newmail-inbox-com.herokuapp.com Open in urlscan Pro
34.252.129.97  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response newmail-inbox-com.herokuapp.com/	15 KB 15 KB	7349ms 7315ms	Document text/html	34.252.129.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://newmail-inbox-com.herokuapp.com/ Protocol HTTP/1.1 Server 34.252.129.97 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-129-97.eu-west-1.compute.amazonaws.com Software Apache / Resource Hash 9db9db274411f068fd2a8be2d854f92cd3bfcfec23ed5bb3d79ad545befefd2d Request headers Host newmail-inbox-com.herokuapp.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection keep-alive Date Thu, 28 Jan 2021 14:27:29 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Via 1.1 vegur
GET H/1.1	200 OK	bm.css newmail-inbox-com.herokuapp.com/styjs/	157 KB 157 KB	93ms 68ms	Stylesheet text/css	34.252.129.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://newmail-inbox-com.herokuapp.com/styjs/bm.css Requested by Host: newmail-inbox-com.herokuapp.com URL: http://newmail-inbox-com.herokuapp.com/ Protocol HTTP/1.1 Server 34.252.129.97 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-129-97.eu-west-1.compute.amazonaws.com Software Apache / Resource Hash 680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c Request headers Referer http://newmail-inbox-com.herokuapp.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 28 Jan 2021 14:27:29 GMT Via 1.1 vegur Last-Modified Mon, 07 Sep 2020 11:44:53 GMT Server Apache Etag "27293-5aeb7bf29f740" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 160403
GET H/1.1	200 OK	custom.css newmail-inbox-com.herokuapp.com/styjs/	4 KB 4 KB	154ms 127ms	Stylesheet text/css	34.252.129.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://newmail-inbox-com.herokuapp.com/styjs/custom.css Requested by Host: newmail-inbox-com.herokuapp.com URL: http://newmail-inbox-com.herokuapp.com/ Protocol HTTP/1.1 Server 34.252.129.97 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-129-97.eu-west-1.compute.amazonaws.com Software Apache / Resource Hash 02a28c669589a79f6d9d08ddbed162d5564a88f386840da97a26bcec4d66d953 Request headers Referer http://newmail-inbox-com.herokuapp.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 28 Jan 2021 14:27:29 GMT Via 1.1 vegur Last-Modified Mon, 07 Sep 2020 11:44:53 GMT Server Apache Etag "e0a-5aeb7bf29f740" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 3594
GET H/1.1	200 OK	logo.png newmail-inbox-com.herokuapp.com/image/	71 KB 72 KB	164ms 138ms	Image image/png	34.252.129.97 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://newmail-inbox-com.herokuapp.com/image/logo.png Requested by Host: newmail-inbox-com.herokuapp.com URL: http://newmail-inbox-com.herokuapp.com/ Protocol HTTP/1.1 Server 34.252.129.97 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-129-97.eu-west-1.compute.amazonaws.com Software Apache / Resource Hash 8ae0c82957607151809bfc7ed8e2bba29e3f9e06e5edc39ee0d1f5dcb75c840f Request headers Referer http://newmail-inbox-com.herokuapp.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 28 Jan 2021 14:27:29 GMT Via 1.1 vegur Last-Modified Mon, 07 Sep 2020 11:44:53 GMT Server Apache Etag "11d1f-5aeb7bf29f740" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 72991

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

newmail-inbox-com.herokuapp.com
34.252.129.97
02a28c669589a79f6d9d08ddbed162d5564a88f386840da97a26bcec4d66d953
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
8ae0c82957607151809bfc7ed8e2bba29e3f9e06e5edc39ee0d1f5dcb75c840f
9db9db274411f068fd2a8be2d854f92cd3bfcfec23ed5bb3d79ad545befefd2d