scenicview.online
Open in
urlscan Pro
54.230.93.128
Malicious Activity!
Public Scan
Submission Tags: 6058864
Submission: On May 28 via api from US
Summary
TLS certificate: Issued by Amazon on May 27th 2019. Valid for: a year.
This is the only time scenicview.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Correo Uruguayo (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 54.230.93.128 54.230.93.128 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:817::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
12 | 2 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-128.fra2.r.cloudfront.net
scenicview.online |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
scenicview.online
scenicview.online |
218 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
11 | scenicview.online |
scenicview.online
|
1 | ajax.googleapis.com |
scenicview.online
|
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
landscaped.online Amazon |
2019-05-27 - 2020-06-27 |
a year | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-05-07 - 2019-07-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://scenicview.online/ab11/uy/ipx/lp6/index.html?sxid=5d2sh0bk5h6a&cid=ur42072d3380c511e9b6bc125ad29b416aab2e47ea5f034a758df8fb3dcca966600385897840fbdca2dd&c=0.023060&target=xray-arb-2uWSlDcX&domain=&vt=NON-ADULT&i=ANTEL&s=wheaten-goose&creative_number=3
Frame ID: 4AC9B018CBED2CFF7A9339933E466E9D
Requests: 12 HTTP requests in this frame
Screenshot
Detected technologies
Amazon S3 (Miscellaneous) ExpandDetected patterns
- headers server /AmazonS3/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
scenicview.online/ab11/uy/ipx/lp6/ |
137 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.4/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
scenicview.online/ab11/uy/ipx/lp6/ |
0 0 |
Stylesheet
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
top_l.png
scenicview.online/ab11/uy/ipx/lp6/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_mark1.png
scenicview.online/ab11/uy/ipx/lp6/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gift.gif
scenicview.online/ab11/uy/ipx/lp6/ |
21 KB 22 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s.png
scenicview.online/ab11/uy/ipx/lp6/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_mark3.png
scenicview.online/ab11/uy/ipx/lp6/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
top_r.png
scenicview.online/ab11/uy/ipx/lp6/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-new.png
scenicview.online/ab11/uy/ipx/lp6/ |
129 KB 129 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
29e5d4862f0470607f803d462bddf5f14cf57969.png
scenicview.online/ab11/uy/ipx/lp6/ |
243 B 243 B |
Image
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
profiles.jpg
scenicview.online/ab11/uy/ipx/lp6/ |
20 KB 20 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Correo Uruguayo (Transportation)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| tellme object| mydate number| year number| day number| month number| daym object| dayarray object| montharray function| getURLParameter string| tmphash object| par number| parl number| vibr string| timers string| tdmnf string| isp string| brand object| dayNames object| monthNames object| now number| count number| counter function| hidemodal01 function| hidemodal02 number| pz0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
scenicview.online
2a00:1450:4001:817::200a
54.230.93.128
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
304367ccfe2510d20b4bf46d4f6a159eee23770d367a2c8135b220cd89569641
3888663dd84f0c638de77d6fb74df9a76b4fbbb059a5d3b3678153663befc1d0
389212287e4c1b54139609476a3d05e590491c8595bcc9290f4b10903abed2f4
4029d90fceb0191bf03b2ccbe28cea09b87dfaeaca8cf396a5990a62cc3053d0
437c4e376171dbafa24d8130019a1617054fab1a4c60b8956e9ed6093aae2e3e
462463734f5652263b3bd995813f584515ed3400d59ba19e04c0fce20b8ef60e
4cdfdb1301d3d2c30a88cc6683062ce0f38867d5b62c4cb704855df748abc0ac
ac771224e3c42f1965b781652989a8d61d6b918940e7e07d6a7140bc8d7a31ff
b75a55881f07db50a2f3c418db07214a7721df61205e3165ae72a8e847013315
e42cb656b03b2fdbed0dbd7c9af665c0f1e48dd75e7078ff8193df2980587e0c