webmail.strongencryption.org
Open in
urlscan Pro
54.165.72.32
Malicious Activity!
Public Scan
Effective URL: https://webmail.strongencryption.org/pages/4fb04a0e358f?crid=312206865&crun=908072&dom=addto.password.land
Submission: On August 31 via manual from US
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 31st 2016. Valid for: 3 years.
This is the only time webmail.strongencryption.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Phishing Simulation (Internet)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 54.165.72.32 54.165.72.32 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 52.216.230.141 52.216.230.141 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 69.48.252.217 69.48.252.217 | 7381 (SUNGARDRS) (SUNGARDRS - SunGard Availability Services LP) | |
9 | 3 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-165-72-32.compute-1.amazonaws.com
webmail.strongencryption.org |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
ASN7381 (SUNGARDRS - SunGard Availability Services LP, US)
PTR: cluster3.convio.net
give.salvationarmyusa.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
strongencryption.org
webmail.strongencryption.org |
810 KB |
1 |
salvationarmyusa.org
give.salvationarmyusa.org |
13 KB |
1 |
amazonaws.com
s3.amazonaws.com |
25 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
7 | webmail.strongencryption.org |
webmail.strongencryption.org
|
1 | give.salvationarmyusa.org |
webmail.strongencryption.org
|
1 | s3.amazonaws.com |
webmail.strongencryption.org
|
9 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
addto.password.land |
Subject Issuer | Validity | Valid | |
---|---|---|---|
knowbe4.com Go Daddy Secure Certificate Authority - G2 |
2016-03-31 - 2019-02-25 |
3 years | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2016-07-29 - 2017-11-29 |
a year | crt.sh |
give.salvationarmyusa.org GeoTrust EV SSL CA - G4 |
2017-06-19 - 2018-08-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://webmail.strongencryption.org/pages/4fb04a0e358f?crid=312206865&crun=908072&dom=addto.password.land
Frame ID: 30546.1
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
4fb04a0e358f
webmail.strongencryption.org/pages/ Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
application-810250b25f18eca662cc77e8c830faa2aaa2d4375e11b7ae5d52276cfdec46a8.js
webmail.strongencryption.org/assets/ |
3 MB 786 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
webmail.strongencryption.org/assets/ |
50 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sei-modal-3fcf13edc4386a4a52e8ac7316ac98aa8c303630b572ce1b09c2bc569a1c3002.css
webmail.strongencryption.org/assets/ |
617 B 347 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sei-tooltip-765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1.css
webmail.strongencryption.org/assets/ |
2 KB 555 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css
webmail.strongencryption.org/assets/ |
1 KB 524 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Hand.png
s3.amazonaws.com/knowbe4-images/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Hurricane_Harvey_banner_855x95.png
give.salvationarmyusa.org/images/content/pagebuilder/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
webmail.strongencryption.org/assets/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Phishing Simulation (Internet)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
give.salvationarmyusa.org
s3.amazonaws.com
webmail.strongencryption.org
52.216.230.141
54.165.72.32
69.48.252.217
2dd106db4056f969d4ec1e4e3d35b44953eed12f72af50107f1eb0c60fb88093
3fcf13edc4386a4a52e8ac7316ac98aa8c303630b572ce1b09c2bc569a1c3002
5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1
810250b25f18eca662cc77e8c830faa2aaa2d4375e11b7ae5d52276cfdec46a8
b02cffc112737ba0eb6659534f4d2ef29dd2bdf135b2ee71eddb278dc16a3158
bd86cece3ea786f054d88f55956d322d68681fa7b58a3f7c4e67698a8982f878
fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9