ec2-3-108-44-239.ap-south-1.compute.amazonaws.com
Open in
urlscan Pro
3.108.44.239
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On September 07 via api from US — Scanned from US
Summary
This is the only time ec2-3-108-44-239.ap-south-1.compute.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WhatsApp (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 3.108.44.239 3.108.44.239 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2607:f8b0:400... 2607:f8b0:4004:c0b::54 | 15169 (GOOGLE) (GOOGLE) | |
1 | 67.20.113.136 67.20.113.136 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
9 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-108-44-239.ap-south-1.compute.amazonaws.com
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: host2062.hostmonster.com
www.ginifab.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
amazonaws.com
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com |
375 KB |
3 |
google.com
accounts.google.com — Cisco Umbrella Rank: 46 |
87 KB |
1 |
ginifab.com
www.ginifab.com |
54 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
9 | 4 |
Domain | Requested by | |
---|---|---|
4 | ec2-3-108-44-239.ap-south-1.compute.amazonaws.com |
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com
|
3 | accounts.google.com |
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com
accounts.google.com |
1 | www.ginifab.com | |
0 | localhost Failed |
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
accounts.google.com WR2 |
2024-08-12 - 2024-11-04 |
3 months | crt.sh |
autodiscover.quotewharf.com R11 |
2024-07-26 - 2024-10-24 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/
Frame ID: 00BE130E377FAF2555190CA0FE273B78
Requests: 8 HTTP requests in this frame
Frame:
https://accounts.google.com/gsi/button?type=standard&theme=outline&size=large&text=undefined&shape=undefined&logo_alignment=undefined&width=undefined&locale=undefined&click_listener=undefined&client_id=227778094159-07epbbp8p8sr846gontdp04aduffbttk.apps.googleusercontent.com&iframe_id=gsi_638065_310003&as=h2BGIZNK87bJCjTAcJWUJg
Frame ID: B199FA08B1030C12061FDAB93DECB8E2
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Vite + ReactPage URL History Show full URLs
-
http://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/
HTTP 307
https://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/ HTTP 307
http://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/ Page URL
Detected technologies
Google Sign-in (Social logins) ExpandDetected patterns
- accounts\.google\.com/gsi/client
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/
HTTP 307
https://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/ HTTP 307
http://ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/ Redirect Chain
|
452 B 759 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-9d892ba7.js
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/assets/ |
372 KB 372 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-27778128.css
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/assets/ |
170 B 460 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
localhost/socket.io/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client
accounts.google.com/gsi/ |
226 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qrcode.jpg
www.ginifab.com/feeds/qr_code/img/ |
54 KB 54 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vite.svg
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com/ |
1 KB 2 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style
accounts.google.com/gsi/ |
533 B 608 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
button
accounts.google.com/gsi/ Frame B199 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- http://localhost:9000/socket.io/?EIO=4&transport=polling&t=P7Bji1B
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WhatsApp (Instant Messenger)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| default_gsi object| _F_toggles object| google object| __G_ID_CLIENT__ object| closure_lm_4101730 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.google.com
ec2-3-108-44-239.ap-south-1.compute.amazonaws.com
localhost
www.ginifab.com
localhost
2607:f8b0:4004:c0b::54
3.108.44.239
67.20.113.136
11f4d80ae9832de3733d18ad5280d5211a71cf250c2c234d77c8dbbfc023b145
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
2777812893b3aa88fd047513322708dd7fbf642b6ebfcedc0bcb2330237c903c
4a748afd443918bb16591c834c401dae33e87861ab5dbad0811c3a3b4a9214fb
522bbcfe99a6683e409a909aa0ead46bfafb0afbf56f1c49267ae95ee81d73be
c5fe4da18987ac5bcb45afbb4da14e57664344d86940d23ca2d80a498b2ede0a
eff466af4389a3fadabf26a4d252e25acd025f051d962e713089c12d7bdf4466