urlscan.io logo urlscan.io
SecurityTrails logo

getflash-s3plug-now.com Open in urlscan Pro
52.21.57.179  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://urllie.com/ky6ou
Effective URL: https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Submission: On September 20 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 6 domains to perform 6 HTTP transactions. The main IP is 52.21.57.179, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is getflash-s3plug-now.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 5th 2020. Valid for: 3 months.
This is the only time getflash-s3plug-now.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple Software Update (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 5.149.248.110 59711 (HZ-NL-AS)
1 1 5.149.248.70 59711 (HZ-NL-AS)
1 78.140.165.10 35415 (WEBZILLA)
1 1 139.45.195.38 9002 (RETN-AS)
1 1 100.25.178.199 14618 (AMAZON-AES)
5 52.21.57.179 14618 (AMAZON-AES)
6 2
1    5.149.248.110 (Netherlands)

ASN59711 (HZ-NL-AS, GB)
urllie.com
1    5.149.248.70 (Netherlands)

ASN59711 (HZ-NL-AS, GB)
xtraserp.com
1    78.140.165.10 (Netherlands)

ASN35415 (WEBZILLA, NL)
g3nerat3dn3w.best
1    139.45.195.38 (Ascension Island)

ASN9002 (RETN-AS, EU)
udookrou.com
1    100.25.178.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-25-178-199.compute-1.amazonaws.com
twn.weareoffers.com
5    52.21.57.179 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-57-179.compute-1.amazonaws.com
getflash-s3plug-now.com
Apex Domain
Subdomains		 Transfer
5 getflash-s3plug-now.com
getflash-s3plug-now.com
136 KB
1 weareoffers.com
twn.weareoffers.com
284 B
1 udookrou.com
udookrou.com
1 KB
1 g3nerat3dn3w.best
g3nerat3dn3w.best
6 KB
1 xtraserp.com
xtraserp.com
540 B
1 urllie.com
urllie.com
428 B
6 6
Domain Requested by
5 getflash-s3plug-now.com g3nerat3dn3w.best
getflash-s3plug-now.com
1 twn.weareoffers.com 1 redirects
1 udookrou.com 1 redirects
1 g3nerat3dn3w.best
1 xtraserp.com 1 redirects
1 urllie.com 1 redirects
6 6

This site contains no links.

Subject Issuer Validity Valid
g3nerat3dn3w.best
Let's Encrypt Authority X3		 2020-07-30 -
2020-10-28		 3 months crt.sh
getflash-s3plug-now.com
Let's Encrypt Authority X3		 2020-08-05 -
2020-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Frame ID: 1050B9E9E9A7D0789D8CE04CD9715107
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://urllie.com/ky6ou HTTP 302
    http://xtraserp.com/ZG93bmxvYWR8M3J6TWpFM2ZId3hOVE13TkRneU5qY3hmSHd5TWpJNGZId29VRUZUVkVVcElGQmhj... HTTP 302
    https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbi... Page URL
  2. https://udookrou.com/link?z=3540907&ymid=AE2jZl_giAAAvDsCAEZSNAASAK_MSvUA&var=35040 HTTP 302
    https://twn.weareoffers.com/fghjuyk/fydjnsrth.php?utm_source=24&utm_campaign=12740918&cid=33134293610713... HTTP 302
    https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=35409... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

2
IPs

3
Countries

141 kB
Transfer

140 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://urllie.com/ky6ou HTTP 302
    http://xtraserp.com/ZG93bmxvYWR8M3J6TWpFM2ZId3hOVE13TkRneU5qY3hmSHd5TWpJNGZId29VRUZUVkVVcElGQmhjM1JsWW1sdUxtTnZiU0JiVUc5emRGMGdlMzA/jobshopcoach/methylsulfonylmethane/gharb.aG9iYml0IHNodXVkIDE3Z29sa2VzaG9.pedantic.holdon HTTP 302
    https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw Page URL
  2. https://udookrou.com/link?z=3540907&ymid=AE2jZl_giAAAvDsCAEZSNAASAK_MSvUA&var=35040 HTTP 302
    https://twn.weareoffers.com/fghjuyk/fydjnsrth.php?utm_source=24&utm_campaign=12740918&cid=331342936107135735&sid=3540907_35040 HTTP 302
    https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://urllie.com/ky6ou HTTP 302
  • http://xtraserp.com/ZG93bmxvYWR8M3J6TWpFM2ZId3hOVE13TkRneU5qY3hmSHd5TWpJNGZId29VRUZUVkVVcElGQmhjM1JsWW1sdUxtTnZiU0JiVUc5emRGMGdlMzA/jobshopcoach/methylsulfonylmethane/gharb.aG9iYml0IHNodXVkIDE3Z29sa2VzaG9.pedantic.holdon HTTP 302
  • https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set /
g3nerat3dn3w.best/r/
Redirect Chain
  • http://urllie.com/ky6ou
  • http://xtraserp.com/ZG93bmxvYWR8M3J6TWpFM2ZId3hOVE13TkRneU5qY3hmSHd5TWpJNGZId29VRUZUVkVVcElGQmhjM1JsWW1sdUxtTnZiU0JiVUc5emRGMGdlMzA/jobshopcoach/methylsulfonylmethane/gharb.aG9iYml0IHNodXVkIDE3Z29s...
  • https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw
5 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
78.140.165.10 , Netherlands, ASN35415 (WEBZILLA, NL),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
9a8ea0ae626971a6c33370cb99bfc844d8feb7dfa8586d302505d00abc7677b7

Request headers

Host
g3nerat3dn3w.best
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx/1.16.1
Date
Sun, 20 Sep 2020 00:33:17 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
bd_context=VMqNiM9NShpCMQYdpKUM3LOmxW+cknrxIQkCbAKQwxq+EQoGCPhDtF/ZV9ttBAdtZ3bC/7C0hie4QI6ooVqceus34DjSXXP7W94jkQ3kfn1skwJ7fEkhjMXmaU7XMvGWMfV1n8Zv4zJH2R1w+7dHqzA93rtPbVQLNNxT1lUtq2Jy18HUG6Hqb5jZyMBO4k8iCVlnmVa0QjOsPXgWQPf6i+KtnpJR+B2lOW1cp1X82VR0zSai7uNlCCdQjq3ZRkwZq3IoJCtFl5X97OIInWQpzm7wAeXz6yKfWPKxC9O+6A2FLalKJ5/SsFn3CLRbTpaa8yMW94VbKDig/w==; Expires=Mon, 20 Sep 2021 00:33:17 GMT

Redirect headers

Date
Sun, 20 Sep 2020 01:29:33 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=98450417daa01ed58b405d394f8607d1; path=/
Location
https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw
Content-Length
0
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
Primary Request Cookie set Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk
getflash-s3plug-now.com/
Redirect Chain
  • https://udookrou.com/link?z=3540907&ymid=AE2jZl_giAAAvDsCAEZSNAASAK_MSvUA&var=35040
  • https://twn.weareoffers.com/fghjuyk/fydjnsrth.php?utm_source=24&utm_campaign=12740918&cid=331342936107135735&sid=3540907_35040
  • https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
24 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Requested by
Host: g3nerat3dn3w.best
URL: https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.57.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-57-179.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2b7afd586b18caad0eaab8250aaf118eba4505563cf7a7290b754f73c1238ac8

Request headers

Host
getflash-s3plug-now.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://g3nerat3dn3w.best/r/?token=9d0745f9c8757824933c881516f6b51678e7f13f&q=hobbit+shuud+17&s3=hobbit+shuud+17&s2=mmaa&s1=ufE1BQ19kYXRhMnw

Response headers

Date
Sun, 20 Sep 2020 00:33:18 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
session=2cd89209-e7e8-431e-a0e3-ae5ad5de2aa7
Server
nginx

Redirect headers

Date
Sun, 20 Sep 2020 00:33:17 GMT
Content-Type
text/html
Content-Length
158
Connection
keep-alive
Location
https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Server
nginx
arrow__blue.png
getflash-s3plug-now.com/resources/lps/flash_mac/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://getflash-s3plug-now.com/resources/lps/flash_mac/images/arrow__blue.png
Requested by
Host: getflash-s3plug-now.com
URL: https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.57.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-57-179.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a

Request headers

Referer
https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 20 Sep 2020 00:33:18 GMT
Last-Modified
Sun, 20 Sep 2020 00:29:51 GMT
Server
nginx
ETag
"5f66a27f-8da"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2266
pattern__safari1.jpg
getflash-s3plug-now.com/resources/lps/flash_mac/images/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://getflash-s3plug-now.com/resources/lps/flash_mac/images/pattern__safari1.jpg
Requested by
Host: getflash-s3plug-now.com
URL: https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.57.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-57-179.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe

Request headers

Referer
https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 20 Sep 2020 00:33:19 GMT
Last-Modified
Sun, 20 Sep 2020 00:30:08 GMT
Server
nginx
ETag
"5f66a290-62cd"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
25293
pattern__safari-arrow.png
getflash-s3plug-now.com/resources/lps/flash_mac/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://getflash-s3plug-now.com/resources/lps/flash_mac/images/pattern__safari-arrow.png
Requested by
Host: getflash-s3plug-now.com
URL: https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.57.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-57-179.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12

Request headers

Referer
https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 20 Sep 2020 00:33:19 GMT
Last-Modified
Sun, 20 Sep 2020 00:30:08 GMT
Server
nginx
ETag
"5f66a290-d96"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3478
clean_k.png
getflash-s3plug-now.com/resources/lps/flash_mac/images/ 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://getflash-s3plug-now.com/resources/lps/flash_mac/images/clean_k.png
Requested by
Host: getflash-s3plug-now.com
URL: https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.57.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-57-179.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2b6f66d6fc25784ab605c93008f911e7e99a78e5de23e0a489ee0f20f0bc2319

Request headers

Referer
https://getflash-s3plug-now.com/Vzlb-EWGZvc5m7hIc5922UbwFdq6JfLD69_dF-JQByk?cid=331342936107135735&sid=3540907_35040
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 20 Sep 2020 00:33:19 GMT
Last-Modified
Sun, 20 Sep 2020 00:29:54 GMT
Server
nginx
ETag
"5f66a282-14259"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
82521

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple Software Update (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| showStep

1 Cookies

Domain/Path Name / Value
getflash-s3plug-now.com/ Name: session
Value: 2cd89209-e7e8-431e-a0e3-ae5ad5de2aa7