uploadedfilesaver.s3.us-east-2.amazonaws.com Open in urlscan Pro
52.219.104.88 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://links.notification.intuit.com/ls/click?upn=LEV65WI9EZ1l5TkUt4hKq8LeajNtGp4AbEgonQ5wnC67TW1-2BUb2RU8L5yKQNskb2J8oYysmGb5dsdmsl1...
Effective URL:
https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
Submission: On September 28 via api (September 28th 2020, 12:48:14 am UTC) from US

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 52.219.104.88, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is uploadedfilesaver.s3.us-east-2.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on July 24th 2020. Valid for: 10 months.

This is the only time uploadedfilesaver.s3.us-east-2.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.115.56 167.89.115.56	11377 (SENDGRID) (SENDGRID)
2	52.219.104.88 52.219.104.88	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
4	3

1 167.89.115.56 (United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789115x56.outbound-mail.sendgrid.net

links.notification.intuit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.219.104.88 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-r-w.us-east-2.amazonaws.com

uploadedfilesaver.s3.us-east-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	amazonaws.com uploadedfilesaver.s3.us-east-2.amazonaws.com	658 KB
1	googleapis.com ajax.googleapis.com	30 KB
1	intuit.com 1 redirects links.notification.intuit.com	266 B
0	ohanaeventscle.com Failed ohanaeventscle.com Failed
4	4

	Domain	Requested by
2	uploadedfilesaver.s3.us-east-2.amazonaws.com	uploadedfilesaver.s3.us-east-2.amazonaws.com
1	ajax.googleapis.com	uploadedfilesaver.s3.us-east-2.amazonaws.com
1	links.notification.intuit.com	1 redirects
0	ohanaeventscle.com Failed	uploadedfilesaver.s3.us-east-2.amazonaws.com
4	4

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.us-east-2.amazonaws.com DigiCert Baltimore CA-2 G2	`2020-07-24` - `2021-05-27`	10 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
Frame ID: CA7480F67622B1905CBD7E6D7F9A0B7F
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://links.notification.intuit.com/ls/click?upn=LEV65WI9EZ1l5TkUt4hKq8LeajNtGp4AbEgonQ5wnC67TW1-2BUb2RU8L5yKQNs... HTTP 302
https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html Page URL

Page Statistics

4
Requests

75 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

722 kB
Transfer

999 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://links.notification.intuit.com/ls/click?upn=LEV65WI9EZ1l5TkUt4hKq8LeajNtGp4AbEgonQ5wnC67TW1-2BUb2RU8L5yKQNskb2J8oYysmGb5dsdmsl1Yzj4lB413OWIuqD1KEO-2Fk8KsYk-3D9jJn_q-2BdpEcq7WJfuCP40fqxszGJt9QNUpgYcS5PykcXTBztbwnzkWfIzfxDIlLNKToV2uT-2BbEmY4yMtpKQsgtsEAFkRlMlhvitd2AZ-2FffoQ3JdbAvGhSyFa9vx8V4GtXz-2FUljCHPwvgtFSfFId2VoQp3NjDOw6hrVAxi-2FICoeoMumc0-2FvxnfAsTGfipMsy8sCWRoqSR3YD-2BMdDEnP-2FXOa82mvLlwefHyOICsX-2FN0VTeWUxrignyxkmk-2F3sYSfYYMMoGKKVUGJrqUclFer0wOm4cSti-2B7b275CYfEt-2B1cnv7iONmtZ1gcoCRAscTAfO-2BmC8sjStYSwMZ0hkCWqEhUjAWvnVn9nVqTPV8tnvrUUpGMAEJs2aAQuZisN3DGPz1ngJal5C5mOJfz33HuTV1Ig48lf-2Bu6UlSFSW0xD9YzkN4FbkChv5eo7vx5ct0YftDuy1lrYd3nGAjDkBWjuyDH-2FuKo-2BbIlucdAqX9-2BVjhGolpkvAIMjNSnIUQ-2F-2FygtCtGJQiX6aPnGlfiSXI8AHFB9u2B-2FG1GBe0JObJ9octuTBxglbGTy4PBZfoH2jHB5SFRGidO21-2FthipFbBolrzjPLhYfKpzn5PiOLLpgBDVi-2BIK5FWQHPldOK-2BtJWhy-2FTBHYLdx7t HTTP 302
https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request saver.html Show response
uploadedfilesaver.s3.us-east-2.amazonaws.com/
Redirect Chain

http://links.notification.intuit.com/ls/click?upn=LEV65WI9EZ1l5TkUt4hKq8LeajNtGp4AbEgonQ5wnC67TW1-2BUb2RU8L5yKQNskb2J8oYysmGb5dsdmsl1Yzj4lB413OWIuqD1KEO-2Fk8KsYk-3D9jJn_q-2BdpEcq7WJfuCP40fqxszGJt9Q...
https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html

657 KB
658 KB

499ms
160ms

Document
text/html

52.219.104.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.104.88 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-r-w.us-east-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 417cf8fb14b4d6cca20979e0a01e6a2e597f81e12445f42e32fd4cdb1035994d

Request headers

Host: uploadedfilesaver.s3.us-east-2.amazonaws.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-id-2: hhdl5nb0CVrjoyyBV5D4qRx4IDbdxUssI8krW89QuOgkXFuLVCqxu94wm5jA/BNfI6VTFvTnsJc=
x-amz-request-id: FF50B32604C84DF0
Date: Mon, 28 Sep 2020 00:47:58 GMT
Last-Modified: Mon, 24 Aug 2020 13:39:40 GMT
ETag: "4755e6df650c5f3e2b371dea59e8027f"
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 673087
Server: AmazonS3

Redirect headers

Server: nginx
Date: Mon, 28 Sep 2020 00:47:57 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 86
Connection: keep-alive
Location: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
X-Robots-Tag: noindex, nofollow

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ 86 KB
30 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: uploadedfilesaver.s3.us-east-2.amazonaws.com
URL: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 27 Sep 2020 20:33:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15270
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Sep 2021 20:33:28 GMT

GET
H/1.1 403
Forbidden 7c-6d2d0e
uploadedfilesaver.s3.us-east-2.amazonaws.com/files/ 0
0 464ms
127ms Stylesheet
application/xml 52.219.104.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/files/7c-6d2d0e
Requested by: Host: uploadedfilesaver.s3.us-east-2.amazonaws.com
URL: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.104.88 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-r-w.us-east-2.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://uploadedfilesaver.s3.us-east-2.amazonaws.com/saver.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 00:47:58 GMT
Server: AmazonS3
x-amz-request-id: 3E6356FA586B6115
Transfer-Encoding: chunked
x-amz-id-2: ACvCCsrE9h2APRuogsZygfCT/M33JR9ogM1nrhxzr7GXk0p6OOssfK8LvnuOIQJu0v62HNgvYNc=
Content-Type: application/xml

GET custom.js
ohanaeventscle.com/share/ 0
0

GET
DATA 200
OK truncated
/ 34 KB
34 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 621444729b901edd79a8ac4fd06bb553901fdf84b7be631b7e1efbf31037b13c

Request headers

Origin: https://uploadedfilesaver.s3.us-east-2.amazonaws.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: font/woff;charset=utf-8

GET
DATA 200
OK truncated
/ 21 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2e1e3e0d6b3b7a358b49b4d2de0dbd265fc7cb2187dd5adce70ac3c6a5b7456

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8707d48b9b9d0cbc3c4cd124890ed9b9064a7cb165053e64566bd32aae7fed8d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 36 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45c12449a454177a5e6ac8353de0367c4b7fd34ddd6788c1eb7b800798e90088

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 54 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0bd66af71683f31b99ba87848912c3becf231a302f0780fe795ecbb6201e5f6b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 86 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dcbcf987cfd097c4a292df8b9736d54e38852f9f619912b242bc91243eaba9db

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 101f465665884f6c666fc82cec1b183d5c66b79230359e5d0214fe2fa46b0700

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 83b9b350aa15ef0898f284b5c3b4da6d90b6742d1922e27b7ead18ef2e84783d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb51a597fd72d38d2fdd80d471ef69bbf68c1420dac1fbd4290e8fab654c8769

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ohanaeventscle.com
URL: https://ohanaeventscle.com/share/custom.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
links.notification.intuit.com
ohanaeventscle.com
uploadedfilesaver.s3.us-east-2.amazonaws.com
ohanaeventscle.com
167.89.115.56
2a00:1450:4001:818::200a
52.219.104.88
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0bd66af71683f31b99ba87848912c3becf231a302f0780fe795ecbb6201e5f6b
101f465665884f6c666fc82cec1b183d5c66b79230359e5d0214fe2fa46b0700
417cf8fb14b4d6cca20979e0a01e6a2e597f81e12445f42e32fd4cdb1035994d
45c12449a454177a5e6ac8353de0367c4b7fd34ddd6788c1eb7b800798e90088
621444729b901edd79a8ac4fd06bb553901fdf84b7be631b7e1efbf31037b13c
83b9b350aa15ef0898f284b5c3b4da6d90b6742d1922e27b7ead18ef2e84783d
8707d48b9b9d0cbc3c4cd124890ed9b9064a7cb165053e64566bd32aae7fed8d
dcbcf987cfd097c4a292df8b9736d54e38852f9f619912b242bc91243eaba9db
e2e1e3e0d6b3b7a358b49b4d2de0dbd265fc7cb2187dd5adce70ac3c6a5b7456
eb51a597fd72d38d2fdd80d471ef69bbf68c1420dac1fbd4290e8fab654c8769

uploadedfilesaver.s3.us-east-2.amazonaws.com Open in urlscan Pro 52.219.104.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

4 Requests

75 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

722 kBTransfer

999 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

uploadedfilesaver.s3.us-east-2.amazonaws.com Open in urlscan Pro
52.219.104.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

722 kB
Transfer

999 kB
Size

0
Cookies

4 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!