9876543456886756565656-secondary.z19.web.core.windows.net
Open in
urlscan Pro
20.38.100.144
Malicious Activity!
Public Scan
Effective URL: https://9876543456886756565656-secondary.z19.web.core.windows.net/
Submission: On December 15 via manual from US
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 02 on November 10th 2020. Valid for: a year.
This is the only time 9876543456886756565656-secondary.z19.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AWS (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID) | |
1 | 151.101.65.195 151.101.65.195 | 54113 (FASTLY) (FASTLY) | |
2 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 20.38.100.144 20.38.100.144 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
3 | 52.216.28.100 52.216.28.100 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 205.251.242.160 205.251.242.160 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 99.86.237.182 99.86.237.182 | 16509 (AMAZON-02) (AMAZON-02) | |
12 | 9 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
9876543456886756565656-secondary.z19.web.core.windows.net |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
aws-signin-website-assets.s3.amazonaws.com |
ASN16509 (AMAZON-02, US)
PTR: server-99-86-237-182.vie50.r.cloudfront.net
d1.awsstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
amazonaws.com
aws-signin-website-assets.s3.amazonaws.com |
406 KB |
2 |
amazon.com
signin.aws.amazon.com |
30 KB |
2 |
jquery.com
code.jquery.com |
56 KB |
1 |
awsstatic.com
d1.awsstatic.com |
61 KB |
1 |
windows.net
9876543456886756565656-secondary.z19.web.core.windows.net |
142 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
14 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
web.app
amz49834788739.web.app |
910 B |
1 |
sendgrid.net
1 redirects
u10961320.ct.sendgrid.net |
376 B |
12 | 9 |
Domain | Requested by | |
---|---|---|
3 | aws-signin-website-assets.s3.amazonaws.com |
9876543456886756565656-secondary.z19.web.core.windows.net
|
2 | signin.aws.amazon.com |
9876543456886756565656-secondary.z19.web.core.windows.net
|
2 | code.jquery.com |
amz49834788739.web.app
|
1 | d1.awsstatic.com |
9876543456886756565656-secondary.z19.web.core.windows.net
|
1 | 9876543456886756565656-secondary.z19.web.core.windows.net |
amz49834788739.web.app
|
1 | stackpath.bootstrapcdn.com |
amz49834788739.web.app
|
1 | cdnjs.cloudflare.com |
amz49834788739.web.app
|
1 | amz49834788739.web.app | |
1 | u10961320.ct.sendgrid.net | 1 redirects |
12 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1O1 |
2020-04-15 - 2021-04-14 |
a year | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
*.web.core.windows.net Microsoft RSA TLS CA 02 |
2020-11-10 - 2021-11-10 |
a year | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-11-09 - 2021-03-12 |
a year | crt.sh |
us-east-1.signin.aws Amazon |
2020-08-18 - 2021-08-10 |
a year | crt.sh |
d1.awsstatic.com Amazon |
2020-08-02 - 2021-09-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://9876543456886756565656-secondary.z19.web.core.windows.net/
Frame ID: B4B289190F7CA706BF4A47317D9C9990
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u10961320.ct.sendgrid.net/ls/click?upn=gfp6wIHSzV1rofivGex1xJjH3DddagK23phiRFbVubEgisUpo1t4loxUL3NKYwH...
HTTP 302
https://amz49834788739.web.app/?utm_content=result&utm_campaign=sendgrid&utm_source=sendgrid&utm_term=high&... Page URL
- https://9876543456886756565656-secondary.z19.web.core.windows.net/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u10961320.ct.sendgrid.net/ls/click?upn=gfp6wIHSzV1rofivGex1xJjH3DddagK23phiRFbVubEgisUpo1t4loxUL3NKYwHe8Th1389K0qSPVrs28E-2FgIqLWYLSvV03Ro34xR75RMdHMKr5wPsVzsrNZnRGipoa5xDtRC0s-2BQEb-2F54f8WFj2I5I2sGInk5SmqT30y5btEho9z1-2BZFTutIPWmxT-2B-2FpKMivMn0d3WF95IibXaUkzYHFTDcmU-2F-2FfhvjzJKmFyvP57E6jqSrZYUugfLFU01azlFbeyNh_nDHiPP-2BsFl3kcs8a4eUPulSWURDJVMLzqQULmeXA40y8cprxk5KFiOh04uqQ-2F-2BqFZnVGBZP1F6jWvY-2BFqtQJWvPynj4MTvheaD4j-2Fwo8MM88vPuk3iXunpTa-2FR9LhyqIt22Q38Gzyfg-2B7Rp20TT-2Bv8e8KJbJnrbaH8MntYTnRZgFOCObnLgsZrgH4sJGmFVEQwvx-2FIdHp0OUfRBfbG-2BWlZ0-2B9u8UlC8p6jA5-2BkMPSC1-2F3T5163PhIWJrzLeacqUN
HTTP 302
https://amz49834788739.web.app/?utm_content=result&utm_campaign=sendgrid&utm_source=sendgrid&utm_term=high&utm_medium=report Page URL
- https://9876543456886756565656-secondary.z19.web.core.windows.net/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u10961320.ct.sendgrid.net/ls/click?upn=gfp6wIHSzV1rofivGex1xJjH3DddagK23phiRFbVubEgisUpo1t4loxUL3NKYwHe8Th1389K0qSPVrs28E-2FgIqLWYLSvV03Ro34xR75RMdHMKr5wPsVzsrNZnRGipoa5xDtRC0s-2BQEb-2F54f8WFj2I5I2sGInk5SmqT30y5btEho9z1-2BZFTutIPWmxT-2B-2FpKMivMn0d3WF95IibXaUkzYHFTDcmU-2F-2FfhvjzJKmFyvP57E6jqSrZYUugfLFU01azlFbeyNh_nDHiPP-2BsFl3kcs8a4eUPulSWURDJVMLzqQULmeXA40y8cprxk5KFiOh04uqQ-2F-2BqFZnVGBZP1F6jWvY-2BFqtQJWvPynj4MTvheaD4j-2Fwo8MM88vPuk3iXunpTa-2FR9LhyqIt22Q38Gzyfg-2B7Rp20TT-2Bv8e8KJbJnrbaH8MntYTnRZgFOCObnLgsZrgH4sJGmFVEQwvx-2FIdHp0OUfRBfbG-2BWlZ0-2B9u8UlC8p6jA5-2BkMPSC1-2F3T5163PhIWJrzLeacqUN HTTP 302
- https://amz49834788739.web.app/?utm_content=result&utm_campaign=sendgrid&utm_source=sendgrid&utm_term=high&utm_medium=report
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
amz49834788739.web.app/ Redirect Chain
|
1 KB 910 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ |
49 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.min.js
code.jquery.com/ |
90 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
9876543456886756565656-secondary.z19.web.core.windows.net/ |
141 KB 142 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.css
aws-signin-website-assets.s3.amazonaws.com/css/ |
383 KB 383 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
grid.css
aws-signin-website-assets.s3.amazonaws.com/css/ |
18 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utilities.css
aws-signin-website-assets.s3.amazonaws.com/css/ |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aws-signin.css
signin.aws.amazon.com/static/css/ |
25 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
u2f-mfa.css
signin.aws.amazon.com/static/css/ |
1 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics%20signin.16b1f43c3d7b4970a4f6b8205df727fe646cd501.png
d1.awsstatic.com/Digital%20Marketing/sitemerch/sign-in/en/ |
60 KB 61 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
511 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
226 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
389 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
622 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AWS (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated number| currentYear function| handleLanguageOptions function| changeLanguage string| hash0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
9876543456886756565656-secondary.z19.web.core.windows.net
amz49834788739.web.app
aws-signin-website-assets.s3.amazonaws.com
cdnjs.cloudflare.com
code.jquery.com
d1.awsstatic.com
signin.aws.amazon.com
stackpath.bootstrapcdn.com
u10961320.ct.sendgrid.net
151.101.65.195
167.89.123.16
20.38.100.144
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:3b
205.251.242.160
2606:4700::6810:135e
52.216.28.100
99.86.237.182
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
095a716973efa65689c85d85b231e0acbba9789870424b963d514a7cfdb563bc
0b1e68b1025d14dce1b3c8cf22e6d3e73ce099bc1ec98e3c11857db320f166fb
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
15ad7487d0aa0f1bd6531ecb0f95310350d79b3c095a951ad96e327a880cbd4b
295437df86381a56ae94b2a5491f916167b1f85db261f4ac2f53111973c09f15
4af0107a578dd0cb3372ab4aa657d37b9fb4eebdeb18899b07db3b451e4aa916
7a737084bd5a4661430f762340fe06a8ccd231b2e300afcfc88601cf6ac0f4e2
81517fb3d42a3fc5cf136de03a24877fad0ccc66ea5b67008ed8105b4f1c3ae4
8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38
9f98ccc26cde14dd9a4ac51e10d7d703e0ec7fd1de9734e7634d1bb2dc1d96d4
a53ae559feabec44a9d5a9f722f34d9fb0f70d010d9fc0b36ba3bc5caadf37bc
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cd1aff9ed552c5215dbc722ca84a468504d2fbe0da8d159bf942b83aca4ae177
d13820cdf75388b299511df5691dd2d6cb2be9c6b879e30f0af767201e6d124e
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e89be6bba4cc671c3fe91a5b721d263f88c1e3d1e1bbcccbb035fd7b524f6aa7