payappremittance.unicornplatform.com
Open in
urlscan Pro
52.44.17.83
Malicious Activity!
Public Scan
Effective URL: https://payappremittance.unicornplatform.com/
Submission: On January 29 via manual from US
Summary
TLS certificate: Issued by R3 on December 4th 2020. Valid for: 3 months.
This is the only time payappremittance.unicornplatform.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sharepoint (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.204.90.22 52.204.90.22 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 52.44.17.83 52.44.17.83 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 2600:9000:206... 2600:9000:206f:f200:1c:dd52:1780:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:817::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a02:26f0:6c0... 2a02:26f0:6c00::210:ba28 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
9 | 5 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-90-22.compute-1.amazonaws.com
urldefense.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-17-83.compute-1.amazonaws.com
payappremittance.unicornplatform.com | |
app.unicornplatform.com |
ASN16509 (AMAZON-02, US)
dghrayk5zwr4u.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
ucarecdn.com
ucarecdn.com |
64 KB |
2 |
gstatic.com
fonts.gstatic.com |
28 KB |
2 |
cloudfront.net
dghrayk5zwr4u.cloudfront.net |
118 KB |
2 |
unicornplatform.com
payappremittance.unicornplatform.com app.unicornplatform.com |
9 KB |
1 |
googleapis.com
fonts.googleapis.com |
511 B |
1 |
urldefense.com
1 redirects
urldefense.com |
140 B |
9 | 6 |
Domain | Requested by | |
---|---|---|
2 | ucarecdn.com |
payappremittance.unicornplatform.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | dghrayk5zwr4u.cloudfront.net |
payappremittance.unicornplatform.com
|
1 | app.unicornplatform.com |
payappremittance.unicornplatform.com
|
1 | fonts.googleapis.com |
payappremittance.unicornplatform.com
|
1 | payappremittance.unicornplatform.com | |
1 | urldefense.com | 1 redirects |
9 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
f000.backblazeb2.com |
unicornplatform.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.unicornplatform.com R3 |
2020-12-04 - 2021-03-04 |
3 months | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2020-05-26 - 2021-04-21 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-05 - 2021-03-30 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2021-01-05 - 2021-03-30 |
3 months | crt.sh |
ucarecdn.com R3 |
2020-12-29 - 2021-03-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://payappremittance.unicornplatform.com/
Frame ID: D3C45CB3ACDB432DD8C26734E3613B4E
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://urldefense.com/v3/__https://payappremittance.unicornplatform.com/__;!!CgLlcYu3QJx4GA!uJbYKM...
HTTP 302
https://payappremittance.unicornplatform.com/ Page URL
Detected technologies
Python (Programming Languages) ExpandDetected patterns
- headers server /gunicorn(?:\/([\d.]+))?/i
gunicorn (Web Servers) Expand
Detected patterns
- headers server /gunicorn(?:\/([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: VIEW
Search URL Search Domain Scan URL
Title: Runs on Unicorn Platform
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://urldefense.com/v3/__https://payappremittance.unicornplatform.com/__;!!CgLlcYu3QJx4GA!uJbYKMgaZ0EJl8ZBDthA1UhcXwRP4ag3MzEcPP3OmaJCYvxcDrUQ5tMUUdxa2wvXtA$
HTTP 302
https://payappremittance.unicornplatform.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
payappremittance.unicornplatform.com/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.54a170eb32e3.css
dghrayk5zwr4u.cloudfront.net/static/css/ |
421 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.e235863197b6.js
dghrayk5zwr4u.cloudfront.net/static/js/ |
210 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 511 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v17/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ucarecdn.com/afb71a6d-acb8-4494-a7eb-112311e9b78c/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft-logo-700x394.png
ucarecdn.com/c4f8adc1-8e30-4d1f-887d-a23034b7bd8f/ |
50 KB 51 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
unicorn-platform-logo.svg
app.unicornplatform.com/static/img/logos/ |
1 KB 852 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sharepoint (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| widgets function| ClipboardJS function| $ function| jQuery function| PhotoSwipe function| PhotoSwipeUI_Default object| unicornplatform0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.unicornplatform.com
dghrayk5zwr4u.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
payappremittance.unicornplatform.com
ucarecdn.com
urldefense.com
2600:9000:206f:f200:1c:dd52:1780:93a1
2a00:1450:4001:80e::200a
2a00:1450:4001:817::2003
2a02:26f0:6c00::210:ba28
52.204.90.22
52.44.17.83
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
231205092015e4018ed461161996af2acef46cc6a75db35b17d7dfca98d90ed0
6164b186079f44a336499335b9d22a5eb32e297c55abda9558260932bcf8191d
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece
8206df8858f09c992c55320173575cd309ba679c91962dabafdaeffebd70c9f8
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
bdba9ce7b75925f2097f65e5ff768d77bf7af8410a834e494b2656d3abb82464
cf9de2256ea473d358f3a5f373796746e1c7ca3d785526620a8bc410ea128149
fe6b8c1071a0601a0ecc830b9fc86fb3a4a15838ffa8e42a596be6f3b60ea4ed