storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:818::2010  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 50app.htm Show response storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/	89 KB 90 KB	430ms 417ms	Document text/html	2a00:1450:4001:818::2010 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 2613297637f1c4fdb3d9cbfa6434cfc25c3651ac5e89e62c533fee49836613ba Request headers :method GET :authority storage.googleapis.com :scheme https :path /50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 x-guploader-uploadid AEnB2UrDHgOtroRmlfDKmQh-r-kwIFXZythWzDiS4zWxcxa0oD30HuJoNGSWkfRrXS3CenulOjj8YcivvSX7ZyIIlKK9dWC74Q expires Wed, 26 Feb 2020 08:57:19 GMT date Wed, 26 Feb 2020 07:57:19 GMT cache-control public, max-age=3600 last-modified Wed, 19 Feb 2020 09:06:48 GMT etag "3dc07dce9e726c7e31f199f62332aceb" x-goog-generation 1582103208654734 x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-stored-content-length 91537 content-type text/html x-goog-hash crc32c=QsJg8w== md5=PcB9zp5ybH4x8Zn2IzKs6w== x-goog-storage-class STANDARD accept-ranges bytes content-length 91537 server UploadServer alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H/1.1	200 OK	style.css adfs.kiwacompany.com/adfs/portal/css/	21 KB 21 KB	127ms 33ms	Stylesheet text/css	23.101.74.106 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://adfs.kiwacompany.com/adfs/portal/css/style.css?id=B504CDBD4DFA77BAA638DE804032565A761ED0A14C4EFDD650B124A12E5C63A0 Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.101.74.106 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash 838963b33cff0c5fe540aa29bd5268881fe6077efde821c1adbd67d607db4f81 Request headers Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Wed, 26 Feb 2020 07:57:20 GMT Server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 Content-Type text/css ETag B504CDBD4DFA77BAA638DE804032565A761ED0A14C4EFDD650B124A12E5C63A0 Content-Length 21669 Expires Fri, 27 Mar 2020 07:57:20 GMT
GET H2	200	okta-login-page.min.f2d34f4f1005894f76211debc41e459a.css dentsuaegis.okta-emea.com/assets/loginpage/css/	178 KB 35 KB	141ms 74ms	Stylesheet text/css	52.58.255.168 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dentsuaegis.okta-emea.com/assets/loginpage/css/okta-login-page.min.f2d34f4f1005894f76211debc41e459a.css Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.255.168 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-255-168.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 2db302f683343cfb742ba979146e931c3a0b3fa686447b1cc34423222bd549b7 Security Headers Name Value Strict-Transport-Security max-age=315360000 Request headers Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 26 Feb 2020 07:57:20 GMT content-encoding gzip last-modified Tue, 17 Dec 2019 01:12:02 GMT server nginx access-control-allow-origin * etag W/"f2d34f4f1005894f76211debc41e459a" vary Accept-Encoding public-key-pins-report-only pin-sha256="1UeprJ9h9qxsp8wLsHzaro/ikoTS/AieY2Eikb3Jz4M="; pin-sha256="pNVPNqc6wAQJLD9AGqxoZIUfOm5TE9qQPCgwngkx+CI="; pin-sha256="8lDSJN+U6Dh5Aex7H16VdOM7QZH1xgU2kCzi8foplGw="; pin-sha256="bf8XR/FlNtQkWPn5Gq2lxK59ETzRJ2p3zcF0SOlPY30="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly" status 200 cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 strict-transport-security max-age=315360000 content-type text/css expires Thu, 25 Feb 2021 07:57:20 GMT
GET H2	200	initLoginPage.pack.479dd4e1fce2ee689a0b388b9bf57159.js Show response dentsuaegis.okta-emea.com/assets/js/mvc/loginpage/	1 MB 414 KB	148ms 89ms	Script application/javascript	52.58.255.168 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dentsuaegis.okta-emea.com/assets/js/mvc/loginpage/initLoginPage.pack.479dd4e1fce2ee689a0b388b9bf57159.js Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.255.168 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-255-168.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash cc0fbf132291d540415f55e41b34e58bbb32e762628fa084f7542b19688e8760 Security Headers Name Value Strict-Transport-Security max-age=315360000 Request headers Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Origin https://storage.googleapis.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 26 Feb 2020 07:57:20 GMT content-encoding gzip last-modified Tue, 17 Dec 2019 01:11:56 GMT server nginx access-control-allow-origin * etag W/"479dd4e1fce2ee689a0b388b9bf57159" vary Accept-Encoding public-key-pins-report-only pin-sha256="1UeprJ9h9qxsp8wLsHzaro/ikoTS/AieY2Eikb3Jz4M="; pin-sha256="pNVPNqc6wAQJLD9AGqxoZIUfOm5TE9qQPCgwngkx+CI="; pin-sha256="8lDSJN+U6Dh5Aex7H16VdOM7QZH1xgU2kCzi8foplGw="; pin-sha256="bf8XR/FlNtQkWPn5Gq2lxK59ETzRJ2p3zcF0SOlPY30="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly" status 200 cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 strict-transport-security max-age=315360000 content-type application/javascript expires Thu, 25 Feb 2021 07:57:20 GMT
GET H2	200	office365.4d711d1fe185fdc7fce851dd80cbf15d.png dentsuaegis.okta-emea.com/assets/img/logos/	3 KB 3 KB	83ms 25ms	Image image/png	52.58.255.168 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://dentsuaegis.okta-emea.com/assets/img/logos/office365.4d711d1fe185fdc7fce851dd80cbf15d.png Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.255.168 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-255-168.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash a08cd808a2eb95f330728db82226d2f77173d27f99d65d32f9000114945a86f4 Security Headers Name Value Strict-Transport-Security max-age=315360000 Request headers Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 26 Feb 2020 07:57:20 GMT last-modified Tue, 08 Jan 2019 19:04:51 GMT server nginx access-control-allow-origin * etag "4d711d1fe185fdc7fce851dd80cbf15d" strict-transport-security max-age=315360000 public-key-pins-report-only pin-sha256="1UeprJ9h9qxsp8wLsHzaro/ikoTS/AieY2Eikb3Jz4M="; pin-sha256="pNVPNqc6wAQJLD9AGqxoZIUfOm5TE9qQPCgwngkx+CI="; pin-sha256="8lDSJN+U6Dh5Aex7H16VdOM7QZH1xgU2kCzi8foplGw="; pin-sha256="bf8XR/FlNtQkWPn5Gq2lxK59ETzRJ2p3zcF0SOlPY30="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly" status 200 cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes content-type image/png content-length 2678 expires Thu, 25 Feb 2021 07:57:20 GMT
GET H/1.1	200 OK	8867.Microsoft_5F00_Logo_2D00_for_2D00_screen.jpg blogs.microsoft.com/wp-content/uploads/2012/08/	589 KB 590 KB	393ms 373ms	Image image/jpeg	192.237.225.141 RACKSPACE
General Check archive.org Show headers Download Go to Show image Full URL http://blogs.microsoft.com/wp-content/uploads/2012/08/8867.Microsoft_5F00_Logo_2D00_for_2D00_screen.jpg Requested by Host: storage.googleapis.com URL: https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Protocol HTTP/1.1 Server 192.237.225.141 San Antonio, United States, ASN19994 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash c6201b38dbd27def1c71266ddb396c47113c84138e8cbce12822425693f4ad0e Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type AppendBlob Date Wed, 26 Feb 2020 07:57:20 GMT x-ms-copy-progress 603054/603054 x-ms-copy-source https://msblogs.blob.core.windows.net:443/prod/2012/08/8867.Microsoft_5F00_Logo_2D00_for_2D00_screen.jpg?sv=2017-04-17&sr=b&sig=ZgYb%2fyx8RcLYbtfLsrMCzgn2t8h4Wzd5ml75NDH2GwM%3d&se=2019-01-14T21%3a38%3a27Z&sp=r&api-version=2017-04-17 Connection keep-alive Content-Length 603054 x-ms-lease-state available x-ms-lease-status unlocked Last-Modified Mon, 07 Jan 2019 21:38:28 GMT Server nginx x-ms-blob-committed-block-count 1 ETag "0x8D674E87606249E" x-ms-copy-completion-time Mon, 07 Jan 2019 21:38:28 GMT Content-Type image/jpeg x-ms-request-id a0e70b12-401e-007a-4b7a-ec9bf5000000 Cache-Control max-age=315360000 x-ms-version 2014-02-14 x-ms-copy-id 3c66c1d4-47a6-4622-a218-2db89ae2260c x-ms-copy-status success Accept-Ranges bytes Keep-Alive timeout=20 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	iframe.html login.okta.com/discovery/ Frame 6C11	0 0	102ms 22ms	Document text/html	143.204.202.34 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://login.okta.com/discovery/iframe.html Requested by Host: dentsuaegis.okta-emea.com URL: https://dentsuaegis.okta-emea.com/assets/js/mvc/loginpage/initLoginPage.pack.479dd4e1fce2ee689a0b388b9bf57159.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.34 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-34.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Host login.okta.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm Response headers Content-Type text/html Content-Length 546 Connection keep-alive Last-Modified Thu, 09 Jan 2020 20:55:35 GMT Server AmazonS3 Date Tue, 25 Feb 2020 13:54:29 GMT ETag "ba966ef1e20f80a6bc3f7ca5b8a9e168" X-Cache Hit from cloudfront Via 1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA53-C1 X-Amz-Cf-Id Go46VUbjXGYGikaHmGSlu0DGJ3Y5azxgi1DYS4cqPlFlYpJkItqHbA== Age 64972
GET H2	200	wfKy3rD.jpg i.imgur.com/	221 KB 221 KB	72ms 24ms	Image image/jpeg	151.101.12.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/wfKy3rD.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash dae1dd4c9f81f6ae7a92974a903d67ba081b9bd5cd28f91788854ca25fb81f9e Request headers Referer https://storage.googleapis.com/50n_oequest-client-id2c1750d9-e03e-4839-98be-dc60a3270uc60a3299/50app.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 26 Feb 2020 07:57:21 GMT age 1805203 x-cache HIT, HIT status 200 content-length 226300 x-served-by cache-bwi5128-BWI, cache-fra19136-FRA last-modified Wed, 15 Aug 2018 18:53:14 GMT server cat factory 1.0 x-timer S1582703842.838522,VS0,VE1 etag "57659bc26a88c37cbbe4f3d1b112bf59" access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-amz-storage-class STANDARD_IA x-cache-hits 1, 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| okta function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login function| runLoginPage object| OktaLogin object| jQBrowser function| jQueryCourage object| Backbone object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://dentsuaegis.okta-emea.com/assets/js/mvc/loginpage/initLoginPage.pack.479dd4e1fce2ee689a0b388b9bf57159.js(Line 117) Message: [okta-auth-sdk] WARN: This browser doesn't support localStorage. Switching to sessionStorage.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adfs.kiwacompany.com
blogs.microsoft.com
dentsuaegis.okta-emea.com
i.imgur.com
login.okta.com
storage.googleapis.com
143.204.202.34
151.101.12.193
192.237.225.141
23.101.74.106
2a00:1450:4001:818::2010
52.58.255.168
2613297637f1c4fdb3d9cbfa6434cfc25c3651ac5e89e62c533fee49836613ba
2db302f683343cfb742ba979146e931c3a0b3fa686447b1cc34423222bd549b7
838963b33cff0c5fe540aa29bd5268881fe6077efde821c1adbd67d607db4f81
a08cd808a2eb95f330728db82226d2f77173d27f99d65d32f9000114945a86f4
c6201b38dbd27def1c71266ddb396c47113c84138e8cbce12822425693f4ad0e
cc0fbf132291d540415f55e41b34e58bbb32e762628fa084f7542b19688e8760
dae1dd4c9f81f6ae7a92974a903d67ba081b9bd5cd28f91788854ca25fb81f9e