![](/screenshots/948b9865-2f74-4da3-ab18-0365d33d8dfb.png)
message-portal-delivery.s3-sa-east-1.amazonaws.com
Open in
urlscan Pro
52.95.165.90
Malicious Activity!
Public Scan
Effective URL: https://message-portal-delivery.s3-sa-east-1.amazonaws.com/index.html
Submission: On May 20 via manual from US
Summary
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on August 27th 2020. Valid for: a year.
This is the only time message-portal-delivery.s3-sa-east-1.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2606:4700:303... 2606:4700:3030::ac43:9361 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:a823 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 52.95.165.90 52.95.165.90 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 103.86.176.6 103.86.176.6 | 133296 (WEBWERKS-...) (WEBWERKS-AS-IN Web Werks India Pvt. Ltd.) | |
7 | 6 |
ASN16509 (AMAZON-02, US)
PTR: s3-sa-east-1-r-w.amazonaws.com
message-portal-delivery.s3-sa-east-1.amazonaws.com |
ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN)
PTR: zoom.herosite.pro
nutlers.in |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
fastkart.net
fastkart.net |
13 KB |
2 |
cloudflare.com
ajax.cloudflare.com cdnjs.cloudflare.com |
32 KB |
1 |
nutlers.in
nutlers.in |
845 B |
1 |
amazonaws.com
message-portal-delivery.s3-sa-east-1.amazonaws.com |
597 KB |
7 | 4 |
Domain | Requested by | |
---|---|---|
3 | fastkart.net |
fastkart.net
|
1 | nutlers.in |
cdnjs.cloudflare.com
|
1 | cdnjs.cloudflare.com |
message-portal-delivery.s3-sa-east-1.amazonaws.com
|
1 | message-portal-delivery.s3-sa-east-1.amazonaws.com |
fastkart.net
|
1 | ajax.cloudflare.com |
fastkart.net
|
7 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-04-15 - 2022-04-14 |
a year | crt.sh |
ajax.cloudflare.com DigiCert ECC Secure Server CA |
2020-08-11 - 2022-08-16 |
2 years | crt.sh |
*.s3-sa-east-1.amazonaws.com DigiCert Baltimore CA-2 G2 |
2020-08-27 - 2021-09-01 |
a year | crt.sh |
nutlers.in cPanel, Inc. Certification Authority |
2021-03-20 - 2021-06-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://message-portal-delivery.s3-sa-east-1.amazonaws.com/index.html
Frame ID: 17A83F9FC91C6EEB0AC3990479AAF046
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/948b9865-2f74-4da3-ab18-0365d33d8dfb.png)
Page URL History Show full URLs
- https://fastkart.net//RK=2/RS=V.w2YJXMAqE6KWxaoDCSD2kWYUI- Page URL
- https://message-portal-delivery.s3-sa-east-1.amazonaws.com/index.html Page URL
Detected technologies
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://fastkart.net//RK=2/RS=V.w2YJXMAqE6KWxaoDCSD2kWYUI- Page URL
- https://message-portal-delivery.s3-sa-east-1.amazonaws.com/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
RS=V.w2YJXMAqE6KWxaoDCSD2kWYUI-
fastkart.net//RK=2/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
install.css
fastkart.net//RK=2/wp-admin/css/ |
7 KB 3 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
wordpress-logo.png
fastkart.net//RK=2/wp-admin/images/ |
7 KB 7 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
message-portal-delivery.s3-sa-east-1.amazonaws.com/ |
597 KB 597 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
277 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
756 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
899 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
222 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
513 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
915 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call.php
nutlers.in/ |
579 B 845 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| lc function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
cdnjs.cloudflare.com
fastkart.net
message-portal-delivery.s3-sa-east-1.amazonaws.com
nutlers.in
103.86.176.6
2606:4700:3030::ac43:9361
2606:4700::6810:135e
2606:4700::6810:a823
52.95.165.90
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1d396fd01f4776b1c8a3bde2963f795f542ba017fecda9f81f2b4efd29abdc12
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
304869d2a9da7e3eb88fbd5bfc2c331ea3bc5473aea3db65815775715d3e7cba
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3a4ed23869685fd17a6e791421baa435b0da49933fa1cd3ae2c64d3b80470d87
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
b85cd243f435a945cffcfe82d655f394d6196364c9dd28e227be411f8f70efd5
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e