opens.nicepage.io Open in urlscan Pro
3.251.41.35 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://opens.nicepage.io/Page-1.html
Submission: On January 15 via manual (January 15th 2021, 5:29:11 pm UTC) from IN

Summary HTTP 14 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 14 HTTP transactions. The main IP is 3.251.41.35, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is opens.nicepage.io.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 18th 2020. Valid for: a year.

This is the only time opens.nicepage.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	3.251.41.35 3.251.41.35	16509 (AMAZON-02) (AMAZON-02)
1	95.211.139.76 95.211.139.76	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2a02:6ea0:c70... 2a02:6ea0:c700::3	60068 (CDN77 (^_^)/) (CDN77 (^_^)/)
1	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE)
3	2600:9000:214... 2600:9000:214f:f400:6:4afb:9140:93a1	16509 (AMAZON-02) (AMAZON-02)
5	52.216.83.16 52.216.83.16	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
14	7

2 3.251.41.35 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com

opens.nicepage.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.211.139.76 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: hosted-by.leaseweb.com

static.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::3 (Germany)

ASN60068 (CDN77 (^_^)/, GB)

capp.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:214f:f400:6:4afb:9140:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.mcauto-images-production.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.216.83.16 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

marketing-image-production.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	amazonaws.com marketing-image-production.s3.amazonaws.com	8 KB
3	sendgrid.net cdn.mcauto-images-production.sendgrid.net	63 KB
2	nicepage.com static.nicepage.com capp.nicepage.com	78 KB
2	nicepage.io opens.nicepage.io	93 KB
1	gstatic.com fonts.gstatic.com	9 KB
1	googleapis.com fonts.googleapis.com	2 KB
14	6

	Domain	Requested by
5	marketing-image-production.s3.amazonaws.com	opens.nicepage.io
3	cdn.mcauto-images-production.sendgrid.net	opens.nicepage.io
2	opens.nicepage.io	opens.nicepage.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	opens.nicepage.io
1	capp.nicepage.com	opens.nicepage.io
1	static.nicepage.com	opens.nicepage.io
14	7

This site contains links to these domains. Also see Links.

Domain
pursatlar.com
www.facebook.com
twitter.com
instagram.com
pinterest.com
linkedin.com
nicepage.com

Subject Issuer	Validity	Valid
*.nicepage.io Go Daddy Secure Certificate Authority - G2	`2020-02-18` - `2021-04-18`	a year	crt.sh
*.nicepage.com Go Daddy Secure Certificate Authority - G2	`2020-10-07` - `2021-11-08`	a year	crt.sh
1156509985.rsc.cdn77.org Let's Encrypt Authority X3	`2020-11-25` - `2021-02-23`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2021-03-12`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://opens.nicepage.io/Page-1.html
Frame ID: 18A20448DDE865D4A872A91D312545B6
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

79 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

253 kB
Transfer

1304 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://pursatlar.com/xaml/Priv8/Priv8/index.html
Title: View Document

Search URL Search Domain Scan URL

URL: https://www.facebook.com/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/
Title:

Search URL Search Domain Scan URL

URL: https://instagram.com/
Title:

Search URL Search Domain Scan URL

URL: https://pinterest.com/
Title:

Search URL Search Domain Scan URL

URL: https://linkedin.com/
Title:

Search URL Search Domain Scan URL

URL: https://nicepage.com/website-templates
Title: Website Templates

Search URL Search Domain Scan URL

URL: https://nicepage.com/https://nicepage.com
Title: Website Builder Software

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Page-1.html Show response
opens.nicepage.io/ 31 KB
5 KB 309ms
140ms Document
text/html 3.251.41.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.251.41.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com
Software: nginx/1.19.2 /
Resource Hash: 3983e1d4e0e20511e6bbb5801d459a19fa26de028b02507c429aceff5138ae95

Request headers

Host: opens.nicepage.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.19.2
Date: Fri, 15 Jan 2021 17:28:53 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-amz-id-2: Y1H0XrIUHIurvx50SI3q7Oiy1Sbcv0AEA4OkT7ixQ3TYWKYD2RHjuN3MQi1SCYfZRhZFKaYhr0c=
x-amz-request-id: 96FAE6998E8E11D0
Last-Modified: Fri, 15 Jan 2021 16:46:31 GMT
ETag: W/"3884b98e6c26e8c9bde65469dee735b0"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type
Content-Encoding: gzip

GET
H/1.1 200
OK nicepage.css
opens.nicepage.io/ 915 KB
88 KB 266ms
266ms Stylesheet
text/css 3.251.41.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/nicepage.css?version=858b6a2f-aa93-44a9-a53a-e210c27f4280
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.251.41.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com
Software: nginx/1.19.2 /
Resource Hash: 4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:53 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15 Jan 2021 16:46:30 GMT
Server: nginx/1.19.2
x-amz-request-id: 1A8E1FC7FD396025
ETag: W/"daf0ed59b01e417d5b63ff0de8db207a"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Content-Type: text/css
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
x-amz-id-2: Elg6gepOjxaVe6Ewax9Dx6CcJ4t/GvsgJiwky8UjLEIM4rM58o4RKch1z27buz9x2u9mqnQvk3g=

GET
H/1.1 200
OK jquery-1.9.1.min.js Show response
static.nicepage.com/shared/assets/ 90 KB
33 KB 734ms
465ms Script
application/javascript 95.211.139.76
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.nicepage.com/shared/assets/jquery-1.9.1.min.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 95.211.139.76 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS: hosted-by.leaseweb.com
Software: Apache 2.1 / ASP.NET
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:54 GMT
Content-Encoding: gzip
ETag: "45dd4e6dcb5ed31:0"
Last-Modified: Thu, 16 Nov 2017 11:09:52 GMT
Server: Apache 2.1
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Content-Length: 33099

GET
H2 200 nicepage.js Show response
capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/ 147 KB
45 KB 150ms
27ms Script
application/javascript 2a02:6ea0:c700::3
CDN77 (^_^)/

General

Check archive.org

Show headers Download Go to

Full URL: https://capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/nicepage.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::3 , Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software: CDN77-Turbo / ASP.NET
Resource Hash: 350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 15 Jan 2021 17:28:53 GMT
content-encoding: br
etag: W/"0bacdbd83ead61:0"
x-edge-pop: frankfurtDE
x-powered-by: ASP.NET
x-cache: HIT
x-age: 86590
x-77-nzt: AcO1rzL3WO/vPlIBAA==
last-modified: Thu, 14 Jan 2021 14:44:20 GMT
server: CDN77-Turbo
x-77-nzt-ray: L7eX62h6e2g=
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
x-edge-ip: 195.181.175.50
access-control-allow-headers: Content-Type
expires: Tue, 26 Jan 2021 17:25:43 GMT

GET
H2 200 css
fonts.googleapis.com/ 45 KB
2 KB 18ms
17ms Stylesheet
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Requested by

Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e5a601055718bba286fd83bef5a238c9c63fcb28a9d40518aa37ec4f5670e57d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 15 Jan 2021 17:28:53 GMT
server: ESF
date: Fri, 15 Jan 2021 17:28:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 Jan 2021 17:28:53 GMT

GET
H/1.1 200
OK 469x107.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/ 5 KB
5 KB 23ms
6ms Image
binary/octet-stream 2600:9000:214f:f400:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/469x107.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Server: 2600:9000:214f:f400:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: dbKZ8T6OUnndv7UdcLBnYGZQ6X27akD1
Via: 1.1 78c402b74e65ae12b398b6b957ab229e.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Jan 2020 23:51:27 GMT
Server: AmazonS3
Age: 2657
ETag: "b606619de32829fa1725ae31a828ea39"
X-Cache: Hit from cloudfront
Content-Type: binary/octet-stream
Connection: keep-alive
Date: Fri, 15 Jan 2021 16:46:43 GMT
x-amz-replication-status: COMPLETED
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
Content-Length: 4893
X-Amz-Cf-Id: Ra47F1Zo-mD2I3g3x3-LH5jnW8RBqRXZXrFk1P03S_bwsA5HNQkDwA==

GET
H/1.1 200
OK 466x288.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/ 48 KB
48 KB 27ms
10ms Image
binary/octet-stream 2600:9000:214f:f400:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/466x288.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Server: 2600:9000:214f:f400:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: ZErvJ_UVaEUDBjnvXRlrAbbJlyFj17Hh
Via: 1.1 a75b67932d84d80b40e12159613deb17.cloudfront.net (CloudFront)
ETag: "d4213d403e8deefbf0bf8a4e5e38541b"
Age: 2783
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 48872
Last-Modified: Mon, 02 Nov 2020 14:11:31 GMT
Server: AmazonS3
Date: Fri, 15 Jan 2021 16:46:43 GMT
Content-Type: binary/octet-stream
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: G4N7SMaGpjPt7tZ6fhK709LNAzpl-SgA37p0wwdsSrXkgYE_fpwp0w==

GET
H/1.1 200
OK 149x87.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/ 9 KB
9 KB 48ms
31ms Image
binary/octet-stream 2600:9000:214f:f400:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/149x87.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Server: 2600:9000:214f:f400:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: pnEc7x5oeC5aqHzby9UOWOAqyta4t0W0
Via: 1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront)
ETag: "270ddaed1302ac2fd6e7319ffdb02f7c"
Age: 2783
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 9010
Last-Modified: Mon, 02 Nov 2020 14:14:44 GMT
Server: AmazonS3
Date: Fri, 15 Jan 2021 16:46:43 GMT
Content-Type: binary/octet-stream
X-Amz-Cf-Pop: FRA53-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: ESAOeq6etUwsE8-XmAOu1Y1W4HWu8ZFR8WFYXEInJVAmToWYiHCSSA==

GET
H/1.1 200
OK facebook.png
marketing-image-production.s3.amazonaws.com/social/white/ 746 B
1 KB 516ms
136ms Image
image/png 52.216.83.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/facebook.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.83.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:55 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:05 GMT
Server: AmazonS3
x-amz-request-id: 4CC2CFA3C99732E8
ETag: "1818ac1941f85157cf5c049321b59e8a"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 746
x-amz-id-2: IGFERV/joG3SDtlaERIVFZTtfW3ucfQpa3//Ydiuq8azF7Y2skC3CkkMhd2GaoT1NsLfkaAWRiI=

GET
H/1.1 200
OK twitter.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 524ms
144ms Image
image/png 52.216.83.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/twitter.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.83.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:55 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:07 GMT
Server: AmazonS3
x-amz-request-id: 5S3XDG4K9V2RDN1P
ETag: "4e54386509b2a7881627dde6e50a5eb8"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1389
x-amz-id-2: BOguMYC9uPiEt9hFLuy4VDWWbEHhNbk6Fq+90bJRt60snir6Ljy35xtxe4pLkn3WXeYTmEtJ9/Q=

GET
H/1.1 200
OK instagram.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 524ms
144ms Image
image/png 52.216.83.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/instagram.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.83.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:55 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: 44D4FBF2FD97D42D
ETag: "c1fb933d57b4122893734f136176860a"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1289
x-amz-id-2: a5eKDq0J9UWNy4+E9yIIsWXrvRMIvl50czvD3jTMPqKnPKym9V+FQTVU9q4BFR55fV0DcQt49ZM=

GET
H/1.1 200
OK pinterest.png
marketing-image-production.s3.amazonaws.com/social/white/ 2 KB
2 KB 522ms
143ms Image
image/png 52.216.83.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/pinterest.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.83.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:55 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: 903FDF81D20F9AFB
ETag: "de120ffa43278ad99c946d56727c3f44"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 2057
x-amz-id-2: +Y3EYnQC8Ve/jBCpRhiWGivNePZXoisjl/QFJfRm3qWeoTosza6fq4JNB3UsTl1GuLd5dry5bbQ=

GET
H/1.1 200
OK linkedin.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
1 KB 514ms
134ms Image
image/png 52.216.83.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/linkedin.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.83.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 17:28:55 GMT
Last-Modified: Tue, 15 Mar 2016 18:17:18 GMT
Server: AmazonS3
x-amz-request-id: 5F1F06DD49D6A894
ETag: "cf25ec9b79612be7393ffb8251fdfc26"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1062
x-amz-id-2: XyrCcLRYSO03pWNxkitUyfVdF8EdvPN91hLgMiWrVRq6aVibA/SUUtuqvqNspGEnoNgEalfeqLs=

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://opens.nicepage.io
Referer: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 13 Jan 2021 19:09:10 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 166784
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Thu, 13 Jan 2022 19:09:10 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

capp.nicepage.com
cdn.mcauto-images-production.sendgrid.net
fonts.googleapis.com
fonts.gstatic.com
marketing-image-production.s3.amazonaws.com
opens.nicepage.io
static.nicepage.com
2600:9000:214f:f400:6:4afb:9140:93a1
2a00:1450:4001:817::200a
2a00:1450:4001:81a::2003
2a02:6ea0:c700::3
3.251.41.35
52.216.83.16
95.211.139.76
0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728
035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc
31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b
350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754
3983e1d4e0e20511e6bbb5801d459a19fa26de028b02507c429aceff5138ae95
40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029
4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791
ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097
d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee
e5a601055718bba286fd83bef5a238c9c63fcb28a9d40518aa37ec4f5670e57d

opens.nicepage.io Open in urlscan Pro 3.251.41.35 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

79 %HTTPS

57 %IPv6

6 Domains

7 Subdomains

7 IPs

4 Countries

253 kBTransfer

1304 kBSize

0 Cookies

8 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

48 JavaScript Global Variables

0 Cookies

Indicators

opens.nicepage.io Open in urlscan Pro
3.251.41.35 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

79 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

253 kB
Transfer

1304 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!