oouz5rtzn5j8xw60m6hfow-on.drv.tw
Open in
urlscan Pro
47.89.250.243
Malicious Activity!
Public Scan
Effective URL: https://oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/vooii.html
Submission Tags: falconsandbox
Submission: On November 10 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 14th 2021. Valid for: 3 months.
This is the only time oouz5rtzn5j8xw60m6hfow-on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 13 | 47.89.250.243 47.89.250.243 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co.) | |
4 4 | 2a00:1450:400... 2a00:1450:4001:82b::200e | 15169 (GOOGLE) (GOOGLE) | |
2 6 | 2a00:1450:400... 2a00:1450:4001:813::2001 | 15169 (GOOGLE) (GOOGLE) | |
2 2 | 2a00:1450:400... 2a00:1450:4001:831::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:811::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c07::9b | 15169 (GOOGLE) (GOOGLE) | |
17 | 5 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN)
oouz5rtzn5j8xw60m6hfow-on.drv.tw | |
drv.tw |
ASN15169 (GOOGLE, US)
doc-00-9g-docs.googleusercontent.com | |
doc-0c-18-docs.googleusercontent.com | |
doc-10-9g-docs.googleusercontent.com | |
doc-10-3c-docs.googleusercontent.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
drv.tw
4 redirects
oouz5rtzn5j8xw60m6hfow-on.drv.tw drv.tw |
187 KB |
6 |
googleusercontent.com
2 redirects
doc-00-9g-docs.googleusercontent.com doc-0c-18-docs.googleusercontent.com doc-10-9g-docs.googleusercontent.com doc-10-3c-docs.googleusercontent.com |
140 KB |
6 |
google.com
6 redirects
drive.google.com docs.google.com |
4 KB |
2 |
google-analytics.com
www.google-analytics.com |
20 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
452 B |
1 |
googletagmanager.com
www.googletagmanager.com |
36 KB |
17 | 6 |
Domain | Requested by | |
---|---|---|
12 | oouz5rtzn5j8xw60m6hfow-on.drv.tw |
4 redirects
oouz5rtzn5j8xw60m6hfow-on.drv.tw
|
4 | drive.google.com | 4 redirects |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | doc-10-3c-docs.googleusercontent.com |
1 redirects
oouz5rtzn5j8xw60m6hfow-on.drv.tw
|
2 | docs.google.com | 2 redirects |
2 | doc-0c-18-docs.googleusercontent.com |
1 redirects
oouz5rtzn5j8xw60m6hfow-on.drv.tw
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.googletagmanager.com |
drv.tw
|
1 | drv.tw |
oouz5rtzn5j8xw60m6hfow-on.drv.tw
|
1 | doc-10-9g-docs.googleusercontent.com |
oouz5rtzn5j8xw60m6hfow-on.drv.tw
|
1 | doc-00-9g-docs.googleusercontent.com |
oouz5rtzn5j8xw60m6hfow-on.drv.tw
|
17 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.drv.tw R3 |
2021-10-14 - 2022-01-12 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/vooii.html
Frame ID: 4C85EFA1641E5A837B57C3BD8C993D85
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/jquery.min.js.download HTTP 302
- https://drive.google.com/uc?id=1iiDwBzyBCegEs4Xf7pI67EKY-aVHvTl2 HTTP 302
- https://doc-00-9g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/tkci5rbd60c6g48vh07803cclvl5rn5s/1636564500000/05412943563525816870/*/1iiDwBzyBCegEs4Xf7pI67EKY-aVHvTl2
- https://oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/bootstrap.min.js(1).download HTTP 302
- https://drive.google.com/uc?id=1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB HTTP 302
- https://doc-0c-18-docs.googleusercontent.com/docs/securesc/d689mgeg9sqahiigghqmt24bp8vk66pb/3eps1996pu4krcufaoap0rjk4qnn1pea/1636564500000/05412943563525816870/12756095120657146158Z/1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB HTTP 302
- https://docs.google.com/nonceSigner?nonce=dg9qbqo86hlvm&continue=https://doc-0c-18-docs.googleusercontent.com/docs/securesc/d689mgeg9sqahiigghqmt24bp8vk66pb/3eps1996pu4krcufaoap0rjk4qnn1pea/1636564500000/05412943563525816870/12756095120657146158Z/1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB&hash=45l725jlvb8a3biarrplfloas3a22n55 HTTP 302
- https://doc-0c-18-docs.googleusercontent.com/docs/securesc/d689mgeg9sqahiigghqmt24bp8vk66pb/3eps1996pu4krcufaoap0rjk4qnn1pea/1636564500000/05412943563525816870/12756095120657146158Z/1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB?nonce=dg9qbqo86hlvm&user=10679399477457801901Z&hash=vj12ur88et5snfkm55u2pa1bgn2de2n7
- https://oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/jquery.session.min.js.download HTTP 302
- https://drive.google.com/uc?id=1ItuUWxr5zxfLYncFb2_j4vMO3rr2pp_X HTTP 302
- https://doc-10-9g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/6188o0gut7jjf672b3g96sd1glk8vnq8/1636564500000/05412943563525816870/*/1ItuUWxr5zxfLYncFb2_j4vMO3rr2pp_X
- https://oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/bootstrap.min.js(1).download HTTP 302
- https://drive.google.com/uc?id=1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB HTTP 302
- https://doc-10-3c-docs.googleusercontent.com/docs/securesc/tt6u79va50p593bv408qhv23qjbefuh5/1clb0jg1a3gbbgrluf56btdu19kvhic7/1636564500000/05412943563525816870/10679399477457801901Z/1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB HTTP 302
- https://docs.google.com/nonceSigner?nonce=krmqojpd3909s&continue=https://doc-10-3c-docs.googleusercontent.com/docs/securesc/tt6u79va50p593bv408qhv23qjbefuh5/1clb0jg1a3gbbgrluf56btdu19kvhic7/1636564500000/05412943563525816870/10679399477457801901Z/1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB&hash=qnj2h9mb4lj3e5amb4hu82lieg6dtpc5 HTTP 302
- https://doc-10-3c-docs.googleusercontent.com/docs/securesc/tt6u79va50p593bv408qhv23qjbefuh5/1clb0jg1a3gbbgrluf56btdu19kvhic7/1636564500000/05412943563525816870/10679399477457801901Z/1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB?nonce=krmqojpd3909s&user=10679399477457801901Z&hash=jjt3k9roiuk8rdo6a07l08pijjidqm0a
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
vooii.html
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hover.css
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/ |
118 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nHk7jPxa3hr-DRk2opAFo-ib.png
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js.download
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/ |
68 KB 68 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js.download
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/ |
19 KB 19 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js.download
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/asse/ |
48 KB 48 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1iiDwBzyBCegEs4Xf7pI67EKY-aVHvTl2
doc-00-9g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/tkci5rbd60c6g48vh07803cclvl5rn5s/1636564500000/05412943563525816870/*/ Redirect Chain
|
84 KB 84 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB
doc-0c-18-docs.googleusercontent.com/docs/securesc/d689mgeg9sqahiigghqmt24bp8vk66pb/3eps1996pu4krcufaoap0rjk4qnn1pea/1636564500000/05412943563525816870/12756095120657146158Z/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1ItuUWxr5zxfLYncFb2_j4vMO3rr2pp_X
doc-10-9g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/6188o0gut7jjf672b3g96sd1glk8vnq8/1636564500000/05412943563525816870/*/ Redirect Chain
|
2 KB 5 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pll.js
oouz5rtzn5j8xw60m6hfow-on.drv.tw/peeru/876756tfhgjhkjoi78675645ersfdgchvgjhkjpo78trdf/ |
35 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
drv.tw/inc/ |
365 B 592 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1IUCbZoqfyr1c_cCQq28dkuDi9weWzcOB
doc-10-3c-docs.googleusercontent.com/docs/securesc/tt6u79va50p593bv408qhv23qjbefuh5/1clb0jg1a3gbbgrluf56btdu19kvhic7/1636564500000/05412943563525816870/10679399477457801901Z/ Redirect Chain
|
50 KB 50 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
90 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 220 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 452 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| Popper object| bootstrap object| webkitEventStorage function| AbortSignalRenderer function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.googleusercontent.com/docs/securesc/tt6u79va50p593bv408qhv23qjbefuh5 | Name: AUTH_hj2rrt6lmut8h1ojg2tngv7phqgcqo12 Value: 10679399477457801901Z|1636564500000|ao6shreaaeu9affshkd5672shkh8stkc |
|
.drv.tw/ | Name: uid Value: rBEO6WGL/j87rwIEl4VmAg== |
|
.google.com/ | Name: NID Value: 511=Xknl3UhI8p3T0CwkpkbrN0-1DehQW2afceAErYYroqSq8-TnSAlc-VGKl-czRug3vvg4fE57Xk2KRMKh7RDl5VI4V3u6Cf1eqJQrpF1y1atdsPhrMcuX2wXHiFfti7V6wQcl6KUKKY-o-k24z1js8gLXHusEcFYN_p-esKxsyFo |
|
oouz5rtzn5j8xw60m6hfow-on.drv.tw/ | Name: __session:0.2540201033339704: Value: https: |
|
.drv.tw/ | Name: _ga Value: GA1.2.200075012.1636564548 |
|
.drv.tw/ | Name: _gid Value: GA1.2.1890441349.1636564548 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
doc-00-9g-docs.googleusercontent.com
doc-0c-18-docs.googleusercontent.com
doc-10-3c-docs.googleusercontent.com
doc-10-9g-docs.googleusercontent.com
docs.google.com
drive.google.com
drv.tw
oouz5rtzn5j8xw60m6hfow-on.drv.tw
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
2a00:1450:4001:811::200e
2a00:1450:4001:813::2001
2a00:1450:4001:82a::2008
2a00:1450:4001:82b::200e
2a00:1450:4001:831::200e
2a00:1450:400c:c07::9b
47.89.250.243
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2293a41ea6feb3996225613590403d4be43e79d0f5a6af0a8de8b84b52290167
31ccb91ffa866d8e061ada54bc00a8ee5f098eb8014607eb92f25d3b8a9eab2f
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b04b3959eb58dbf2f6364f3b413837f2e328f8454c0976c3b7417f7452d6023d
d8f36a83159ad91843a83a32b9dd22f55ef1e7031f7e46104d266661d2fbbf84
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c