549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com Open in urlscan Pro
52.219.101.170  Malicious Activity! Public Scan

URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Submission: On January 22 via manual from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 52.219.101.170, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on July 24th 2020. Valid for: 10 months.
This is the only time 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
11 52.219.101.170 16509 (AMAZON-02)
11 1
Apex Domain
Subdomains
Transfer
11 amazonaws.com
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
386 KB
11 1
Domain Requested by
11 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
11 1

This site contains no links.

Subject Issuer Validity Valid
*.s3.us-east-2.amazonaws.com
DigiCert Baltimore CA-2 G2
2020-07-24 -
2021-05-27
10 months crt.sh

This page contains 1 frames:

Primary Page: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Frame ID: AA1281D7A0912C7CA15D624CA9A583AD
Requests: 11 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

386 kB
Transfer

383 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.html
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
10 KB
11 KB
Document
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
f8da9db9b44d241743076eb3057bc42b881ddd0a15a7d61ececadd8f84d64fb0

Request headers

Host
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-id-2
/o77Wo1bGigbcSiB2U8hMveEqCPwJpqxNSwfGu/c0OpwCQbUNkxFzwNCJi2cIrED2ydqlvayXFI=
x-amz-request-id
F134269D07CC90F4
Date
Fri, 22 Jan 2021 18:05:22 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:30 GMT
ETag
"2c1b3cd4931bbfc77044f9c2be512465"
Accept-Ranges
bytes
Content-Type
text/html
Content-Length
10536
Server
AmazonS3
bootstrap.min.css
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
138 KB
138 KB
Stylesheet
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/bootstrap.min.css
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:22 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:25 GMT
Server
AmazonS3
x-amz-request-id
47D63581320C1A56
ETag
"a7022c6fa83d91db67738d6e3cd3252d"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
140930
x-amz-id-2
ZmhE9Gc3bRPTYR9mIF92znxvG8KQCO3t/w1CXV7KeAaMMMGqlA1KsfNsbvDSuP02xYXsmTyP894=
style.css
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
7 KB
8 KB
Stylesheet
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/style.css
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
17ecfb633c2142af931d0e365019aaaa6668911ee61d374ffc00d5a99778da5c

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:37 GMT
Server
AmazonS3
x-amz-request-id
9X7RCKDR5P9S0Z7W
ETag
"041e9d6f7d44bdabf6c561bcd401cbee"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
7437
x-amz-id-2
XfpEOvF/MUO4lNUM+GabVEXWdYqDJ58K9TcUR1EkZanuwDVXnP+nF+y9WHa2zbiGbrha6UkY4NQ=
axios.min.js
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
13 KB
14 KB
Script
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/axios.min.js
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
4b52781951c70cc8a2ae2afdaac5d673c656c3be0f1c769fa6c1e9e4f5ed8d3b

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:21 GMT
Server
AmazonS3
x-amz-request-id
A78431B2688138DA
ETag
"d7a175dcf106af47e1c0f608b892a115"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
13696
x-amz-id-2
+Xy5tI9YfLyGu9ylq3D+2lIde96gs6UwHsGwOOb+m/iMTo017DNq/Ug1QZaGWYaY2+9/BPXjhmo=
font-awesome.min.css
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
30 KB
31 KB
Stylesheet
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/font-awesome.min.css
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:28 GMT
Server
AmazonS3
x-amz-request-id
BE3F43FAB17BBD3C
ETag
"269550530cc127b6aa5a35925a7de6ce"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
31000
x-amz-id-2
jfBsCu4KVZqOXLjXn1GKeBczc2ZBzoh2InwJNgCPm6b1W2lbcoR5To3gSwXT80/KgMBe7/nUhiA=
MaskedPassword.js
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
17 KB
17 KB
Script
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/MaskedPassword.js
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:33 GMT
Server
AmazonS3
x-amz-request-id
54C1EDEC5CCA3CC9
ETag
"093b948a3133ccde7091158531d5d63e"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
16904
x-amz-id-2
EaF1/9Z9NA8yOTpHGdQAEu3rpqEnwoNmnmiCycPjPhZ36Rflbk9wdmTLBRQaiG0Lbt8kXcOoH5o=
main.js
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
13 KB
13 KB
Script
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/main.js
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
34c9ad5b894d84e9168855734a7fffac0acce3d8d02d5fb1b84348b04999ee82

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:32 GMT
Server
AmazonS3
x-amz-request-id
2D14FB00D270263D
ETag
"a73b10be5c438a34d759ed6f93486613"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
12803
x-amz-id-2
1Lnq3Dywf0kjQ/x+0hiM6eTJeZGBhUneUv2N7dkhxdHjzQezOcqclRTh+SsSsUsU3kiTf1URJc4=
jquery-3.3.1.slim.min.js
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
68 KB
69 KB
Script
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/jquery-3.3.1.slim.min.js
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:31 GMT
Server
AmazonS3
x-amz-request-id
0ECFE7BCEB15E5C4
ETag
"99b0a83cf1b0b1e2cb16041520e87641"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
69917
x-amz-id-2
EeRT0j11Cbz1+Ow5lU0EsX6LFrHM5Du8v6Bx1ovw0ejV0hkHSZaeLjsn9C79gV3tm5xHYhgPwG8=
popper.min.js
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
20 KB
20 KB
Script
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/popper.min.js
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:35 GMT
Server
AmazonS3
x-amz-request-id
189E69C095A0D4E4
ETag
"83fb8c4d9199dce0224da0206423106f"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
20337
x-amz-id-2
3PFnd0wu1TmErs2HkAEcB8nzswZkFcJt6/Spo0e0D9FM6EI+CbmuvdAG5kNF3Uhzmc/W6lICu40=
bootstrap.min.js
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
50 KB
50 KB
Script
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/bootstrap.min.js
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
c5a17d46976d471cf060c5a0e25749a323d6ab20cf0910f40afed81047ba21ef

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:26 GMT
Server
AmazonS3
x-amz-request-id
F7C3631AC403BB48
ETag
"eb5fac582a82f296aeb74900b01a2fa3"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
50731
x-amz-id-2
NC4esV0d1r/Ag7a+xC7Ic+Kba/oPqr1Y3t5OMOPd2I979SsAHIiespUO1ig2lHZDAAkF/SRegVw=
bg.jpg
549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/
17 KB
17 KB
Image
General
Full URL
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/bg.jpg
Requested by
Host: 549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com
URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.101.170 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-r-w.us-east-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Referer
https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 22 Jan 2021 18:05:23 GMT
Last-Modified
Thu, 21 Jan 2021 20:31:22 GMT
Server
AmazonS3
x-amz-request-id
EC5E8AC6404A800B
ETag
"7916a894ebde7d29c2cc29b267f1299f"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
17453
x-amz-id-2
SOrHgziLrwUQwE71gRWysP6FHGtJ2P0V81Pn+ysDUscrlTBHZnKq7EvvwbDLtIvZ4R1zF10Gx68=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer)

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| axios function| MaskedPassword function| loadForm function| redirect function| emGet function| loadEmail function| loadPassword function| loadPasswordAgain undefined| userEmail undefined| userPassword undefined| confirmPassword function| processEmail function| processPassword function| processPassword2 function| displayPassword function| displayPassword2 function| show function| hide function| set function| sendDetails function| ValidateEmail string| url_link object| emailDiv object| emailForm object| email_InputDiv object| email_input object| accountDiv object| creatAccountDiv object| accessDiv object| acesssAccountDiv object| next_buttonholderDiv object| next_buttonholder1 object| next_buttonholder2 object| next_buttonholder3 object| nextbutton object| passwordDiv object| passwordForm object| password_InputDiv object| password_input object| forgot_passwordDiv object| signin_buttonholderDiv object| signin_buttonholder1 object| signin_buttonholder2 object| signin_buttonholder3 object| signinbutton function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://549kdfsdksa3ndy5883.s3.us-east-2.amazonaws.com/main.js(Line 18)
Message:
EMAIL IS ==:::