log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com Open in urlscan Pro
16.15.177.40 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2flog%2din%2dsecure%2ddoc%2dshare.s3.us%2deast%2d1.amazon...
Effective URL:
https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/NRedirect.html
Submission: On October 24 via manual (October 24th 2024, 2:21:20 pm UTC) from AE — Scanned from IT

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 7 domains to perform 6 HTTP transactions. The main IP is 16.15.177.40, located in United States and belongs to AMAZON-AES, US. The main domain is log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on September 18th 2024. Valid for: a year.

This is the only time log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	44.227.218.224 44.227.218.224	16509 (AMAZON-02) (AMAZON-02)
1	52.216.10.46 52.216.10.46	16509 (AMAZON-02) (AMAZON-02)
1 1	104.18.68.40 104.18.68.40	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.67.182.115 172.67.182.115	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	159.65.213.219 159.65.213.219	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3 3	54.194.191.188 54.194.191.188	16509 (AMAZON-02) (AMAZON-02)
1 1	18.245.86.98 18.245.86.98	16509 (AMAZON-02) (AMAZON-02)
2	16.15.177.40 16.15.177.40	14618 (AMAZON-AES) (AMAZON-AES)
6	4

1 44.227.218.224 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-227-218-224.us-west-2.compute.amazonaws.com

smex-ctp.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.10.46 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-east-1-r-w.amazonaws.com

log-in-secure-doc-share.s3.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.68.40 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

link.mail.beehiiv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.182.115 (United States)

ASN13335 (CLOUDFLARENET, US)

xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.65.213.219 (Slough, United Kingdom) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: api.transpond.io

api.mailsenderam1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.194.191.188 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-191-188.eu-west-1.compute.amazonaws.com

click.pstmrk.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.98 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-98.fra60.r.cloudfront.net

cnx8wj.fj63.fdske.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 16.15.177.40 (United States)

ASN14618 (AMAZON-AES, US)

log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	pstmrk.it 3 redirects click.pstmrk.it — Cisco Umbrella Rank: 54426	619 B
3	xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de	3 KB
3	amazonaws.com log-in-secure-doc-share.s3.us-east-1.amazonaws.com log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com	15 KB
1	fdske.com 1 redirects cnx8wj.fj63.fdske.com	382 B
1	mailsenderam1.com 1 redirects api.mailsenderam1.com	577 B
1	beehiiv.com 1 redirects link.mail.beehiiv.com — Cisco Umbrella Rank: 51550	665 B
1	trendmicro.com 1 redirects smex-ctp.trendmicro.com	235 B
6	7

	Domain	Requested by
3	click.pstmrk.it	3 redirects
3	xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de	log-in-secure-doc-share.s3.us-east-1.amazonaws.com xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de
2	log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com	xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de
1	cnx8wj.fj63.fdske.com	1 redirects
1	api.mailsenderam1.com	1 redirects
1	link.mail.beehiiv.com	1 redirects
1	log-in-secure-doc-share.s3.us-east-1.amazonaws.com
1	smex-ctp.trendmicro.com	1 redirects
6	8

This site contains no links.

Subject Issuer	Validity	Valid
s3.amazonaws.com Amazon RSA 2048 M01	`2024-09-18` - `2025-09-16`	a year	crt.sh
xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/NRedirect.html
Frame ID: 837871B7BF2FEBAC7A96D6ADB3DC3DC7
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Confirm Your Identity

Page URL History Show full URLs

https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2flog%2din%2dsecure%2ddoc%2dshare.s3.... HTTP 302
https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html Page URL
https://link.mail.beehiiv.com/ls/click?upn=u001.OntRk5QVouPgVcpt7jiOA1uVzOIUSMyiZxg-2BdTYy44H4vyO-2BjsX-2B... HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_med... Page URL
https://api.mailsenderam1.com/c/0247fac4a52ed58f166fa7b81117cdb1_bd496533e24a8da4d57e8a5fafe120a8?sid=f925... HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html Page URL
https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fcnx8wj.fj63.fdske.com%2... HTTP 302
https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fcnx8wj.fj63.fdske.com%252Fe%252Fc%252F01jaxp8eap2n... HTTP 302
https://click.pstmrk.it/3s/cnx8wj.fj63.fdske.com%2Fe%2Fc%2F01jaxp8eap2nz594831dsc9577%2F01jaxp8eap2n... HTTP 302
https://cnx8wj.fj63.fdske.com/e/c/01jaxp8eap2nz594831dsc9577/01jaxp8eap2nz594831g14b0g4 HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html Page URL
https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/NRedirect.html Page URL

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

7
Domains

8
Subdomains

4
IPs

4
Countries

18 kB
Transfer

21 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2flog%2din%2dsecure%2ddoc%2dshare.s3.us%2deast%2d1.amazonaws.com%2findexfinal.html&umid=fc22ef5a-2485-43e9-848b-f1fe949112c3&auth=30e19357da9420d50ded5134777d5c23087c2967-aaaa5d73d77dc16ba5ac657fe91c46535bd187a0 HTTP 302
https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html Page URL
https://link.mail.beehiiv.com/ls/click?upn=u001.OntRk5QVouPgVcpt7jiOA1uVzOIUSMyiZxg-2BdTYy44H4vyO-2BjsX-2BFKOGr-2F8h-2BLC2SH5lyuiLMnyaXpfHawqTYUVWy4ZbF-2FbXiPbwXB71KWWiqo9ScoTq4lFwizDRDALoLeC-2FLP6PVgYrDWzKmoMmMEwgv9Za7QwQsNrvUpo-2FF9bdGoDBGGsNqXDI1IiLySvlAexXd7XhXCcSwKBjrp4bIXB0C0PbNc-2FzfigngtIDuH4-3D5wcy_zbv2vD5DXrAqdowK1HhrRUVQoiiMykGgshFnQ1F-2BibJOi5uUEJybHxzFljTlKTy6S592Bv8wzyW3aHAT4Cp01-2B8Inf62iG02Jw8XQSJbzqryotJLtlFnZXCvcNchbDirqOxeb8VskNWzYQa43a5SgIYxibyq1gFn-2BQsOUMKAf-2FuCYqOnPMl7o-2FlFayQzRKBw9HHU-2B2YJ3vng0I-2Fjg0bLYP7Sf1bSRBtiJAvUXje9jlRs0-2BQ0P-2B81kBUmIrXqXlRWBEHnpKJANdtnmULgu-2BbyC-2BjDLgzymoq2Xu5K2wHYY7vpZ78YQ8t5PVPDFOzpct5v1WElWqcWg3opJqcTwIYOhLeiWeieZXUv2UoFyLinS6hloA2G-2FQ87VoJeOjJz4LfA6g-2BVfqx5bH84zltVQ0X-2BFXhaCBDhE8Fv38kSy8zOv9hjnx95rZoiJiXDeZuNGbKY HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today Page URL
https://api.mailsenderam1.com/c/0247fac4a52ed58f166fa7b81117cdb1_bd496533e24a8da4d57e8a5fafe120a8?sid=f9253b9b01f98d59ca0bd7cdfec225ff_bad8e64987c1ae2e0445470487cdc6e9&aid=ZqOV HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html Page URL
https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fcnx8wj.fj63.fdske.com%25252Fe%25252Fc%25252F01jaxp8eap2nz594831dsc9577%25252F01jaxp8eap2nz594831g14b0g4%252FGxTg%252FKeG4AQ%252FAQ%252F5448b62d-1d26-4b6e-b99a-41eb2b730f6c%252F1%252FKchTs4y9va%2FGxTg%2FKuG4AQ%2FAQ%2F8aef9841-ffaf-448a-a1d3-a5538cd8345b%2F1%2FQ2iCayL_GS/GxTg/K_G4AQ/AQ/8b718222-abc3-49db-8819-e7562c137028/1/3f5-Rc4_X6 HTTP 302
https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fcnx8wj.fj63.fdske.com%252Fe%252Fc%252F01jaxp8eap2nz594831dsc9577%252F01jaxp8eap2nz594831g14b0g4%2FGxTg%2FKeG4AQ%2FAQ%2F5448b62d-1d26-4b6e-b99a-41eb2b730f6c%2F1%2FKchTs4y9va/GxTg/KuG4AQ/AQ/8aef9841-ffaf-448a-a1d3-a5538cd8345b/1/Q2iCayL_GS HTTP 302
https://click.pstmrk.it/3s/cnx8wj.fj63.fdske.com%2Fe%2Fc%2F01jaxp8eap2nz594831dsc9577%2F01jaxp8eap2nz594831g14b0g4/GxTg/KeG4AQ/AQ/5448b62d-1d26-4b6e-b99a-41eb2b730f6c/1/KchTs4y9va HTTP 302
https://cnx8wj.fj63.fdske.com/e/c/01jaxp8eap2nz594831dsc9577/01jaxp8eap2nz594831g14b0g4 HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html Page URL
https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/NRedirect.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2flog%2din%2dsecure%2ddoc%2dshare.s3.us%2deast%2d1.amazonaws.com%2findexfinal.html&umid=fc22ef5a-2485-43e9-848b-f1fe949112c3&auth=30e19357da9420d50ded5134777d5c23087c2967-aaaa5d73d77dc16ba5ac657fe91c46535bd187a0 HTTP 302
https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html

Request Chain 1

https://link.mail.beehiiv.com/ls/click?upn=u001.OntRk5QVouPgVcpt7jiOA1uVzOIUSMyiZxg-2BdTYy44H4vyO-2BjsX-2BFKOGr-2F8h-2BLC2SH5lyuiLMnyaXpfHawqTYUVWy4ZbF-2FbXiPbwXB71KWWiqo9ScoTq4lFwizDRDALoLeC-2FLP6PVgYrDWzKmoMmMEwgv9Za7QwQsNrvUpo-2FF9bdGoDBGGsNqXDI1IiLySvlAexXd7XhXCcSwKBjrp4bIXB0C0PbNc-2FzfigngtIDuH4-3D5wcy_zbv2vD5DXrAqdowK1HhrRUVQoiiMykGgshFnQ1F-2BibJOi5uUEJybHxzFljTlKTy6S592Bv8wzyW3aHAT4Cp01-2B8Inf62iG02Jw8XQSJbzqryotJLtlFnZXCvcNchbDirqOxeb8VskNWzYQa43a5SgIYxibyq1gFn-2BQsOUMKAf-2FuCYqOnPMl7o-2FlFayQzRKBw9HHU-2B2YJ3vng0I-2Fjg0bLYP7Sf1bSRBtiJAvUXje9jlRs0-2BQ0P-2B81kBUmIrXqXlRWBEHnpKJANdtnmULgu-2BbyC-2BjDLgzymoq2Xu5K2wHYY7vpZ78YQ8t5PVPDFOzpct5v1WElWqcWg3opJqcTwIYOhLeiWeieZXUv2UoFyLinS6hloA2G-2FQ87VoJeOjJz4LfA6g-2BVfqx5bH84zltVQ0X-2BFXhaCBDhE8Fv38kSy8zOv9hjnx95rZoiJiXDeZuNGbKY HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today

Request Chain 2

https://api.mailsenderam1.com/c/0247fac4a52ed58f166fa7b81117cdb1_bd496533e24a8da4d57e8a5fafe120a8?sid=f9253b9b01f98d59ca0bd7cdfec225ff_bad8e64987c1ae2e0445470487cdc6e9&aid=ZqOV HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html

Request Chain 3

https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fcnx8wj.fj63.fdske.com%25252Fe%25252Fc%25252F01jaxp8eap2nz594831dsc9577%25252F01jaxp8eap2nz594831g14b0g4%252FGxTg%252FKeG4AQ%252FAQ%252F5448b62d-1d26-4b6e-b99a-41eb2b730f6c%252F1%252FKchTs4y9va%2FGxTg%2FKuG4AQ%2FAQ%2F8aef9841-ffaf-448a-a1d3-a5538cd8345b%2F1%2FQ2iCayL_GS/GxTg/K_G4AQ/AQ/8b718222-abc3-49db-8819-e7562c137028/1/3f5-Rc4_X6 HTTP 302
https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fcnx8wj.fj63.fdske.com%252Fe%252Fc%252F01jaxp8eap2nz594831dsc9577%252F01jaxp8eap2nz594831g14b0g4%2FGxTg%2FKeG4AQ%2FAQ%2F5448b62d-1d26-4b6e-b99a-41eb2b730f6c%2F1%2FKchTs4y9va/GxTg/KuG4AQ/AQ/8aef9841-ffaf-448a-a1d3-a5538cd8345b/1/Q2iCayL_GS HTTP 302
https://click.pstmrk.it/3s/cnx8wj.fj63.fdske.com%2Fe%2Fc%2F01jaxp8eap2nz594831dsc9577%2F01jaxp8eap2nz594831g14b0g4/GxTg/KeG4AQ/AQ/5448b62d-1d26-4b6e-b99a-41eb2b730f6c/1/KchTs4y9va HTTP 302
https://cnx8wj.fj63.fdske.com/e/c/01jaxp8eap2nz594831dsc9577/01jaxp8eap2nz594831g14b0g4 HTTP 302
https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	indexfinal.html Show response log-in-secure-doc-share.s3.us-east-1.amazonaws.com/ Redirect Chain https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2flog%2din%2dsecure%2ddoc%2dshare.s3.us%2deast%2d1.amazonaws.com%2findexfinal.html&umid=fc22ef5a-2485-43e9-848b-f1fe949112c3&a... https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html	1 KB 2 KB	567ms 187ms	Document text/html	52.216.10.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html Protocol HTTP/1.1 Security TLS 1.3, , CHACHA20_POLY1305 Server 52.216.10.46 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash `75e60c5ed7f8fc004bba7fa4eaa3c0c37d91838bdb8bd10f504dc80cbbdb7dda` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Content-Length 1489 Content-Type text/html Date Thu, 24 Oct 2024 14:21:06 GMT ETag "609ee44fd65202ff8adfdb3891459495" Last-Modified Thu, 24 Oct 2024 10:54:09 GMT Server AmazonS3 x-amz-id-2 ghXaIzI3uLJLhBKBNejLL+39fqt7ep14z5SyMRvbTIl5WB97GBJEbDeuii3Gc2rWx7brPFkvlSk= x-amz-request-id BTK52YFZ7ZYDSDB9 x-amz-server-side-encryption AES256 x-amz-version-id eUyBjJZEa82tcNxw.xyn0hLNUVaaqobR Redirect headers access-control-allow-origin * content-length 0 content-type text/html; charset=UTF-8 date Thu, 24 Oct 2024 14:21:05 GMT location https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html server istio-envoy x-envoy-decorator-operation ctp-web-service.ctp.svc.cluster.local:8080/* x-envoy-upstream-service-time 28
GET H2	200	index.html xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/ Redirect Chain https://link.mail.beehiiv.com/ls/click?upn=u001.OntRk5QVouPgVcpt7jiOA1uVzOIUSMyiZxg-2BdTYy44H4vyO-2BjsX-2BFKOGr-2F8h-2BLC2SH5lyuiLMnyaXpfHawqTYUVWy4ZbF-2FbXiPbwXB71KWWiqo9ScoTq4lFwizDRDALoLeC-2FLP6... https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today	880 B 1 KB	1188ms 665ms	Document text/html	172.67.182.115 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today Requested by Host: log-in-secure-doc-share.s3.us-east-1.amazonaws.com URL: https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.182.115 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://log-in-secure-doc-share.s3.us-east-1.amazonaws.com/indexfinal.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d7a9c884efc3ce1-CDG content-encoding br content-type text/html; charset=UTF-8 date Thu, 24 Oct 2024 14:21:07 GMT last-modified Mon, 21 Oct 2024 23:24:39 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J3qtIzbQtSyBV7zsxK6dZuWnnlpT4qDBJvJYFB%2F2gIJI05h4r54%2FGCGtx0z8D%2BY02kSLlqpiaGCoOXMHkhXF%2F%2FgD6vXu1LaljCKmt%2BPQpjDYhUvikccUCeUTD6dh%2F2ymdTVp762wYlVPzJRkvVaApF2alsiePg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=22966&sent=8&recv=10&lost=0&retrans=0&sent_bytes=3931&recv_bytes=2454&delivery_rate=157239&cwnd=254&unsent_bytes=0&cid=9a5900dcf0e0e0ba&ts=576&x=0" vary Accept-Encoding Redirect headers cf-cache-status DYNAMIC cf-ray 8d7a9c8359603760-MXP content-type text/html; charset=utf-8 date Thu, 24 Oct 2024 14:21:06 GMT location https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today server cloudflare x-robots-tag noindex, nofollow
GET H2	200	index.html xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/ Redirect Chain https://api.mailsenderam1.com/c/0247fac4a52ed58f166fa7b81117cdb1_bd496533e24a8da4d57e8a5fafe120a8?sid=f9253b9b01f98d59ca0bd7cdfec225ff_bad8e64987c1ae2e0445470487cdc6e9&aid=ZqOV https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html	1 KB 1 KB	294ms 293ms	Document text/html	172.67.182.115 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html Requested by Host: xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de URL: https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.182.115 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/beehiiv/index.html?utm_source=praveens-newsletter-ed1dd5.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d7a9c8f88fb3ce1-CDG content-encoding br content-type text/html; charset=UTF-8 date Thu, 24 Oct 2024 14:21:08 GMT last-modified Wed, 23 Oct 2024 22:04:36 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vSpaMEEzpXAJzHUA6Q36LEpEQdlD5A7iky8w7%2F3v1q6cZQDDXnEIRElc4KIW1tV0wsQtiBhroGvWsry5X2X0Zccy9X0VwoPI6ADlkST1VOUoiyokCE0%2F3OecablpBZ3u3Z4kcrycxNfOV7SavRc%2BNhDQ%2FYMfiA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=34452&sent=13&recv=14&lost=0&retrans=1&sent_bytes=5133&recv_bytes=2553&delivery_rate=157239&cwnd=257&unsent_bytes=0&cid=9a5900dcf0e0e0ba&ts=1540&x=0" vary Accept-Encoding Redirect headers access-control-allow-credentials true access-control-allow-methods PUT, GET, POST, DELETE, OPTIONS access-control-expose-headers X-User, X-Master, X-Token cache-control no-store, no-cache, must-revalidate, proxy-revalidate content-length 172 content-type text/html; charset=utf-8 date Thu, 24 Oct 2024 14:21:08 GMT location https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html server nginx vary Origin, Accept, Accept-Encoding x-request-id 00-a20625b2005b24fa7642b549ce14c797-37a88b5dacc08a9d-01 x-robots-tag noindex
GET H2	200	index.html xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/ Redirect Chain https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fcnx8wj.fj63.fdske.com%25252Fe%25252Fc%25252F01jaxp8eap2nz594831dsc9577%25252F01jaxp8eap2nz594831g14b0g4%252FGxTg%252FKeG... https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fcnx8wj.fj63.fdske.com%252Fe%252Fc%252F01jaxp8eap2nz594831dsc9577%252F01jaxp8eap2nz594831g14b0g4%2FGxTg%2FKeG4AQ%2FAQ%2F5448b62d-1d26-4b6e-b99a-41eb... https://click.pstmrk.it/3s/cnx8wj.fj63.fdske.com%2Fe%2Fc%2F01jaxp8eap2nz594831dsc9577%2F01jaxp8eap2nz594831g14b0g4/GxTg/KeG4AQ/AQ/5448b62d-1d26-4b6e-b99a-41eb2b730f6c/1/KchTs4y9va https://cnx8wj.fj63.fdske.com/e/c/01jaxp8eap2nz594831dsc9577/01jaxp8eap2nz594831g14b0g4 https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html	805 B 869 B	298ms 298ms	Document text/html	172.67.182.115 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html Requested by Host: xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de URL: https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.182.115 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/transpond/index.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d7a9c9b19e33ce1-CDG content-encoding br content-type text/html; charset=UTF-8 date Thu, 24 Oct 2024 14:21:10 GMT last-modified Thu, 24 Oct 2024 07:24:35 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m2ZWFkphSLXlhHL49AADotAQhkxld7weJhALT19GAbHIk8Q6R6VwG9TXQhf3m3dVlqpTbF0%2B8D6%2B39k6nhZiGYmQBnBkxN93klObZ6%2FuzIGnf8vNgilTALc6Sb%2Fk807gyE7Di1LwKMudkM5jOwWxrJL8mN%2BoJA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=30542&sent=18&recv=19&lost=0&retrans=1&sent_bytes=6283&recv_bytes=2618&delivery_rate=205185&cwnd=257&unsent_bytes=0&cid=9a5900dcf0e0e0ba&ts=3394&x=0" vary Accept-Encoding Redirect headers content-length 85 content-type text/html; charset=utf-8 date Thu, 24 Oct 2024 14:21:10 GMT location https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html vary Origin via 1.1 56a77d6c9e6b49fa4179a99507a9582e.cloudfront.net (CloudFront) x-amz-cf-id nrWDdkdFiuQUia8qHGp-wW8zYTtxJ49DSEHyJFdxE3OcTy7dw0G8uw== x-amz-cf-pop FRA60-P6 x-cache Miss from cloudfront
GET H/1.1	200 OK	Primary Request NRedirect.html Show response log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/	12 KB 12 KB	681ms 187ms	Document text/html	16.15.177.40 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/NRedirect.html Requested by Host: xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de URL: https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/flodesk/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.15.177.40 , United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software AmazonS3 / Resource Hash `3098ca8eabdac375055fbad013bd5a3c17c871994c972e190964264015ff97cb` Request headers Referer https://xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Content-Length 11935 Content-Type text/html Date Thu, 24 Oct 2024 14:21:12 GMT ETag "1b77dbd60834a8e9454a8cde29fcb55c" Last-Modified Thu, 24 Oct 2024 10:51:38 GMT Server AmazonS3 x-amz-id-2 JFenJrbQCrf+wKMpo9pAQVeqWTawYQrCkrJYCiekI6hB4SWoS+4/gEUfPUJM2fJJMsOvsnRIQ8jZBSYsixuIVVquVlWNYL4Mc4UN0YLAre8= x-amz-request-id DQMEN62WD0EDPVT6 x-amz-server-side-encryption AES256 x-amz-version-id DwJ.PEXp5..N0mhzjmgMGhK2VvMd8zTT
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ff0407d4ec832e14fba9171bc288d0c481c956af888cba44382d147c0dbae6f9` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H/1.1	403 Forbidden	favicon.ico log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/	275 B 585 B	148ms 148ms	Other application/xml	16.15.177.40 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.15.177.40 , United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software AmazonS3 / Resource Hash `c5acca740d74a31dac57904803702fabeefa4ba550f3fac9e3c5678c8d871f66` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/NRedirect.html Response headers Transfer-Encoding chunked x-amz-request-id DQM0TZGZX3SMW7Q0 Date Thu, 24 Oct 2024 14:21:10 GMT Content-Type application/xml Server AmazonS3 x-amz-id-2 +7WisuPwetQlS9kg/uGGQFTU9BEXR90wno/33IDrKtG5ROyGXEk+l8uoNSu74JdPgvu8QKWziAr+JHy8qTWxCnoCAWwGfGYEJSyCVG1dw3M=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| fetchEmailList function| continueLoading function| validateEmail function| fetchRandomWiki

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.beehiiv.com/	1970-01-21 00:29:41	Name: __cf_bm Value: VT0cAOPXNyrRRB_2YbL35pHGtegkow_Bp.3RKSFB_SI-1729779666-1.0.1.1-KrPKfd1CGQ473AUpB6Db11kKuPcUGmpY5BaGpET4yFO9UDcFxEUBEwSf9A4F1xBHGh8vT2hDP6KnXskNoaqeLQ

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.mailsenderam1.com
click.pstmrk.it
cnx8wj.fj63.fdske.com
link.mail.beehiiv.com
log-in-secure-doc-share.s3.us-east-1.amazonaws.com
log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com
smex-ctp.trendmicro.com
xz1-sgidalgh20ruhjdeaq40cvhnfdxo.de
104.18.68.40
159.65.213.219
16.15.177.40
172.67.182.115
18.245.86.98
44.227.218.224
52.216.10.46
54.194.191.188
3098ca8eabdac375055fbad013bd5a3c17c871994c972e190964264015ff97cb
75e60c5ed7f8fc004bba7fa4eaa3c0c37d91838bdb8bd10f504dc80cbbdb7dda
c5acca740d74a31dac57904803702fabeefa4ba550f3fac9e3c5678c8d871f66
ff0407d4ec832e14fba9171bc288d0c481c956af888cba44382d147c0dbae6f9

log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com Open in urlscan Pro 16.15.177.40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

7 Domains

8 Subdomains

4 IPs

4 Countries

18 kBTransfer

21 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

log-in-sharedoc-one-drive-remittance-slip-statement.s3.us-east-1.amazonaws.com Open in urlscan Pro
16.15.177.40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

7
Domains

8
Subdomains

4
IPs

4
Countries

18 kB
Transfer

21 kB
Size

1
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!