urlscan.io logo urlscan.io
SecurityTrails logo

s3.amazonaws.com Open in urlscan Pro
52.217.164.0  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html#blara@bpd.com.do
Effective URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Submission: On August 16 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 52.217.164.0, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
TLS certificate: Issued by Amazon on April 1st 2022. Valid for: a year.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 52.217.164.0 16509 (AMAZON-02)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2 99.86.240.36 16509 (AMAZON-02)
1 52.222.214.46 16509 (AMAZON-02)
5 5
Apex Domain
Subdomains		 Transfer
2 clearbit.com
logo.clearbit.com — Cisco Umbrella Rank: 20622
335 B
2 amazonaws.com
s3.amazonaws.com
100 KB
1 thum.io
image.thum.io — Cisco Umbrella Rank: 288768
24 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 615
83 KB
5 4
Domain Requested by
2 logo.clearbit.com 1 redirects s3.amazonaws.com
2 s3.amazonaws.com s3.amazonaws.com
1 image.thum.io s3.amazonaws.com
1 code.jquery.com s3.amazonaws.com
5 4

This site contains no links.

Subject Issuer Validity Valid
s3.amazonaws.com
Amazon		 2022-04-01 -
2023-03-30		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
thum.io
Amazon		 2021-11-07 -
2022-12-05		 a year crt.sh

This page contains 1 frames:

Primary Page: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Frame ID: 7B6D8E5845FDE956D1F05936F8573CB5
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Webmail Portal Access - bpd.com.do

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

80 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

207 kB
Transfer

421 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://logo.clearbit.com/https://bpd.com.do HTTP 301
  • https://logo.clearbit.com/https:/bpd.com.do

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index%20new.html
s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/ 		100 KB
100 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.164.0 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
46aaac5bdca8f85f0dde0817afc86d72f9c68b91abcc7493ab6308874b0559f4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public,max-age=86400
Content-Length
102235
Content-Type
text/html
Date
Tue, 16 Aug 2022 08:16:32 GMT
ETag
"53a89730c73d7de84209cf647b1a89f3"
Last-Modified
Sun, 14 Aug 2022 19:31:32 GMT
Server
AmazonS3
x-amz-id-2
fReE3x2+poqUILo329MbdgbhANIoppylaY37biEBLLHGTmeHfuJY618SgVgCPHiajEowppTRIV4=
x-amz-meta-app-version
test
x-amz-meta-appname
richkey
x-amz-request-id
6F8RFHEMWAXC88A4
x-amz-server-side-encryption
AES256
x-amz-version-id
bYSPn61p2hlWU_EStaT8zGHpvTR976Xe
jquery-3.5.0.js
code.jquery.com/ 		281 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.0.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
aff01a147aeccc9b70a5efad1f2362fd709f3316296ec460d94aa7d31decdb37

Request headers

Referer
https://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Tue, 16 Aug 2022 08:16:31 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-463a1"
vary
Accept-Encoding
x-hw
1660637791.dop244.fr8.t,1660637791.cds124.fr8.hn,1660637791.cds165.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
84374
jquery-3.6.0.min.js
s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/jquery-3.6.0.min.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.164.0 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Tue, 16 Aug 2022 08:16:31 GMT
Server
AmazonS3
x-amz-request-id
6F8H6KTT12NWHC23
Transfer-Encoding
chunked
x-amz-id-2
UyrPaO1feS2VdYLm6NmOp17B+bCT1cYKLzTaTDNU2SdBUU/i1zwYtIvotKLXk+9wdCN2ioNHrZ0=
Content-Type
application/xml
truncated
/ 		16 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		558 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		520 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/png
bpd.com.do
logo.clearbit.com/https:/
Redirect Chain
  • https://logo.clearbit.com/https://bpd.com.do
  • https://logo.clearbit.com/https:/bpd.com.do
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://logo.clearbit.com/https:/bpd.com.do
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Protocol
H2
Server
99.86.240.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-240-36.vie50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Redirect headers

date
Tue, 16 Aug 2022 06:19:08 GMT
via
1.1 6efe5b6e0a48bab07dc8cc99f7fb58fe.cloudfront.net (CloudFront)
x-content-type-options
nosniff
server
envoy
age
7045
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
Hit from cloudfront
content-type
text/html; charset=utf-8
location
/https:/bpd.com.do
x-amz-cf-pop
VIE50-C1
content-length
53
x-amz-cf-id
7HhaNSIrxl3jKyFxsk4lRTlEkQBl9P_mvgJmzhhmcf6_GZ7i0kEeFw==
bpd.com.do
image.thum.io/get/auth/54029-f0473646bcdd359fbc526d3d0ec8b771/https:// 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image.thum.io/get/auth/54029-f0473646bcdd359fbc526d3d0ec8b771/https://bpd.com.do
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.214.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-46.fra56.r.cloudfront.net
Software
/
Resource Hash
c0758ee30cd0654566f8ffb7d117c2e5a3385309e841ba703d3e0b84bda11020

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 16 Aug 2022 06:19:08 GMT
via
1.1 5626bf35345f32d3e58fb8d33ec4d966.cloudfront.net (CloudFront)
age
7045
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=86400
content-disposition
inline; filename= "bpd.com.do.png"
x-amz-cf-pop
FRA56-P3
thum_status_code
200
x-amz-cf-id
OC1c7PidEtViX-3xqHVNs5iTi3kLjw21OXBnvMZHC3aIYgUcCnIcBQ==
expires
Wed, 17 Aug 2022 06:19:08 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| url string| hash string| hasherror string| email string| error number| count string| my_email number| ind string| my_slice string| mainPage string| sv string| image undefined| msg object| alertt function| showEl function| hideEl

0 Cookies

4 Console Messages

Source Level URL
Text
javascript warning URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.5.0.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/index%20new.html(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.5.0.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://s3.amazonaws.com/appforest_uf/f1660505490734x664811688952246000/jquery-3.6.0.min.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
network error URL: https://logo.clearbit.com/https:/bpd.com.do
Message:
Failed to load resource: the server responded with a status of 404 ()