storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:81d::2010  Malicious Activity! Public Scan

URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Submission: On July 09 via automatic, source openphish

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2a00:1450:4001:81d::2010, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is storage.googleapis.com.
TLS certificate: Issued by GTS CA 1O1 on June 17th 2020. Valid for: 3 months.
This is the only time storage.googleapis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 1&1 Ionos (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
3 2a00:1450:400... 15169 (GOOGLE)
1 195.20.251.98 8560 (ONEANDONE...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
5 213.165.66.58 8560 (ONEANDONE...)
10 5
Apex Domain
Subdomains
Transfer
5 uicdn.net
ce1.uicdn.net
256 KB
3 googleapis.com
storage.googleapis.com
370 KB
1 jquery.com
code.jquery.com
24 KB
1 ionos.com
tif.ionos.com
2 KB
10 4
Domain Requested by
5 ce1.uicdn.net storage.googleapis.com
3 storage.googleapis.com storage.googleapis.com
1 code.jquery.com storage.googleapis.com
1 tif.ionos.com storage.googleapis.com
10 4

This site contains links to these domains. Also see Links.

Domain
www.ionos.com
ias.ionos.com
my.ionos.com
hidrive.ionos.com
archive.ionos.com
www.ionos-status.com
Subject Issuer Validity Valid
*.storage.googleapis.com
GTS CA 1O1
2020-06-17 -
2020-09-09
3 months crt.sh
*.ionos.com
GeoTrust RSA CA 2018
2018-12-04 -
2020-12-03
2 years crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2 years crt.sh
ce1.uicdn.net
GeoTrust RSA CA 2018
2020-03-03 -
2022-03-08
2 years crt.sh

This page contains 2 frames:

Primary Page: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Frame ID: 0D42AEFDF081C87C68002D0059E6CBF1
Requests: 10 HTTP requests in this frame

Frame: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/Webmail%20Login%20_%20IONOS%20by%201&1_files/robots.html
Frame ID: 18AA056B2575C235EDFF3B7A76A77100
Requests: 1 HTTP requests in this frame

Screenshot


Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

652 kB
Transfer

697 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 65ghty657hj67546rty5454.html
storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/
369 KB
369 KB
Document
General
Full URL
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
bfba3ece5c02e857c5445d22801c9b836c6707c649806670207dab247a9b343f

Request headers

:method
GET
:authority
storage.googleapis.com
:scheme
https
:path
/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
x-guploader-uploadid
AAANsUkX3REb4bDtwV9hFx7Ywk5XoXm81TWNI5X4wzkkM6CHsjRvY3fm3auIjKCUXR_5r1zZIjxWdxNcuVR9ZQxhAFo
expires
Thu, 09 Jul 2020 02:33:39 GMT
date
Thu, 09 Jul 2020 01:33:39 GMT
cache-control
public, max-age=3600
last-modified
Wed, 24 Jun 2020 03:12:59 GMT
etag
"91115ed6e65b8132b74d544cd63eb3fb"
x-goog-generation
1592968379372535
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
377432
content-type
text/html
x-goog-hash
crc32c=R+sKpQ== md5=kRFe1uZbgTK3TVRM1j6z+w==
x-goog-storage-class
STANDARD
accept-ranges
bytes
content-length
377432
server
UploadServer
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
70000.js
tif.ionos.com/js/
5 KB
2 KB
Script
General
Full URL
https://tif.ionos.com/js/70000.js
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.20.251.98 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
tif-bap.ionos.com
Software
Apache /
Resource Hash
4c492c39769e0c0943694e44d40d0a560cb903d4638015e73943685fdae6934d

Request headers

Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 09 Jul 2020 01:33:39 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 May 2020 11:10:08 GMT
Server
Apache
ETag
"1486-5a677058d0400-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=86400, public
Connection
close
Accept-Ranges
bytes
Content-Length
1906
mail-archiving-de-warning-promo.svg
storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/Webmail%20Login%20_%20IONOS%20by%201&1_files/
223 B
223 B
Image
General
Full URL
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/Webmail%20Login%20_%20IONOS%20by%201&1_files/mail-archiving-de-warning-promo.svg
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343

Request headers

Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 09 Jul 2020 01:33:39 GMT
server
UploadServer
x-guploader-uploadid
AAANsUlGTqDuCb7iCNr7vplAMb3UNfzT2N-dZqFCwugbnGwVZqqvS-QZP5Ofti7XOMhuayZakvkHEEUimMHAw-0kH50
content-type
application/xml; charset=UTF-8
status
403
cache-control
private, max-age=0
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
223
expires
Thu, 09 Jul 2020 01:33:39 GMT
jquery-3.3.1.slim.min.js
code.jquery.com/
68 KB
24 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Origin
https://storage.googleapis.com

Response headers

Date
Thu, 09 Jul 2020 01:33:39 GMT
Content-Encoding
gzip
Last-Modified
Sat, 20 Jan 2018 17:26:44 GMT
Server
nginx
ETag
W/"5a637bd4-1111d"
Vary
Accept-Encoding
X-HW
1594258419.dop122.fr8.t,1594258419.cds160.fr8.shn,1594258419.cds160.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
24038
robots.html
storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/Webmail%20Login%20_%20IONOS%20by%201&1_files/ Frame 18AA
223 B
361 B
Document
General
Full URL
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/Webmail%20Login%20_%20IONOS%20by%201&1_files/robots.html
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343

Request headers

:method
GET
:authority
storage.googleapis.com
:scheme
https
:path
/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/Webmail%20Login%20_%20IONOS%20by%201&1_files/robots.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=

Response headers

status
403
x-guploader-uploadid
AAANsUlM2Gp0Jxl14geQa0ADN7TwuYLWUQet-700LkexlHlvSNbhMwLjg_XPj-fAVA_X4A2rsAPUWCQn7JlRf9NViGA
content-type
application/xml; charset=UTF-8
content-length
223
date
Thu, 09 Jul 2020 01:33:39 GMT
expires
Thu, 09 Jul 2020 01:33:39 GMT
cache-control
private, max-age=0
server
UploadServer
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/
62 KB
63 KB
Font
General
Full URL
https://ce1.uicdn.net/exos/fonts/open-sans/opensans-regular.woff
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.165.66.58 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Origin
https://storage.googleapis.com

Response headers

date
Thu, 09 Jul 2020 01:33:39 GMT
last-modified
Tue, 12 Jun 2018 09:26:07 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
63712
expires
Fri, 09 Jul 2021 01:33:39 GMT
truncated
/
320 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c8e1724edab4d29c68d698c71f04db98774a5ba4fb432e4d37bfb0beecdac987

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
exos-icon-font.woff
ce1.uicdn.net/exos/icons/
47 KB
47 KB
Font
General
Full URL
https://ce1.uicdn.net/exos/icons/exos-icon-font.woff?v=5
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.165.66.58 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
b2c8697ee2d90ad32dc069c43694ca9143c109e5aa354a0fdec686dcaa50bd2e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Origin
https://storage.googleapis.com

Response headers

date
Thu, 09 Jul 2020 01:33:39 GMT
last-modified
Fri, 07 Feb 2020 11:21:22 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
48128
expires
Fri, 09 Jul 2021 01:33:39 GMT
overpass-regular.woff
ce1.uicdn.net/exos/fonts/overpass/
42 KB
42 KB
Font
General
Full URL
https://ce1.uicdn.net/exos/fonts/overpass/overpass-regular.woff
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.165.66.58 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d78e7ad4838a9fb4db11451b1db78ccd0b0c7b28f5787684ce2870918ce27bb5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Origin
https://storage.googleapis.com

Response headers

date
Thu, 09 Jul 2020 01:33:39 GMT
last-modified
Tue, 12 Jun 2018 09:26:06 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
42580
expires
Fri, 09 Jul 2021 01:33:39 GMT
opensans-bold.woff
ce1.uicdn.net/exos/fonts/open-sans/
62 KB
62 KB
Font
General
Full URL
https://ce1.uicdn.net/exos/fonts/open-sans/opensans-bold.woff
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.165.66.58 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Origin
https://storage.googleapis.com

Response headers

date
Thu, 09 Jul 2020 01:33:39 GMT
last-modified
Tue, 12 Jun 2018 09:26:07 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
63564
expires
Fri, 09 Jul 2021 01:33:39 GMT
overpass-bold.woff
ce1.uicdn.net/exos/fonts/overpass/
41 KB
41 KB
Font
General
Full URL
https://ce1.uicdn.net/exos/fonts/overpass/overpass-bold.woff
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.165.66.58 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
7afccd9150b0fcbf1a1056e6cc6051c9b6d85a55da7bf1a7fb0f475c0b22facc

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=
Origin
https://storage.googleapis.com

Response headers

date
Thu, 09 Jul 2020 01:33:39 GMT
last-modified
Tue, 12 Jun 2018 09:26:06 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
42092
expires
Fri, 09 Jul 2021 01:33:39 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1&1 Ionos (Telecommunication)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NSfTIF function| $ function| jQuery string| hash undefined| encoded_string function| sendmails

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://storage.googleapis.com/covid19dfagfdghsfgddcovid19fertgdfgfpackage2020covid19/65ghty657hj67546rty5454.html?email=(Line 3310)
Message:
undefined