opens.nicepage.io Open in urlscan Pro
151.101.194.132 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://opens.nicepage.io/Page-1.html
Submission: On September 04 via api (September 4th 2023, 4:51:24 pm UTC) from US — Scanned from US

Summary HTTP 14 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 6 IPs in 1 countries across 6 domains to perform 14 HTTP transactions. The main IP is 151.101.194.132, located in United States and belongs to FASTLY, US. The main domain is opens.nicepage.io.
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.

This is the only time opens.nicepage.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY)
2	2a02:6ea0:e20... 2a02:6ea0:e200::2	60068 (CDN77 ^_^) (CDN77 ^_^)
1	2607:f8b0:400... 2607:f8b0:4004:c06::5f	15169 (GOOGLE) (GOOGLE)
3	2600:9000:246... 2600:9000:246c:a200:6:4afb:9140:93a1	16509 (AMAZON-02) (AMAZON-02)
5	52.216.209.129 52.216.209.129	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c17::5e	15169 (GOOGLE) (GOOGLE)
14	6

2 151.101.194.132 (United States)

ASN54113 (FASTLY, US)

opens.nicepage.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6ea0:e200::2 (Ashburn, United States)

ASN60068 (CDN77 ^_^, GB)

static.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
capp.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:246c:a200:6:4afb:9140:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.mcauto-images-production.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.216.209.129 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

marketing-image-production.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	amazonaws.com marketing-image-production.s3.amazonaws.com — Cisco Umbrella Rank: 45268	8 KB
3	sendgrid.net cdn.mcauto-images-production.sendgrid.net — Cisco Umbrella Rank: 18408	63 KB
2	nicepage.com static.nicepage.com capp.nicepage.com	81 KB
2	nicepage.io opens.nicepage.io	93 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 41	2 KB
14	6

	Domain	Requested by
5	marketing-image-production.s3.amazonaws.com	opens.nicepage.io
3	cdn.mcauto-images-production.sendgrid.net	opens.nicepage.io
2	opens.nicepage.io	opens.nicepage.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	opens.nicepage.io
1	capp.nicepage.com	opens.nicepage.io
1	static.nicepage.com	opens.nicepage.io
14	7

This site contains links to these domains. Also see Links.

Domain
www.orimas.o2o.my
www.facebook.com
twitter.com
instagram.com
pinterest.com
linkedin.com
nicepage.com

Subject Issuer	Validity	Valid
*.nicepage.io R3	`2023-07-24` - `2023-10-22`	3 months	crt.sh
1832675839.rsc.cdn77.org R3	`2023-06-29` - `2023-09-27`	3 months	crt.sh
1156509985.rsc.cdn77.org R3	`2023-07-01` - `2023-09-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
cdn.mcauto-images-production.sendgrid.net Amazon RSA 2048 M02	`2023-04-19` - `2024-05-17`	a year	crt.sh
*.s3.amazonaws.com Amazon RSA 2048 M01	`2023-03-21` - `2023-12-19`	9 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://opens.nicepage.io/Page-1.html
Frame ID: 59CAC0DEF50AE398918BE39D96409F62
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page 1

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

6
IPs

1
Countries

294 kB
Transfer

1350 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.orimas.o2o.my/.well-known/az/Priv8/Priv8/index.html
Title: View Document

Search URL Search Domain Scan URL

URL: https://www.facebook.com/

Search URL Search Domain Scan URL

URL: https://twitter.com/

Search URL Search Domain Scan URL

URL: https://instagram.com/

Search URL Search Domain Scan URL

URL: https://pinterest.com/

Search URL Search Domain Scan URL

URL: https://linkedin.com/

Search URL Search Domain Scan URL

URL: https://nicepage.com/website-templates
Title: Website Templates

Search URL Search Domain Scan URL

URL: https://nicepage.com/https://nicepage.com
Title: Website Builder Software

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request Page-1.html Show response
opens.nicepage.io/ 31 KB
5 KB 566ms
430ms Document
text/html 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.19.2 /
Resource Hash: 9b126c3aad0ba7b56b9f36ccdc0de6ece3fd4abb5aaf4ddd8649ddb6dd0241e1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
access-control-allow-origin: *
age: 0
content-encoding: gzip
content-length: 4762
content-type: text/html
date: Mon, 04 Sep 2023 16:51:20 GMT
etag: W/"eb795eb5033eae5c3bc5c72a15cb1efd"
last-modified: Tue, 19 Jan 2021 00:36:35 GMT
server: nginx/1.19.2
vary: Accept-Encoding
via: 1.1 varnish
x-amz-id-2: jqzz1hu2QeLANRAg3ttjNK/JIOxn+dlon7nPMWr1XPeN2jZuzLQWjWwKw1fQMDwVdWbH1a4UXJ4=
x-amz-request-id: GSRWVP4PKBZNA5D8
x-amz-version-id: null
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4572-YYZ
x-timer: S1693846280.642743,VS0,VE410

GET
H2 200 nicepage.css
opens.nicepage.io/ 915 KB
88 KB 22ms
21ms Stylesheet
text/css 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/nicepage.css?version=97f2fa82-f5b0-4e36-a7a8-a62395e03dfb
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.19.2 /
Resource Hash: 4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/Page-1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 varnish
date: Mon, 04 Sep 2023 16:51:20 GMT
x-amz-request-id: JHTEKDW2WKB73VAM
age: 71
x-cache: HIT
content-length: 89381
x-amz-id-2: Q84QDPA0uNzSS1MG/cJmRqndLdKI62EhR/PN04p7eBUOzrbtPT8yyP17TCKSibcB7epXg/RhYZc=
x-served-by: cache-yyz4572-YYZ
last-modified: Fri, 15 Jan 2021 16:46:30 GMT
server: nginx/1.19.2
x-timer: S1693846280.076867,VS0,VE2
etag: W/"daf0ed59b01e417d5b63ff0de8db207a"
vary: Accept-Encoding
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
content-type: text/css
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: Content-Type
x-cache-hits: 1

GET
H2 200 jquery-1.9.1.min.js Show response
static.nicepage.com/shared/assets/ 90 KB
33 KB 119ms
37ms Script
application/javascript 2a02:6ea0:e200::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://static.nicepage.com/shared/assets/jquery-1.9.1.min.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:e200::2 Ashburn, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-77-pop: ashburnUSVA
date: Mon, 04 Sep 2023 16:51:20 GMT
content-encoding: gzip
x-amz-request-id: GQ29P3K348999VKA
x-amz-meta-sha256: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
x-cache: HIT
x-77-cache: HIT
x-age: 340514
x-accel-date: 1693505766
x-amz-id-2: LV9WBlJbg5XpeNMlx4Om/bF/Audnx7U3YTDOUniC+IuED8d/4BzqYwXBv83qugRTUD1ClLES5PU=
x-77-nzt: ASUTzgQ/qzf/IjIFAA
x-accel-expires: @1694542566
last-modified: Wed, 04 May 2022 16:07:45 GMT
server: CDN77-Turbo
etag: W/"397754ba49e9e0cf4e7c190da78dda05"
x-77-nzt-ray: 8e305f1cd9e50c3b080bf664396f440a
vary: Accept-Encoding
content-type: application/javascript
x-amz-meta-s3b-last-modified: 20171116T110952Z

GET
H2 200 nicepage.js Show response
capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/ 147 KB
48 KB 140ms
65ms Script
application/javascript 2a02:6ea0:e200::2
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/nicepage.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:e200::2 Ashburn, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-77-pop: ashburnUSVA
date: Mon, 04 Sep 2023 16:51:20 GMT
x-amz-version-id: rWSlZQKgLhnBdRpsRCvFlafxcoryiKss
content-encoding: gzip
x-amz-request-id: H0F8QK6KMV4AD05K
x-cache: HIT
x-77-cache: HIT
x-age: 3312289
x-accel-date: 1690533991
x-amz-id-2: EGSzlgpPwk4P+GwqBFCcAAw8v+p/yqoJ7bidn8/mEYUX2DjwRZdh7kQDs5on7KS6BPZMRH0BPiI=
x-77-nzt: ASUTzgQo6J3/oYoyAA
x-accel-expires: @1722069991
last-modified: Tue, 06 Dec 2022 11:37:04 GMT
server: CDN77-Turbo
etag: W/"d27677bc68a10ae9c168ffad882f425f"
x-77-nzt-ray: 8e305f1cd9e5f33a080bf6646707b609
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 52 KB
2 KB 111ms
44ms Stylesheet
text/css 2607:f8b0:4004:c06::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Requested by

Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cf79c8dcb1bcdd4ef05c21b9e577369091315a6fca0f9a40c42005b20b18be60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 04 Sep 2023 16:51:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 04 Sep 2023 16:51:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Sep 2023 16:51:20 GMT

GET
H2 200 469x107.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/ 5 KB
5 KB 274ms
162ms Image
image/png 2600:9000:246c:a200:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/469x107.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:246c:a200:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: 1by6AmuiLpCeNV4ZvVkXpwFWtVyAp47z
via: 1.1 eafee5b78499205055c54c6464d6ae70.cloudfront.net (CloudFront)
last-modified: Tue, 06 Dec 2022 22:40:50 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P1
etag: "b606619de32829fa1725ae31a828ea39"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 4893
x-amz-cf-id: 9lkZFpplr5m1w-s_Cu7v2-l00ttcLyzsCNsVu79D048BX9ioCogFOw==

GET
H2 200 466x288.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/ 48 KB
48 KB 229ms
118ms Image
image/png 2600:9000:246c:a200:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/466x288.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:246c:a200:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: ZYl1j_nYNN2ypu1mrQ3Oe3fuiwWGe3s.
via: 1.1 eafee5b78499205055c54c6464d6ae70.cloudfront.net (CloudFront)
last-modified: Tue, 06 Dec 2022 22:41:18 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P1
etag: "d4213d403e8deefbf0bf8a4e5e38541b"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 48872
x-amz-cf-id: -MtUswxeoT2EOqrw_56-QGmIFVEx6bh93U-xZSJx9EAjjfAdqC5CyQ==

GET
H2 200 149x87.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/ 9 KB
9 KB 235ms
123ms Image
image/png 2600:9000:246c:a200:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/149x87.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:246c:a200:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: yNKZ9vbEfBnj1qhWWTYykJyUV_VquP_k
via: 1.1 eafee5b78499205055c54c6464d6ae70.cloudfront.net (CloudFront)
last-modified: Tue, 06 Dec 2022 22:39:14 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P1
etag: "270ddaed1302ac2fd6e7319ffdb02f7c"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 9010
x-amz-cf-id: _i1tER087KJn26IvjNjDXPFts8JKDyAUVyOStkE61bzNFKdPRhzHIA==

GET
H/1.1 200
OK facebook.png
marketing-image-production.s3.amazonaws.com/social/white/ 746 B
1 KB 155ms
66ms Image
image/png 52.216.209.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/facebook.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.209.129 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: null
Last-Modified: Tue, 29 Dec 2015 21:55:05 GMT
Server: AmazonS3
x-amz-request-id: XQCJBT990VP13ZGP
ETag: "1818ac1941f85157cf5c049321b59e8a"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 746
x-amz-id-2: Mql4XBoStYEmVYVRDKp2APQtvmteoEFPNf+mm0vm6i76EB79y3hTa4kEnDmY03KvabJCcfaksPc=

GET
H/1.1 200
OK twitter.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 160ms
71ms Image
image/png 52.216.209.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/twitter.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.209.129 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: null
Last-Modified: Tue, 29 Dec 2015 21:55:07 GMT
Server: AmazonS3
x-amz-request-id: XQCWSF4JCE3STZ2N
ETag: "4e54386509b2a7881627dde6e50a5eb8"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1389
x-amz-id-2: 6eXu76VLg2RC2eC+cNVBYGPLjW1V7ySeXk9Jk92aqJv1m0sJ/oGEkRWDatZHlLdjlBFEFh0UwNs=

GET
H/1.1 200
OK instagram.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 146ms
57ms Image
image/png 52.216.209.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/instagram.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.209.129 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: null
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: XQCJ3QSWVV37Z6VH
ETag: "c1fb933d57b4122893734f136176860a"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1289
x-amz-id-2: l/eUTvDINanzNy1tHfKFXYZOII1fVOr8pm+EFbbIwE+3nfHRGtAFCqGiOnYWgcGk+/RaSb4V5YA=

GET
H/1.1 200
OK pinterest.png
marketing-image-production.s3.amazonaws.com/social/white/ 2 KB
2 KB 158ms
69ms Image
image/png 52.216.209.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/pinterest.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.209.129 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: null
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: XQCR33D44AJ6EP1Y
ETag: "de120ffa43278ad99c946d56727c3f44"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2057
x-amz-id-2: g+1gtZNHsO1cJdUGy8I70Tey0UNSeEBCtly58XSWOESn+L7JFi4ZqrA8VMaDPKmOHEtDdUZQjmU=

GET
H/1.1 200
OK linkedin.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
1 KB 143ms
54ms Image
image/png 52.216.209.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/linkedin.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.209.129 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee

Request headers

accept-language: en-US,en;q=0.9
Referer: https://opens.nicepage.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Mon, 04 Sep 2023 16:51:21 GMT
x-amz-version-id: null
Last-Modified: Tue, 15 Mar 2016 18:17:18 GMT
Server: AmazonS3
x-amz-request-id: XQCZ6VCY94H9FJJQ
ETag: "cf25ec9b79612be7393ffb8251fdfc26"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1062
x-amz-id-2: 5huQ/Z/5wsEKCATLU8ONL6ZcWkocqcZ/vSFRN1bONkKvwUWLZfxahUkJqCT7e3PjDoaCAcqUyqo=

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 47 KB
48 KB 100ms
33ms Font
font/woff2 2607:f8b0:4004:c17::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://opens.nicepage.io
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sun, 03 Sep 2023 14:59:34 GMT
x-content-type-options: nosniff
age: 93106
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48412
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 02 Sep 2024 14:59:34 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://opens.nicepage.io/Page-1.html Message: Mixed Content: The page at 'https://opens.nicepage.io/Page-1.html' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/469x107.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://opens.nicepage.io/Page-1.html Message: Mixed Content: The page at 'https://opens.nicepage.io/Page-1.html' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/466x288.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://opens.nicepage.io/Page-1.html Message: Mixed Content: The page at 'https://opens.nicepage.io/Page-1.html' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/149x87.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://opens.nicepage.io/Page-1.html(Line 406) Message: Mixed Content: The page at 'https://opens.nicepage.io/Page-1.html' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/469x107.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://opens.nicepage.io/Page-1.html(Line 406) Message: Mixed Content: The page at 'https://opens.nicepage.io/Page-1.html' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/466x288.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://opens.nicepage.io/Page-1.html(Line 406) Message: Mixed Content: The page at 'https://opens.nicepage.io/Page-1.html' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/149x87.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

capp.nicepage.com
cdn.mcauto-images-production.sendgrid.net
fonts.googleapis.com
fonts.gstatic.com
marketing-image-production.s3.amazonaws.com
opens.nicepage.io
static.nicepage.com
151.101.194.132
2600:9000:246c:a200:6:4afb:9140:93a1
2607:f8b0:4004:c06::5f
2607:f8b0:4004:c17::5e
2a02:6ea0:e200::2
52.216.209.129
0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728
035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc
31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b
350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754
40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029
4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
9b126c3aad0ba7b56b9f36ccdc0de6ece3fd4abb5aaf4ddd8649ddb6dd0241e1
a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791
ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097
cf79c8dcb1bcdd4ef05c21b9e577369091315a6fca0f9a40c42005b20b18be60
d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee

opens.nicepage.io Open in urlscan Pro 151.101.194.132 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

6 Domains

7 Subdomains

6 IPs

1 Countries

294 kBTransfer

1350 kBSize

0 Cookies

8 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

40 JavaScript Global Variables

0 Cookies

6 Console Messages

Indicators

opens.nicepage.io Open in urlscan Pro
151.101.194.132 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

6
IPs

1
Countries

294 kB
Transfer

1350 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!