![](/screenshots/cdaa7afe-cbac-4ab1-995a-1a9ae6774f30.png)
gatewayserver439.z22.web.core.windows.net
Open in
urlscan Pro
20.150.34.1
Malicious Activity!
Public Scan
Submission: On January 25 via manual from IN
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 01 on November 14th 2020. Valid for: a year.
This is the only time gatewayserver439.z22.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 20.150.34.1 20.150.34.1 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
14 28 | 2620:100:6021... 2620:100:6021:15::a27d:410f | 19679 (DROPBOX) (DROPBOX) | |
15 | 2 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
gatewayserver439.z22.web.core.windows.net |
ASN19679 (DROPBOX, US)
dl.dropbox.com | |
dl.dropboxusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
dropboxusercontent.com
dl.dropboxusercontent.com |
144 KB |
14 |
dropbox.com
14 redirects
dl.dropbox.com |
1 KB |
1 |
windows.net
gatewayserver439.z22.web.core.windows.net |
11 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
14 | dl.dropboxusercontent.com |
gatewayserver439.z22.web.core.windows.net
|
14 | dl.dropbox.com | 14 redirects |
1 | gatewayserver439.z22.web.core.windows.net | |
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft RSA TLS CA 01 |
2020-11-14 - 2021-11-14 |
a year | crt.sh |
*.dl.dropboxusercontent.com DigiCert SHA2 High Assurance Server CA |
2020-01-30 - 2022-04-14 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://gatewayserver439.z22.web.core.windows.net/
Frame ID: 28C7F848275E3910F7615B248E479900
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/cdaa7afe-cbac-4ab1-995a-1a9ae6774f30.png)
Detected technologies
![](/vendor/wappa/icons/Microsoft.png)
Detected patterns
- headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://dl.dropbox.com/s/dgic4imayed9tlj/av011.png HTTP 302
- https://dl.dropboxusercontent.com/s/dgic4imayed9tlj/av011.png
- https://dl.dropbox.com/s/g634ic40jmgmxon/bt01.png HTTP 302
- https://dl.dropboxusercontent.com/s/g634ic40jmgmxon/bt01.png
- https://dl.dropbox.com/s/v724tbwpss9wdso/av021.png HTTP 302
- https://dl.dropboxusercontent.com/s/v724tbwpss9wdso/av021.png
- https://dl.dropbox.com/s/akn3lgzlu177nje/av022.png HTTP 302
- https://dl.dropboxusercontent.com/s/akn3lgzlu177nje/av022.png
- https://dl.dropbox.com/s/439iyf2245czbig/bt02.png HTTP 302
- https://dl.dropboxusercontent.com/s/439iyf2245czbig/bt02.png
- https://dl.dropbox.com/s/0k62hg1tw3r0zq9/av031.png HTTP 302
- https://dl.dropboxusercontent.com/s/0k62hg1tw3r0zq9/av031.png
- https://dl.dropbox.com/s/6vxpjb2jo658ip6/bt03.png HTTP 302
- https://dl.dropboxusercontent.com/s/6vxpjb2jo658ip6/bt03.png
- https://dl.dropbox.com/s/rjm9gkkiy0kq3nx/av041.png HTTP 302
- https://dl.dropboxusercontent.com/s/rjm9gkkiy0kq3nx/av041.png
- https://dl.dropbox.com/s/1t8usi83i6wfr7b/bt04.png HTTP 302
- https://dl.dropboxusercontent.com/s/1t8usi83i6wfr7b/bt04.png
- https://dl.dropbox.com/s/sxfkuqgjw49vmg9/av051.png HTTP 302
- https://dl.dropboxusercontent.com/s/sxfkuqgjw49vmg9/av051.png
- https://dl.dropbox.com/s/poxvsb3ava7ti3m/bt05.png HTTP 302
- https://dl.dropboxusercontent.com/s/poxvsb3ava7ti3m/bt05.png
- https://dl.dropbox.com/s/8uf0lnlhhs86b0b/av061.png HTTP 302
- https://dl.dropboxusercontent.com/s/8uf0lnlhhs86b0b/av061.png
- https://dl.dropbox.com/s/oiogxtso70rhxki/bt06.png HTTP 302
- https://dl.dropboxusercontent.com/s/oiogxtso70rhxki/bt06.png
- https://dl.dropbox.com/s/ipu0azjpmggvg42/landing-devices-bg.png HTTP 302
- https://dl.dropboxusercontent.com/s/ipu0azjpmggvg42/landing-devices-bg.png
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
gatewayserver439.z22.web.core.windows.net/ |
11 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av011.png
dl.dropboxusercontent.com/s/dgic4imayed9tlj/ Redirect Chain
|
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt01.png
dl.dropboxusercontent.com/s/g634ic40jmgmxon/ Redirect Chain
|
491 B 734 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av021.png
dl.dropboxusercontent.com/s/v724tbwpss9wdso/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av022.png
dl.dropboxusercontent.com/s/akn3lgzlu177nje/ Redirect Chain
|
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt02.png
dl.dropboxusercontent.com/s/439iyf2245czbig/ Redirect Chain
|
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av031.png
dl.dropboxusercontent.com/s/0k62hg1tw3r0zq9/ Redirect Chain
|
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt03.png
dl.dropboxusercontent.com/s/6vxpjb2jo658ip6/ Redirect Chain
|
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av041.png
dl.dropboxusercontent.com/s/rjm9gkkiy0kq3nx/ Redirect Chain
|
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt04.png
dl.dropboxusercontent.com/s/1t8usi83i6wfr7b/ Redirect Chain
|
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av051.png
dl.dropboxusercontent.com/s/sxfkuqgjw49vmg9/ Redirect Chain
|
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt05.png
dl.dropboxusercontent.com/s/poxvsb3ava7ti3m/ Redirect Chain
|
923 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
av061.png
dl.dropboxusercontent.com/s/8uf0lnlhhs86b0b/ Redirect Chain
|
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt06.png
dl.dropboxusercontent.com/s/oiogxtso70rhxki/ Redirect Chain
|
491 B 620 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
landing-devices-bg.png
dl.dropboxusercontent.com/s/ipu0azjpmggvg42/ Redirect Chain
|
110 KB 111 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dl.dropbox.com
dl.dropboxusercontent.com
gatewayserver439.z22.web.core.windows.net
20.150.34.1
2620:100:6021:15::a27d:410f
0ca9497a9e2c19628ef30c1405a682b5eefab5a38821d35c563642e1e79a62a0
137aa9734d8c02300502944ed1376d395a9f4ba97676e701ed32d07dbbf28be6
24a8a365301768ddcf849160e1342d63b1feae4d5dacb1cb3d608c8cb6fa5994
3fe2e6bec88c9dfda8a8a396ef687309fb6663b5da176f5dce730e44763e298b
590f45556412336488ff1db500b4e34104f30e7161e494992e4d0493a3d06dc6
6bdd77a0448306ef0f6aea95131560c6fc2c81aaa25158bf975c91906616a237
768dd37692da0e49e9652f2905657c90759429f4b94c3e36a5bf5290376fd8cb
9c93e8dbbb882fd57e533f32709d0a28f94e3c7cce2fcaf1729ddc97e61979c3
9cbe5707e809deadfa7ed3791411e22b6fad0a8a9fe2513cc3157eed8909f5a9
a15b29fe61cdf379483582fe360b12868747042fa87bb40b0e9af42ccfd548ee
a609042b1ca43d30d0006c66a1417fea56b42766feeaeba8b20803a43e6dff09
b66a50616923e92b5b89fa4f2ca2f9a0281f5a27845885cf21dd397a0c1abb07
bc1a464cf269178d8c6e77030104427d6a443e56551a248e1ba2dd99e46c4967
bfc52d51178c1fb22377b03c09c8479d611e2afecbeb5d5a34988bbbbb60d08c