serveraccesssite76n.z13.web.core.windows.net
Open in
urlscan Pro
52.239.153.33
Malicious Activity!
Public Scan
Submission: On June 10 via manual from US
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 02 on May 17th 2021. Valid for: a year.
This is the only time serveraccesssite76n.z13.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.239.153.33 52.239.153.33 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
8 16 | 2620:100:6022... 2620:100:6022:15::a27d:420f | 19679 (DROPBOX) (DROPBOX) | |
2 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
14 | 5 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
serveraccesssite76n.z13.web.core.windows.net |
ASN19679 (DROPBOX, US)
dl.dropbox.com | |
dl.dropboxusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
dropboxusercontent.com
dl.dropboxusercontent.com |
79 KB |
8 |
dropbox.com
8 redirects
dl.dropbox.com |
1 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
35 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
windows.net
serveraccesssite76n.z13.web.core.windows.net |
12 KB |
14 | 5 |
Domain | Requested by | |
---|---|---|
8 | dl.dropboxusercontent.com |
serveraccesssite76n.z13.web.core.windows.net
dl.dropboxusercontent.com |
8 | dl.dropbox.com | 8 redirects |
2 | maxcdn.bootstrapcdn.com |
serveraccesssite76n.z13.web.core.windows.net
|
1 | ajax.googleapis.com |
serveraccesssite76n.z13.web.core.windows.net
|
1 | serveraccesssite76n.z13.web.core.windows.net | |
14 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.dropbox.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft RSA TLS CA 02 |
2021-05-17 - 2022-05-17 |
a year | crt.sh |
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-01-19 - 2022-02-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-01 - 2022-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://serveraccesssite76n.z13.web.core.windows.net/W2VtYWlsXQ==
Frame ID: 13BA286D4F7A88E03C5B9F4A06859124
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Microsoft HTTPAPI (Web Servers) Expand
Detected patterns
- headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Try Dropbox Business
Search URL Search Domain Scan URL
Title: Download the app
Search URL Search Domain Scan URL
Title: Dropbox
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://dl.dropbox.com/s/iyph1sp6n9karsz/login_or_register-vflAJk0Kd.css HTTP 302
- https://dl.dropboxusercontent.com/s/iyph1sp6n9karsz/login_or_register-vflAJk0Kd.css
- https://dl.dropbox.com/s/c3wnon2zes3ra1d/base-vflequooz.css HTTP 302
- https://dl.dropboxusercontent.com/s/c3wnon2zes3ra1d/base-vflequooz.css
- https://dl.dropbox.com/s/167c10jxugzyukm/font_atlas_grotesk-vfldINMge.css HTTP 302
- https://dl.dropboxusercontent.com/s/167c10jxugzyukm/font_atlas_grotesk-vfldINMge.css
- https://dl.dropbox.com/s/zy865wtegesilce/login_or_register-vflZ9ry5P.css HTTP 302
- https://dl.dropboxusercontent.com/s/zy865wtegesilce/login_or_register-vflZ9ry5P.css
- https://dl.dropbox.com/s/sxedeas0tuit0nc/css.css HTTP 302
- https://dl.dropboxusercontent.com/s/sxedeas0tuit0nc/css.css
- https://dl.dropbox.com/s/qwlet5piu38cx70/dropbox_logo_glyph_2015_m1.svg HTTP 302
- https://dl.dropboxusercontent.com/s/qwlet5piu38cx70/dropbox_logo_glyph_2015_m1.svg
- https://dl.dropbox.com/s/lc9bq7jjmwxta2g/dropbox_logo_text_2015_m1.svg HTTP 302
- https://dl.dropboxusercontent.com/s/lc9bq7jjmwxta2g/dropbox_logo_text_2015_m1.svg
- https://dl.dropbox.com/s/hz65ril3606724c/sign-in-boulder-vfl2oGV4v.png HTTP 302
- https://dl.dropboxusercontent.com/s/hz65ril3606724c/sign-in-boulder-vfl2oGV4v.png
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
W2VtYWlsXQ==
serveraccesssite76n.z13.web.core.windows.net/ |
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_or_register-vflAJk0Kd.css
dl.dropboxusercontent.com/s/iyph1sp6n9karsz/ Redirect Chain
|
1 KB 568 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base-vflequooz.css
dl.dropboxusercontent.com/s/c3wnon2zes3ra1d/ Redirect Chain
|
23 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font_atlas_grotesk-vfldINMge.css
dl.dropboxusercontent.com/s/167c10jxugzyukm/ Redirect Chain
|
2 KB 1007 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_or_register-vflZ9ry5P.css
dl.dropboxusercontent.com/s/zy865wtegesilce/ Redirect Chain
|
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
dl.dropboxusercontent.com/s/sxedeas0tuit0nc/ Redirect Chain
|
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/ |
59 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dropbox_logo_glyph_2015_m1.svg
dl.dropboxusercontent.com/s/qwlet5piu38cx70/ Redirect Chain
|
314 B 383 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dropbox_logo_text_2015_m1.svg
dl.dropboxusercontent.com/s/lc9bq7jjmwxta2g/ Redirect Chain
|
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sign-in-boulder-vfl2oGV4v.png
dl.dropboxusercontent.com/s/hz65ril3606724c/ Redirect Chain
|
67 KB 68 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Medium-webfont-vflGvvuWg.woff2
dl.dropboxusercontent.com/static/fonts/roboto/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Medium-webfont-vflmx1vK6.ttf
dl.dropboxusercontent.com/static/fonts/roboto/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dl.dropboxusercontent.com
- URL
- https://dl.dropboxusercontent.com/static/fonts/roboto/Roboto-Medium-webfont-vflGvvuWg.woff2
- Domain
- dl.dropboxusercontent.com
- URL
- https://dl.dropboxusercontent.com/static/fonts/roboto/Roboto-Medium-webfont-vflmx1vK6.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
dl.dropbox.com
dl.dropboxusercontent.com
maxcdn.bootstrapcdn.com
serveraccesssite76n.z13.web.core.windows.net
dl.dropboxusercontent.com
2606:4700::6812:bcf
2620:100:6022:15::a27d:420f
2a00:1450:4001:829::200a
52.239.153.33
010c11dcfcd951e1ea6f2071da1e3143bc0bdaa95b2a4ab93cc55953e4926775
11dbfbfe0600ee2ef8d7d9dc0e37dc5ca1c1f865ec527576b1596ffdc1475df4
1683bf67bf7e9ed81d1b1d42e95f3c58d7c292e0e20e88b101f7dde8ce3a9799
5455e6c9958e8476a848aa2f9eb3afa3fd58819c6d68e4e1e2f7557f57aaba1a
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6ae62cd87949feb085e901e1beaee9f3d2f9f34da2ee835f315b56e772eaac9c
72863dacbd76512a770f8914ed3f46fa8c8ea967ce3505efd79b1733e0a15d37
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
953355434379fb10cb2c01eaa17b5357f71291b368fe0c107f91ff453a2c0913
ada476bd3f81aeea547d596df2ea963aa72d1e48d863a79e9c1833733c456dd0
f486dd244f3bae8a006758b411a1b19799d4b23aff2c360ec7b7b72c187deaa3
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d