1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com
Open in
urlscan Pro
52.218.63.2
Malicious Activity!
Public Scan
Effective URL: https://1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com/6c3d29bcca0029c2c37a887ecfd714ed
Submission: On January 29 via manual from IN
Summary
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on November 9th 2019. Valid for: a year.
This is the only time 1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 101.50.1.16 101.50.1.16 | 55688 (BEON-AS-I...) (BEON-AS-ID PT. Beon Intermedia) | |
1 | 52.218.63.2 52.218.63.2 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 103.153.182.185 103.153.182.185 | 140947 (SNTHOSTIN...) (SNTHOSTINGS-AS-AP SnTHostings) | |
3 | 3 |
ASN55688 (BEON-AS-ID PT. Beon Intermedia, ID)
PTR: meepo.beon.co.id
www.wkgvctr.griyabroker.com | |
griyabroker.com | |
www.griyabroker.com |
ASN16509 (AMAZON-02, US)
PTR: s3-3-w.amazonaws.com
1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com |
ASN140947 (SNTHOSTINGS-AS-AP SnTHostings, IN)
PTR: 103.153.182.185.static.snthostings.com
gfylwco.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
griyabroker.com
2 redirects
www.wkgvctr.griyabroker.com griyabroker.com www.griyabroker.com |
855 B |
2 |
gfylwco.ru
1 redirects
gfylwco.ru |
256 B |
1 |
amazonaws.com
1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com |
495 B |
3 | 3 |
Domain | Requested by | |
---|---|---|
2 | gfylwco.ru |
1 redirects
1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com
|
1 | 1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com | |
1 | www.griyabroker.com | |
1 | griyabroker.com | 1 redirects |
1 | www.wkgvctr.griyabroker.com | 1 redirects |
3 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
griyabroker.com cPanel, Inc. Certification Authority |
2020-11-22 - 2021-02-20 |
3 months | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-11-09 - 2021-03-12 |
a year | crt.sh |
gfylwco.ru R3 |
2021-01-28 - 2021-04-28 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com/6c3d29bcca0029c2c37a887ecfd714ed
Frame ID: 693FF96766C992135A304322FC2F8C08
Requests: 2 HTTP requests in this frame
Frame:
https://gfylwco.ru/sancjkndcsjkcds/
Frame ID: 622F92CFEE90F50085B0A99597C14171
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.wkgvctr.griyabroker.com/%4020%4040%40/
HTTP 302
https://griyabroker.com/zz/ HTTP 301
https://www.griyabroker.com/zz/ Page URL
- https://1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com/6c3d29bcca0029c2c37a887ecfd714ed Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.wkgvctr.griyabroker.com/%4020%4040%40/
HTTP 302
https://griyabroker.com/zz/ HTTP 301
https://www.griyabroker.com/zz/ Page URL
- https://1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com/6c3d29bcca0029c2c37a887ecfd714ed Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.wkgvctr.griyabroker.com/%4020%4040%40/ HTTP 302
- https://griyabroker.com/zz/ HTTP 301
- https://www.griyabroker.com/zz/
- https://gfylwco.ru/sancjkndcsjkcds HTTP 301
- https://gfylwco.ru/sancjkndcsjkcds/
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
www.griyabroker.com/zz/ Redirect Chain
|
418 B 338 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
6c3d29bcca0029c2c37a887ecfd714ed
1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com/ |
139 B 495 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
gfylwco.ru/sancjkndcsjkcds/ Frame 622F Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1dcc70c93e2101b7a5a3a82caa34d7ed.s3.amazonaws.com
gfylwco.ru
griyabroker.com
www.griyabroker.com
www.wkgvctr.griyabroker.com
101.50.1.16
103.153.182.185
52.218.63.2
4832fcfb3ddd9840cb7f9b019cf69c3c1335aa51378fed36772024d11d17469e
adf4eb8567f39277bf4896652e291e2f36cc3ca7c051deb513fd4ab9b779e60f