![](/screenshots/bb26cd81-9c14-4a06-89bb-0473bf118658.png)
s3-ca-central-1.amazonaws.com
Open in
urlscan Pro
52.95.145.31
Malicious Activity!
Public Scan
Effective URL: https://s3-ca-central-1.amazonaws.com/24wx8z2xv3/index_rpl_n.html?fbclid=13434494493130752&fbnam=AdobeFlashPlayer.dmg
Submission: On July 04 via api from DE
Summary
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on March 19th 2019. Valid for: a year.
This is the only time s3-ca-central-1.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fake Flash UpdateDomain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 213.247.47.190 213.247.47.190 | 27257 (WEBAIR-IN...) (WEBAIR-INTERNET - Webair Internet Development Company Inc.) | |
2 | 3.92.103.120 3.92.103.120 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 1 | 2606:4700:30:... 2606:4700:30::681f:4397 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
3 | 52.95.145.31 52.95.145.31 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
8 | 4 |
ASN27257 (WEBAIR-INTERNET - Webair Internet Development Company Inc., US)
sentinelandenterpirse.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-92-103-120.compute-1.amazonaws.com
usa.franciscus-ful.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
kkdojdkx.airstreamwashing.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3.ca-central-1.amazonaws.com
s3-ca-central-1.amazonaws.com |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
amazonaws.com
s3-ca-central-1.amazonaws.com |
20 KB |
2 |
franciscus-ful.com
usa.franciscus-ful.com |
3 KB |
2 |
sentinelandenterpirse.com
sentinelandenterpirse.com |
1 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
airstreamwashing.com
1 redirects
kkdojdkx.airstreamwashing.com |
488 B |
8 | 5 |
Domain | Requested by | |
---|---|---|
3 | s3-ca-central-1.amazonaws.com |
usa.franciscus-ful.com
s3-ca-central-1.amazonaws.com |
2 | usa.franciscus-ful.com |
sentinelandenterpirse.com
usa.franciscus-ful.com |
2 | sentinelandenterpirse.com |
sentinelandenterpirse.com
|
1 | code.jquery.com |
s3-ca-central-1.amazonaws.com
|
1 | kkdojdkx.airstreamwashing.com | 1 redirects |
8 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
advancedwatchers--elliotfinkel.repl.co |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.ca-central-1.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-03-19 - 2020-07-10 |
a year | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://s3-ca-central-1.amazonaws.com/24wx8z2xv3/index_rpl_n.html?fbclid=13434494493130752&fbnam=AdobeFlashPlayer.dmg
Frame ID: CB5A39ABB751EF74DBD478D7B6D1957D
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/bb26cd81-9c14-4a06-89bb-0473bf118658.png)
Page URL History Show full URLs
- http://sentinelandenterpirse.com/ Page URL
- http://sentinelandenterpirse.com/ Page URL
- http://usa.franciscus-ful.com/zcvisitor/7cc5ae42-9e90-11e9-9feb-0acfd90ff23e?campaignid=6155c980-852f-11e9... Page URL
- http://usa.franciscus-ful.com/zcredirect?visitid=7cc5ae42-9e90-11e9-9feb-0acfd90ff23e&type=js&browserWidth... Page URL
-
https://kkdojdkx.airstreamwashing.com/pontel/?fbcmid=4583&fbsuid=zr7cc5ae429e9011e99feb0acfd90ff23e00da21cfa05c4e5...
HTTP 302
https://s3-ca-central-1.amazonaws.com/24wx8z2xv3/index_rpl_n.html?fbclid=13434494493130752&fbnam=AdobeFlashPlayer.dmg Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: click here
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://sentinelandenterpirse.com/ Page URL
- http://sentinelandenterpirse.com/ Page URL
- http://usa.franciscus-ful.com/zcvisitor/7cc5ae42-9e90-11e9-9feb-0acfd90ff23e?campaignid=6155c980-852f-11e9-a9b5-0a157bfa6bfc Page URL
- http://usa.franciscus-ful.com/zcredirect?visitid=7cc5ae42-9e90-11e9-9feb-0acfd90ff23e&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false Page URL
-
https://kkdojdkx.airstreamwashing.com/pontel/?fbcmid=4583&fbsuid=zr7cc5ae429e9011e99feb0acfd90ff23e00da21cfa05c4e53a994d418bad279ef039499c2ffc07b01b5
HTTP 302
https://s3-ca-central-1.amazonaws.com/24wx8z2xv3/index_rpl_n.html?fbclid=13434494493130752&fbnam=AdobeFlashPlayer.dmg Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sentinelandenterpirse.com/ |
664 B 637 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
![]() sentinelandenterpirse.com/ |
220 B 614 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7cc5ae42-9e90-11e9-9feb-0acfd90ff23e
usa.franciscus-ful.com/zcvisitor/ |
1014 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zcredirect
usa.franciscus-ful.com/ |
480 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index_rpl_n.html
s3-ca-central-1.amazonaws.com/24wx8z2xv3/ Redirect Chain
|
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
topbar.png
s3-ca-central-1.amazonaws.com/24wx8z2xv3/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
s3-ca-central-1.amazonaws.com/24wx8z2xv3/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fake Flash Update5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
kkdojdkx.airstreamwashing.com
s3-ca-central-1.amazonaws.com
sentinelandenterpirse.com
usa.franciscus-ful.com
205.185.208.52
213.247.47.190
2606:4700:30::681f:4397
3.92.103.120
52.95.145.31
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
5fb788479069416a864a98fb67586db346e64648bad45f9770ee8ef41fac7571
9582c556213790471ab235d13d9d2cffafee8eea6d0880f11f01367fe48aea82
c892ede66daf7312088c3cacc68ccc3fb35cac385657d8028609c0d49aaf540f
c98f42f9309c37da7a046944797f97a220fa2b36e404ae7f06f0741cf6aeb0b9
e81e79f107c7173ca17b9760c4e35b8442634d3fcbedd4d91b765d176256300b
f2e75a91bcc3142b3dfff9c0c3692fb66b1cb719ce128fb37e5fbb118209cff5