ac-landing-pages-user-uploads-production.s3.amazonaws.com Open in urlscan Pro
52.217.42.36  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 8c7deea9-a953-4e3d-9e9a-893cf662983a.html Show response ac-landing-pages-user-uploads-production.s3.amazonaws.com/0000075071/	458 B 846 B	567ms 180ms	Document text/html	52.217.42.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ac-landing-pages-user-uploads-production.s3.amazonaws.com/0000075071/8c7deea9-a953-4e3d-9e9a-893cf662983a.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.42.36 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash a1c0daa4ef234d726cef160139bd246bb1b58cc27ac2c3c920aae84fa5ce4bda Request headers Host ac-landing-pages-user-uploads-production.s3.amazonaws.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-id-2 5HafQJ+PNxfZPOSdynt/ZK22RW2ywkVtn7hBvTtdGZtyUVOZaLunHo7N2DMWNPWWKz2QPoz/1Ds= x-amz-request-id EQCSATAJ9SFWFPCM Date Mon, 22 Feb 2021 18:20:21 GMT Last-Modified Mon, 22 Feb 2021 03:45:04 GMT ETag "b1f5737fbda2101437bd18ab6a587f60" Cache-Control max-age=1209600 Accept-Ranges bytes Content-Type text/html Content-Length 458 Server AmazonS3
GET H2	200	/ Show response mega-scripts.icu/	239 KB 94 KB	541ms 221ms	Script text/html	104.37.190.203 IS-AS-1
General Check archive.org Show headers Download Go to Full URL https://mega-scripts.icu/?token=d979e5cc7476d4308bfbbc740f153db3 Requested by Host: ac-landing-pages-user-uploads-production.s3.amazonaws.com URL: https://ac-landing-pages-user-uploads-production.s3.amazonaws.com/0000075071/8c7deea9-a953-4e3d-9e9a-893cf662983a.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.37.190.203 , United States, ASN19318 (IS-AS-1, US), Reverse DNS webhosting2011.is.cc Software LiteSpeed / PHP/7.4.14 Resource Hash 96f61854258a4803abc8d82f77e02a2b6fbe7834b1cc4adf902db30e50f5f238 Request headers Referer https://ac-landing-pages-user-uploads-production.s3.amazonaws.com/0000075071/8c7deea9-a953-4e3d-9e9a-893cf662983a.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 22 Feb 2021 18:20:20 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.4.14 vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	/ whos.amung.us/pingjs/	28 B 28 B	424ms 141ms	Image text/javascript	67.202.114.216 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=elcoonew&t=Blacksar%20Inc.&x=https://whos.amung.us/&y=https://whos.amung.us/&a=-1&d=0&v=27&r=7631 Requested by Host: ac-landing-pages-user-uploads-production.s3.amazonaws.com URL: https://ac-landing-pages-user-uploads-production.s3.amazonaws.com/0000075071/8c7deea9-a953-4e3d-9e9a-893cf662983a.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.216 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ac-landing-pages-user-uploads-production.s3.amazonaws.com/0000075071/8c7deea9-a953-4e3d-9e9a-893cf662983a.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 22 Feb 2021 18:20:21 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	51 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| d object| dom string| back boolean| ignoreHistoryChange boolean| ignoreHashChange string| kon object| _$_f395 string| head string| bod

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ac-landing-pages-user-uploads-production.s3.amazonaws.com
mega-scripts.icu
whos.amung.us
104.37.190.203
52.217.42.36
67.202.114.216
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
96f61854258a4803abc8d82f77e02a2b6fbe7834b1cc4adf902db30e50f5f238
a1c0daa4ef234d726cef160139bd246bb1b58cc27ac2c3c920aae84fa5ce4bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855