f000.backblazeb2.com
Open in
urlscan Pro
104.153.233.177
Malicious Activity!
Public Scan
Effective URL: https://f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-dmoain-number-server-...
Submission: On November 30 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 29th 2020. Valid for: 3 months.
This is the only time f000.backblazeb2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 2 | 199.231.164.114 199.231.164.114 | 29802 (HVC-AS) (HVC-AS) | |
2 | 104.153.233.177 104.153.233.177 | 32354 (UNWIRED) (UNWIRED) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:1634 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 145.239.131.60 145.239.131.60 | 16276 (OVH) (OVH) | |
1 | 2606:4700::68... 2606:4700::6810:125e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2606:4700:e6:... 2606:4700:e6::ac40:ca1c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 10 |
ASN29802 (HVC-AS, US)
PTR: 199-231-164-114.static.hvvc.us
matter.pk |
ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com | |
stackpath.bootstrapcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
ibb.co
i.ibb.co |
202 KB |
5 |
fontawesome.com
kit.fontawesome.com ka-f.fontawesome.com |
21 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com stackpath.bootstrapcdn.com |
34 KB |
2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
30 KB |
2 |
backblazeb2.com
f000.backblazeb2.com |
182 KB |
2 |
matter.pk
1 redirects
matter.pk |
603 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
bit.ly
1 redirects
bit.ly |
255 B |
23 | 9 |
Domain | Requested by | |
---|---|---|
9 | i.ibb.co |
matter.pk
f000.backblazeb2.com |
4 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | f000.backblazeb2.com |
matter.pk
|
2 | matter.pk | 1 redirects |
1 | stackpath.bootstrapcdn.com |
matter.pk
|
1 | cdnjs.cloudflare.com |
matter.pk
|
1 | kit.fontawesome.com |
matter.pk
|
1 | fonts.googleapis.com |
matter.pk
|
1 | maxcdn.bootstrapcdn.com |
matter.pk
|
1 | code.jquery.com |
matter.pk
|
1 | ajax.googleapis.com |
matter.pk
|
1 | bit.ly | 1 redirects |
23 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
backblazeb2.com Let's Encrypt Authority X3 |
2020-09-29 - 2020-12-28 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2020-11-13 - 2021-12-14 |
a year | crt.sh |
ibb.co Let's Encrypt Authority X3 |
2020-10-02 - 2020-12-31 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-dmoain-number-server-linux-maxutf-uuid-no-12335412312/login.html?fnigw=zuTmJLTzjMphTFHHZ&ebyegx=y7lsLjW1mxk6g9ownM7oJ&otuu=XJL66Aga8P7SEde&enthj=kQWEUHi8hFPGg4urZnea37DOWi&qygwdqboep=56B6dizhlhCVxA6ZOiHMsQAGa&xpeht=Hg7zj7LQoPGL7ylhXgER5L
Frame ID: 0E8628FD9222124FC2EF660FA525AF89
Requests: 21 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://bit.ly/37c2iox
HTTP 301
http://matter.pk/lookmen/redirect HTTP 301
http://matter.pk/lookmen/redirect/ Page URL
- https://f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-d... Page URL
- https://f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-d... Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/37c2iox
HTTP 301
http://matter.pk/lookmen/redirect HTTP 301
http://matter.pk/lookmen/redirect/ Page URL
- https://f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-dmoain-number-server-linux-maxutf-uuid-no-12335412312/index.html Page URL
- https://f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-dmoain-number-server-linux-maxutf-uuid-no-12335412312/login.html?fnigw=zuTmJLTzjMphTFHHZ&ebyegx=y7lsLjW1mxk6g9ownM7oJ&otuu=XJL66Aga8P7SEde&enthj=kQWEUHi8hFPGg4urZnea37DOWi&qygwdqboep=56B6dizhlhCVxA6ZOiHMsQAGa&xpeht=Hg7zj7LQoPGL7ylhXgER5L Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bit.ly/37c2iox HTTP 301
- http://matter.pk/lookmen/redirect HTTP 301
- http://matter.pk/lookmen/redirect/
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
matter.pk/lookmen/redirect/ Redirect Chain
|
234 B 397 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.html
f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-dmoain-number-server-linux-maxutf-uuid-no-12335412312/ |
75 KB 76 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.html
f000.backblazeb2.com/file/web-data-storage-lcatioon-1/web-data-server-uid-space-cloud-loctation-dmoain-number-server-linux-maxutf-uuid-no-12335412312/ |
106 KB 107 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 544 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ |
10 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
i.ibb.co/h7q2f7Z/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.png
i.ibb.co/Yhh7K8m/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.png
i.ibb.co/tpjqg7Z/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
i.ibb.co/TPMPkS4/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.png
i.ibb.co/jkNWTxk/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.png
i.ibb.co/vJb3hYL/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9.png
i.ibb.co/7pycyZk/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmail.png
i.ibb.co/6RPmLj8/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.1/css/ |
0 0 |
Other
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.1/css/ |
0 0 |
Other
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.1/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.1/css/ |
26 KB 4 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
i.ibb.co/MN5BJkk/ |
65 KB 66 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Dropbox (Consumer)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _0x2d1f function| _0x48f8 object| Zlib function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bit.ly
cdnjs.cloudflare.com
code.jquery.com
f000.backblazeb2.com
fonts.googleapis.com
i.ibb.co
ka-f.fontawesome.com
kit.fontawesome.com
matter.pk
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
104.153.233.177
145.239.131.60
199.231.164.114
2001:4de0:ac19::1:b:2a
2001:4de0:ac19::1:b:2b
2606:4700::6810:125e
2606:4700::6812:1634
2606:4700:e6::ac40:ca1c
2a00:1450:4001:809::200a
2a00:1450:4001:820::200a
67.199.248.10
043af73afad9c3cb08fd3508b8d80dd77502230d2157204e6c76b02fbedaf70e
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
21f54475b1f9a3d64aa6b488ce9ecdb61b1dec95b43a15b484b4ca6c43e0ee83
2641774a75edf22f36ae246a5ae426c1497e0827018f458323b34d9260d35994
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
2c8416aa9bddd7c6d65f2b74abf012f2667d14f360812a369c3b170073d757b9
3b43e570605c2f6da13819b28abd440e336c73eb52b808463f7cebf283b70137
49a86a41fbf82937721790486c81c5f9a44791ae01c57341a92aff405df4ed7a
4f02bd6f018d6f08c37c39f2d114101beac342c2c065046635e5ed0c42853590
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6bd91cfa6c06d582d808173123d28694c25f779cd5c3ea4b9254b12370dc0daa
704e83d712675ef5372b082bc11dce00c8e498836b383c4514099ba5e0b9f833
71f1650f5d522e8483138d1086aaae8d17b89630923bd61eab377c4077943954
835e090b62233f9d990c703cefa880a957a4434ca980649bb6f4568576541a5a
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
89aefc0d984e5d5395d065627fdd87cc435a7749d71bc9e665b5c49d4cf5616a
8efbbe5cfd01e0a6f702535306359e34808218072a35307183d3d18053cec70f
9b754423be69dea3e01679cc64def1f161cf0760c5893bc65182e1b1ed16adca
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
cfff9ea502195a7b96fe38deca9188a59b758deeecc2cd4e78aea7d911e638c6
f25557bee2901b8016fab7613f082eab60f505325b24a8f053002146a296db65