urlscan.io logo urlscan.io
SecurityTrails logo

s3.eu-west-3.amazonaws.com Open in urlscan Pro
3.5.226.160  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://secure-web.cisco.com/1ZIBSo7ZHwVzEM7EdPsIjyP3OKbZbjciAkX2CQROXXZjGxEQhQsHJtklpzN822hm4z5UplU6NSqwSO7iq3-7Z1VLUsfa88T4...
Effective URL: https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html
Submission: On March 02 via manual from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 5 HTTP transactions. The main IP is 3.5.226.160, located in Paris, France and belongs to AMAZON-02, US. The main domain is s3.eu-west-3.amazonaws.com.
TLS certificate: Issued by Amazon on December 14th 2021. Valid for: a year.
This is the only time s3.eu-west-3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2a04:e4c7:fff... 36692 (OPENDNS)
1 3.5.226.160 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 162.240.33.34 46606 (UNIFIEDLA...)
2 152.199.4.73 15133 (EDGECAST)
5 5
1    2a04:e4c7:ffff::69 (United States)

ASN36692 (OPENDNS, US)
secure-web.cisco.com
1    3.5.226.160 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: s3.eu-west-3.amazonaws.com
s3.eu-west-3.amazonaws.com
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    162.240.33.34 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 5655442.khaled.cf
nepotz.ml
2    152.199.4.73 (United States)

ASN15133 (EDGECAST, US)
aadcdn.msauthimages.net
Apex Domain
Subdomains		 Transfer
2 msauthimages.net
aadcdn.msauthimages.net — Cisco Umbrella Rank: 3813
258 KB
1 nepotz.ml
nepotz.ml
2 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 194
28 KB
1 amazonaws.com
s3.eu-west-3.amazonaws.com
597 KB
1 cisco.com
secure-web.cisco.com — Cisco Umbrella Rank: 12674
189 B
5 5
Domain Requested by
2 aadcdn.msauthimages.net
1 nepotz.ml cdnjs.cloudflare.com
1 cdnjs.cloudflare.com s3.eu-west-3.amazonaws.com
1 s3.eu-west-3.amazonaws.com
1 secure-web.cisco.com 1 redirects
5 5

This site contains no links.

Subject Issuer Validity Valid
*.s3.eu-west-3.amazonaws.com
Amazon		 2021-12-14 -
2022-12-13		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
nepotz.ml
R3		 2022-02-27 -
2022-05-28		 3 months crt.sh
aadcdn.msauthimages.net
Microsoft Azure TLS Issuing CA 02		 2021-06-08 -
2022-06-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html
Frame ID: E4676187B155C9CA611E45E86030B08A
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to Outlook

Page URL History Show full URLs

  1. https://secure-web.cisco.com/1ZIBSo7ZHwVzEM7EdPsIjyP3OKbZbjciAkX2CQROXXZjGxEQhQsHJtklpzN822hm4z5UplU6NSqw... HTTP 302
    https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

885 kB
Transfer

1229 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://secure-web.cisco.com/1ZIBSo7ZHwVzEM7EdPsIjyP3OKbZbjciAkX2CQROXXZjGxEQhQsHJtklpzN822hm4z5UplU6NSqwSO7iq3-7Z1VLUsfa88T40yT52Gf-WczCrSP388Bbwta9H8RfMsaiPwr_iZdTSIk4UWrupOiQWeeYOgIGwh8C-B_aWJ65a38PtN5DTwqac144a0c4dCIqVeE6ap9Ti7qlvogTCry57devjzkZbnhqY-L6-Gmwff7S-O6ylMoOKk0csg6Jj8X_zx8hOrIpsOE8jNnYjOGylluOslJC4tj9yBvXGg07qsfNczcwFNSv-dkDsANpKrx0T/https%3A%2F%2Fs3.eu-west-3.amazonaws.com%2Fsafteystorageunit.facedsupplytrain%2Fpayappfile08087.html%23mark.paull%40cn.ca%23bWFyay5wYXVsbEBjbi5jYQ%3D%3D%5D%29 HTTP 302
    https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request payappfile08087.html
s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/
Redirect Chain
  • https://secure-web.cisco.com/1ZIBSo7ZHwVzEM7EdPsIjyP3OKbZbjciAkX2CQROXXZjGxEQhQsHJtklpzN822hm4z5UplU6NSqwSO7iq3-7Z1VLUsfa88T40yT52Gf-WczCrSP388Bbwta9H8RfMsaiPwr_iZdTSIk4UWrupOiQWeeYOgIGwh8C-B_aWJ65...
  • https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html
597 KB
597 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.5.226.160 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
s3.eu-west-3.amazonaws.com
Software
AmazonS3 /
Resource Hash
2f710211bb101942e27de898ba9dabae0f6008ba4bba204423c742cb692d83be

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

x-amz-id-2
5YwAsaQaVn9mvm+GL2bBZl0EOyu++7IDuI5jFtzcsLbbYQmCZ+g3bU9V1U4Yt1k2AGLmYi8HuhZl98TvNlYq2g==
x-amz-request-id
PASBZQBVQ8KBAPY6
Date
Wed, 02 Mar 2022 21:19:15 GMT
Last-Modified
Wed, 02 Mar 2022 16:40:20 GMT
ETag
"d107e404cdc425d530f67d554e4c4cc2"
Accept-Ranges
bytes
Content-Type
text/html
Server
AmazonS3
Content-Length
611129

Redirect headers

server
openresty/1.19.3.1
date
Wed, 02 Mar 2022 21:19:13 GMT
content-type
text/html
content-length
0
location
https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html#mark.paull@cn.ca#bWFyay5wYXVsbEBjbi5jYQ==])
talos-dc-id
8
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: s3.eu-west-3.amazonaws.com
URL: https://s3.eu-west-3.amazonaws.com/safteystorageunit.facedsupplytrain/payappfile08087.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://s3.eu-west-3.amazonaws.com/
Origin
https://s3.eu-west-3.amazonaws.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 21:19:14 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1819322
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27938
timing-allow-origin
*
last-modified
Tue, 02 Mar 2021 18:58:36 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"603e8adc-15d9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9VSNunwIZO2HAdNhvyxBnibXNY1gn8xaqOvdlbeaRAInff6VpBqk%2B9A3ey6c47hxehP2JMseIsfXVMv2W%2F%2ForbzaLQ20qj%2B8L13XE7KAidF4rRSCAOWJC4%2BmifTItzPAg%2FUyPvDh7thKDP%2FgnR0es4WZ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6e5d2b62ec0a7144-YUL
expires
Mon, 20 Feb 2023 21:19:14 GMT
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		756 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		899 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		222 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		277 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		513 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		915 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/svg+xml
call.php
nepotz.ml/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://nepotz.ml/call.php?u=mark.paull@cn.ca
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.240.33.34 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
5655442.khaled.cf
Software
Apache /
Resource Hash
ebe4cb4abe94e7fac4166962719e4da7b828bc0afae4f10634f9c11cc7c7a445

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://s3.eu-west-3.amazonaws.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Wed, 02 Mar 2022 21:19:15 GMT
cache-control
no-cache
server
Apache
access-control-allow-headers
*
content-type
application/json
illustration
aadcdn.msauthimages.net/dbd5a2dd-0xdqhcczpid1-nit4vy868ppc3wbby-rv96h4-eff20/logintenantbranding/0/ 		256 KB
256 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauthimages.net/dbd5a2dd-0xdqhcczpid1-nit4vy868ppc3wbby-rv96h4-eff20/logintenantbranding/0/illustration?ts=637198198105392300
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.4.73 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7928) /
Resource Hash
d5fafd32020bbde2c62ee875a824b46db51560268138dfb10eb18587a4ff8d1d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://s3.eu-west-3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 02 Mar 2022 21:19:16 GMT
last-modified
Sat, 14 Mar 2020 21:56:51 GMT
server
ECAcc (nya/7928)
content-md5
YeM8nq5xGlip8u3zl1ty7w==
age
13001
etag
0x8D7C86299F83B94
x-cache
HIT
content-type
image/*
x-ms-request-id
2ac70897-a01e-0028-6d5c-2ef7e6000000
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
262130
bannerlogo
aadcdn.msauthimages.net/dbd5a2dd-0xdqhcczpid1-nit4vy868ppc3wbby-rv96h4-eff20/logintenantbranding/0/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauthimages.net/dbd5a2dd-0xdqhcczpid1-nit4vy868ppc3wbby-rv96h4-eff20/logintenantbranding/0/bannerlogo?ts=637198198116770071
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.4.73 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79D2) /
Resource Hash
e1d7357c972dde74e46f8eda9d2b1f1dbb34a44d9e114b523032c4e8be24d2c9

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://s3.eu-west-3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 02 Mar 2022 21:19:16 GMT
last-modified
Sat, 14 Mar 2020 21:56:52 GMT
server
ECAcc (nya/79D2)
content-md5
Vqlm9Fej2G405Gp9nE+4KA==
age
15846
etag
0x8D7C8629A94980B
x-cache
HIT
content-type
image/*
x-ms-request-id
c4dd2a3b-001e-0048-0556-2eb2c4000000
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
1561

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery number| lc function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash

0 Cookies