URL: http://salesforce.sbm-demo.xyz/phishing.html
Submission: On September 18 via manual from IL

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 34.255.234.254, located in Dublin, Ireland and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is salesforce.sbm-demo.xyz.
This is the only time salesforce.sbm-demo.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 34.255.234.254 16509 (AMAZON-02)
1 104.111.242.105 16625 (AKAMAI-AS)
7 2
Apex Domain
Subdomains
Transfer
6 sbm-demo.xyz
salesforce.sbm-demo.xyz
290 KB
1 salesforce.com
c.salesforce.com
7 2
Domain Requested by
6 salesforce.sbm-demo.xyz salesforce.sbm-demo.xyz
1 c.salesforce.com salesforce.sbm-demo.xyz
7 2

This site contains links to these domains. Also see Links.

Domain
login.salesforce.com
www.salesforce.com
Subject Issuer Validity Valid
c.salesforce.com
GeoTrust RSA CA 2018
2019-03-26 -
2020-06-24
a year crt.sh

This page contains 2 frames:

Primary Page: http://salesforce.sbm-demo.xyz/phishing.html
Frame ID: 971A86DA7393D8083D41F55B225361A9
Requests: 6 HTTP requests in this frame

Frame: https://c.salesforce.com/login-messages/promos.html
Frame ID: C85FF8080EB5EBF1A30B9E8393658875
Requests: 1 HTTP requests in this frame

Screenshot


Page Statistics

7
Requests

14 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

290 kB
Transfer

288 kB
Size

9
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request phishing.html
salesforce.sbm-demo.xyz/
5 KB
5 KB
Document
General
Full URL
http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Server
34.255.234.254 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-234-254.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
f14e59d6b4898650ac4e18e12c71ab4e4e548957c22917bec8c3517071ff4461

Request headers

Host
salesforce.sbm-demo.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
public, max-age=0
Content-Type
text/html; charset=UTF-8
Date
Wed, 18 Sep 2019 12:32:35 GMT
ETag
W/"141d-16a1b0f7900"
Last-Modified
Sun, 14 Apr 2019 08:56:00 GMT
X-Powered-By
Express
Content-Length
5149
Connection
keep-alive
app.css
salesforce.sbm-demo.xyz/
17 KB
17 KB
Stylesheet
General
Full URL
http://salesforce.sbm-demo.xyz/app.css
Requested by
Host: salesforce.sbm-demo.xyz
URL: http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Server
34.255.234.254 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-234-254.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
9981c40d77e7cbd6475367178003183e70baefcac5e054ec6f2c642d28a6ff4f

Request headers

Referer
http://salesforce.sbm-demo.xyz/phishing.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 18 Sep 2019 12:32:35 GMT
Last-Modified
Mon, 20 May 2019 10:30:51 GMT
X-Powered-By
Express
ETag
W/"4222-16ad4cb3f78"
Content-Type
text/css; charset=UTF-8
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16930
logo214.svg
salesforce.sbm-demo.xyz/img/
7 KB
7 KB
Image
General
Full URL
http://salesforce.sbm-demo.xyz/img/logo214.svg
Requested by
Host: salesforce.sbm-demo.xyz
URL: http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Server
34.255.234.254 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-234-254.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
a48f997fa23140662c20f7a46e93cefcef071fbf81ce038067582f2d822d86d5

Request headers

Referer
http://salesforce.sbm-demo.xyz/phishing.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 18 Sep 2019 12:32:35 GMT
Last-Modified
Thu, 31 Jan 2019 11:04:16 GMT
X-Powered-By
Express
ETag
W/"1a28-168a394ab80"
Content-Type
image/svg+xml
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6696
hacked-2127635_640.png
salesforce.sbm-demo.xyz/img/
206 KB
206 KB
Image
General
Full URL
http://salesforce.sbm-demo.xyz/img/hacked-2127635_640.png
Requested by
Host: salesforce.sbm-demo.xyz
URL: http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Server
34.255.234.254 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-234-254.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
64a589b66d30f94bfa107a61d9185eca42aed2bf995c59eadb6a9ee7491b4a86

Request headers

Referer
http://salesforce.sbm-demo.xyz/phishing.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 18 Sep 2019 12:32:35 GMT
Last-Modified
Thu, 31 Jan 2019 11:04:16 GMT
X-Powered-By
Express
ETag
W/"33831-168a394ab80"
Content-Type
image/png
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
210993
promos.html
c.salesforce.com/login-messages/ Frame C85F
0
0
Document
General
Full URL
https://c.salesforce.com/login-messages/promos.html
Requested by
Host: salesforce.sbm-demo.xyz
URL: http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.242.105 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-242-105.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Host
c.salesforce.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
http://salesforce.sbm-demo.xyz/phishing.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
http://salesforce.sbm-demo.xyz/phishing.html

Response headers

Server
Apache
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer-when-downgrade
X-UA-Compatible
IE=9; IE=8; IE=7; IE=EDGE
Content-Type
text/html
Content-Length
5772
Date
Wed, 18 Sep 2019 12:32:35 GMT
Connection
keep-alive
SalesforceSans-Regular.woff2
salesforce.sbm-demo.xyz/fonts/
27 KB
27 KB
Font
General
Full URL
http://salesforce.sbm-demo.xyz/fonts/SalesforceSans-Regular.woff2
Requested by
Host: salesforce.sbm-demo.xyz
URL: http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Server
34.255.234.254 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-234-254.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
1f1752651aca663f40e45c60e182172fc426a40df042098f6e68a56db2c459f3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://salesforce.sbm-demo.xyz/app.css
Origin
http://salesforce.sbm-demo.xyz

Response headers

Date
Wed, 18 Sep 2019 12:32:35 GMT
Last-Modified
Thu, 31 Jan 2019 11:04:16 GMT
X-Powered-By
Express
ETag
W/"6bbc-168a394ab80"
Content-Type
application/font-woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27580
SalesforceSans-Light.woff2
salesforce.sbm-demo.xyz/fonts/
27 KB
27 KB
Font
General
Full URL
http://salesforce.sbm-demo.xyz/fonts/SalesforceSans-Light.woff2
Requested by
Host: salesforce.sbm-demo.xyz
URL: http://salesforce.sbm-demo.xyz/phishing.html
Protocol
HTTP/1.1
Server
34.255.234.254 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-234-254.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
b7df2d6cb9d0ecda707a1de1302b3c9d9bda16247dc382e696579a8308d49771

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://salesforce.sbm-demo.xyz/app.css
Origin
http://salesforce.sbm-demo.xyz

Response headers

Date
Wed, 18 Sep 2019 12:32:35 GMT
Last-Modified
Thu, 31 Jan 2019 11:04:16 GMT
X-Powered-By
Express
ETag
W/"6c58-168a394ab80"
Content-Type
application/font-woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27736

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| displayHahcked

9 Cookies

Domain/Path Name / Value
.salesforce.com/ Name: OptanonConsent
Value: landingPath=https%3A%2F%2Fc.salesforce.com%2Flogin-messages%2Fpromos.html&datestamp=Wed+Sep+18+2019+14%3A32%3A35+GMT%2B0200+(Central+European+Summer+Time)&version=4.4.0&EU=true&groups=1%3A1%2C0_165883%3A1%2C0_165890%3A1%2C3%3A1%2C0_166673%3A1%2C4%3A0%2C0_166674%3A1%2C0_167477%3A1%2C0_167478%3A1%2C0_167479%3A1%2C0_167480%3A1%2C0_167481%3A1%2C0_165873%3A0%2C0_165874%3A0%2C0_165876%3A0%2C0_165878%3A0%2C0_165880%3A0%2C0_167482%3A0%2C0_165882%3A0%2C0_165884%3A0%2C0_165886%3A0%2C0_165888%3A0%2C0_165891%3A0%2C0_177554%3A0%2C0_165875%3A0%2C0_165877%3A0%2C0_177553%3A0%2C0_165879%3A0%2C0_165881%3A0%2C0_165885%3A0%2C0_165887%3A0%2C0_165889%3A0
.salesforce.com/ Name: AMCV_8D6C67C25245AF020A490D4C%40AdobeOrg
Value: -1891778711%7CMCIDTS%7C18158%7CMCMID%7C14089539921856459240724520047488695026%7CMCAAMLH-1569414755%7C6%7CMCAAMB-1569414755%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1568817155s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18165%7CvVersion%7C2.4.0
.demdex.net/ Name: demdex
Value: 18265455248322892000061553333124149286
.c.salesforce.com/ Name: _gat_UA-140200881-1
Value: 1
.c.salesforce.com/ Name: _gid
Value: GA1.3.812499975.1568809956
c.salesforce.com/ Name: kxsfdc_us_visits
Value: 1
.c.salesforce.com/ Name: _ga
Value: GA1.3.798624829.1568809956
.salesforce.com/ Name: s_ecid
Value: MCMID%7C14089539921856459240724520047488695026
.salesforce.com/ Name: AMCVS_8D6C67C25245AF020A490D4C%40AdobeOrg
Value: 1