storage.googleapis.com
Open in
urlscan Pro
2a00:1450:4001:825::2010
Malicious Activity!
Public Scan
Submission: On February 20 via manual from GB
Summary
TLS certificate: Issued by GTS CA 1O1 on January 29th 2020. Valid for: 3 months.
This is the only time storage.googleapis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:1450:400... 2a00:1450:4001:825::2010 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
8 | 31.28.167.86 31.28.167.86 | 15497 (COLOCALL ...) (COLOCALL Internet Data Center _ColoCALL_) | |
1 | 31.28.168.4 31.28.168.4 | 15497 (COLOCALL ...) (COLOCALL Internet Data Center _ColoCALL_) | |
1 | 2a00:1450:400... 2a00:1450:4001:819::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 5 |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
ASN15169 (GOOGLE, US)
ajax.googleapis.com | |
fonts.googleapis.com |
ASN15497 (COLOCALL Internet Data Center _ColoCALL_, UA)
racksmtp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
racksmtp.com
racksmtp.com |
102 KB |
5 |
googleapis.com
storage.googleapis.com ajax.googleapis.com fonts.googleapis.com |
68 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
webpicture.cc
webpicture.cc |
233 KB |
15 | 4 |
Domain | Requested by | |
---|---|---|
8 | racksmtp.com |
ajax.googleapis.com
|
2 | ajax.googleapis.com |
storage.googleapis.com
ajax.googleapis.com |
2 | storage.googleapis.com |
ajax.googleapis.com
|
1 | fonts.gstatic.com | |
1 | webpicture.cc | |
1 | fonts.googleapis.com | |
15 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.storage.googleapis.com GTS CA 1O1 |
2020-01-29 - 2020-04-22 |
3 months | crt.sh |
racksmtp.com Let's Encrypt Authority X3 |
2020-02-14 - 2020-05-14 |
3 months | crt.sh |
webpicture.cc Let's Encrypt Authority X3 |
2020-02-14 - 2020-05-14 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-01-29 - 2020-04-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://storage.googleapis.com/asharepoint-limequat-939454772/index.html
Frame ID: BAE8B40B8D4C096CDD8CF2AAA9662D17
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
storage.googleapis.com/asharepoint-limequat-939454772/ |
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-home.html
storage.googleapis.com/asharepoint-limequat-939454772/ |
5 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
racksmtp.com/email-list/sharepoint/sp3/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
one-logo.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aol.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
outlook.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
other.png
racksmtp.com/email-list/sharepoint/sp3/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
12 KB 950 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
other-email-bg.jpg
webpicture.cc/email-list/sharepoint/sp3/images/ |
232 KB 233 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| GetURLParameter function| window_opener_xc function| get_extra_data0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
racksmtp.com
storage.googleapis.com
webpicture.cc
2a00:1450:4001:808::200a
2a00:1450:4001:819::2003
2a00:1450:4001:825::2010
31.28.167.86
31.28.168.4
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
19c4cfdc396e560ce905899d7c0c97b6c557aa2911b16f011fcc3b6897b971d7
318d6043fcb074ce096db3a7deef33be7c88e1710fb825e1f3764ca355ad6a34
4539c658d6cdfa7332e46c22f9ba4c89e51f84700b67c84d1907a318f428bbfa
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5f689b96634dec6f633fe62259331181a6defcaee60618dcdaa6b2b96a817732
6134fd5e7e24e1ead516241b963409e6d74cc0e4df4562367c2599c47e30c69b
684fd90b448e4af72ab01622a7ae9df6f50638117311f6fb380b0bc3a3e34c2c
84e6ba10a3ea0dbddf004cdd014b1621c5fe8a7065a3f15271307272befea438
8a9a0ae9093196d7f14e8bd459d93c15e84b3cbd6da01d990ab08098baedc714
8d16d7fccc95a170e245c84e0243a1cbf82e992c5833459579e609b493b46562
9c88ac05bfcc327e381d3aa0d1ff0565473e09d3a7948006b2db3b871bc366dc
a50c23dca077f72587e2975a70fb6d399453e2e0bfef82318fbdff6c3feeb148
ca398c3ed99c4884fc8a7f91bf899efe80c25cd11f67b6c66c1aee428d85e25e