gothic-depth-276417.uc.r.appspot.com Open in urlscan Pro
2a00:1450:4001:802::2014 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://gothic-depth-276417.uc.r.appspot.com/home.html
Submission: On July 09 via api (July 9th 2020, 5:35:45 pm UTC) from TW

Summary HTTP 10 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 2a00:1450:4001:802::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is gothic-depth-276417.uc.r.appspot.com.

This is the only time gothic-depth-276417.uc.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:802::2014	15169 (GOOGLE) (GOOGLE)
3	2a02:26f0:f1:... 2a02:26f0:f1:188::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.16.186.18 2.16.186.18	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba28	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2.16.186.25 2.16.186.25	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:10c... 2a02:26f0:10c:381::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	6

1 2a00:1450:4001:802::2014 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

gothic-depth-276417.uc.r.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:f1:188::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.18 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-18.deploy.static.akamaitechnologies.com

statics-marketingsites-eus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba28 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.16.186.25 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-25.deploy.static.akamaitechnologies.com

spoprod-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:381::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	microsoft.com www.microsoft.com	46 KB
2	s-microsoft.com c.s-microsoft.com	63 KB
2	akamaihd.net spoprod-a.akamaihd.net	22 KB
2	akamaized.net statics-marketingsites-eus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net	5 KB
1	appspot.com gothic-depth-276417.uc.r.appspot.com	37 KB
10	5

	Domain	Requested by
3	www.microsoft.com	gothic-depth-276417.uc.r.appspot.com
2	c.s-microsoft.com	gothic-depth-276417.uc.r.appspot.com
2	spoprod-a.akamaihd.net	gothic-depth-276417.uc.r.appspot.com
1	img-prod-cms-rt-microsoft-com.akamaized.net	gothic-depth-276417.uc.r.appspot.com
1	statics-marketingsites-eus-ms-com.akamaized.net	gothic-depth-276417.uc.r.appspot.com
1	gothic-depth-276417.uc.r.appspot.com
10	6

This site contains links to these domains. Also see Links.

Domain
products.office.com
www.microsoft.com
support.microsoft.com
onedrive.live.com
outlook.live.com
www.skype.com
www.onenote.com
www.xbox.com
azure.microsoft.com
visualstudio.microsoft.com
developer.microsoft.com
docs.microsoft.com
signup.live.com
go.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://gothic-depth-276417.uc.r.appspot.com/home.html
Frame ID: 66D9D5475C52C73686F2D04B7762FD1D
Requests: 9 HTTP requests in this frame

Frame: https://www.microsoft.com/store/buy/cartcount
Frame ID: A3242015D866E662FA46485AE01C220D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Google App Engine (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /Google Frontend/i

Page Statistics

10
Requests

90 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

174 kB
Transfer

435 kB
Size

0
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://products.office.com/EN/home
Title: Office

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/windows/
Title: Windows

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/
Title: Support

Search URL Search Domain Scan URL

URL: https://onedrive.live.com/about/en-pk/
Title: OneDrive

Search URL Search Domain Scan URL

URL: https://outlook.live.com/owa/
Title: Outlook

Search URL Search Domain Scan URL

URL: https://www.skype.com/en/
Title: Skype

Search URL Search Domain Scan URL

URL: https://www.onenote.com/
Title: OneNote

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/windows/devices
Title: PCs & tablets

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/accessories/en-us
Title: Accessories

Search URL Search Domain Scan URL

URL: https://www.xbox.com/ur-PK/
Title: Xbox games

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/store/games/windows?icid=TopNavWindowsGames
Title: Windows digital games

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/
Title: Microsoft Azure

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/dynamics365/home
Title: Microsoft Dynamics 365

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/microsoft-365
Title: Microsoft 365

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/enterprise
Title: Microsoft Industry

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/sql-server/
Title: Data platform

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/net/
Title: .NET

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/cloud-platform/windows-server
Title: Windows Server

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us
Title: Docs

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/download/default.aspx
Title: Free downloads & security

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/education?icid=CNavMSCOML0_Studentsandeducation
Title: Education

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/sitemap.aspx
Title: View Sitemap

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/store/buy
Title: 0

Search URL Search Domain Scan URL

URL: http://www.microsoft.com/en-us/locale.aspx
Title: English

Search URL Search Domain Scan URL

URL: https://signup.live.com/signup.aspx?id=250206&wreply=https%3a%2f%2fonedrive.live.com%2f%3fgologin%3d1%26su%3d1&cp=2&rx=https%3a%2f%2fonedrive.live.com%3a443%2fabout%2fen-pk%2f&mkt=en-PK&lw=1&fl=easi2&wsucxt=2
Title: Create a Microsoft account

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkId=786655
Title: See plans and pricing

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://www.microsoft.com/store/buy/cartcount HTTP 307
https://www.microsoft.com/store/buy/cartcount

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request home.html Show response
gothic-depth-276417.uc.r.appspot.com/ 174 KB
37 KB 156ms
121ms Document
text/html 2a00:1450:4001:802::2014
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://gothic-depth-276417.uc.r.appspot.com/home.html
Protocol: HTTP/1.1
Server: 2a00:1450:4001:802::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 3481a2cf6c188d90a958ae6ead6becec99575d1194d7f9a0390c68bda4dd8244

Request headers

Host: gothic-depth-276417.uc.r.appspot.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 09 Jul 2020 17:35:25 GMT
Expires: Thu, 09 Jul 2020 17:45:25 GMT
ETag: "-DRfOg"
X-Cloud-Trace-Context: 72a7f47fe2901f9bc5c90d13e40e1b39
Content-Type: text/html
Content-Encoding: gzip
Server: Google Frontend
Cache-Control: public, max-age=600
Content-Length: 37168
Age: 0

GET
H2 200 9a-d5f843
www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/ 146 KB
20 KB 57ms
35ms Stylesheet
text/css 2a02:26f0:f1:188::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0

Requested by

Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:f1:188::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

533dfe29ffec7d95269af84eeef90d23acca773475c46e97e2dbbbc53ce338fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://gothic-depth-276417.uc.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 81c40fe8df3d6e48b8999f4f0d875d93
date: Thu, 09 Jul 2020 17:35:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-07-09T13:48:06
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: c18c3f74-4f02-4686-b3ec-11cc8bcf1938
tls_version: tls1.2
x-s1: 2020-07-09T13:48:05
ms-cv: HYdIZZp52UW6CgGu.0
vary: Accept-Encoding
content-length: 19633
x-xss-protection: 1; mode=block
last-modified: Thu, 09 Jul 2020 13:48:05 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-07-02T04:43:40.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31522314
timing-allow-origin: *
x-appversion: 1.0.7487.37310
expires: Fri, 09 Jul 2021 13:47:19 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-eus-ms-com.akamaized.net/statics/ 1 KB
907 B 135ms
37ms Stylesheet
text/css 2.16.186.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.18 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-18.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: http://gothic-depth-276417.uc.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Thu, 09 Jul 2020 17:35:26 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: ad6b2b0a-f01e-0073-7eb6-407ac9000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 29ms
6ms Image
image/png 2a02:26f0:6c00::210:ba28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:6c00::210:ba28 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: http://gothic-depth-276417.uc.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Thu, 09 Jul 2020 17:35:25 GMT
x-source-length: 4054
status: 200
x-activityid: b7654231-4964-42e1-9431-0e2b8ee22898
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-length: 4054
last-modified: Mon, 06 Jul 2020 09:56:40 GMT
x-datacenter: NorthEU
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=145275
x-instance: Resizer.Web_IN_0
timing-allow-origin: *
expires: Sat, 11 Jul 2020 09:56:40 GMT

GET
H2 200 hero_devices.svg
spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/ 19 KB
19 KB 143ms
47ms Image
image/svg+xml 2.16.186.25
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/hero_devices.svg
Requested by: Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.25 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-25.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 687738f7d943a2e5d33eab6a13ae98357a9fe9400f5991a69b08caa4b5e56bf6

Request headers

Referer: http://gothic-depth-276417.uc.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 Jul 2020 17:35:26 GMT
content-md5: YMQYFZNEhnld4HATrDjx5A==
status: 200
content-length: 19396
x-ms-lease-status: unlocked
last-modified: Fri, 06 Dec 2019 16:58:48 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D77A6D906E0E73
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c5753bfd-201e-0043-5ca2-41373b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29047381
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2

200

cartcount
www.microsoft.com/store/buy/ Frame A324
Redirect Chain

http://www.microsoft.com/store/buy/cartcount
https://www.microsoft.com/store/buy/cartcount

0
0

35ms
34ms

Document
text/html

2a02:26f0:f1:188::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/store/buy/cartcount

Requested by

Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:f1:188::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /store/buy/cartcount
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://gothic-depth-276417.uc.r.appspot.com/home.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://gothic-depth-276417.uc.r.appspot.com/home.html

Response headers

status: 200
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
x-activity-id: 4468fef1-65ed-4ec3-bea8-2ae5a89ad799
ms-cv: PJMXZilGKkySy3xX.0
x-appversion: 1.0.7460.7038
x-az: {did:0f33282e4311401e958b35fb1cb65e20, rid: 49, sn: onestore-neu-prod, dt: 2020-06-21T09:19:36.6149496Z, bt: 2020-06-04T03:54:36.0000000Z}
ms-operation-id: 9a5d4d92e4f9c54689cef024228d5dfd
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-content-type-options: nosniff
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
x-xss-protection: 1; mode=block
content-length: 398
cache-control: max-age=85314
expires: Fri, 10 Jul 2020 17:17:20 GMT
date: Thu, 09 Jul 2020 17:35:26 GMT
vary: Accept-Encoding
tls_version: tls1.2
strict-transport-security: max-age=31536000
x-rtag: Str

Redirect headers

Location: https://www.microsoft.com/store/buy/cartcount
Non-Authoritative-Reason: HSTS

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 74ms
9ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
Origin: http://gothic-depth-276417.uc.r.appspot.com

Response headers

date: Thu, 09 Jul 2020 17:35:26 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "588d483e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=370909
accept-ranges: bytes
content-length: 34052
expires: Tue, 14 Jul 2020 00:37:15 GMT

GET
H2 200 hero_clouds.svg
spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/ 2 KB
3 KB 93ms
90ms Image
image/svg+xml 2.16.186.25
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/hero_clouds.svg
Requested by: Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.25 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-25.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: eb51a597fd72d38d2fdd80d471ef69bbf68c1420dac1fbd4290e8fab654c8769

Request headers

Referer: http://gothic-depth-276417.uc.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 Jul 2020 17:35:26 GMT
content-md5: NKQ/419p4luEKhxaXpLQ8w==
status: 200
content-length: 2518
x-ms-lease-status: unlocked
last-modified: Fri, 06 Dec 2019 16:58:48 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D77A6D906DE75C
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: be8da30d-f01e-0101-1791-3e5a7a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=28710213
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 47ms
28ms Font
application/font-woff 2a02:26f0:f1:188::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:f1:188::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
Origin: http://gothic-depth-276417.uc.r.appspot.com

Response headers

ms-operation-id: 588b128e7354724d8b7117f3dc123198
date: Thu, 09 Jul 2020 17:35:26 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: cae7e3f7-cff9-4bc5-a8aa-1b308dd93b6c
tls_version: tls1.2
ms-cv: jbPaQc8zYE2JpeqB.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Fri, 01 Nov 2019 08:35:05 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2019-10-26T07:31:04.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=9817237
x-appversion: 1.0.7237.42332
expires: Sat, 31 Oct 2020 08:36:03 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 29 KB
30 KB 9ms
9ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by: Host: gothic-depth-276417.uc.r.appspot.com
URL: http://gothic-depth-276417.uc.r.appspot.com/home.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
Origin: http://gothic-depth-276417.uc.r.appspot.com

Response headers

date: Thu, 09 Jul 2020 17:35:26 GMT
last-modified: Fri, 10 Jan 2020 19:09:42 GMT
etag: "83cce83e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=392279
accept-ranges: bytes
content-length: 30132
expires: Tue, 14 Jul 2020 06:33:25 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) OneDrive (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| autoredirect undefined| orgLogin undefined| msaLogin

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.s-microsoft.com
gothic-depth-276417.uc.r.appspot.com
img-prod-cms-rt-microsoft-com.akamaized.net
spoprod-a.akamaihd.net
statics-marketingsites-eus-ms-com.akamaized.net
www.microsoft.com
2.16.186.18
2.16.186.25
2a00:1450:4001:802::2014
2a02:26f0:10c:381::356e
2a02:26f0:6c00::210:ba28
2a02:26f0:f1:188::356e
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
3481a2cf6c188d90a958ae6ead6becec99575d1194d7f9a0390c68bda4dd8244
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
533dfe29ffec7d95269af84eeef90d23acca773475c46e97e2dbbbc53ce338fc
687738f7d943a2e5d33eab6a13ae98357a9fe9400f5991a69b08caa4b5e56bf6
eb51a597fd72d38d2fdd80d471ef69bbf68c1420dac1fbd4290e8fab654c8769

gothic-depth-276417.uc.r.appspot.com Open in urlscan Pro 2a00:1450:4001:802::2014 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

67 %IPv6

5 Domains

6 Subdomains

6 IPs

2 Countries

174 kBTransfer

435 kBSize

0 Cookies

28 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

gothic-depth-276417.uc.r.appspot.com Open in urlscan Pro
2a00:1450:4001:802::2014 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

174 kB
Transfer

435 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!