![](/screenshots/ad8591e5-195a-40b8-aced-2d0aa7af7d69.png)
s3.amazonaws.com
Open in
urlscan Pro
52.216.105.245
Malicious Activity!
Public Scan
Submission: On February 28 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by Amazon RSA 2048 M01 on December 6th 2022. Valid for: a year.
This is the only time s3.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: LinkedIn (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 52.216.105.245 52.216.105.245 | 16509 (AMAZON-02) (AMAZON-02) | |
7 | 2620:1ec:4f:1... 2620:1ec:4f:1::45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
4 | 2606:2800:233... 2606:2800:233:66b5:799a:7cd3:f74d:7071 | 15133 (EDGECAST) (EDGECAST) | |
1 | 54.246.217.115 54.246.217.115 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200d | 15169 (GOOGLE) (GOOGLE) | |
15 | 5 |
ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
ASN15133 (EDGECAST, US)
platform.linkedin.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-217-115.eu-west-1.compute.amazonaws.com
lnkd.demdex.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
licdn.com
static-exp1.licdn.com — Cisco Umbrella Rank: 139970 |
158 KB |
4 |
linkedin.com
platform.linkedin.com — Cisco Umbrella Rank: 3065 |
97 KB |
2 |
amazonaws.com
s3.amazonaws.com |
35 KB |
1 |
google.com
accounts.google.com — Cisco Umbrella Rank: 76 |
949 B |
1 |
demdex.net
lnkd.demdex.net — Cisco Umbrella Rank: 5005 |
3 KB |
15 | 5 |
Domain | Requested by | |
---|---|---|
7 | static-exp1.licdn.com |
s3.amazonaws.com
|
4 | platform.linkedin.com |
s3.amazonaws.com
|
2 | s3.amazonaws.com |
static-exp1.licdn.com
|
1 | accounts.google.com |
static-exp1.licdn.com
|
1 | lnkd.demdex.net |
s3.amazonaws.com
|
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
s3.amazonaws.com Amazon RSA 2048 M01 |
2022-12-06 - 2023-12-05 |
a year | crt.sh |
static.licdn.com DigiCert SHA2 Secure Server CA |
2023-01-27 - 2023-07-27 |
6 months | crt.sh |
platform.linkedin.com DigiCert SHA2 Secure Server CA |
2022-08-11 - 2023-08-11 |
a year | crt.sh |
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-09-26 - 2023-10-27 |
a year | crt.sh |
accounts.google.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://s3.amazonaws.com/appforest_uf/f1677593621170x603422655249978900/LinkedIn.html
Frame ID: AF5A3160E891D12A5E59943F25BF8BFF
Requests: 14 HTTP requests in this frame
Frame:
https://lnkd.demdex.net/dest5.html?d_nsid=0
Frame ID: 934DE4CE6023702C21E904DFF8D7480E
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
LinkedIn.html
s3.amazonaws.com/appforest_uf/f1677593621170x603422655249978900/ |
34 KB 34 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6u4abakrebm97iir18d17rmu0
static-exp1.licdn.com/sc/h/ |
206 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9z2qszoigwown5438iofxsbd3
static-exp1.licdn.com/sc/h/ |
134 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2qwdjwm18c9qqjkkqgthouslg
static-exp1.licdn.com/sc/h/ |
62 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6jblk5oqhlo45xbkmcr7s4zix
static-exp1.licdn.com/sc/h/ |
64 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eifp0ukycgmm5y0uay3omxuap
static-exp1.licdn.com/sc/h/ |
1 KB 793 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
z5z0fyn9degkqxthacxz44e4
static-exp1.licdn.com/sc/h/ |
73 KB 22 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtag-adwords.js
platform.linkedin.com/litms/vendor/google/ |
78 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
50seqnxcfadh00enh9ffvk85k
static-exp1.licdn.com/sc/h/ |
181 KB 51 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.js
platform.linkedin.com/litms/utag/checkpoint-frontend/ |
132 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.107.js
platform.linkedin.com/litms/utag/checkpoint-frontend/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
platform.linkedin.com/js/ |
60 KB 23 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
lnkd.demdex.net/ Frame 934D |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
status
accounts.google.com/gsi/ |
37 B 949 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
track
s3.amazonaws.com/li/ |
296 B 595 B |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: LinkedIn (Social Network)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| gapi object| _ object| gadgets object| osapi object| ___jsl object| oauth2 object| default_gsi object| closure_lm_72721 object| google object| artdeco object| _artdecoBakedCurves object| __core-js_shared__ object| utag_data object| utag_cfg_ovrd object| _0x3365 function| _0xcf3d function| GooglemKTybQhCsO function| google_trackConversion object| google_tag_manager object| dataLayer object| google_tag_data function| ga object| gaplugins undefined| tealiumDil boolean| utag_condload object| landingPageUrl object| utag boolean| __tealium_twc_switch function| DIL object| __G_ID_CLIENT__1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.linkedin.com/ | Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=2961:u=1:x=1:i=1677628240:t=1677714640:v=2:sig=AQGrl9jRaljL4r7jPGQaVn79QCx_saDm" |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.google.com
lnkd.demdex.net
platform.linkedin.com
s3.amazonaws.com
static-exp1.licdn.com
2606:2800:233:66b5:799a:7cd3:f74d:7071
2620:1ec:4f:1::45
2a00:1450:4001:80e::200d
52.216.105.245
54.246.217.115
2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f
2e98c7afb5696bf2b30f59eeb5cf6ccdb6d39c031d34c41b4549ac396e7733c9
348df093a36c0b1c994a7d028a8db84e2f15715c3ede86d6338a20fe3eb7be32
597c946522dec4cf136d651c70944887b7e30adfb8aa5196815b0225283e1253
6473bb74e2ed75f67eccc9e098332561dde8a1375cf26cb63b8bbbe002423d5e
704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
99c52046d1df362721eb275cabcd169c7e105d0bbaf374a7c9f96ddf6c1216f2
9edf0e1fc3ef5062d6aef1b537226c289970b6bb7bb5cd0f1855ad8fadecdd42
9f4acbcc048cd2aa16c33ae9ad0d7fc15b449dc0e608e5f0541ca818a52a378a
c07f4c4caa7bf62915a154289d26250b2ae256215175e2f413cd5e664c94bde2
f42b7a2cbb2607296976b3374653138109d4b2f05070c52820860ed1a83a98da
f5e6ec23679c3943d6a270eeb3adbf3a1477e316c0461071d5a81e143df3a4ab
fb7c416a03d56261dc4877bb453599c15479a079455aea149754e8cc44d1c6f1
ffbf8b87d477b1f917e6358124494745533f7820946c87bab5e9817202356b8a