com
www.firstcloudit.com

Subject Issuer	Validity	Valid
*.firstcloudit.com AlphaSSL CA - SHA256 - G4	`2023-09-01` - `2024-10-02`	a year	crt.sh
*.drivehq.com AlphaSSL CA - SHA256 - G4	`2023-10-17` - `2024-11-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mfa-files.firstcloudit.com/
Frame ID: F872FF37391BF0AE8DA097139B7B406D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://mfa-files.firstcloudit.com/ HTTP 307
https://mfa-files.firstcloudit.com/ Page URL

Page Statistics

8
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

560 kB
Transfer

559 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cameraftp.com/

Search URL Search Domain Scan URL

URL: https://www.drivehq.com/

Search URL Search Domain Scan URL

URL: https://www.firstcloudit.com/
Title: FirstCloudIT.com

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mfa-files.firstcloudit.com/ HTTP 307
https://mfa-files.firstcloudit.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://mfa-files.firstcloudit.com/favicon.ico HTTP 302
https://www.drivehq.com/help/hosting/FileNotFound.aspx?errCode=3&filePath=\\mfa-files\wwwhome\favicon.ico

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response mfa-files.firstcloudit.com/ Redirect Chain http://mfa-files.firstcloudit.com/ https://mfa-files.firstcloudit.com/	6 KB 6 KB	542ms 184ms	Document text/html	66.220.9.47 HURRICANE
General Check archive.org Show headers Download Go to Full URL https://mfa-files.firstcloudit.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.220.9.47 Salinas, United States, ASN6939 (HURRICANE, US), Reverse DNS www.firstcloudit.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `9ecaa238473eda1c438b7e7235e9ac0f54f36d1b1d668b6a9cc65318ac07b409` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers accept-ranges bytes access-control-allow-origin * cache-control private content-length 5926 content-type text/html date Fri, 12 Apr 2024 13:25:29 GMT etag 638439025464170000 last-modified Mon, 19 Feb 2024 09:22:26 GMT server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 x-powered-by ASP.NET Redirect headers Location https://mfa-files.firstcloudit.com/ Non-Authoritative-Reason HttpsUpgrades
GET H2	200	a.css mfa-files.firstcloudit.com/	2 KB 3 KB	187ms 186ms	Stylesheet text/css	66.220.9.47 HURRICANE
General Check archive.org Show headers Download Go to Full URL https://mfa-files.firstcloudit.com/a.css Requested by Host: mfa-files.firstcloudit.com URL: https://mfa-files.firstcloudit.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.220.9.47 Salinas, United States, ASN6939 (HURRICANE, US), Reverse DNS www.firstcloudit.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `8827fa3b9d8fa186a1a4639757b3bae296e1b130a20987f785ef099a9e327d3a` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://mfa-files.firstcloudit.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 12 Apr 2024 13:25:29 GMT last-modified Mon, 19 Feb 2024 09:10:30 GMT server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 etag 638439018305500000 x-powered-by ASP.NET content-type text/css access-control-allow-origin * cache-control private accept-ranges bytes content-length 2543
GET		071bc9fc-d236-4cdd-a99f-34fc5113928e webhook.site/	0 0

GET H2	200	Capture2.PNG mfa-files.firstcloudit.com/	6 KB 6 KB	189ms 189ms	Image image/png	66.220.9.47 HURRICANE
General Check archive.org Show headers Download Go to Show image Full URL https://mfa-files.firstcloudit.com/Capture2.PNG Requested by Host: mfa-files.firstcloudit.com URL: https://mfa-files.firstcloudit.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.220.9.47 Salinas, United States, ASN6939 (HURRICANE, US), Reverse DNS www.firstcloudit.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `d37c80ca3767668be0a020a9f4dacbdb38eb9a186c9d94f2bc4284217905e1bf` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://mfa-files.firstcloudit.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 12 Apr 2024 13:25:29 GMT last-modified Mon, 19 Feb 2024 09:10:29 GMT server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 etag 638439018299900000 x-powered-by ASP.NET content-type image/png access-control-allow-origin * cache-control private accept-ranges bytes content-length 5880
GET H2	200	Capture119.PNG mfa-files.firstcloudit.com/	501 KB 501 KB	347ms 347ms	Image image/png	66.220.9.47 HURRICANE
General Check archive.org Show headers Download Go to Show image Full URL https://mfa-files.firstcloudit.com/Capture119.PNG Requested by Host: mfa-files.firstcloudit.com URL: https://mfa-files.firstcloudit.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.220.9.47 Salinas, United States, ASN6939 (HURRICANE, US), Reverse DNS www.firstcloudit.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `3c36775b12a18a8c39368d680a05c9ccfb88c8bbe5fd31da3896762883525485` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://mfa-files.firstcloudit.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 12 Apr 2024 13:25:29 GMT last-modified Mon, 19 Feb 2024 09:10:29 GMT server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 etag 638439018291030000 x-powered-by ASP.NET content-type image/png access-control-allow-origin * cache-control private accept-ranges bytes content-length 513000
GET H/1.1	200 OK	CameraFTPBanner800x100.png www.drivehq.com/images/banner/	23 KB 23 KB	816ms 172ms	Image image/png	66.220.9.57 HURRICANE
General Check archive.org Show headers Download Go to Show image Full URL https://www.drivehq.com/images/banner/CameraFTPBanner800x100.png Requested by Host: mfa-files.firstcloudit.com URL: https://mfa-files.firstcloudit.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.220.9.57 Salinas, United States, ASN6939 (HURRICANE, US), Reverse DNS www.drivehq.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `aca885e7cdacd4d11dcc85d46f2f8355bff58fdc80253a9a28417ec79220fc74` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://mfa-files.firstcloudit.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 12 Apr 2024 13:25:29 GMT Last-Modified Thu, 09 Mar 2023 12:26:13 GMT Server Microsoft-IIS/10.0 ETag "c794cc568252d91:0" X-Powered-By ASP.NET Content-Type image/png Cache-Control max-age=86400 Accept-Ranges bytes Content-Length 23045
GET H/1.1	200 OK	DriveMappingBanner.png www.drivehq.com/images/banner/	21 KB 22 KB	1159ms 174ms	Image image/png	66.220.9.57 HURRICANE
General Check archive.org Show headers Download Go to Show image Full URL https://www.drivehq.com/images/banner/DriveMappingBanner.png Requested by Host: mfa-files.firstcloudit.com URL: https://mfa-files.firstcloudit.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.220.9.57 Salinas, United States, ASN6939 (HURRICANE, US), Reverse DNS www.drivehq.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1c1c70de820fd83f647f28d11653e3d8b48c8a60219aa3de7977a3bac462eaf3` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://mfa-files.firstcloudit.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 12 Apr 2024 13:25:30 GMT Last-Modified Thu, 09 Mar 2023 12:26:13 GMT Server Microsoft-IIS/10.0 ETag "f26dae568252d91:0" X-Powered-By ASP.NET Content-Type image/png Cache-Control max-age=86400 Accept-Ranges bytes Content-Length 21943
GET		FileNotFound.aspx www.drivehq.com/help/hosting/ Redirect Chain https://mfa-files.firstcloudit.com/favicon.ico https://www.drivehq.com/help/hosting/FileNotFound.aspx?errCode=3&filePath=\\mfa-files\wwwhome\favicon.ico	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: webhook.site
URL: https://webhook.site/071bc9fc-d236-4cdd-a99f-34fc5113928e

Domain: www.drivehq.com
URL: https://www.drivehq.com/help/hosting/FileNotFound.aspx?errCode=3&filePath=\\mfa-files\wwwhome\favicon.ico

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| s function| wwd function| ssq function| mobileCheck

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mfa-files.firstcloudit.com/	1970-01-20 19:49:17	Name: MBizSessionID Value: 13545993711367415

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mfa-files.firstcloudit.com
webhook.site
www.drivehq.com
webhook.site
www.drivehq.com
66.220.9.47
66.220.9.57
1c1c70de820fd83f647f28d11653e3d8b48c8a60219aa3de7977a3bac462eaf3
3c36775b12a18a8c39368d680a05c9ccfb88c8bbe5fd31da3896762883525485
8827fa3b9d8fa186a1a4639757b3bae296e1b130a20987f785ef099a9e327d3a
9ecaa238473eda1c438b7e7235e9ac0f54f36d1b1d668b6a9cc65318ac07b409
aca885e7cdacd4d11dcc85d46f2f8355bff58fdc80253a9a28417ec79220fc74
d37c80ca3767668be0a020a9f4dacbdb38eb9a186c9d94f2bc4284217905e1bf

mfa-files.firstcloudit.com Open in urlscan Pro 66.220.9.47 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

8 Requests

75 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

560 kBTransfer

559 kBSize

1 Cookies

3 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

Indicators

mfa-files.firstcloudit.com Open in urlscan Pro
66.220.9.47 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

560 kB
Transfer

559 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions