![](/screenshots/1f37920a-cd36-4709-89e1-f30313ada03a.png)
s3.us-east-2.amazonaws.com
Open in
urlscan Pro
52.219.96.66
Malicious Activity!
Public Scan
Submission: On May 22 via manual from US
Summary
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on February 27th 2018. Valid for: a year.
This is the only time s3.us-east-2.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dotloop (Real Estate)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.219.96.66 52.219.96.66 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
3 | 54.230.93.159 54.230.93.159 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
7 | 216.58.210.10 216.58.210.10 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 104.17.71.176 104.17.71.176 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 172.217.17.51 172.217.17.51 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 216.58.208.48 216.58.208.48 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 216.58.210.3 216.58.210.3 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 104.17.210.204 104.17.210.204 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
3 | 104.16.250.5 104.16.250.5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 104.17.232.204 104.17.232.204 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 104.17.113.176 104.17.113.176 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 104.17.203.204 104.17.203.204 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 185.60.216.19 185.60.216.19 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
2 | 185.60.216.38 185.60.216.38 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
29 | 14 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3.us-east-2.amazonaws.com
s3.us-east-2.amazonaws.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-159.fra2.r.cloudfront.net
www.dotloop.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f10.1e100.net
fonts.googleapis.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hs-analytics.net |
ASN15169 (GOOGLE - Google LLC, US)
PTR: ams16s29-in-f51.1e100.net
www.snapengage.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s12-in-f48.1e100.net
storage.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f3.1e100.net
fonts.gstatic.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hs-scripts.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
track.hubspot.com | |
forms.hubspot.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hsleadflows.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hsadspixel.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
api.hubapi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
googleapis.com
fonts.googleapis.com storage.googleapis.com |
63 KB |
3 |
hubspot.com
track.hubspot.com forms.hubspot.com |
3 KB |
3 |
gstatic.com
fonts.gstatic.com |
54 KB |
3 |
dotloop.com
www.dotloop.com |
129 KB |
2 |
facebook.com
www.facebook.com |
455 B |
2 |
facebook.net
connect.facebook.net |
26 KB |
2 |
hs-analytics.net
js.hs-analytics.net |
51 KB |
1 |
hubapi.com
api.hubapi.com |
566 B |
1 |
hsadspixel.net
js.hsadspixel.net |
2 KB |
1 |
hsleadflows.net
js.hsleadflows.net |
47 KB |
1 |
hs-scripts.com
js.hs-scripts.com |
1016 B |
1 |
snapengage.com
www.snapengage.com |
449 B |
1 |
amazonaws.com
s3.us-east-2.amazonaws.com |
7 KB |
29 | 13 |
Domain | Requested by | |
---|---|---|
7 | fonts.googleapis.com |
s3.us-east-2.amazonaws.com
|
3 | fonts.gstatic.com |
s3.us-east-2.amazonaws.com
|
3 | www.dotloop.com |
s3.us-east-2.amazonaws.com
|
2 | www.facebook.com | |
2 | connect.facebook.net |
js.hsadspixel.net
connect.facebook.net |
2 | track.hubspot.com | |
2 | js.hs-analytics.net |
s3.us-east-2.amazonaws.com
js.hs-scripts.com |
1 | forms.hubspot.com |
js.hsleadflows.net
|
1 | api.hubapi.com |
js.hsadspixel.net
|
1 | js.hsadspixel.net |
js.hs-scripts.com
|
1 | js.hsleadflows.net |
js.hs-scripts.com
|
1 | js.hs-scripts.com |
js.hs-analytics.net
|
1 | storage.googleapis.com |
s3.us-east-2.amazonaws.com
|
1 | www.snapengage.com |
s3.us-east-2.amazonaws.com
|
1 | s3.us-east-2.amazonaws.com | |
29 | 15 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.us-east-2.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-02-27 - 2019-04-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://s3.us-east-2.amazonaws.com/dot.loop.6gjppnqwr6sdr2207n51/M1ljJOgrYy3a9VeUWSO8qBpRLk4ixlXf3zJ7bBpY/JEU9rPVHrKxNDcYGqO61.htm
Frame ID: 3FAE47F008F4423D8C9FA7F7BC5A643D
Requests: 29 HTTP requests in this frame
Screenshot
![](/screenshots/1f37920a-cd36-4709-89e1-f30313ada03a.png)
Detected technologies
Detected patterns
- headers server /AmazonS3/i
Detected patterns
- script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
![](/vendor/wappa/icons/HubSpot.png)
Detected patterns
- env /^(?:_hsq|hubspot)$/i
Piwik () Expand
Detected patterns
- env /^_paq$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
JEU9rPVHrKxNDcYGqO61.htm
s3.us-east-2.amazonaws.com/dot.loop.6gjppnqwr6sdr2207n51/M1ljJOgrYy3a9VeUWSO8qBpRLk4ixlXf3zJ7bBpY/ |
6 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
home.81449ca89559d59c9f690103d485b1557b8160a7.css
www.dotloop.com/my/static/style/external/main/ |
259 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
1 KB 475 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
223 B 297 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
467208.js
js.hs-analytics.net/analytics/1498606500000/ |
75 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
ServiceGetConfig
www.snapengage.com/chatjs/ |
211 B 449 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
logo.png
www.dotloop.com/my/static/images/external/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1.jpg
storage.googleapis.com/bnvvvhghgv/jzZpKxzfRTgMZNAGVxe8/xWkkeqwLlCjOrktSKSsS/ |
60 KB 61 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
1 KB 384 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
227 B 272 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
236 B 278 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
1021 B 378 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
947 B 364 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mem8YaGs126MiZpBA-UFVZ0e.ttf
fonts.gstatic.com/s/opensans/v15/ |
26 KB 18 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mem5YaGs126MiZpBA-UN7rgOUuhs.ttf
fonts.gstatic.com/s/opensans/v15/ |
28 KB 18 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
icons-global-5.png
www.dotloop.com/my/static/images/sprites/ |
91 KB 91 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mem5YaGs126MiZpBA-UNirkOUuhs.ttf
fonts.gstatic.com/s/opensans/v15/ |
27 KB 18 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
467208.js
js.hs-scripts.com/ |
2 KB 1016 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
__ptq.gif
track.hubspot.com/ |
45 B 219 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
leadflows.js
js.hsleadflows.net/ |
239 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
fb.js
js.hsadspixel.net/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
467208.js
js.hs-analytics.net/analytics/1527019200000/ |
75 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
json
api.hubapi.com/hs-script-loader-public/v1/config/facebook/ |
28 B 566 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
json
forms.hubspot.com/lead-flows-config/v1/config/ |
17 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
fbevents.js
connect.facebook.net/en_US/ |
39 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1521107018212781
connect.facebook.net/signals/config/ |
55 KB 13 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
/
www.facebook.com/tr/ |
44 B 251 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
__ptq.gif
track.hubspot.com/ |
45 B 99 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
/
www.facebook.com/tr/ |
44 B 204 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dotloop (Real Estate)50 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _hsq object| _paq boolean| _hstc_loaded boolean| _hstc_ran number| expireDateTime object| e boolean| HS_FB_PIXEL_RAN function| scheduleCallback function| wrapIfNeeded function| dispatchCallbacks function| removeTransientObserversFor function| forEachAncestorAndObserverEnqueueRecord function| JsMutationObserver function| MutationRecord function| copyMutationRecord function| getRecord function| getRecordWithOldValue function| clearRecords function| recordRepresentsCurrentMutation function| selectRecord function| Registration object| globalRoot undefined| hns undefined| defineProperty undefined| counter undefined| registrationsTable undefined| setImmediate undefined| setImmediateQueue undefined| sentinel undefined| isScheduled undefined| scheduledObservers undefined| uidCounter undefined| currentRecord undefined| recordWithOldValue object| leadflows function| hmerge object| hubspot function| OutpostErrorReporter undefined| hns2 undefined| jade undefined| I18n undefined| hubspot_mailcheck undefined| Pikaday undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN function| fbq function| _fbq boolean| LEAD_FLOW_DOCUMENT_READY_RAN4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
s3.us-east-2.amazonaws.com/ | Name: hubspotutk Value: 5d32aaa0a339108c123f8d7bc7d62655 |
|
s3.us-east-2.amazonaws.com/ | Name: __hssc Value: 110895450.1.1527019228016 |
|
s3.us-east-2.amazonaws.com/ | Name: __hssrc Value: 1 |
|
s3.us-east-2.amazonaws.com/ | Name: __hstc Value: 110895450.5d32aaa0a339108c123f8d7bc7d62655.1527019228015.1527019228015.1527019228015.1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.hubapi.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
js.hs-analytics.net
js.hs-scripts.com
js.hsadspixel.net
js.hsleadflows.net
s3.us-east-2.amazonaws.com
storage.googleapis.com
track.hubspot.com
www.dotloop.com
www.facebook.com
www.snapengage.com
104.16.250.5
104.17.113.176
104.17.203.204
104.17.210.204
104.17.232.204
104.17.71.176
172.217.17.51
185.60.216.19
185.60.216.38
216.58.208.48
216.58.210.10
216.58.210.3
52.219.96.66
54.230.93.159
0782a52179d0e25f19c39b43253795b25787d65abdbd8bfa38be0f21a4512748
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
112560223d7dcf6f78bd1f4f1271590233b6cd02adf7a10f896b0f628c2c4d24
1d02f02429e6d2d5818b91646b4b1fdfe71f4612c0d5b1483db00fe52df8d65d
1d12cb248aa500dc28b99afbdb79961dd9cc64318de27c19f2e2108d438c8eb1
20163153f9d5dced96068ffa32d076700fd466bfdd9b7530ee349bb233ccf07c
43216655c8191d342b605ae86b8b829e626acf2dfac8bb4adbaf165a1f87e074
5ea1d12da7c740903a066196ea3940147dc9a20c163fecd4e1965a88badad514
74461248f0a3edd43acbe67fbd98bb8bc6f26bb6b2e8b948c4757724717bde5c
882ba5aaeb2328300f6c8f75b566530e8db31f2a40dbbb0db0bb7d5e3ec2ca10
8e2b4466935103d89074ddfbf31ba6696490eb1a4b531801bec61c7b228b094e
9105e3935f58d0e3904458a9df47251b3122d936e37beb6f87ceab313a59cb12
927658fe940c899225567ad7885c40a7871dee09c2b9f00d31f7ca62d1f424fc
9501a7f471f64701b1060b46c2c3cdff99c5dce59787b2ec56d789fc62a3f040
a6346f0a204789921bd77bdbdb5817c866b0cfb9327a42b826491b9144c7f0e8
a63b5c4a8b3257715a415780f5f7a0697af464ddd588136e112c322e427e14e4
ab8298ef975e6a1c2fbd7824a5f30b8183b0fd037cc218ce60be083b61ad99ed
c4f576e97b5b3f1078c5139b46e38590ac4ea0713f462cc132787738bbe12d45
c54cd0f9c7c02362804f4452c40d20d9219c0c5d63783a17eebc395ffb1c608e
d327df997a948d0f5553cada162838803da27b1c7c306e94f559000c66b0715b
d419879958ab95d9c3e9080c110c504de3655ab212224a48d4be36fdd168450e
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
eaf544c0ef1c801bec8b961abf5de3f8e3097b60b13137dfcfdbc53c8fe31915
f889a8f799e4d4a7cb4c7a3c6c47fcdea77910607af6cb2ea027a10c8f15aae7
fc64cc98f95b098b127af0923775d7b6ca49251654ff2c1a601914f0679b5f4f
ff2e2cf0618b27aa51cfe4ee44d04f41d238d2cae482ac48113f0dba759bd139