opens.nicepage.io Open in urlscan Pro
3.251.41.35 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://opens.nicepage.io/Page-1.html
Submission: On February 21 via manual (February 21st 2021, 7:02:59 am UTC) from FR

Summary HTTP 14 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 14 HTTP transactions. The main IP is 3.251.41.35, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is opens.nicepage.io.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 18th 2020. Valid for: a year.

This is the only time opens.nicepage.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	3.251.41.35 3.251.41.35	16509 (AMAZON-02) (AMAZON-02)
1	95.211.139.76 95.211.139.76	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2a02:6ea0:c70... 2a02:6ea0:c700::1	60068 (CDN77 (^_^)/) (CDN77 (^_^)/)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
3	2600:9000:211... 2600:9000:211e:f600:6:4afb:9140:93a1	16509 (AMAZON-02) (AMAZON-02)
5	52.216.105.155 52.216.105.155	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
14	7

2 3.251.41.35 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com

opens.nicepage.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.211.139.76 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

static.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::1 (Frankfurt am Main, Germany)

ASN60068 (CDN77 (^_^)/, GB)

capp.nicepage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:211e:f600:6:4afb:9140:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.mcauto-images-production.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.216.105.155 (Ashburn, United States)

ASN16509 (AMAZON-02, US)

marketing-image-production.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	amazonaws.com marketing-image-production.s3.amazonaws.com	8 KB
3	sendgrid.net cdn.mcauto-images-production.sendgrid.net	63 KB
2	nicepage.com static.nicepage.com capp.nicepage.com	78 KB
2	nicepage.io opens.nicepage.io	93 KB
1	gstatic.com fonts.gstatic.com	9 KB
1	googleapis.com fonts.googleapis.com	2 KB
14	6

	Domain	Requested by
5	marketing-image-production.s3.amazonaws.com	opens.nicepage.io
3	cdn.mcauto-images-production.sendgrid.net	opens.nicepage.io
2	opens.nicepage.io	opens.nicepage.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	opens.nicepage.io
1	capp.nicepage.com	opens.nicepage.io
1	static.nicepage.com	opens.nicepage.io
14	7

This site contains links to these domains. Also see Links.

Domain
www.orimas.o2o.my
www.facebook.com
twitter.com
instagram.com
pinterest.com
linkedin.com
nicepage.com

Subject Issuer	Validity	Valid
*.nicepage.io Go Daddy Secure Certificate Authority - G2	`2020-02-18` - `2021-04-18`	a year	crt.sh
*.nicepage.com Go Daddy Secure Certificate Authority - G2	`2020-10-07` - `2021-11-08`	a year	crt.sh
1156509985.rsc.cdn77.org R3	`2021-02-03` - `2021-05-04`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
cdn.mcauto-images-production.sendgrid.net Amazon	`2020-07-16` - `2021-08-16`	a year	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://opens.nicepage.io/Page-1.html
Frame ID: F687E5781E7F92DF5645832414D29DB7
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

253 kB
Transfer

1304 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.orimas.o2o.my/.well-known/az/Priv8/Priv8/index.html
Title: View Document

Search URL Search Domain Scan URL

URL: https://www.facebook.com/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/
Title:

Search URL Search Domain Scan URL

URL: https://instagram.com/
Title:

Search URL Search Domain Scan URL

URL: https://pinterest.com/
Title:

Search URL Search Domain Scan URL

URL: https://linkedin.com/
Title:

Search URL Search Domain Scan URL

URL: https://nicepage.com/website-templates
Title: Website Templates

Search URL Search Domain Scan URL

URL: https://nicepage.com/https://nicepage.com
Title: Website Builder Software

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Page-1.html Show response
opens.nicepage.io/ 31 KB
5 KB 278ms
154ms Document
text/html 3.251.41.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.251.41.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com
Software: nginx/1.19.2 /
Resource Hash: 9b126c3aad0ba7b56b9f36ccdc0de6ece3fd4abb5aaf4ddd8649ddb6dd0241e1

Request headers

Host: opens.nicepage.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.19.2
Date: Sun, 21 Feb 2021 07:02:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-amz-id-2: 2b0gPokmHGTWtjCxBGsz9Od+TxELQ1KWRvZ9y1w6aSMyCqi4YntRMUzpdkoXegRINtDE6IyjcH0=
x-amz-request-id: E587A3CF9064FD03
Last-Modified: Tue, 19 Jan 2021 00:36:35 GMT
ETag: W/"eb795eb5033eae5c3bc5c72a15cb1efd"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type
Content-Encoding: gzip

GET
H/1.1 200
OK nicepage.css
opens.nicepage.io/ 915 KB
88 KB 287ms
286ms Stylesheet
text/css 3.251.41.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://opens.nicepage.io/nicepage.css?version=97f2fa82-f5b0-4e36-a7a8-a62395e03dfb
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.251.41.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-251-41-35.eu-west-1.compute.amazonaws.com
Software: nginx/1.19.2 /
Resource Hash: 4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:33 GMT
Content-Encoding: gzip
Last-Modified: Fri, 15 Jan 2021 16:46:30 GMT
Server: nginx/1.19.2
x-amz-request-id: A51E26E381EAB39E
ETag: W/"daf0ed59b01e417d5b63ff0de8db207a"
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Content-Type: text/css
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
x-amz-id-2: I0Cwnkhe4J8NeyOyIn+NvguVwFuhvnU/lTQTd8rz5ypTnNgJc6diZYen04vOfSkgjLrJr0MwJ9Q=

GET
H/1.1 200
OK jquery-1.9.1.min.js Show response
static.nicepage.com/shared/assets/ 90 KB
33 KB 152ms
36ms Script
application/javascript 95.211.139.76
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.nicepage.com/shared/assets/jquery-1.9.1.min.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 95.211.139.76 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: Apache 2.1 / ASP.NET
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:33 GMT
Content-Encoding: gzip
ETag: "45dd4e6dcb5ed31:0"
Last-Modified: Thu, 16 Nov 2017 11:09:52 GMT
Server: Apache 2.1
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PUT, DELETE, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Content-Length: 33099

GET
H2 200 nicepage.js Show response
capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/ 147 KB
45 KB 129ms
32ms Script
application/javascript 2a02:6ea0:c700::1
CDN77 (^_^)/

General

Check archive.org

Show headers Download Go to

Full URL: https://capp.nicepage.com/7a416b186e7abe17a61deb139f0f799040d0396e/nicepage.js
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::1 Frankfurt am Main, Germany, ASN60068 (CDN77 (^_^)/, GB),
Reverse DNS
Software: CDN77-Turbo / ASP.NET
Resource Hash: 350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Sun, 21 Feb 2021 07:02:33 GMT
content-encoding: br
etag: W/"0bacdbd83ead61:0"
x-powered-by: ASP.NET
x-77-cache: HIT
x-cache: HIT
x-age: 384686
x-77-nzt: AcO1ryy3tHDvrt4FAA==
last-modified: Thu, 14 Jan 2021 14:44:20 GMT
server: CDN77-Turbo
x-77-nzt-ray: Zj13bYyfsqo=
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-headers: Content-Type
expires: Sun, 28 Feb 2021 20:11:07 GMT

GET
H2 200 css
fonts.googleapis.com/ 45 KB
2 KB 15ms
14ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Requested by

Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e5a601055718bba286fd83bef5a238c9c63fcb28a9d40518aa37ec4f5670e57d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 21 Feb 2021 06:59:05 GMT
server: ESF
date: Sun, 21 Feb 2021 07:02:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 21 Feb 2021 07:02:32 GMT

GET
H2 200 469x107.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/ 5 KB
5 KB 446ms
418ms Image
binary/octet-stream 2600:9000:211e:f600:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/ef118e0f-126b-4dce-bb7e-15870d850db0/469x107.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:f600:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: dbKZ8T6OUnndv7UdcLBnYGZQ6X27akD1
via: 1.1 6c63b8e5a6627b953ced3e530ce1b09d.cloudfront.net (CloudFront)
last-modified: Thu, 30 Jan 2020 23:51:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
etag: "b606619de32829fa1725ae31a828ea39"
x-cache: RefreshHit from cloudfront
content-type: binary/octet-stream
date: Sun, 21 Feb 2021 07:02:34 GMT
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 4893
x-amz-cf-id: BsFMlFuq3zSDbCmnByXRByhgeUqCuuYnpIfbu-tmE4lr8-8WMvI-og==

GET
H2 200 466x288.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/ 48 KB
48 KB 547ms
519ms Image
binary/octet-stream 2600:9000:211e:f600:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/fee04730-2e11-46f8-a27c-9d6fa89b1d97/466x288.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:f600:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sun, 21 Feb 2021 07:02:34 GMT
via: 1.1 6c63b8e5a6627b953ced3e530ce1b09d.cloudfront.net (CloudFront)
last-modified: Mon, 02 Nov 2020 14:11:31 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
etag: "d4213d403e8deefbf0bf8a4e5e38541b"
x-cache: Miss from cloudfront
x-amz-version-id: ZErvJ_UVaEUDBjnvXRlrAbbJlyFj17Hh
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-type: binary/octet-stream
content-length: 48872
x-amz-cf-id: W5Qrl8jKWhkD6gjkbO9k1ZMRHituuPIgn7efazF3Vp5KWn9821ydcQ==

GET
H2 200 149x87.png
cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/ 9 KB
9 KB 435ms
407ms Image
binary/octet-stream 2600:9000:211e:f600:6:4afb:9140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/07d9ac8cc71e2271/2ca8985f-8769-4456-b98c-94a807c1ea45/149x87.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:f600:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: pnEc7x5oeC5aqHzby9UOWOAqyta4t0W0
via: 1.1 6c63b8e5a6627b953ced3e530ce1b09d.cloudfront.net (CloudFront)
last-modified: Mon, 02 Nov 2020 14:14:44 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
etag: "270ddaed1302ac2fd6e7319ffdb02f7c"
x-cache: RefreshHit from cloudfront
content-type: binary/octet-stream
date: Sun, 21 Feb 2021 07:02:34 GMT
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 9010
x-amz-cf-id: Wl9LcJXljymgb3NOO_Sc9jI-Uaq4IKOlSIuSWv0PZCtocZGnTMQaTw==

GET
H/1.1 200
OK facebook.png
marketing-image-production.s3.amazonaws.com/social/white/ 746 B
1 KB 420ms
113ms Image
image/png 52.216.105.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/facebook.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.105.155 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:34 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:05 GMT
Server: AmazonS3
x-amz-request-id: 9CF23126E392B18D
ETag: "1818ac1941f85157cf5c049321b59e8a"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 746
x-amz-id-2: nq0cr80u2gn0PtSJLAdzYLB2wGF3CVn2DzNihoq5BnNtarVRpIt2HdH3ondJ759UoTlyf6CWR0E=

GET
H/1.1 200
OK twitter.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 421ms
113ms Image
image/png 52.216.105.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/twitter.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.105.155 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:34 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:07 GMT
Server: AmazonS3
x-amz-request-id: 502B55C9072945D4
ETag: "4e54386509b2a7881627dde6e50a5eb8"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1389
x-amz-id-2: MJMQUX09v250mjRxn01/cxadoeWWuV7MM5DGkxeSgx0RifH0Y31oGKI6QViMVAp7Y9Y8e+cvktE=

GET
H/1.1 200
OK instagram.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
2 KB 424ms
115ms Image
image/png 52.216.105.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/instagram.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.105.155 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:34 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: FV4TEQEW5P5K3V0P
ETag: "c1fb933d57b4122893734f136176860a"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1289
x-amz-id-2: 8jSYL3/G42DeTluGE1CFO8WxEcCCkw4jv81pvUvNomHJYHm0J6fLwEICyNtTGFdXodamGwjBYZY=

GET
H/1.1 200
OK pinterest.png
marketing-image-production.s3.amazonaws.com/social/white/ 2 KB
2 KB 423ms
115ms Image
image/png 52.216.105.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/pinterest.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.105.155 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:34 GMT
Last-Modified: Tue, 29 Dec 2015 21:55:06 GMT
Server: AmazonS3
x-amz-request-id: B8AB3271C5F5AD98
ETag: "de120ffa43278ad99c946d56727c3f44"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 2057
x-amz-id-2: GwcuKfTqHtkvAXUZvSWx2B9Gzbe2NB7JBIpAmH6o+elWjILkc+l8Cf3Wv5NmIFqVEaxxo710uPI=

GET
H/1.1 200
OK linkedin.png
marketing-image-production.s3.amazonaws.com/social/white/ 1 KB
1 KB 424ms
115ms Image
image/png 52.216.105.155
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marketing-image-production.s3.amazonaws.com/social/white/linkedin.png
Requested by: Host: opens.nicepage.io
URL: https://opens.nicepage.io/Page-1.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.105.155 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee

Request headers

Referer: https://opens.nicepage.io/Page-1.html?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 21 Feb 2021 07:02:34 GMT
Last-Modified: Tue, 15 Mar 2016 18:17:18 GMT
Server: AmazonS3
x-amz-request-id: AA38F4BE4C887865
ETag: "cf25ec9b79612be7393ffb8251fdfc26"
Content-Type: image/png
x-amz-version-id: null
Accept-Ranges: bytes
Content-Length: 1062
x-amz-id-2: a66yP8i9F1DPvyKdQk6jF80dxxFQVck80wBJddz8XJrkEfJTN2eU1G1q6OXcJkBnYLGC6hGWd5o=

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://opens.nicepage.io
Referer: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 15 Feb 2021 16:25:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 484652
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Tue, 15 Feb 2022 16:25:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

capp.nicepage.com
cdn.mcauto-images-production.sendgrid.net
fonts.googleapis.com
fonts.gstatic.com
marketing-image-production.s3.amazonaws.com
opens.nicepage.io
static.nicepage.com
2600:9000:211e:f600:6:4afb:9140:93a1
2a00:1450:4001:812::200a
2a00:1450:4001:828::2003
2a02:6ea0:c700::1
3.251.41.35
52.216.105.155
95.211.139.76
0154369b7faddde0dd9042555d53afab09935a99d1e4c035ba6dab3ba91e1728
035ffda1f12b59c12b3e8e702cf98d555634e088dacc3d4d6f836290ffe92cfc
31cd010d4129451a24e7a27700c8602fa695f7dc3e57f7189418e17c18605d2b
350e08d6c89250b2b21329e80037651b733cd1619e0861c78fca8494a4fcf754
40d145934118f5fa7dc39207d3f63992143bcd74d58f54ef0837b321df072029
4a9495f2f89c6d9dd257d696b1f0ef43e02196364c893ff313c13d71dc2dac66
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
9b126c3aad0ba7b56b9f36ccdc0de6ece3fd4abb5aaf4ddd8649ddb6dd0241e1
a6007bc753977879bb74f610f4c193eb5ac81648b8de4e0582554017c1ba1791
ad759fa2c31b5d717c304d14567cf436338b054b247bc10bdc736b394944d463
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cee502c5b67f76895134d68fd3a23374dc9b57e32ca42b72855ae5e33a541097
d83af247def45828af6233ddafc93309bd81d5c64817a66b24e8b9ed572123ee
e5a601055718bba286fd83bef5a238c9c63fcb28a9d40518aa37ec4f5670e57d

opens.nicepage.io Open in urlscan Pro 3.251.41.35 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

57 %IPv6

6 Domains

7 Subdomains

7 IPs

4 Countries

253 kBTransfer

1304 kBSize

0 Cookies

8 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

48 JavaScript Global Variables

0 Cookies

Indicators

opens.nicepage.io Open in urlscan Pro
3.251.41.35 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

253 kB
Transfer

1304 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!