f000.backblazeb2.com
Open in
urlscan Pro
104.153.233.177
Malicious Activity!
Public Scan
Effective URL: https://f000.backblazeb2.com/file/hemiprotein9791507/login.html?xrpsfhnteg=SPzEdyWDWlHHmJkWGC8&cksbxbldr=a299z65nYwas2ZsnUVC&...
Submission: On January 21 via manual from US
Summary
TLS certificate: Issued by R3 on December 9th 2020. Valid for: 3 months.
This is the only time f000.backblazeb2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Generic (Online) Excel / PDF download (Online)Domain & IP information
ASN11377 (SENDGRID, US)
PTR: o16789123x122.outbound-mail.sendgrid.net
u15445604.ct.sendgrid.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
earthsmtp.com
earthsmtp.com |
2 MB |
4 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
61 KB |
3 |
gstatic.com
fonts.gstatic.com |
27 KB |
3 |
fontawesome.com
kit.fontawesome.com ka-f.fontawesome.com |
22 KB |
3 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com stackpath.bootstrapcdn.com |
41 KB |
2 |
backblazeb2.com
f000.backblazeb2.com |
131 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
6 KB |
1 |
ibb.co
i.ibb.co |
52 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
sendgrid.net
1 redirects
u15445604.ct.sendgrid.net |
266 B |
28 | 10 |
Domain | Requested by | |
---|---|---|
10 | earthsmtp.com |
f000.backblazeb2.com
earthsmtp.com |
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | stackpath.bootstrapcdn.com |
f000.backblazeb2.com
|
2 | fonts.googleapis.com |
f000.backblazeb2.com
earthsmtp.com |
2 | ajax.googleapis.com |
f000.backblazeb2.com
|
2 | f000.backblazeb2.com |
f000.backblazeb2.com
|
1 | cdnjs.cloudflare.com |
f000.backblazeb2.com
|
1 | i.ibb.co |
f000.backblazeb2.com
|
1 | kit.fontawesome.com |
f000.backblazeb2.com
|
1 | maxcdn.bootstrapcdn.com |
f000.backblazeb2.com
|
1 | code.jquery.com |
f000.backblazeb2.com
|
1 | u15445604.ct.sendgrid.net | 1 redirects |
28 | 13 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
backblazeb2.com R3 |
2020-12-09 - 2021-03-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-05 - 2021-03-30 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2020-11-13 - 2021-12-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-11-01 - 2021-10-31 |
a year | crt.sh |
ibb.co R3 |
2020-12-03 - 2021-03-03 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-12-15 - 2021-03-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://f000.backblazeb2.com/file/hemiprotein9791507/login.html?xrpsfhnteg=SPzEdyWDWlHHmJkWGC8&cksbxbldr=a299z65nYwas2ZsnUVC&asjvcuiyp=qZ3ItbVLPcaOByBI1rrCW7Gb3wJf&ytnsw=ffuHeTRsTDcfdxjP7&qpux=UM39OttMd41UxSv2YxXFy&kfudeo=yXESMhewuyIhu3s7UJcB3QMvaho8e
Frame ID: E69104EED6E87150F2B25533F3B63BD7
Requests: 28 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u15445604.ct.sendgrid.net/ls/click?upn=JB5kdiH-2Fd-2BIhUV8SPVIq369srDaPdvb8sxEwVQmvyk7p09uVVR1h1a4bQzg...
HTTP 302
https://f000.backblazeb2.com/file/hemiprotein9791507/index.html Page URL
- https://f000.backblazeb2.com/file/hemiprotein9791507/login.html?xrpsfhnteg=SPzEdyWDWlHHmJkWGC8&cksbxbldr=... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u15445604.ct.sendgrid.net/ls/click?upn=JB5kdiH-2Fd-2BIhUV8SPVIq369srDaPdvb8sxEwVQmvyk7p09uVVR1h1a4bQzgjAyDcYBueJQNpvSijSw4yTNQFJdGhD9wsjjkeln27Zeexj2U-3DJCbc_IG7-2BGZHSnYxNhj4el4KMTi2VHR-2F0WC7XT25JfIfrKDbNPjjALbwMUgkKVQJW953ow85cV9b9gwO8lRpehYHwqABZptc15lFGigmq2KCEHCKS2-2BKrU0TpOAgHaq-2F-2Bu0tUvu8CYGIyr4bITidWHdbw-2BVSaSyTxMQVC7Nh7UepbjWpmeLPUBfxDsl0NYgLY48koPJK0b-2BiFkaYLPZ4BicwZ15T2iSAxtM0GZmaQ39fj9cI-3D
HTTP 302
https://f000.backblazeb2.com/file/hemiprotein9791507/index.html Page URL
- https://f000.backblazeb2.com/file/hemiprotein9791507/login.html?xrpsfhnteg=SPzEdyWDWlHHmJkWGC8&cksbxbldr=a299z65nYwas2ZsnUVC&asjvcuiyp=qZ3ItbVLPcaOByBI1rrCW7Gb3wJf&ytnsw=ffuHeTRsTDcfdxjP7&qpux=UM39OttMd41UxSv2YxXFy&kfudeo=yXESMhewuyIhu3s7UJcB3QMvaho8e Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u15445604.ct.sendgrid.net/ls/click?upn=JB5kdiH-2Fd-2BIhUV8SPVIq369srDaPdvb8sxEwVQmvyk7p09uVVR1h1a4bQzgjAyDcYBueJQNpvSijSw4yTNQFJdGhD9wsjjkeln27Zeexj2U-3DJCbc_IG7-2BGZHSnYxNhj4el4KMTi2VHR-2F0WC7XT25JfIfrKDbNPjjALbwMUgkKVQJW953ow85cV9b9gwO8lRpehYHwqABZptc15lFGigmq2KCEHCKS2-2BKrU0TpOAgHaq-2F-2Bu0tUvu8CYGIyr4bITidWHdbw-2BVSaSyTxMQVC7Nh7UepbjWpmeLPUBfxDsl0NYgLY48koPJK0b-2BiFkaYLPZ4BicwZ15T2iSAxtM0GZmaQ39fj9cI-3D HTTP 302
- https://f000.backblazeb2.com/file/hemiprotein9791507/index.html
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
f000.backblazeb2.com/file/hemiprotein9791507/ Redirect Chain
|
101 KB 101 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.html
f000.backblazeb2.com/file/hemiprotein9791507/ |
29 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 548 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
earthsmtp.com/email-list/adobe20/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a-logo.png
earthsmtp.com/email-list/adobe20/images/ |
181 KB 182 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmail.jpg
earthsmtp.com/email-list/adobe20/images/ |
14 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol.jpg
earthsmtp.com/email-list/adobe20/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
outlook.jpg
earthsmtp.com/email-list/adobe20/images/ |
15 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office.jpg
earthsmtp.com/email-list/adobe20/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo.jpg
earthsmtp.com/email-list/adobe20/images/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other.jpg
earthsmtp.com/email-list/adobe20/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-logos.jpg
earthsmtp.com/email-list/adobe20/images/ |
101 KB 101 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmail.png
i.ibb.co/6RPmLj8/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.2/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.2/css/ |
26 KB 4 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
css
fonts.googleapis.com/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log-bg.jpg
earthsmtp.com/email-list/adobe20/images/ |
2 MB 2 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Generic (Online) Excel / PDF download (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| outp string| outpp string| theID string| x object| newHTML function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
earthsmtp.com
f000.backblazeb2.com
fonts.googleapis.com
fonts.gstatic.com
i.ibb.co
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
u15445604.ct.sendgrid.net
104.153.233.177
145.239.131.55
167.89.123.122
2001:4de0:ac19::1:b:1a
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:2b
2606:4700:3031::ac43:862f
2606:4700::6810:125e
2606:4700::6812:1634
2606:4700:e6::ac40:ca1c
2a00:1450:4001:801::2003
2a00:1450:4001:803::200a
2a00:1450:4001:809::200a
2a00:1450:4001:816::200a
0395c2d974a610a5826088c1752b49945c0b38e841389e794bf7171e2326982c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2641774a75edf22f36ae246a5ae426c1497e0827018f458323b34d9260d35994
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
3b7320792e1ec9c71f5a9640aca9997e6f71ce7f2a17f8dc501802a545c7747a
423f8e9e6aa35beed3422b2f932bcb4a617a19d0afa09792ddd144e6fd720d0b
49d6703e6d07c3fbef4b4a808bb4e3afe9ef282bcfdd84d5076c0213fa9c8486
51f2f79e64b33d994f8c1f25ad14f451b51597dd36bfb9bed179b5e88315cc75
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
7943d6d067db8587e9fb675f0d2cc78d6c90c91b187cf8642a3f52ff91381685
7976b777c1a1d694739e57292d1629d371aa79be6d7a2a87bcb0d0b9edad79f2
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
9b754423be69dea3e01679cc64def1f161cf0760c5893bc65182e1b1ed16adca
9dcb3f39c6f1c7f2b0fa75391efa497c84ade4b3a12867af284fbe224d24c3e9
a2b9b987eff6ff30857883ebc340392b15763d51bc3434db68f18ca36f600d75
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a8911de9c6b54ea92f9322ea7570ee16713718211f4dabc77b820256dc923b4c
b1b69a7928a5cfcf27268b7bf1cc353eec1794b402269a5d8da6588567dad88c
b2bf99365d81089bbb0939d15bd959809492c068555dbead87f91802589ef5a9
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bedcbef0141493931f41db1b4410c80f62812f1d5a5f98de10fcfe4da57e994d
d35194abf113ffbdb79849cc6e15b015f12faafe4ec12fb27827c197d91a403c
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101