signin.aws.amazon.login.invoice.cinderella-sdc.de Open in urlscan Pro
88.198.242.191 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://u8691174.ct.sendgrid.net/ls/click?upn=uf3bbEPlk-2FG-2FYlW0rtBMPs960ajRPX5X4LK9bD6KI3ZT8RK7rBaY6VnwXMHTzsN0s2GCjHGz4f4gEaU...
Effective URL:
http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1
Submission: On May 11 via manual (May 11th 2020, 9:56:53 am UTC) from US

Summary HTTP 11 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 88.198.242.191, located in Germany and belongs to HETZNER-AS, DE. The main domain is signin.aws.amazon.login.invoice.cinderella-sdc.de.

This is the only time signin.aws.amazon.login.invoice.cinderella-sdc.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AWS (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.115.54 167.89.115.54	11377 (SENDGRID) (SENDGRID)
11	88.198.242.191 88.198.242.191	24940 (HETZNER-AS) (HETZNER-AS)
11	1

1 167.89.115.54 (United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789115x54.outbound-mail.sendgrid.net

u8691174.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 88.198.242.191 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88.198.242.191.clients.your-server.de

signin.aws.amazon.login.invoice.cinderella-sdc.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	cinderella-sdc.de signin.aws.amazon.login.invoice.cinderella-sdc.de	318 KB
1	sendgrid.net 1 redirects u8691174.ct.sendgrid.net	326 B
11	2

	Domain	Requested by
11	signin.aws.amazon.login.invoice.cinderella-sdc.de	signin.aws.amazon.login.invoice.cinderella-sdc.de
1	u8691174.ct.sendgrid.net	1 redirects
11	2

This site contains links to these domains. Also see Links.

Domain
aws.amazon.com
console.aws.amazon.com
signin.aws.amazon.com
docs.aws.amazon.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1
Frame ID: A9804B7C99390BE540E17013DFD3E071
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://u8691174.ct.sendgrid.net/ls/click?upn=uf3bbEPlk-2FG-2FYlW0rtBMPs960ajRPX5X4LK9bD6KI3ZT8RK7rBaY6VnwXMH... HTTP 302
http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

318 kB
Transfer

316 kB
Size

0
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: http://aws.amazon.com/
Title: Amazon Web Services Login

Search URL Search Domain Scan URL

URL: https://console.aws.amazon.com/billing/home#/paymenthistory
Title: payment page

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://signin.aws.amazon.com/oauth?Action=logout&redirect_uri=aws.amazon.com
Title: here.

Search URL Search Domain Scan URL

URL: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_u2f.html?icmpid=docs_iam_console
Title: Learn more

Search URL Search Domain Scan URL

URL: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_u2f_supported_configurations.html?icmpid=docs_iam_console
Title: See the list of compatible browsers

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/free/?sc_ichannel=ha&sc_icampaign=signin_prospects&sc_isegment=en&sc_iplace=sign-in&sc_icontent=freetier&sc_segment=-1

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/agreement/recent-changes/
Title: Recent Changes

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/terms/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://aws.amazon.com/agreement/
Title: AWS Customer Agreement

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://u8691174.ct.sendgrid.net/ls/click?upn=uf3bbEPlk-2FG-2FYlW0rtBMPs960ajRPX5X4LK9bD6KI3ZT8RK7rBaY6VnwXMHTzsN0s2GCjHGz4f4gEaUF3DEFUQWTDC0gVL2ue3pLjxrVKyN6ACIrow4VcNSegIiye1s2NshUO0yVNlK-2FYCaEuB-2B8StcPQrxuKMvdVUgHgJP3ENm0-2BklYJaSE3zq8VtwsOFcoGsum_-2BHB8d5C343hfLp7ljYtulZ2pEV3NLPeRA-2FCD8ckC1QSN8RjYGouWu2OSbigYeX0Q1zbTkGb-2Bj-2BNN3eV3IY7aV388mLkNCwJWF1qo9xA6Cq2EnMbD7BnZWdunAuaEWZpcxtH-2FnEzJ4XIXF6mwdhOwTSMlHF3bVqCJeynxa0RWudWZNR5sBq6e9y9ZY-2FMrEFLoGC5vRnozy11hGD8crT7bJR6Ks7VWor3jTiukMrZDmRM-3D HTTP 302
http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/ Redirect Chain http://u8691174.ct.sendgrid.net/ls/click?upn=uf3bbEPlk-2FG-2FYlW0rtBMPs960ajRPX5X4LK9bD6KI3ZT8RK7rBaY6VnwXMHTzsN0s2GCjHGz4f4gEaUF3DEFUQWTDC0gVL2ue3pLjxrVKyN6ACIrow4VcNSegIiye1s2NshUO0yVNlK-2FYCaEuB... http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1	65 KB 66 KB	85ms 40ms	Document text/html	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / PHP/7.3.17 Resource Hash `fa386cc1d459ff23825009f4df6241065da0b93d4f503308f91e41b0fbf47844` Request headers Host signin.aws.amazon.login.invoice.cinderella-sdc.de Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:35 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 X-Powered-By PHP/7.3.17 Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Server nginx Date Mon, 11 May 2020 09:56:35 GMT Content-Type text/html; charset=utf-8 Content-Length 149 Connection keep-alive Location http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 X-Robots-Tag noindex, nofollow
GET H/1.1	200 OK	components.css signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	108 KB 108 KB	45ms 32ms	Stylesheet text/css	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/components.css Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `671849de2cbc06abf736bbac74287be1275478bdafb830b176cb602b350ae030` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:35 GMT Last-Modified Sun, 10 May 2020 18:36:02 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 ETag "1b024-5a54f80a58300" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 110628
GET H/1.1	200 OK	grid.css signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	18 KB 19 KB	45ms 33ms	Stylesheet text/css	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/grid.css Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `295437df86381a56ae94b2a5491f916167b1f85db261f4ac2f53111973c09f15` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:35 GMT Last-Modified Sun, 10 May 2020 18:36:03 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 ETag "4937-5a54f80ada90f" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18743
GET H/1.1	200 OK	utilities.css signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	3 KB 4 KB	45ms 33ms	Stylesheet text/css	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/utilities.css Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `0b1e68b1025d14dce1b3c8cf22e6d3e73ce099bc1ec98e3c11857db320f166fb` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:35 GMT Last-Modified Sun, 10 May 2020 18:36:05 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 ETag "ddc-5a54f80c92c70" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3548
GET H/1.1	200 OK	jquery-1.12.4.js Show response signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	85 KB 85 KB	45ms 33ms	Script application/javascript	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/jquery-1.12.4.js Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:35 GMT Last-Modified Sun, 10 May 2020 18:36:04 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 ETag "1538e-5a54f80c311d9" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 86926
GET H/1.1	200 OK	Prospect_image.fb1bf2461c8e1b8246368922beceff77f50c39aa.jpg signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	32 KB 32 KB	22ms 22ms	Image image/jpeg	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/Prospect_image.fb1bf2461c8e1b8246368922beceff77f50c39aa.jpg Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `50e56bd81afcef466f4155d50c7225da52d1f0594357c32a13762afa69947b73` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:35 GMT Last-Modified Sun, 10 May 2020 18:36:04 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 ETag "7fdb-5a54f80c407f4" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 32731
GET H/1.1	200 OK	ffa95d7fd2bc6ba7ff308f22edbbb261e95afdf1.png signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	3 KB 3 KB	23ms 22ms	Image image/png	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/ffa95d7fd2bc6ba7ff308f22edbbb261e95afdf1.png Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:36 GMT Last-Modified Sun, 10 May 2020 18:36:03 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 ETag "c0c-5a54f80adb8af" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3084
GET H/1.1	404 Not Found	b011b05a5600241d1ba593bea6ffd7799cd37d69.svg signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	255 B 255 B	22ms 22ms	Image text/html	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/b011b05a5600241d1ba593bea6ffd7799cd37d69.svg Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `97f9a639cbb95cd940e484eee1ef2c927060618215a217ec704e8276aa63b9ef` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/components.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:36 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 255 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	b5c77dd4262b3111a4836adc97d3bc9da62d3523.svg signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/	248 B 248 B	22ms 22ms	Image text/html	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/b5c77dd4262b3111a4836adc97d3bc9da62d3523.svg Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `1fda02b898e1f73e29c33804306baebbcf8e898c81426a8a510ce82f51e70416` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:36 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 248 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	188dcd7f603b14c53bf827d6e0ef22484d5acc7b.svg signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	255 B 255 B	22ms 22ms	Image text/html	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/188dcd7f603b14c53bf827d6e0ef22484d5acc7b.svg Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `349adb11bf7d8a684deacd90d24715cfca848965de4eb9804fbffc1863ce2726` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/components.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:36 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 255 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	79f85bb52ac815a4b87cc7f727a0e0a0c8e0704b.svg signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/	255 B 255 B	22ms 22ms	Image text/html	88.198.242.191 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/79f85bb52ac815a4b87cc7f727a0e0a0c8e0704b.svg Requested by Host: signin.aws.amazon.login.invoice.cinderella-sdc.de URL: http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/?esignin=040620190&default=59125175f8c964ece46dcd5ab0d9c6c1 Protocol HTTP/1.1 Server 88.198.242.191 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.88.198.242.191.clients.your-server.de Software Apache/2.4.6 (CentOS) PHP/7.3.17 / Resource Hash `018161ba32f8aa355e99147c188b5c96ee014ef142f045a5df09bb74c6dbfa02` Request headers Referer http://signin.aws.amazon.login.invoice.cinderella-sdc.de/Login/assets/components.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 11 May 2020 09:56:36 GMT Server Apache/2.4.6 (CentOS) PHP/7.3.17 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 255 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AWS (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

signin.aws.amazon.login.invoice.cinderella-sdc.de
u8691174.ct.sendgrid.net
167.89.115.54
88.198.242.191
018161ba32f8aa355e99147c188b5c96ee014ef142f045a5df09bb74c6dbfa02
0b1e68b1025d14dce1b3c8cf22e6d3e73ce099bc1ec98e3c11857db320f166fb
1fda02b898e1f73e29c33804306baebbcf8e898c81426a8a510ce82f51e70416
295437df86381a56ae94b2a5491f916167b1f85db261f4ac2f53111973c09f15
349adb11bf7d8a684deacd90d24715cfca848965de4eb9804fbffc1863ce2726
50e56bd81afcef466f4155d50c7225da52d1f0594357c32a13762afa69947b73
671849de2cbc06abf736bbac74287be1275478bdafb830b176cb602b350ae030
8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38
97f9a639cbb95cd940e484eee1ef2c927060618215a217ec704e8276aa63b9ef
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
fa386cc1d459ff23825009f4df6241065da0b93d4f503308f91e41b0fbf47844

signin.aws.amazon.login.invoice.cinderella-sdc.de Open in urlscan Pro 88.198.242.191 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

318 kBTransfer

316 kBSize

0 Cookies

11 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

signin.aws.amazon.login.invoice.cinderella-sdc.de Open in urlscan Pro
88.198.242.191 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

318 kB
Transfer

316 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!