filesconnect.cloud Open in urlscan Pro
44.227.238.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMD...
Submission: On October 04 via manual (October 4th 2022, 4:04:34 pm UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 44.227.238.106, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is filesconnect.cloud.
TLS certificate: Issued by R3 on September 29th 2022. Valid for: 3 months.

This is the only time filesconnect.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
10	44.227.238.106 44.227.238.106	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:10e... 2a02:26f0:10e:296::35c1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	2

10 44.227.238.106 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-227-238-106.us-west-2.compute.amazonaws.com

filesconnect.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10e:296::35c1 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	filesconnect.cloud filesconnect.cloud	38 KB
1	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 20917	2 KB
11	2

	Domain	Requested by
10	filesconnect.cloud	filesconnect.cloud
1	secure.aadcdn.microsoftonline-p.com	filesconnect.cloud
11	2

This site contains no links.

Subject Issuer	Validity	Valid
filesconnect.cloud R3	`2022-09-29` - `2022-12-28`	3 months	crt.sh
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 02	`2021-11-18` - `2022-11-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Frame ID: FBB2C10265C14428E01209129D4475AA
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

verify your credentials

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

40 kB
Transfer

131 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request verify Show response
filesconnect.cloud/O%20V%206/page/ 19 KB
7 KB 2648ms
2057ms Document
text/html 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 1bf61d556b67f1c25c73e51415a7bbba74f74824eafd9797f4418764f84fcc59

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 04 Oct 2022 16:04:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: openresty
vary: Accept-Encoding
x-cache: BYPASS
x-service: pixie-cpanel
x-turbo-charged-by: LiteSpeed

GET
H2 200 style.css
filesconnect.cloud/O%20V%206/page/css/ 94 KB
15 KB 180ms
179ms Stylesheet
text/css 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://filesconnect.cloud/O%20V%206/page/css/style.css
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 1cf4b3ad7abf3189e78c1b3bd07308c92a03fa795fdbc5821fcde24030cfead0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
content-encoding: br
last-modified: Thu, 22 Sep 2022 17:07:36 GMT
server: openresty
vary: Accept-Encoding
x-cache: BYPASS
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 15157
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H/1.1 200
OK microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ 4 KB
2 KB 138ms
19ms Image
image/svg+xml 2a02:26f0:10e:296::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd

Requested by

Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10e:296::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Tue, 04 Oct 2022 16:04:29 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000
Last-Modified: Sat, 18 May 2019 23:35:05 GMT
Content-MD5: nzaLxFgP7ZB3dfMcaybWzw==
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=156324
Connection: keep-alive
Content-Length: 1435

GET
H2 200 sigin2.png
filesconnect.cloud/O%20V%206/page/images/ 1 KB
2 KB 339ms
337ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/sigin2.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 52437f983f1667f1d4043ea60d89e5f0f38acd4ca794eb77585b714490fbcea1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:42 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 1439
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 firstmsg1.png
filesconnect.cloud/O%20V%206/page/images/ 8 KB
8 KB 337ms
336ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/firstmsg1.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: f7bb8c87c9ab76081f182ccf8fbebd8d43da4e9b94cdbcaedfd2697c057c61ba

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:40 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 7833
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 noacc.png
filesconnect.cloud/O%20V%206/page/images/ 2 KB
2 KB 339ms
337ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/noacc.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 37b9fc582daf62db4435d5e57a767e9f66de99e8f9d138c7376b3c7c59a2e7be

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:42 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 1589
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 cantacces.png
filesconnect.cloud/O%20V%206/page/images/ 1 KB
2 KB 184ms
183ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/cantacces.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 8f5537fcea8ad9835744175e3e6f04e5999c8fe1b98a032b7ffe8e1ce9835e58

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:38 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 1510
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 sigopt.png
filesconnect.cloud/O%20V%206/page/images/ 1023 B
1 KB 339ms
338ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/sigopt.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 45bcfbb3d06eacae315e8f641dfcfa11af31da7d6a8e3dc002f00cbe193708e9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:42 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1023
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 ellipsis_grey.svg
filesconnect.cloud/O%20V%206/page/images/ 915 B
501 B 337ms
336ms Image
image/svg+xml 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/ellipsis_grey.svg
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
content-encoding: br
last-modified: Thu, 22 Sep 2022 17:07:40 GMT
server: openresty
vary: Accept-Encoding
x-cache: BYPASS
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 223
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 putmail.png
filesconnect.cloud/O%20V%206/page/images/ 607 B
847 B 181ms
180ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/putmail.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 4e50e37d29c6a3c1f0f1ae57cb0ccb78d2c2f518ad53d8df37f3baae76e9c08a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:42 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 607
expires: Tue, 11 Oct 2022 16:04:29 GMT

GET
H2 200 continue.png
filesconnect.cloud/O%20V%206/page/images/ 495 B
735 B 179ms
179ms Image
image/png 44.227.238.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://filesconnect.cloud/O%20V%206/page/images/continue.png
Requested by: Host: filesconnect.cloud
URL: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.227.238.106 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-227-238-106.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: 97a4488434a10d406081498268d1c4452209922cf1c5802134ad9d3693c41112

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://filesconnect.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi80ODI1NjZmOWI3NGIzNGNlMDA0ZGIzMGNhMjA3ZGI1OTcwZTNiNGI4MDQxMDIxNzAxMDQwOTNjYTJlMTc0ZTdhZjYwZWMwZWQ0YzU4YWMxZmJmY2E3ZjgwNjVlMmM4MDQxMDIxNzAxMDQwOTMwNDYzMGVlMTcyZWFmZjI4YWVkZjhlYzM5Y2ViY2M1MDNiZjgyZDljMDQxMDIxNzAxMDQwOTM3N2RlYzgxMzdhNjcwZDVkMTBhOGQ5MTYwMTNlZmM0OTRmOTIyMzA5MDQxMDIxNzAxMDQwOTMvcGFnZS92ZXJpZnk=cX4Wkrvp-rJ1G-1x7k-1LFU-a93GHnwFWxAY_wy2uDg0Khd3s8W6BNxq5fFot74bclCkmGjiMVU9rvepZSHOE1zmeg3LciG2uQp610wvfo9MqnhKU8Jx5DjTlCbPXVzrRdA7EkHNSoLki8yTVRPfvFUz9AB7lnmpuZa0XbWh32qeCNH14KstSOJD5Qj&status=putuser
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 16:04:29 GMT
last-modified: Thu, 22 Sep 2022 17:07:40 GMT
server: openresty
x-cache: BYPASS
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
x-service: pixie-cpanel
accept-ranges: bytes
content-length: 495
expires: Tue, 11 Oct 2022 16:04:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			filesconnect.cloud/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2898c86ba3a8534c49e4adf2e8d6f947

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

filesconnect.cloud
secure.aadcdn.microsoftonline-p.com
2a02:26f0:10e:296::35c1
44.227.238.106
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
1bf61d556b67f1c25c73e51415a7bbba74f74824eafd9797f4418764f84fcc59
1cf4b3ad7abf3189e78c1b3bd07308c92a03fa795fdbc5821fcde24030cfead0
37b9fc582daf62db4435d5e57a767e9f66de99e8f9d138c7376b3c7c59a2e7be
45bcfbb3d06eacae315e8f641dfcfa11af31da7d6a8e3dc002f00cbe193708e9
4e50e37d29c6a3c1f0f1ae57cb0ccb78d2c2f518ad53d8df37f3baae76e9c08a
52437f983f1667f1d4043ea60d89e5f0f38acd4ca794eb77585b714490fbcea1
8f5537fcea8ad9835744175e3e6f04e5999c8fe1b98a032b7ffe8e1ce9835e58
97a4488434a10d406081498268d1c4452209922cf1c5802134ad9d3693c41112
f7bb8c87c9ab76081f182ccf8fbebd8d43da4e9b94cdbcaedfd2697c057c61ba

filesconnect.cloud Open in urlscan Pro 44.227.238.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

40 kBTransfer

131 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

34 JavaScript Global Variables

1 Cookies

Indicators

filesconnect.cloud Open in urlscan Pro
44.227.238.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

40 kB
Transfer

131 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!