zoom-invite.s3-website.eu-central-1.amazonaws.com
52.219.169.88  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/ 4yr old
Submission: On February 11 via manual (February 11th 2022, 5:20:02 pm UTC) from BR — Scanned from DE
Summary HTTP 4 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 4 HTTP transactions. The main IP is 52.219.169.88, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is zoom-invite.s3-website.eu-central-1.amazonaws.com. 4yr old
This is the only time zoom-invite.s3-website.eu-central-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 52.219.169.88 52.219.169.88 16509 (AMAZON-02) (AMAZON-02)
1 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b 20446 (HIGHWINDS3) (HIGHWINDS3)
1 1 2a00:1450:400... 2a00:1450:4001:810::2004 15169 (GOOGLE) (GOOGLE)
1 2a00:1450:400... 2a00:1450:4001:82f::2004 15169 (GOOGLE) (GOOGLE)
1 173.208.219.13 173.208.219.13 32097 (WII) (WII)
4 5
1    52.219.169.88 (Frankfurt am Main, Germany)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN16509 (AMAZON-02, US)
PTR: s3-website.eu-central-1.amazonaws.com
zoom-invite.s3-website.eu-central-1.amazonaws.com 4yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    2001:4de0:ac18::1:a:3b (Netherlands)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN20446 (HIGHWINDS3, US)
code.jquery.com 13yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 1 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN15169 (GOOGLE, US)
www.google.com 13yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN15169 (GOOGLE, US)
t2.gstatic.com 10yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    173.208.219.13 (United States)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN32097 (WII, US)
PTR: angle.excellentfixmemory.us
www.pngitem.com 7yr old
VirusTotal SecurityTrails crt.sh Domaintools
Apex Domain
Subdomains		 Transfer
1 pngitem.com
www.pngitem.com — Cisco Umbrella Rank: 31864 7yr old
55 KB
1 gstatic.com
t2.gstatic.com 10yr old
1010 B
1 google.com 1 redirects
www.google.com — Cisco Umbrella Rank: 2 13yr old
383 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 546 13yr old
33 KB
1 amazonaws.com
zoom-invite.s3-website.eu-central-1.amazonaws.com 4yr old
13 KB
4 5
Domain Requested by
1 www.pngitem.com zoom-invite.s3-website.eu-central-1.amazonaws.com
1 t2.gstatic.com zoom-invite.s3-website.eu-central-1.amazonaws.com
1 www.google.com 1 redirects
1 code.jquery.com zoom-invite.s3-website.eu-central-1.amazonaws.com
1 zoom-invite.s3-website.eu-central-1.amazonaws.com
4 5

This site contains no links.

Subject Issuer Validity Valid
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 1yr crt.sh
pngitem.com
R3		 2022-02-05 -
2022-05-06		 3mo crt.sh

This page contains 1 frames:

Primary Page: http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
Frame ID: 717A9C348D34201DFA831ACDC92F10CD
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Zoom Portal Login

Detected technologies

(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

50 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

102 kB
Transfer

163 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www.google.com/s2/favicons?domain=biofactlife.com HTTP 301
  • https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16

4 HTTP transactions
2 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H/1.1 		200
OK 		Primary Request / Show response
zoom-invite.s3-website.eu-central-1.amazonaws.com/ 		13 KB
13 KB 		270ms
248ms 		Document
text/html		 52.219.169.88
AMAZON-02
General
Check archive.org
Download Go to
Full URL
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
Protocol
HTTP/1.1
Server
52.219.169.88 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
80693759562137102fdba73ff7d12fc9962cb9c64e9e6ddaa89369079719e5d9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

x-amz-id-2
a18m48xY64wkbIG+y0eR0zogT3zn7t7t67Q272Cde4uOA3kcY6y0KKWvLTwcCyyrl5RS5Fm+Al8=
x-amz-request-id
N3T7T04K2707X7T1
Date
Fri, 11 Feb 2022 17:20:03 GMT
Last-Modified
Thu, 27 Jan 2022 04:48:46 GMT
ETag
"35c89989e5c182ba963d7fc5bd1e2d81"
Content-Type
text/html
Server
AmazonS3
Content-Length
13151
GET
H2 		200
 jquery-1.11.1.min.js Show response
code.jquery.com/ 		94 KB
33 KB 		53ms
18ms 		Script
application/javascript		 2001:4de0:ac18::1:a:3b
HIGHWINDS3
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.11.1.min.js
Requested by
Host: zoom-invite.s3-website.eu-central-1.amazonaws.com
URL: http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 11 Feb 2022 17:20:02 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-1762a"
vary
Accept-Encoding
x-hw
1644600002.dop003.ml1.t,1644600002.cds214.ml1.hn,1644600002.cds019.ml1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
33202
GET
H2 		404
 faviconV2
t2.gstatic.com/
Redirect Chain
  • https://www.google.com/s2/favicons?domain=biofactlife.com
  • https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16
726 B
1010 B 		43ms
16ms 		Image
image/png		 2a00:1450:4001:82f::2004
GOOGLE
General
Check archive.org
Download Go to Show image
Full URL
https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16
Requested by
Host: zoom-invite.s3-website.eu-central-1.amazonaws.com
URL: http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
Protocol
H2
Server
2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Fri, 11 Feb 2022 17:20:02 GMT
x-content-type-options
nosniff
server
sffe
content-type
image/png
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
726
x-xss-protection
0

Redirect headers

date
Fri, 11 Feb 2022 17:20:02 GMT
x-content-type-options
nosniff
server
sffe
content-type
text/html; charset=UTF-8
location
https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16
cache-control
public, max-age=1800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
335
x-xss-protection
0
expires
Fri, 11 Feb 2022 17:50:02 GMT
GET
H/1.1 		200
OK 		26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
www.pngitem.com/pimgs/m/ 		55 KB
55 KB 		1034ms
767ms 		Image
image/png		 173.208.219.13
WII
General
Check archive.org
Download Go to Show image
Full URL
https://www.pngitem.com/pimgs/m/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
Requested by
Host: zoom-invite.s3-website.eu-central-1.amazonaws.com
URL: http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.208.219.13 , United States, ASN32097 (WII, US),
Reverse DNS
angle.excellentfixmemory.us
Software
nginx/1.14.0 /
Resource Hash
42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Fri, 11 Feb 2022 17:20:03 GMT
Last-Modified
Tue, 15 Oct 2019 13:09:45 GMT
Server
nginx/1.14.0
ETag
"5da5c519-db2d"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
56109
GET
DATA 		200
OK 		truncated
/ 		558 B
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/png
GET
DATA 		200
OK 		truncated
/ 		520 B
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://zoom-invite.s3-website.eu-central-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

10 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone function| $ function| jQuery object| _0x29a3 function| _0x40b2 function| _0x2e20a0 string| hash number| n function| goNow

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
javascript warning URL: http://zoom-invite.s3-website.eu-central-1.amazonaws.com/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-1.11.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: http://zoom-invite.s3-website.eu-central-1.amazonaws.com/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-1.11.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16
Message:
Failed to load resource: the server responded with a status of 404 ()