opens.nicepage.io Open in urlscan Pro
3.251.41.35 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://opens.nicepage.io/Page-1.html
Submission: On January 18 via api (January 18th 2021, 3:48:40 pm UTC) from DE

Summary HTTP 14 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 14 HTTP transactions. The main IP is 3.251.41.35, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is opens.nicepage.io.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 18th 2020. Valid for: a year.

This is the only time opens.nicepage.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	3.251.41.35 3.251.41.35	16509 (AMAZON-02) (AMAZON-02)
1	95.211.139.76 95.211.139.76	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2a02:6ea0:c70... 2a02:6ea0:c700::4	60068 (CDN77 (^_^)/) (CDN77 (^_^)/)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
3	2600:9000:21f... 2600:9000:21f3:9a00:6:4afb:9140:93a1	16509 (AMAZON-02) (AMAZON-02)
5	52.217.70.28 52.217.70.28	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
14	7

2 3.251.41.35 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com

opens.nicepage.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.211.139.76 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: hosted-by.leaseweb.com

static.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::4 (Germany)

ASN60068 (CDN77 (^_^)/, GB)

capp.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21f3:9a00:6:4afb:9140:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.mcauto-images-production.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.217.70.28 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

marketing-image-production.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	amazonaws.com marketing-image-production.s3.amazonaws.com	8 KB
3	sendgrid.net cdn.mcauto-images-production.sendgrid.net	63 KB
2	nicepage.com static.nicepage.com capp.nicepage.com	78 KB
2	nicepage.io opens.nicepage.io	93 KB
1	gstatic.com fonts.gstatic.com	9 KB
1	googleapis.com fonts.googleapis.com	2 KB
14	6

	Domain	Requested by
5	marketing-image-production.s3.amazonaws.com	opens.nicepage.io
3	cdn.mcauto-images-production.sendgrid.net	opens.nicepage.io
2	opens.nicepage.io	opens.nicepage.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	opens.nicepage.io
1	capp.nicepage.com	opens.nicepage.io
1	static.nicepage.com	opens.nicepage.io
14	7

This site contains links to these domains. Also see Links.

Domain
pmsg.o2o.my
www.facebook.com
twitter.com
instagram.com
pinterest.com
linkedin.com
nicepage.com

Subject Issuer	Validity	Valid
*.nicepage.io Go Daddy Secure Certificate Authority - G2	`2020-02-18` - `2021-04-18`	a year	crt.sh
*.nicepage.com Go Daddy Secure Certificate Authority - G2	`2020-10-07` - `2021-11-08`	a year	crt.sh
1156509985.rsc.cdn77.org Let's Encrypt Authority X3	`2020-11-25` - `2021-02-23`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2021-03-12`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://opens.nicepage.io/Page-1.html
Frame ID: 7B74C32F752B74F4CA0A0CAD47E4D366
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

79 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

253 kB
Transfer

1304 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://pmsg.o2o.my/as/Priv8/Priv8/index.html
Title: View Document

Search URL Search Domain Scan URL

URL: https://www.facebook.com/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/
Title:

Search URL Search Domain Scan URL

URL: https://instagram.com/
Title:

Search URL Search Domain Scan URL

URL: https://pinterest.com/
Title:

Search URL Search Domain Scan URL

URL: https://linkedin.com/
Title:

Search URL Search Domain Scan URL

URL: https://nicepage.com/website-templates
Title: Website Templates

Search URL Search Domain Scan URL

URL: https://nicepage.com/https://nicepage.com
Title: Website Builder Software

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Page-1.html Show response
opens.nicepage.io/ 31 KB
5 KB 379ms
211ms Document
text/html 3.251.41.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.251.41.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com
Software: nginx/1.19.2 /
Resource Hash: b802c35036d32bca61bca3a9abeea3eacd5cc88fdb9afdcd5bb942c0288c8f33

Request headers

Host: opens.nicepage.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.19.2
Date: Mon, 18 Jan 2021 15:48:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-amz-id-2: 87Zo4NupcBeaZBAkydptX63+D9t9tBvXcRScTEvxm5GcSCV33wHTeP6EOMxVIxPAXlrNypTi6Xg=
x-amz-request-id: FCB744F234C01C69
Last-Modified: Sat, 16 Jan 2021 04:10:18 GMT
ETag: W/"e4df4c2d95253b474343a086c1ad8fa0"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type
Content-Encoding: gzip

GET
H/1.1 200
OK nicepage.css
opens.nicepage.io/ 915 KB
88 KB 320ms
319ms Stylesheet
text/css 3.251.41.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/nicepage.css?version=06ba3450-14a8-4f39-92b6-45c42ea995d8
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.251.41.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com
Software: nginx/1.19.2 /
Resource Hash: 4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:20 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15 Jan 2021 16:46:30 GMT
Server: nginx/1.19.2
x-amz-request-id: FF02F13C0B25107D
ETag: W/"daf0ed59b01e417d5b63ff0de8db207a"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Content-Type: text/css
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
x-amz-id-2: o9E7epFi62H/c2W6EdTjI1enHjaY41ZCFuh3AEPU5Hb5bYKP6sOJrGaLO4xfN50mJp8FaExN6zE=

GET
H/1.1 200
OK jquery-1.9.1.min.js Show response
static.nicepage.com/shared/assets/ 90 KB
33 KB 357ms
92ms Script
application/javascript 95.211.139.76
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.nicepage.com/shared/assets/jquery-1.9.1.min.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 95.211.139.76 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS: hosted-by.leaseweb.com
Software: Apache 2.1 / ASP.NET
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:20 GMT
Content-Encoding: gzip
ETag: "45dd4e6dcb5ed31:0"
Last-Modified: Thu, 16 Nov 2017 11:09:52 GMT
Server: Apache 2.1
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Content-Length: 33099

GET
H2 200 nicepage.js Show response
capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/ 147 KB
45 KB 117ms
29ms Script
application/javascript 2a02:6ea0:c700::4
CDN77 (^_^)/

General

Check archive.org

Show headers Download Go to

Full URL: https://capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/nicepage.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::4 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software: CDN77-Turbo / ASP.NET
Resource Hash: 350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Mon, 18 Jan 2021 15:48:20 GMT
content-encoding: br
etag: W/"0bacdbd83ead61:0"
x-edge-pop: frankfurtDE
x-powered-by: ASP.NET
x-cache: HIT
x-age: 345418
x-77-nzt: AcO1rzVeDonvSkUFAA==
last-modified: Thu, 14 Jan 2021 14:44:20 GMT
server: CDN77-Turbo
x-77-nzt-ray: Xk6ZyQkR/3Y=
x-77-cache: HIT
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
x-edge-ip: 195.181.175.53
access-control-allow-headers: Content-Type
expires: Tue, 26 Jan 2021 15:51:22 GMT

GET
H2 200 css
fonts.googleapis.com/ 45 KB
2 KB 19ms
18ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Requested by

Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e5a601055718bba286fd83bef5a238c9c63fcb28a9d40518aa37ec4f5670e57d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 18 Jan 2021 15:48:20 GMT
server: ESF
date: Mon, 18 Jan 2021 15:48:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Jan 2021 15:48:20 GMT

GET
H/1.1 200
OK 469x107.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/ 5 KB
5 KB 422ms
408ms Image
binary/octet-stream 2600:9000:21f3:9a00:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/469x107.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Server: 2600:9000:21f3:9a00:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: dbKZ8T6OUnndv7UdcLBnYGZQ6X27akD1
Via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Jan 2020 23:51:27 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA2-C2
ETag: "b606619de32829fa1725ae31a828ea39"
X-Cache: RefreshHit from cloudfront
Content-Type: binary/octet-stream
Date: Mon, 18 Jan 2021 15:48:21 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4893
X-Amz-Cf-Id: i5FJwYWY-Nfv-O0LATROWPhCRQpHaYqGtKqe-rkYn-X2zhZXCV2JSg==

GET
H/1.1 200
OK 466x288.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/ 48 KB
48 KB 26ms
12ms Image
binary/octet-stream 2600:9000:21f3:9a00:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/466x288.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Server: 2600:9000:21f3:9a00:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: ZErvJ_UVaEUDBjnvXRlrAbbJlyFj17Hh
Via: 1.1 882f747f39885162595630c95dd0012d.cloudfront.net (CloudFront)
Last-Modified: Mon, 02 Nov 2020 14:11:31 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA2-C2
ETag: "d4213d403e8deefbf0bf8a4e5e38541b"
X-Cache: Hit from cloudfront
Content-Type: binary/octet-stream
Date: Mon, 18 Jan 2021 15:48:20 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 48872
X-Amz-Cf-Id: fNhQ2r85jCSqeJaeZVKzvgVHILZJbGxti8GKzU2ob7E87Ket7HkYLA==

GET
H/1.1 200
OK 149x87.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/ 9 KB
9 KB 595ms
582ms Image
binary/octet-stream 2600:9000:21f3:9a00:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/149x87.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Server: 2600:9000:21f3:9a00:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: pnEc7x5oeC5aqHzby9UOWOAqyta4t0W0
Via: 1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
Last-Modified: Mon, 02 Nov 2020 14:14:44 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA2-C2
ETag: "270ddaed1302ac2fd6e7319ffdb02f7c"
X-Cache: RefreshHit from cloudfront
Content-Type: binary/octet-stream
Date: Mon, 18 Jan 2021 15:48:21 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9010
X-Amz-Cf-Id: IPs92o7HqRX2HbSphLfNzz49l_BijlpW3pyV3_YWfUY4UhP528NwEg==

GET
H/1.1 200
OK facebook.png
marketing-image-production.s3.amazonaws.com/social/white/ 746 B
1 KB 543ms
147ms Image
image/png 52.217.70.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/facebook.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.70.28 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:21 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:05 GMT
Server: AmazonS3
x-amz-request-id: 4A6472FF3271F1F5
ETag: "1818ac1941f85157cf5c049321b59e8a"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 746
x-amz-id-2: TmBhMzpv16qzeboz6LXatDuydnvAiCi6XCMq6QbPbVoanxgPo7Nq5aXKuQbtyB7Y1Zlbtcz+wm8=

GET
H/1.1 200
OK twitter.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 547ms
144ms Image
image/png 52.217.70.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/twitter.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.70.28 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:21 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:07 GMT
Server: AmazonS3
x-amz-request-id: 4G4P7Q4Y1ZDS2H9Y
ETag: "4e54386509b2a7881627dde6e50a5eb8"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1389
x-amz-id-2: tC3qlf06ESnCKmWGSTNpwv4tnendzdzJkWPsJ1bmzXjv1s4kjH9b6Z6XrIQGqX8LfeFCCl08sF8=

GET
H/1.1 200
OK instagram.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 555ms
146ms Image
image/png 52.217.70.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/instagram.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.70.28 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:21 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: 517EE4A9496128D5
ETag: "c1fb933d57b4122893734f136176860a"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1289
x-amz-id-2: FmqYXCVRzVAG6OBbiuwCVWHJDcZQDxL2xfEaOrAhBQAlMMyxsvY8WD4dKZGOd6LqVWRryujT+Bw=

GET
H/1.1 200
OK pinterest.png
marketing-image-production.s3.amazonaws.com/social/white/ 2 KB
2 KB 565ms
148ms Image
image/png 52.217.70.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/pinterest.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.70.28 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:21 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: 994358792EFFABA3
ETag: "de120ffa43278ad99c946d56727c3f44"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 2057
x-amz-id-2: Q6ckK/yqqXbMWMBrQP4tjGfLwFn2jmhDlSQJZrDqerm4LC+rH04ttHvOY851Yvs/wZWYeGi5AH4=

GET
H/1.1 200
OK linkedin.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
1 KB 564ms
146ms Image
image/png 52.217.70.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/linkedin.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.70.28 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 18 Jan 2021 15:48:21 GMT
Last-Modified: Tue, 15 Mar 2016 18:17:18 GMT
Server: AmazonS3
x-amz-request-id: F86BD3372A799625
ETag: "cf25ec9b79612be7393ffb8251fdfc26"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1062
x-amz-id-2: Ipb30RsrXjV0ddkfgkZ5KaUMcfjjQnfZMRRVHRk+ZzAtk+fi1yYE1KEjpV3bThefVvY/cyZNlG4=

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://opens.nicepage.io
Referer: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 13 Jan 2021 19:09:10 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 419950
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Thu, 13 Jan 2022 19:09:10 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

capp.nicepage.com
cdn.mcauto-images-production.sendgrid.net
fonts.googleapis.com
fonts.gstatic.com
marketing-image-production.s3.amazonaws.com
opens.nicepage.io
static.nicepage.com
2600:9000:21f3:9a00:6:4afb:9140:93a1
2a00:1450:4001:802::200a
2a00:1450:4001:809::2003
2a02:6ea0:c700::4
3.251.41.35
52.217.70.28
95.211.139.76
0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728
035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc
31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b
350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754
40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029
4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791
ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463
b802c35036d32bca61bca3a9abeea3eacd5cc88fdb9afdcd5bb942c0288c8f33
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097
d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee
e5a601055718bba286fd83bef5a238c9c63fcb28a9d40518aa37ec4f5670e57d

opens.nicepage.io Open in urlscan Pro 3.251.41.35 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

79 %HTTPS

57 %IPv6

6 Domains

7 Subdomains

7 IPs

4 Countries

253 kBTransfer

1304 kBSize

0 Cookies

8 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

48 JavaScript Global Variables

0 Cookies

Indicators

opens.nicepage.io Open in urlscan Pro
3.251.41.35 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

79 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

253 kB
Transfer

1304 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!