dpuploadserver8223.z24.web.core.windows.net
Open in
urlscan Pro
52.239.216.1
Malicious Activity!
Public Scan
Effective URL: https://dpuploadserver8223.z24.web.core.windows.net/
Submission: On April 13 via manual from US
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 01 on March 5th 2021. Valid for: a year.
This is the only time dpuploadserver8223.z24.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a03:b0c0:3:d... 2a03:b0c0:3:d0::d23:e001 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 52.239.216.1 52.239.216.1 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
8 16 | 2620:100:6021... 2620:100:6021:15::a27d:410f | 19679 (DROPBOX) (DROPBOX) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
16 | 7 |
ASN14061 (DIGITALOCEAN-ASN, US)
dropboxuploadserver-2031cc.netlify.app |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dpuploadserver8223.z24.web.core.windows.net |
ASN19679 (DROPBOX, US)
dl.dropbox.com | |
dl.dropboxusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
dropboxusercontent.com
dl.dropboxusercontent.com |
79 KB |
8 |
dropbox.com
8 redirects
dl.dropbox.com |
1 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
36 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
windows.net
dpuploadserver8223.z24.web.core.windows.net |
12 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
netlify.app
dropboxuploadserver-2031cc.netlify.app |
441 B |
16 | 7 |
Domain | Requested by | |
---|---|---|
8 | dl.dropboxusercontent.com |
dpuploadserver8223.z24.web.core.windows.net
dl.dropboxusercontent.com |
8 | dl.dropbox.com | 8 redirects |
2 | maxcdn.bootstrapcdn.com |
dpuploadserver8223.z24.web.core.windows.net
|
1 | ajax.googleapis.com |
dpuploadserver8223.z24.web.core.windows.net
|
1 | dpuploadserver8223.z24.web.core.windows.net |
dropboxuploadserver-2031cc.netlify.app
|
1 | code.jquery.com |
dropboxuploadserver-2031cc.netlify.app
|
1 | dropboxuploadserver-2031cc.netlify.app | |
16 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.dropbox.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.netlify.app DigiCert TLS RSA SHA256 2020 CA1 |
2021-02-24 - 2022-02-27 |
a year | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
*.web.core.windows.net Microsoft RSA TLS CA 01 |
2021-03-05 - 2022-03-05 |
a year | crt.sh |
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-01-19 - 2022-02-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-01 - 2022-02-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-03-16 - 2021-06-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dpuploadserver8223.z24.web.core.windows.net/
Frame ID: C2132CF8241AD70CCAE3EACB4C71F204
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://dropboxuploadserver-2031cc.netlify.app/
HTTP 307
https://dropboxuploadserver-2031cc.netlify.app/ Page URL
- https://dpuploadserver8223.z24.web.core.windows.net/ Page URL
Detected technologies
Netlify (Web Servers) ExpandDetected patterns
- headers server /^Netlify/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Try Dropbox Business
Search URL Search Domain Scan URL
Title: Download the app
Search URL Search Domain Scan URL
Title: Dropbox
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://dropboxuploadserver-2031cc.netlify.app/
HTTP 307
https://dropboxuploadserver-2031cc.netlify.app/ Page URL
- https://dpuploadserver8223.z24.web.core.windows.net/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://dropboxuploadserver-2031cc.netlify.app/ HTTP 307
- https://dropboxuploadserver-2031cc.netlify.app/
- https://dl.dropbox.com/s/iyph1sp6n9karsz/login_or_register-vflAJk0Kd.css HTTP 302
- https://dl.dropboxusercontent.com/s/iyph1sp6n9karsz/login_or_register-vflAJk0Kd.css
- https://dl.dropbox.com/s/c3wnon2zes3ra1d/base-vflequooz.css HTTP 302
- https://dl.dropboxusercontent.com/s/c3wnon2zes3ra1d/base-vflequooz.css
- https://dl.dropbox.com/s/167c10jxugzyukm/font_atlas_grotesk-vfldINMge.css HTTP 302
- https://dl.dropboxusercontent.com/s/167c10jxugzyukm/font_atlas_grotesk-vfldINMge.css
- https://dl.dropbox.com/s/zy865wtegesilce/login_or_register-vflZ9ry5P.css HTTP 302
- https://dl.dropboxusercontent.com/s/zy865wtegesilce/login_or_register-vflZ9ry5P.css
- https://dl.dropbox.com/s/sxedeas0tuit0nc/css.css HTTP 302
- https://dl.dropboxusercontent.com/s/sxedeas0tuit0nc/css.css
- https://dl.dropbox.com/s/qwlet5piu38cx70/dropbox_logo_glyph_2015_m1.svg HTTP 302
- https://dl.dropboxusercontent.com/s/qwlet5piu38cx70/dropbox_logo_glyph_2015_m1.svg
- https://dl.dropbox.com/s/lc9bq7jjmwxta2g/dropbox_logo_text_2015_m1.svg HTTP 302
- https://dl.dropboxusercontent.com/s/lc9bq7jjmwxta2g/dropbox_logo_text_2015_m1.svg
- https://dl.dropbox.com/s/hz65ril3606724c/sign-in-boulder-vfl2oGV4v.png HTTP 302
- https://dl.dropboxusercontent.com/s/hz65ril3606724c/sign-in-boulder-vfl2oGV4v.png
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
dropboxuploadserver-2031cc.netlify.app/ Redirect Chain
|
213 B 441 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
dpuploadserver8223.z24.web.core.windows.net/ |
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_or_register-vflAJk0Kd.css
dl.dropboxusercontent.com/s/iyph1sp6n9karsz/ Redirect Chain
|
1 KB 569 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base-vflequooz.css
dl.dropboxusercontent.com/s/c3wnon2zes3ra1d/ Redirect Chain
|
23 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font_atlas_grotesk-vfldINMge.css
dl.dropboxusercontent.com/s/167c10jxugzyukm/ Redirect Chain
|
2 KB 1002 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_or_register-vflZ9ry5P.css
dl.dropboxusercontent.com/s/zy865wtegesilce/ Redirect Chain
|
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
dl.dropboxusercontent.com/s/sxedeas0tuit0nc/ Redirect Chain
|
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/ |
59 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dropbox_logo_glyph_2015_m1.svg
dl.dropboxusercontent.com/s/qwlet5piu38cx70/ Redirect Chain
|
314 B 384 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dropbox_logo_text_2015_m1.svg
dl.dropboxusercontent.com/s/lc9bq7jjmwxta2g/ Redirect Chain
|
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sign-in-boulder-vfl2oGV4v.png
dl.dropboxusercontent.com/s/hz65ril3606724c/ Redirect Chain
|
67 KB 68 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Medium-webfont-vflGvvuWg.woff2
dl.dropboxusercontent.com/static/fonts/roboto/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Medium-webfont-vflmx1vK6.ttf
dl.dropboxusercontent.com/static/fonts/roboto/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dl.dropboxusercontent.com
- URL
- https://dl.dropboxusercontent.com/static/fonts/roboto/Roboto-Medium-webfont-vflGvvuWg.woff2
- Domain
- dl.dropboxusercontent.com
- URL
- https://dl.dropboxusercontent.com/static/fonts/roboto/Roboto-Medium-webfont-vflmx1vK6.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
code.jquery.com
dl.dropbox.com
dl.dropboxusercontent.com
dpuploadserver8223.z24.web.core.windows.net
dropboxuploadserver-2031cc.netlify.app
maxcdn.bootstrapcdn.com
dl.dropboxusercontent.com
2001:4de0:ac18::1:a:1a
2606:4700::6812:acf
2620:100:6021:15::a27d:410f
2a00:1450:4001:800::200a
2a03:b0c0:3:d0::d23:e001
52.239.216.1
11dbfbfe0600ee2ef8d7d9dc0e37dc5ca1c1f865ec527576b1596ffdc1475df4
1683bf67bf7e9ed81d1b1d42e95f3c58d7c292e0e20e88b101f7dde8ce3a9799
5455e6c9958e8476a848aa2f9eb3afa3fd58819c6d68e4e1e2f7557f57aaba1a
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6ae62cd87949feb085e901e1beaee9f3d2f9f34da2ee835f315b56e772eaac9c
72863dacbd76512a770f8914ed3f46fa8c8ea967ce3505efd79b1733e0a15d37
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
953355434379fb10cb2c01eaa17b5357f71291b368fe0c107f91ff453a2c0913
ada476bd3f81aeea547d596df2ea963aa72d1e48d863a79e9c1833733c456dd0
e23236278ed4084bbe91dafe7b103ba49d5c1208f54a38317e3eaba142638a82
f486dd244f3bae8a006758b411a1b19799d4b23aff2c360ec7b7b72c187deaa3
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc042d8391718824e68421b2af41de0485b6df247e9314e50f52ad7254daa15d