f004.backblazeb2.com Open in urlscan Pro
149.137.128.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html
Submission: On March 09 via manual (March 9th 2022, 3:27:28 am UTC) from NZ — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 149.137.128.16, located in United States and belongs to BACKBLAZE, US. The main domain is f004.backblazeb2.com.
TLS certificate: Issued by R3 on February 8th 2022. Valid for: 3 months.

This is the only time f004.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	149.137.128.16 149.137.128.16	40401 (BACKBLAZE) (BACKBLAZE)
12	2a06:98c1:312... 2a06:98c1:3121::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2

2 149.137.128.16 (United States)

ASN40401 (BACKBLAZE, US)
PTR: f004.backblazeb2.com

f004.backblazeb2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)

sogosmtp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	sogosmtp.com sogosmtp.com — Cisco Umbrella Rank: 585716	244 KB
2	backblazeb2.com f004.backblazeb2.com	76 KB
14	2

	Domain	Requested by
12	sogosmtp.com	f004.backblazeb2.com
2	f004.backblazeb2.com	f004.backblazeb2.com
14	2

This site contains no links.

Subject Issuer	Validity	Valid
backblazeb2.com R3	`2022-02-08` - `2022-05-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-02-23` - `2023-02-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html
Frame ID: 475B12EE4C9964E22309B2E8F871D32B
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dropbox

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

320 kB
Transfer

448 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request index.html Show response f004.backblazeb2.com/file/deputized-meliatin-staybolt/	76 KB 76 KB	841ms 334ms	Document text/html	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `92560be7b5a724b5dd20d68fa140e5e448e14bcc1867c7e75fa4fa4c9a2f884f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers x-bz-file-name index.html x-bz-file-id 4_zb053ac514cb46a817df20d1e_f110b727776de4635_d20220308_m065103_c004_v0402005_t0050 x-bz-content-sha1 cdeb9485fc15e4603b3ce357c9d40d1b40959da4 X-Bz-Upload-Timestamp 1646722263000 Accept-Ranges bytes Content-Type text/html Content-Length 77382 Date Wed, 09 Mar 2022 03:27:22 GMT Keep-Alive timeout=5 Connection keep-alive
GET H2	200	bootstrap.min.css sogosmtp.com/email-list/dropboxcxcx22/img/	157 KB 25 KB	452ms 76ms	Stylesheet text/css	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/bootstrap.min.css Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a547652943e11dd21e7a0c39fae37b84c6dd27de5efff7ea4f45cde43c938f89` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT content-encoding br cf-cache-status MISS last-modified Wed, 27 Oct 2021 23:13:30 GMT server cloudflare etag W/"6179dd1a-27299" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I4Zvj01Nlf5m2PeKSrKN2OJjHbGD4xpsxElzapLhv9jXz%2FfuOsPfRZPld6m2K7zBM02HT52vS%2BxfM2PYadTPuIeK%2F%2B4znxPiyrJBEbBqyQ3QiWWJb%2BQ5WjvXpsrnRWFoy6FCEZKmzPzD3CY%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=315360000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6e90b6ef59a49bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	3.png sogosmtp.com/email-list/dropboxcxcx22/img/	7 KB 7 KB	434ms 58ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/3.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e71e76473b99fccdb728ad0c93cebc97129b379194439c00b95d99026d2f79df` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 7154 last-modified Wed, 27 Oct 2021 23:13:36 GMT server cloudflare etag "6179dd20-1bf2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FDokcaSTf5eKTrZ%2B7vhdp0qd88TTikfQ8TomP34kr7It%2Fk%2FL%2F0TiewjUjUWKYwP1JhpX1ndV3ClTRJsxjBiL4P%2BU%2B17LrH6A207oOa9tN1AoQlw81IUwhqJ9Ju9WAa7aZyF6UN9G7%2BXwwNw%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef79c69bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	2.png sogosmtp.com/email-list/dropboxcxcx22/img/	7 KB 7 KB	426ms 51ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/2.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3724402e444447c43c55554b01a91204ab38314bec788e2458b7cad112bf614e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6836 last-modified Wed, 27 Oct 2021 23:13:38 GMT server cloudflare etag "6179dd22-1ab4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FGl9eyq53lJPPsifjA4nWtZhwQVciAL%2B2erp3aG9RbgWjO37p5PDKvkEuFefi9zgtPJnGQbSR2lESKF95X%2BEbtgr4%2B3LF7bqLH%2FSAicSI30raKxme%2BwOZlbFuVZX6F%2FCpKKfCIjzFGSZGH0%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69ab9bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	4.png sogosmtp.com/email-list/dropboxcxcx22/img/	6 KB 6 KB	451ms 75ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/4.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3d8e438c5f6a243fc8f81061dc2d00854fac5ad5b4cca87639d4095f29bc0129` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 5804 last-modified Wed, 27 Oct 2021 23:13:36 GMT server cloudflare etag "6179dd20-16ac" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zvqvc99MLfwvHzOZ1%2BqQI2K8%2FpnCBefQ9HO%2B4gYJ8HbKo4xTQLdEWr94OaWpCBDKRWAisy6DxpyopZRvSpzDFJOqAegxP3QC1cyIsFHfrcwgWFSmixGnFuK2%2BAF4fy8%2F4xv7O1ZoftrIH60%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef79c19bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	6.png sogosmtp.com/email-list/dropboxcxcx22/img/	48 KB 48 KB	436ms 61ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/6.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7641528292d5b3f033bc90e0f70757be629dd60092b63ab77d087a16745e6ef5` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 48936 last-modified Wed, 27 Oct 2021 23:13:34 GMT server cloudflare etag "6179dd1e-bf28" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=677kk9F0qnUVEqWMUPoFyRrVkRYb%2BGEQxcXvsUPwYNO85PsDYpeLRSbhw%2BT%2F%2FbuqWPYnlhaglbVA1jeKymIn8HjoTmt2KOTwZHoVfyUXPZrC%2BYdMlRz3FHHtjYsGfoZ%2BMEAp%2FqWU8ZwKG%2B8%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69ac9bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	7.png sogosmtp.com/email-list/dropboxcxcx22/img/	9 KB 9 KB	449ms 74ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/7.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bc7d62b5e732fd38160532e48780cb53fd0de4a7e85b2b24b914ebf10e074866` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 8998 last-modified Wed, 27 Oct 2021 23:13:34 GMT server cloudflare etag "6179dd1e-2326" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oE0LDhWvqFX1JdSJybIo6RXgT5cnepGzR24fxNvdZ5OOV3LhNABH4pDlvA4W21lKn8qZRY6rpqXcVse8TYfYwhXg8xolNwZQixDkOB25S%2BtZeYiyr%2BNEL5OFHvhgFE3IYyd%2Fuua3g6JMzF8%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef79c39bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	8.png sogosmtp.com/email-list/dropboxcxcx22/img/	10 KB 11 KB	425ms 52ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/8.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `adfd07de1b4bbe23f8e4f7eedddc6fde432a2406f5487fd299a82d6616ff2779` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 10532 last-modified Wed, 27 Oct 2021 23:13:32 GMT server cloudflare etag "6179dd1c-2924" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EPlYpFaCgScoK2zEtpXRW00vhLyl0lrpqP3T60VOHaZiwZ3KwEXapZwGqQPL%2FqN437N%2FIklpQ0DE3zE9E5AzeGYwnyZD0SOv2bxGDgRdrkwy9UHLWl6PjiUdUkDyLJXbsLUzkJUr0vPucp8%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69a59bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	9.png sogosmtp.com/email-list/dropboxcxcx22/img/	8 KB 8 KB	422ms 50ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/9.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `73bfffb999b9979b23b7788d75c1e3f57d13c2ce6ed3729b7852b9a50eedcdd4` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 7955 last-modified Wed, 27 Oct 2021 23:13:32 GMT server cloudflare etag "6179dd1c-1f13" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u7f4t%2F%2FdFsOVkvfUSvS4%2FeuLvGuCgQd5oUVOGyGjbPsxI3Ca%2BFVOq%2Bk5kJT7VKeVReBGEf9jX0s93MkXvoUWsQc1HpX9hk%2BcDvu3AU3md0pPrnC0IRWQBVoB3LJOlkL%2BNDLxT0Am8Kwc%2BkQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69a79bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	10.png sogosmtp.com/email-list/dropboxcxcx22/img/	8 KB 9 KB	430ms 57ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/10.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e20b9371531b230f9aed947f14294d4d5e88bda62332e9242609dee8cc0af66e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 8512 last-modified Wed, 27 Oct 2021 23:13:40 GMT server cloudflare etag "6179dd24-2140" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c3%2B0rQft2s7Tqc8Gt2KoWwoF4Db1OhCk%2Btn3vpyEFd9Qurd41096XMHdHiIh8HTro%2FapAG39Fb93NA7nJEUWljDjWI7HAIDxB8%2FMhOqQ4tft%2BXfr6VjLluuBHbDQTNcXPNg%2B%2FyfCwAVD%2Bto%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69a69bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	11.png sogosmtp.com/email-list/dropboxcxcx22/img/	8 KB 8 KB	424ms 52ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/11.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `10954634b697781f7868941ae52e272f9b6b8817ddb45405d6713fd7496b85be` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 8358 last-modified Wed, 27 Oct 2021 23:13:40 GMT server cloudflare etag "6179dd24-20a6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lppLLro%2B9%2BP1WsFmXCnPQlwx0KuDdcSS4Y3tj23V67G2OlQPWQ2FG%2Bh36i7albZwwXuMbl04byrgOZJoxg98mEoweR%2BlPusyWKhVx3SrvRsdKgIUpZhvsMql%2BWcPUOXR1ICj%2FUcK8lhMxO8%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69a89bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	12.png sogosmtp.com/email-list/dropboxcxcx22/img/	11 KB 11 KB	414ms 42ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/12.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a51541c50e41e5e521bcfa4dd6175ad9f2f57287d1932c4ca8d9637007f078ff` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 10848 last-modified Wed, 27 Oct 2021 23:13:38 GMT server cloudflare etag "6179dd22-2a60" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AieDDmEdK%2FltI%2BtchAYUig6CmWLJi8L21IU975r2PiK3UZYb6Bxm70s9rDiKiYV0RNc8iKCt4OqF9rnvk22hW%2FLn0wqdtjH8QiGlt5TLynN%2FgcydpRHOiSToZwG6KKgVnV6pytyEKOpv0ds%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef69aa9bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	1.png sogosmtp.com/email-list/dropboxcxcx22/img/	94 KB 95 KB	461ms 89ms	Image image/png	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sogosmtp.com/email-list/dropboxcxcx22/img/1.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `414e7f5b3a30e7f608dd3838409092bf8dd47c19bbbaf32be3c235a14b5ea2e7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 03:27:24 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 96764 last-modified Wed, 27 Oct 2021 23:13:40 GMT server cloudflare etag "6179dd24-179fc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1fAYpDTTJ2f%2BXKkmRJSQIvfjQKupUZdL8fViGG6Mkc1oB0pVAJMDDs9XJQuRBgIKHJiqkRyT%2F9JBSIGEjRYChCX9cf5F5NXzIJCnllSzravJcBlZnuIggpw6DWxyKJ8CcJ7c%2B%2BMD92%2FTxK0%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6e90b6ef79c59bd7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	404	5.png f004.backblazeb2.com/file/deputized-meliatin-staybolt/img/	94 B 94 B	165ms 165ms	Image application/json	149.137.128.16 BACKBLAZE
General Check archive.org Show headers Download Go to Show image Full URL https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/img/5.png Requested by Host: f004.backblazeb2.com URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.128.16 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS f004.backblazeb2.com Software / Resource Hash `a87ef7b2a413f234985afa048f77baf7911825ddda1a8b3610fecdd2c3093272` Request headers Accept-Language de-DE,de;q=0.9 Referer https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Wed, 09 Mar 2022 03:27:23 GMT Cache-Control max-age=0, no-cache, no-store Connection keep-alive Keep-Alive timeout=5 Content-Length 94 Content-Type application/json;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://f004.backblazeb2.com/file/deputized-meliatin-staybolt/img/5.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

f004.backblazeb2.com
sogosmtp.com
149.137.128.16
2a06:98c1:3121::7
10954634b697781f7868941ae52e272f9b6b8817ddb45405d6713fd7496b85be
3724402e444447c43c55554b01a91204ab38314bec788e2458b7cad112bf614e
3d8e438c5f6a243fc8f81061dc2d00854fac5ad5b4cca87639d4095f29bc0129
414e7f5b3a30e7f608dd3838409092bf8dd47c19bbbaf32be3c235a14b5ea2e7
73bfffb999b9979b23b7788d75c1e3f57d13c2ce6ed3729b7852b9a50eedcdd4
7641528292d5b3f033bc90e0f70757be629dd60092b63ab77d087a16745e6ef5
92560be7b5a724b5dd20d68fa140e5e448e14bcc1867c7e75fa4fa4c9a2f884f
a51541c50e41e5e521bcfa4dd6175ad9f2f57287d1932c4ca8d9637007f078ff
a547652943e11dd21e7a0c39fae37b84c6dd27de5efff7ea4f45cde43c938f89
a87ef7b2a413f234985afa048f77baf7911825ddda1a8b3610fecdd2c3093272
adfd07de1b4bbe23f8e4f7eedddc6fde432a2406f5487fd299a82d6616ff2779
bc7d62b5e732fd38160532e48780cb53fd0de4a7e85b2b24b914ebf10e074866
e20b9371531b230f9aed947f14294d4d5e88bda62332e9242609dee8cc0af66e
e71e76473b99fccdb728ad0c93cebc97129b379194439c00b95d99026d2f79df

f004.backblazeb2.com Open in urlscan Pro 149.137.128.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

320 kBTransfer

448 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

f004.backblazeb2.com Open in urlscan Pro
149.137.128.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

320 kB
Transfer

448 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!