![](/screenshots/8a9bdd46-c7fc-4978-8a9b-3f4aca398b0b.png)
perpendicular-sleigher.s3.us-east-2.amazonaws.com
Open in
urlscan Pro
52.219.96.224
Malicious Activity!
Public Scan
Effective URL: https://perpendicular-sleigher.s3.us-east-2.amazonaws.com/guarabu/index.html
Submission: On April 14 via manual from MY
Summary
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on January 14th 2021. Valid for: a year.
This is the only time perpendicular-sleigher.s3.us-east-2.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:20:... 2606:4700:20::6819:e935 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 52.219.96.224 52.219.96.224 | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 2606:4700:303... 2606:4700:3037::6815:4dbc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 2 |
ASN16509 (AMAZON-02, US)
PTR: s3-r-w.us-east-2.amazonaws.com
perpendicular-sleigher.s3.us-east-2.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
smtptemp.site
smtptemp.site |
189 KB |
1 |
amazonaws.com
perpendicular-sleigher.s3.us-east-2.amazonaws.com |
77 KB |
1 |
is.gd
1 redirects
is.gd |
622 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
10 | smtptemp.site |
perpendicular-sleigher.s3.us-east-2.amazonaws.com
|
1 | perpendicular-sleigher.s3.us-east-2.amazonaws.com | |
1 | is.gd | 1 redirects |
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.us-east-2.amazonaws.com DigiCert Baltimore CA-2 G2 |
2021-01-14 - 2022-01-18 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-05 - 2022-03-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://perpendicular-sleigher.s3.us-east-2.amazonaws.com/guarabu/index.html
Frame ID: 137EB07C83FA5B46A4CD8E0B81905AC6
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/8a9bdd46-c7fc-4978-8a9b-3f4aca398b0b.png)
Page URL History Show full URLs
-
https://is.gd/Kyl9yN
HTTP 301
https://perpendicular-sleigher.s3.us-east-2.amazonaws.com/guarabu/index.html Page URL
Detected technologies
Detected patterns
- headers server /^AmazonS3$/i
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://is.gd/Kyl9yN
HTTP 301
https://perpendicular-sleigher.s3.us-east-2.amazonaws.com/guarabu/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
perpendicular-sleigher.s3.us-east-2.amazonaws.com/guarabu/ Redirect Chain
|
76 KB 77 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
157 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
11.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
12.png
smtptemp.site/email-list/onedrivedbhcsyd32/img-css/ |
83 KB 84 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _0x4471 function| _0x2539 object| Zlib function| templatePage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
is.gd
perpendicular-sleigher.s3.us-east-2.amazonaws.com
smtptemp.site
2606:4700:20::6819:e935
2606:4700:3037::6815:4dbc
52.219.96.224
172f4e7bb8722658406f6e13a53f5a7a3a9083e128d12e8047fc55f8d0f8fa37
2477b4b08ccdc262123a0e0029b7d45fc557ea9d553718aa480ace142c58cccf
273f5fe56e9a657897a81292f054876d116e9cc40589908854cb8f538dacffaa
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
86ca5fdb1ed73c8d3cd91b7a8bcf45f630574a3d59464a5d826bf07e8def99fd
9d2c57835ca05ea901cdc07680921aef273c35bb043941db3b468a2adb7f3f82
cbba2402feb0b7a6cacf40ccfeb5b2d5ea9e12c4fd7784585914a5d5febec453
cd9a5febfc8486b2ea7f266070cb03523ad5f7cdc5af22ac2db8ae3552a2578d
d8f5475680fc496ea93eacfd03a943b973b26ed321bce038b02f64ee3bf4916f
f980da766be71a530a32fb7fc66fd4d2e30cd33630d9c24b9720f72c94e9ae9d
fd2568a85b9b6337ce89cc0fe85a80704180ce9be1027fa96d11f3eb90b94401