s3.amazonaws.com Open in urlscan Pro
52.216.128.61  Malicious Activity! Public Scan

Submitted URL: https://www.google.com.ni/url?q=%68%74t%70%3A%2F%2Fs%77%4e%6aS%55%44q%2e%74ommygr%61ym%75%73i%63.com%3F%73wNjSUDq%3D6d61%3...
Effective URL: https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAsz...
Submission: On January 16 via manual from IN — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 52.216.128.61, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on December 6th 2022. Valid for: a year.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
1 1 69.49.244.31 19871 (NETWORK-S...)
3 52.216.128.61 16509 (AMAZON-02)
2 162.213.255.79 22612 (NAMECHEAP...)
6 4
Apex Domain
Subdomains
Transfer
3 amazonaws.com
s3.amazonaws.com
101 KB
2 schseels.com
schseels.com
1 KB
1 tommygraymusic.com
swnjsudq.tommygraymusic.com
556 B
1 google.com.ni
www.google.com.ni — Cisco Umbrella Rank: 37051
2 KB
6 4
Domain Requested by
3 s3.amazonaws.com www.google.com.ni
s3.amazonaws.com
2 schseels.com s3.amazonaws.com
1 swnjsudq.tommygraymusic.com 1 redirects
1 www.google.com.ni
6 4

This site contains no links.

Subject Issuer Validity Valid
*.google.com.ni
GTS CA 1C3
2022-12-12 -
2023-03-06
3 months crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2022-12-06 -
2023-12-05
a year crt.sh
schseels.com
Sectigo RSA Domain Validation Secure Server CA
2022-07-28 -
2023-07-28
a year crt.sh

This page contains 1 frames:

Primary Page: https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
Frame ID: 0A62F94BD68C96FC8FBC17561BA6F4D4
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Sign In

Page URL History Show full URLs

  1. https://www.google.com.ni/url?q=%68%74t%70%3A%2F%2Fs%77%4e%6aS%55%44q%2e%74ommygr%61ym%75%73i%63.com%3... Page URL
  2. http://swnjsudq.tommygraymusic.com/?swNjSUDq=6d6172632e6a61636b736f6e407361696e742d676f6261696e2e636f6d&16 HTTP 302
    https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2... Page URL

Page Statistics

6
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

104 kB
Transfer

132 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.google.com.ni/url?q=%68%74t%70%3A%2F%2Fs%77%4e%6aS%55%44q%2e%74ommygr%61ym%75%73i%63.com%3F%73wNjSUDq%3D6d61%37%32%36%33%32%656a6%31%36%336b%37%33%36f%36e%3407%336%316%39%36e74%32d676%666%3261%36%396e2%656%33%36f6d%26%316&sa=D&sntz=1&usg=AOvVaw0FCZX1GWjeFuO8q7xE_lI6 Page URL
  2. http://swnjsudq.tommygraymusic.com/?swNjSUDq=6d6172632e6a61636b736f6e407361696e742d676f6261696e2e636f6d&16 HTTP 302
    https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
url
www.google.com.ni/
585 B
2 KB
Document
General
Full URL
https://www.google.com.ni/url?q=%68%74t%70%3A%2F%2Fs%77%4e%6aS%55%44q%2e%74ommygr%61ym%75%73i%63.com%3F%73wNjSUDq%3D6d61%37%32%36%33%32%656a6%31%36%336b%37%33%36f%36e%3407%336%316%39%36e74%32d676%666%3261%36%396e2%656%33%36f6d%26%316&sa=D&sntz=1&usg=AOvVaw0FCZX1GWjeFuO8q7xE_lI6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
819c5d1fb51703af9f1e39181edc1b2adb3148b0a285c1c8aa5f8548ff3e0877
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-length
585
content-type
text/html; charset=UTF-8
cross-origin-opener-policy-report-only
same-origin-allow-popups; report-to="gws"
date
Mon, 16 Jan 2023 10:15:38 GMT
expires
Mon, 16 Jan 2023 10:15:38 GMT
location
http://swNjSUDq.tommygraymusic.com?swNjSUDq=6d6172632e6a61636b736f6e407361696e742d676f6261696e2e636f6d&16
origin-trial
AqRrpS1jM/HOs1rGR0CnXerKEP/QFz7qj9ApDSZqAO+0U+KcT/h/lxA6akW4ar0kT0V1bw5MD4t8O7L7OFwM5gUAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY3ODIzMzU5OX0=
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy
unload=()
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
server
gws
strict-transport-security
max-age=31536000
x-xss-protection
0
Primary Request index.shtml
s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/
Redirect Chain
  • http://swnjsudq.tommygraymusic.com/?swNjSUDq=6d6172632e6a61636b736f6e407361696e742d676f6261696e2e636f6d&16
  • https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dO...
6 KB
7 KB
Document
General
Full URL
https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
Requested by
Host: www.google.com.ni
URL: https://www.google.com.ni/url?q=%68%74t%70%3A%2F%2Fs%77%4e%6aS%55%44q%2e%74ommygr%61ym%75%73i%63.com%3F%73wNjSUDq%3D6d61%37%32%36%33%32%656a6%31%36%336b%37%33%36f%36e%3407%336%316%39%36e74%32d676%666%3261%36%396e2%656%33%36f6d%26%316&sa=D&sntz=1&usg=AOvVaw0FCZX1GWjeFuO8q7xE_lI6
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.128.61 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
3e3d3ad6ea83f2c798c644a893e2d54bdc4b020a0be5f8e93721fe8d3fa30eb0

Request headers

Referer
https://www.google.com.ni/url?q=%68%74t%70%3A%2F%2Fs%77%4e%6aS%55%44q%2e%74ommygr%61ym%75%73i%63.com%3F%73wNjSUDq%3D6d61%37%32%36%33%32%656a6%31%36%336b%37%33%36f%36e%3407%336%316%39%36e74%32d676%666%3261%36%396e2%656%33%36f6d%26%316&sa=D&sntz=1&usg=AOvVaw0FCZX1GWjeFuO8q7xE_lI6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public,max-age=86400
Content-Length
6252
Content-Type
text/html
Date
Mon, 16 Jan 2023 10:15:40 GMT
ETag
"0e7f18e329e7ade74e6daa92a7086d59"
Last-Modified
Tue, 03 Jan 2023 01:07:12 GMT
Server
AmazonS3
x-amz-id-2
PnT1leqyc1lO+KvdEe8sRYQ1DPd/B8H8MP3EZKbF5Cw+vFc74niDjK3ias6Cv4DcK/q7dK0LlxQ=
x-amz-meta-app-version
test
x-amz-meta-appname
oiuytreoihgfr56utr678uy67
x-amz-request-id
ST9PCQT14YR12YCZ
x-amz-server-side-encryption
AES256
x-amz-version-id
2QSUxSuLjrXkfwU3PyBBpnBoQe8C0qhg

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 16 Jan 2023 10:15:38 GMT
Keep-Alive
timeout=5, max=100
Location
https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
Server
Apache
style.js
s3.amazonaws.com/appforest_uf/f1672707970263x166322066186114430/
34 KB
34 KB
Script
General
Full URL
https://s3.amazonaws.com/appforest_uf/f1672707970263x166322066186114430/style.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.128.61 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2e61bc2f5a1d63d85416d7f9f18f915902e674079873effcee70b2a580647906

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Mon, 16 Jan 2023 10:15:40 GMT
x-amz-meta-appname
oiuytreoihgfr56utr678uy67
x-amz-version-id
Se.dcA1MCFOVbXT7VAVKXnUnE98wQINr
Last-Modified
Tue, 03 Jan 2023 01:06:11 GMT
Server
AmazonS3
x-amz-request-id
ST9GTY60HKDCGVD9
ETag
"e96887c9a5e057c40be38854086ae65d"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
34588
x-amz-id-2
ota5xE/O3G8sJ5wvm2Uo6KG6/qCkgLN9LyzZcO6TRCjic9bXT0tWJZ452AEMpinQveJBfSY8YzM=
style.css
s3.amazonaws.com/appforest_uf/f1672683999879x350647862015784700/
60 KB
60 KB
Stylesheet
General
Full URL
https://s3.amazonaws.com/appforest_uf/f1672683999879x350647862015784700/style.css
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.128.61 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d821b8c489cce8225e2426092268ea570c115869213cf654eae559a828a2b8aa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/appforest_uf/f1672708030825x172733930866008060/index.shtml?yvNXukzoUHFXOz3e2UseQzJRzzvIc8ANClAszmi6mQwUEeCXOc/wjlziFxZgWEw0CULPNFCtKsFJPFILUg8LqYKe8Xlid0i1XfzeZ?LnmaRwPP=dOCdrNPMQIwCOnP1yfLN&email=marc.jackson@saint-gobain.com&tpYbj51tFvvnjLd8KcG1NSIsJW9vRhU27awTsvjE62c33ikIKL9=GBt1vOLNnVPPQhRREgjMTxCIkIGoad01Nh8s8SfcBET78J1I68
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Mon, 16 Jan 2023 10:15:40 GMT
x-amz-meta-appname
oiuytreoihgfr56utr678uy67
x-amz-version-id
_8tMYkkeSAhVHtAMR9OMtA0ucJoNHoKx
Last-Modified
Mon, 02 Jan 2023 18:26:41 GMT
Server
AmazonS3
x-amz-request-id
ST9SHA18SB35CM5N
ETag
"3b558262599658cb91628aa1f34cca88"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/css
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
61106
x-amz-id-2
TUVOdkDPrNM1YtXXhqEHmJkTDw0gVruqf2FxhP5v+7b5QtRPWY88PS6Myvg7nXJ0Jmj2u3O76CY=
sendmail.php
schseels.com/
465 B
476 B
XHR
General
Full URL
https://schseels.com/sendmail.php
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1672707970263x166322066186114430/style.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed / PHP/7.1.33
Resource Hash
e66d8f1437eaead687a5714763f5baa36c9955f8e3e02a7f344368b3f49b4e44

Request headers

Referer
https://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 16 Jan 2023 10:15:41 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.1.33
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
x-turbo-charged-by
LiteSpeed
content-length
255
expires
Mon, 16 Jan 2023 10:15:41 GMT
sendmail.php
schseels.com/
3 KB
876 B
XHR
General
Full URL
https://schseels.com/sendmail.php
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1672707970263x166322066186114430/style.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed / PHP/7.1.33
Resource Hash
29510f66b5eec4dceaea07219cd7dfd7834daf520775ffb23520a36e9109ff79

Request headers

Referer
https://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 16 Jan 2023 10:15:41 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.1.33
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
x-turbo-charged-by
LiteSpeed
content-length
655
expires
Mon, 16 Jan 2023 10:15:41 GMT
truncated
/
28 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange string| url_land function| sendData function| GetLogoBanner function| ForLanG function| LoginErrors number| maxPasswordLength function| getUrlVars function| InputUtil object| paginationManager object| Login function| check_email undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage object| PaginationUtil object| PaginationManager object| LoginManager object| options object| _self string| value

2 Cookies

Domain/Path Name / Value
.google.com.ni/ Name: __Secure-ENID
Value: 9.SE=EEXqfkxpQXHim8rMngEx8De-jNjt3h79rM7EnkdoI27nUvKd9miC2o2glg71YfQHwjLpjvv8fna3aqjFwwSoS0WZJvjKsck1fK3zUwTtyJYYxhz7UlyCeT1Ie8qdpLpKEofwo_3gZqaKlTtC07Yx8iLgxWApsnVz_4057Z46VBY
.google.com.ni/ Name: CONSENT
Value: PENDING+997

1 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'unload'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 0