storageapi.fleek.co
Open in
urlscan Pro
2606:4700::6812:791
Malicious Activity!
Public Scan
Effective URL: https://storageapi.fleek.co/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/indexx%20(1).html
Submission: On November 01 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 31st 2022. Valid for: a year.
This is the only time storageapi.fleek.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2600:9000:214... 2600:9000:214f:e00:16:ad5f:7f80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 2 | 44.228.116.46 44.228.116.46 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 103.131.61.194 103.131.61.194 | 138126 (IDNIC-NEW...) (IDNIC-NEWTON-AS-ID PT. NEWTON CIPTA INFORMATIKA) | |
1 3 | 161.35.232.133 161.35.232.133 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2606:4700::68... 2606:4700::6812:791 | () () | |
1 | 2620:1ec:49::44 2620:1ec:49::44 | () () | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200a | () () | |
6 | 6 |
ASN16509 (AMAZON-02, US)
protection.greathorn.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-228-116-46.us-west-2.compute.amazonaws.com
go.mypoints.com |
ASN138126 (IDNIC-NEWTON-AS-ID PT. NEWTON CIPTA INFORMATIKA, ID)
bapenda.bulungan.go.id |
ASN14061 (DIGITALOCEAN-ASN, US)
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
vidaelemental.com
1 redirects
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com |
23 KB |
2 |
mypoints.com
2 redirects
go.mypoints.com — Cisco Umbrella Rank: 243902 |
2 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
msauth.net
aadcdn.msauth.net |
17 KB |
1 |
fleek.co
storageapi.fleek.co |
58 KB |
1 |
bulungan.go.id
bapenda.bulungan.go.id |
933 B |
1 |
greathorn.com
1 redirects
protection.greathorn.com — Cisco Umbrella Rank: 944449 |
848 B |
6 | 7 |
Domain | Requested by | |
---|---|---|
3 | missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com |
1 redirects
bapenda.bulungan.go.id
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com |
2 | go.mypoints.com | 2 redirects |
1 | ajax.googleapis.com |
storageapi.fleek.co
|
1 | aadcdn.msauth.net |
storageapi.fleek.co
|
1 | storageapi.fleek.co |
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com
|
1 | bapenda.bulungan.go.id | |
1 | protection.greathorn.com | 1 redirects |
6 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bapenda.bulungan.go.id R3 |
2022-09-29 - 2022-12-28 |
3 months | crt.sh |
vidaelemental.com R3 |
2022-10-31 - 2023-01-29 |
3 months | crt.sh |
fleek.co Cloudflare Inc ECC CA-3 |
2022-03-31 - 2023-03-30 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2022-08-23 - 2023-08-23 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-09-26 - 2022-12-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://storageapi.fleek.co/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/indexx%20(1).html
Frame ID: 98AF9C44AF3B853C4A2EA395C7ABFE54
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://protection.greathorn.com/services/v2/lookupUrl/9edb03e4-0bb8-46f1-979b-fcd172f55928/1132/7852ac102a23...
HTTP 302
https://go.mypoints.com/?cmd=oh-offer-click&placementID=7950011&hash=942GR166pTs495tgdun3M1wAmlj9D3z... HTTP 302
https://go.mypoints.com/g/shopredir?trkid=p7950011&h=6d96641877f7bdb8ce57cbbe1ec0a48d&merchant=10237... HTTP 302
https://bapenda.bulungan.go.id/c/49764/1480657/4270?af_reengagement_window=30d&c=affiliate_2022&pid=impactr... Page URL
- https://missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com/?username=srogan@janney.com Page URL
-
https://missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com/?username=srogan@janney.com
HTTP 302
https://storageapi.fleek.co/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/indexx%20(1).html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://protection.greathorn.com/services/v2/lookupUrl/9edb03e4-0bb8-46f1-979b-fcd172f55928/1132/7852ac102a2317d5d5b06a7a94ae11ac2de2cc48?domain=go.mypoints.com&path=/
HTTP 302
https://go.mypoints.com/?cmd=oh-offer-click&placementID=7950011&hash=942GR166pTs495tgdun3M1wAmlj9D3zn24T6sMfS&taskID=1125397&redirectlink=&directLink=https%3A%2F%2Fbapenda.bulungan.go.id%2Fc%2F49764%2F1480657%2F4270%3Faf_reengagement_window%3D30d%26c%3Daffiliate_2022%26pid%3Dimpactradius_int%26af_channel%3Daffiliates%26af_siteid%3D49764%26is_retargeting%3Dtrue HTTP 302
https://go.mypoints.com/g/shopredir?trkid=p7950011&h=6d96641877f7bdb8ce57cbbe1ec0a48d&merchant=10237&page=110&finalUrl=https%3A%2F%2Fbapenda.bulungan.go.id%2Fc%2F49764%2F1480657%2F4270%3Faf_reengagement_window%3D30d%26c%3Daffiliate_2022%26pid%3Dimpactradius_int%26af_channel%3Daffiliates%26af_siteid%3D49764%26is_retargeting%3Dtrue&brand=Adidas HTTP 302
https://bapenda.bulungan.go.id/c/49764/1480657/4270?af_reengagement_window=30d&c=affiliate_2022&pid=impactradius_int&af_channel=affiliates&af_siteid=49764&is_retargeting=true&subId1=1466179555&subId2=MP&afsrc=1 Page URL
- https://missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com/?username=srogan@janney.com Page URL
-
https://missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com/?username=srogan@janney.com
HTTP 302
https://storageapi.fleek.co/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/indexx%20(1).html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://protection.greathorn.com/services/v2/lookupUrl/9edb03e4-0bb8-46f1-979b-fcd172f55928/1132/7852ac102a2317d5d5b06a7a94ae11ac2de2cc48?domain=go.mypoints.com&path=/ HTTP 302
- https://go.mypoints.com/?cmd=oh-offer-click&placementID=7950011&hash=942GR166pTs495tgdun3M1wAmlj9D3zn24T6sMfS&taskID=1125397&redirectlink=&directLink=https%3A%2F%2Fbapenda.bulungan.go.id%2Fc%2F49764%2F1480657%2F4270%3Faf_reengagement_window%3D30d%26c%3Daffiliate_2022%26pid%3Dimpactradius_int%26af_channel%3Daffiliates%26af_siteid%3D49764%26is_retargeting%3Dtrue HTTP 302
- https://go.mypoints.com/g/shopredir?trkid=p7950011&h=6d96641877f7bdb8ce57cbbe1ec0a48d&merchant=10237&page=110&finalUrl=https%3A%2F%2Fbapenda.bulungan.go.id%2Fc%2F49764%2F1480657%2F4270%3Faf_reengagement_window%3D30d%26c%3Daffiliate_2022%26pid%3Dimpactradius_int%26af_channel%3Daffiliates%26af_siteid%3D49764%26is_retargeting%3Dtrue&brand=Adidas HTTP 302
- https://bapenda.bulungan.go.id/c/49764/1480657/4270?af_reengagement_window=30d&c=affiliate_2022&pid=impactradius_int&af_channel=affiliates&af_siteid=49764&is_retargeting=true&subId1=1466179555&subId2=MP&afsrc=1
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
4270
bapenda.bulungan.go.id/c/49764/1480657/ Redirect Chain
|
462 B 933 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com/ |
58 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com/ |
204 B 352 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
indexx%20(1).html
storageapi.fleek.co/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/ Redirect Chain
|
298 KB 58 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/ests/2.1/content/images/ |
17 KB 17 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bapenda.bulungan.go.id/c/49764/1480657 | Name: __wpdm_client Value: fa357cb05051a57b30170febc43373d2 |
|
.mypoints.com/ | Name: proson Value: jxC8QGNhE90 |
|
.mypoints.com/ | Name: __appname Value: app12 |
|
.mypoints.com/ | Name: __urqm Value: 22608273~bbe15d916451d96a39a0f305e0003be0~J7zT3LT9WsIN~np |
|
go.mypoints.com/ | Name: AWSALB Value: n1YdDu/UllatXUHY1I2kdMWwgUieNYkPTJ5BHZqsFXguB7twGg/SVaDxGK5oR2cXQFyZtdx7nxk+DcXLX11h3/fjXpeN4cZRP7fPRxj/2kQKMvoB63resPizV7NM |
|
go.mypoints.com/ | Name: AWSALBCORS Value: n1YdDu/UllatXUHY1I2kdMWwgUieNYkPTJ5BHZqsFXguB7twGg/SVaDxGK5oR2cXQFyZtdx7nxk+DcXLX11h3/fjXpeN4cZRP7fPRxj/2kQKMvoB63resPizV7NM |
|
.mypoints.com/ | Name: __urqc Value: b0297e8a-7f6e-4285-bb64-a5b3752286bd |
|
.vidaelemental.com/ | Name: qtkNl7 Value: NzQyZjkxOGEtMGI5ZS00ODY1LThjYmYtNjRkNzI1YzBmZWM5OjMyZDAwMDRkLWFiM2YtNDViZC1iODJmLTE0NzkwNjQxYWU1ZA== |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
ajax.googleapis.com
bapenda.bulungan.go.id
go.mypoints.com
missedcallsandserverlogin-microsoftonlineauthenticator.vidaelemental.com
protection.greathorn.com
storageapi.fleek.co
103.131.61.194
161.35.232.133
2600:9000:214f:e00:16:ad5f:7f80:93a1
2606:4700::6812:791
2620:1ec:49::44
2a00:1450:4001:80e::200a
44.228.116.46
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
31d3843b0649440f135e5cfa1048336cf0a63253b94509635841d9a5858b88a5
6cf799f2f4976f33994548a741b39d05097c35e3c991fb4dc6db5e66f05b4b2b
90355719997bdae64237fba1548abd6a2eb0f4545baa1dd4488e3080af827db5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
aead21a3079667c1fff0eeb76da750014560cf88cff637691fedcb17461c0ff3
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3