394878548754877834874587-secondary.z19.web.core.windows.net Open in urlscan Pro
52.239.156.97 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://394878548754877834874587-secondary.z19.web.core.windows.net/#contact@phenocell.com
Effective URL:
https://394878548754877834874587-secondary.z19.web.core.windows.net/
Submission: On December 16 via automatic, source phishtank (December 16th 2020, 4:19:00 pm UTC)

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 4 domains to perform 7 HTTP transactions. The main IP is 52.239.156.97, located in Boydton, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is 394878548754877834874587-secondary.z19.web.core.windows.net.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on November 9th 2020. Valid for: a year.

This is the only time 394878548754877834874587-secondary.z19.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AWS (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	52.239.156.97 52.239.156.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	52.217.97.228 52.217.97.228	16509 (AMAZON-02) (AMAZON-02)
2	52.46.159.144 52.46.159.144	16509 (AMAZON-02) (AMAZON-02)
1	13.226.157.122 13.226.157.122	16509 (AMAZON-02) (AMAZON-02)
7	5

1 52.239.156.97 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

394878548754877834874587-secondary.z19.web.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.217.97.228 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

aws-signin-website-assets.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.159.144 (Ashburn, United States)

ASN16509 (AMAZON-02, US)

signin.aws.amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.157.122 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-157-122.dus51.r.cloudfront.net

d1.awsstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	amazonaws.com aws-signin-website-assets.s3.amazonaws.com	406 KB
2	amazon.com signin.aws.amazon.com	30 KB
1	awsstatic.com d1.awsstatic.com	61 KB
1	windows.net 394878548754877834874587-secondary.z19.web.core.windows.net	142 KB
7	4

	Domain	Requested by
3	aws-signin-website-assets.s3.amazonaws.com	394878548754877834874587-secondary.z19.web.core.windows.net
2	signin.aws.amazon.com	394878548754877834874587-secondary.z19.web.core.windows.net
1	d1.awsstatic.com	394878548754877834874587-secondary.z19.web.core.windows.net
1	394878548754877834874587-secondary.z19.web.core.windows.net
7	4

This site contains no links.

Subject Issuer	Validity	Valid
*.web.core.windows.net Microsoft RSA TLS CA 01	`2020-11-09` - `2021-11-09`	a year	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2021-03-12`	a year	crt.sh
us-east-1.signin.aws Amazon	`2020-08-18` - `2021-08-10`	a year	crt.sh
d1.awsstatic.com Amazon	`2020-08-02` - `2021-09-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://394878548754877834874587-secondary.z19.web.core.windows.net/
Frame ID: 316E358A8AF26738AF3610A32E234925
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

1
Countries

638 kB
Transfer

638 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
394878548754877834874587-secondary.z19.web.core.windows.net/ 141 KB
142 KB 595ms
142ms Document
text/html 52.239.156.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.156.97 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 81517fb3d42a3fc5cf136de03a24877fad0ccc66ea5b67008ed8105b4f1c3ae4

Request headers

Host: 394878548754877834874587-secondary.z19.web.core.windows.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 144863
Content-Type: text/html
Content-MD5: f98opGbgDHHePU9l4XUfJQ==
Last-Modified: Wed, 16 Dec 2020 11:44:17 GMT
Accept-Ranges: bytes
ETag: "0x8D8A1B7EB62A845"
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 77886c21-701e-00e7-36c7-d31b36000000
x-ms-version: 2018-03-28
Date: Wed, 16 Dec 2020 16:18:42 GMT

GET
H/1.1 200
OK components.css
aws-signin-website-assets.s3.amazonaws.com/css/ 383 KB
383 KB 418ms
124ms Stylesheet
text/css 52.217.97.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aws-signin-website-assets.s3.amazonaws.com/css/components.css
Requested by: Host: 394878548754877834874587-secondary.z19.web.core.windows.net
URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.97.228 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d13820cdf75388b299511df5691dd2d6cb2be9c6b879e30f0af767201e6d124e

Request headers

Referer: https://394878548754877834874587-secondary.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 16:18:45 GMT
Last-Modified: Mon, 22 May 2017 20:25:50 GMT
Server: AmazonS3
x-amz-request-id: E25A97506EC3793D
ETag: "9ecf865cb4b2b9b391ee4e28aac21a53"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 392094
x-amz-id-2: tfq572sG7m/Tdi5mTA6y3bUUKsBl9dd32NrmkA+aFw1CL3sRdubwHBbV29EAx55xCT8vRRh9io0=

GET
H/1.1 200
OK grid.css
aws-signin-website-assets.s3.amazonaws.com/css/ 18 KB
19 KB 407ms
112ms Stylesheet
text/css 52.217.97.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aws-signin-website-assets.s3.amazonaws.com/css/grid.css
Requested by: Host: 394878548754877834874587-secondary.z19.web.core.windows.net
URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.97.228 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 295437df86381a56ae94b2a5491f916167b1f85db261f4ac2f53111973c09f15

Request headers

Referer: https://394878548754877834874587-secondary.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 16:18:45 GMT
Last-Modified: Mon, 22 May 2017 20:25:50 GMT
Server: AmazonS3
x-amz-request-id: 32353D00D424F04B
ETag: "b94a1f2171b7563e9403ddf1cffb045c"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 18743
x-amz-id-2: grlrQ1TodIZpspY9+vMhyaa9at33IdWOFBNzzmiHDZZoXyFOrseQngBX6qpDSOUHFi87A2r8uzk=

GET
H/1.1 200
OK utilities.css
aws-signin-website-assets.s3.amazonaws.com/css/ 3 KB
4 KB 407ms
113ms Stylesheet
text/css 52.217.97.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aws-signin-website-assets.s3.amazonaws.com/css/utilities.css
Requested by: Host: 394878548754877834874587-secondary.z19.web.core.windows.net
URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.97.228 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0b1e68b1025d14dce1b3c8cf22e6d3e73ce099bc1ec98e3c11857db320f166fb

Request headers

Referer: https://394878548754877834874587-secondary.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 16:18:45 GMT
Last-Modified: Mon, 22 May 2017 20:25:49 GMT
Server: AmazonS3
x-amz-request-id: 9102533354B4A8A2
ETag: "75e112c677b7f08468951efc500ca09a"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 3548
x-amz-id-2: 2fKQ0T1Llxma7CRzWEUFobwKQTdczUjT+WRnHIV99mGdR3hii9iSHHvyPrJz2kQjEoLLM5/0YwI=

GET
H/1.1 200
OK aws-signin.css
signin.aws.amazon.com/static/css/ 25 KB
27 KB 395ms
100ms Stylesheet
text/css 52.46.159.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.aws.amazon.com/static/css/aws-signin.css

Requested by

Host: 394878548754877834874587-secondary.z19.web.core.windows.net
URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_CBC

Server

52.46.159.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

7a737084bd5a4661430f762340fe06a8ccd231b2e300afcfc88601cf6ac0f4e2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none' https://aws.amazon.com https://.signin.aws.amazon.com https://signin.aws.amazon.com 'unsafe-inline'; img-src 'self' data: https://.signin.aws.amazon.com https://signin.aws.amazon.com https://opfcaptcha-prod.s3.amazonaws.com https://images-na.ssl-images-amazon.com https://d1.awsstatic.com https://internal-cdn.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net https://d0.awsstatic.com; media-src 'self' https://.signin.aws.amazon.com https://signin.aws.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net; script-src 'self' https://aws.amazon.com https://.signin.aws.amazon.com https://signin.aws.amazon.com https://d1dgtfo2wk29o4.cloudfront.net/fwcim.js https://m.media-amazon.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://aws-signin-website-assets.s3.amazonaws.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-inline'; report-uri /metrics/cspreport;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://394878548754877834874587-secondary.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 18 Nov 2020 09:04:29 GMT
Server: Server
ETag: W/"26073-1605690269000"
X-Frame-Options: DENY
Content-Type: text/css;charset=UTF-8
Date: Wed, 16 Dec 2020 16:18:43 GMT
Content-Security-Policy: default-src 'none' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com 'unsafe-inline'; img-src 'self' data: https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://opfcaptcha-prod.s3.amazonaws.com https://images-na.ssl-images-amazon.com https://d1.awsstatic.com https://internal-cdn.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net https://d0.awsstatic.com; media-src 'self' https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net; script-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://d1dgtfo2wk29o4.cloudfront.net/fwcim.js https://m.media-amazon.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://aws-signin-website-assets.s3.amazonaws.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-inline'; report-uri /metrics/cspreport;
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: frame-ancestors 'self'; report-uri /metrics/cspreportonly;
Content-Length: 26073
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=Edge

GET
H/1.1 200
OK u2f-mfa.css
signin.aws.amazon.com/static/css/ 1 KB
3 KB 404ms
102ms Stylesheet
text/css 52.46.159.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.aws.amazon.com/static/css/u2f-mfa.css

Requested by

Host: 394878548754877834874587-secondary.z19.web.core.windows.net
URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_CBC

Server

52.46.159.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

cd1aff9ed552c5215dbc722ca84a468504d2fbe0da8d159bf942b83aca4ae177

Security Headers

Name	Value
Content-Security-Policy	default-src 'none' https://aws.amazon.com https://.signin.aws.amazon.com https://signin.aws.amazon.com 'unsafe-inline'; img-src 'self' data: https://.signin.aws.amazon.com https://signin.aws.amazon.com https://opfcaptcha-prod.s3.amazonaws.com https://images-na.ssl-images-amazon.com https://d1.awsstatic.com https://internal-cdn.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net https://d0.awsstatic.com; media-src 'self' https://.signin.aws.amazon.com https://signin.aws.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net; script-src 'self' https://aws.amazon.com https://.signin.aws.amazon.com https://signin.aws.amazon.com https://d1dgtfo2wk29o4.cloudfront.net/fwcim.js https://m.media-amazon.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://aws-signin-website-assets.s3.amazonaws.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-inline'; report-uri /metrics/cspreport;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://394878548754877834874587-secondary.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 18 Nov 2020 09:04:29 GMT
Server: Server
ETag: W/"1326-1605690269000"
X-Frame-Options: DENY
Content-Type: text/css;charset=UTF-8
Date: Wed, 16 Dec 2020 16:18:43 GMT
Content-Security-Policy: default-src 'none' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com 'unsafe-inline'; img-src 'self' data: https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://opfcaptcha-prod.s3.amazonaws.com https://images-na.ssl-images-amazon.com https://d1.awsstatic.com https://internal-cdn.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net https://d0.awsstatic.com; media-src 'self' https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://media.amazonwebservices.com https://d36cz9buwru1tt.cloudfront.net; script-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://d1dgtfo2wk29o4.cloudfront.net/fwcim.js https://m.media-amazon.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-eval' 'unsafe-inline'; style-src 'self' https://aws.amazon.com https://*.signin.aws.amazon.com https://signin.aws.amazon.com https://aws-signin-website-assets.s3.amazonaws.com https://l0.awsstatic.com https://images-na.ssl-images-amazon.com 'unsafe-inline'; report-uri /metrics/cspreport;
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: frame-ancestors 'self'; report-uri /metrics/cspreportonly;
Content-Length: 1326
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=Edge

GET
H2 200 analytics%20signin.16b1f43c3d7b4970a4f6b8205df727fe646cd501.png
d1.awsstatic.com/Digital%20Marketing/sitemerch/sign-in/en/ 60 KB
61 KB 112ms
45ms Image
image/png 13.226.157.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1.awsstatic.com/Digital%20Marketing/sitemerch/sign-in/en/analytics%20signin.16b1f43c3d7b4970a4f6b8205df727fe646cd501.png
Requested by: Host: 394878548754877834874587-secondary.z19.web.core.windows.net
URL: https://394878548754877834874587-secondary.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.157.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-157-122.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4af0107a578dd0cb3372ab4aa657d37b9fb4eebdeb18899b07db3b451e4aa916

Request headers

Referer: https://394878548754877834874587-secondary.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Dec 2020 19:33:34 GMT
via: 1.1 f6bd96409cae11d77ed75457d756ef80.cloudfront.net (CloudFront)
age: 1284311
x-amz-meta-version: 2020-11-27T23:15:55.440Z
x-amz-replication-status: COMPLETED
x-cache: Hit from cloudfront
content-length: 61569
last-modified: Fri, 27 Nov 2020 23:16:43 GMT
server: AmazonS3
etag: "0f430402cc4cc4eb3031526213286608"
x-amz-version-id: _Ept9Ld5pX5XYPkFXCtK3x6tGrDg83Wt
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 6WhIQtyQFYAEUkL9PJaFAC0_tC2o14XiVA31hXuOncwmbMKneYhnRA==

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 511 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 095a716973efa65689c85d85b231e0acbba9789870424b963d514a7cfdb563bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 226 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e89be6bba4cc671c3fe91a5b721d263f88c1e3d1e1bbcccbb035fd7b524f6aa7

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 389 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15ad7487d0aa0f1bd6531ecb0f95310350d79b3c095a951ad96e327a880cbd4b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 622 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a53ae559feabec44a9d5a9f722f34d9fb0f70d010d9fc0b36ba3bc5caadf37bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AWS (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

394878548754877834874587-secondary.z19.web.core.windows.net
aws-signin-website-assets.s3.amazonaws.com
d1.awsstatic.com
signin.aws.amazon.com
13.226.157.122
52.217.97.228
52.239.156.97
52.46.159.144
095a716973efa65689c85d85b231e0acbba9789870424b963d514a7cfdb563bc
0b1e68b1025d14dce1b3c8cf22e6d3e73ce099bc1ec98e3c11857db320f166fb
15ad7487d0aa0f1bd6531ecb0f95310350d79b3c095a951ad96e327a880cbd4b
295437df86381a56ae94b2a5491f916167b1f85db261f4ac2f53111973c09f15
4af0107a578dd0cb3372ab4aa657d37b9fb4eebdeb18899b07db3b451e4aa916
7a737084bd5a4661430f762340fe06a8ccd231b2e300afcfc88601cf6ac0f4e2
81517fb3d42a3fc5cf136de03a24877fad0ccc66ea5b67008ed8105b4f1c3ae4
8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38
a53ae559feabec44a9d5a9f722f34d9fb0f70d010d9fc0b36ba3bc5caadf37bc
cd1aff9ed552c5215dbc722ca84a468504d2fbe0da8d159bf942b83aca4ae177
d13820cdf75388b299511df5691dd2d6cb2be9c6b879e30f0af767201e6d124e
e89be6bba4cc671c3fe91a5b721d263f88c1e3d1e1bbcccbb035fd7b524f6aa7

394878548754877834874587-secondary.z19.web.core.windows.net Open in urlscan Pro 52.239.156.97 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

1 Countries

638 kBTransfer

638 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

394878548754877834874587-secondary.z19.web.core.windows.net Open in urlscan Pro
52.239.156.97 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

1
Countries

638 kB
Transfer

638 kB
Size

0
Cookies

7 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!