Report - lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299

Report Overview

Visited public
2025-05-06 11:35:52
Tags
microsoft phishing
URL
lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Finishing URL
lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
IP / ASN
16.182.33.217
#16509 AMAZON-02
Title
Sign in to your account
Phishing - Microsoft

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdnjs.cloudflare.com	235	unknown	No data	No data	456 B	49 kB	104.17.24.14
ajax.googleapis.com	12905	unknown	No data	No data	449 B	89 kB	142.250.74.170
webdevtrick.com	139086	unknown	No data	No data	926 B	32 kB	96.125.163.17
lm7lwm4oq0y7685.s3.amazonaws.com	unknown	unknown	No data	No data	1.2 kB	41 kB	16.15.200.72

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	From	Size	First Seen	Last Seen
	cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	ScriptElement	48 kB	2023-03-07	2025-05-17
Pretty URL cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:04 Last Seen2025-05-17 23:14 Times Seen55093 Hash cf3402d7483b127ded4069d651ea4a22 bde186152457cacf9c35477b5bdda5bcb56b1f45 eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc Loading...

	lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299	ScriptElement	3.6 kB	2025-05-03	2025-05-06
Pretty URL lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299 IP 16.15.200.72 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-03 11:50 Last Seen2025-05-06 11:36 Times Seen3 Hash 0dd58357d0badce746746467469468f4 33e91730654e61d937cc42107a869f1e3aee59c0 7ba85ccab9b34ef98743ecff3a57f19f3f0f835cb4644db1b8d227155f164247 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js	ScriptElement	88 kB	2023-03-07	2025-05-18
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-18 04:56 Times Seen68539 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

HTTP Transactions (6)

URL IP Response Size

lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299

16.15.200.72

200 OK

40 kB

URL User Request GET
lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
IP
16.15.200.72:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subject*.s3.amazonaws.com
Fingerprint2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69
ValidityFri, 14 Feb 2025 00:00:00 GMT - Sat, 07 Feb 2026 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (27997), with CRLF line terminators
Size
40 kB (39998 bytes)
Hash
8ae7b78fb104641a7bcbcd9cc90bfdd6
f55a6c4113d0c98cf5e48d1aa6b24c42b176c723
6c1a9319444033f307a2b03b2aefbf4e02761587b1030011aaf6c9ac105db1f0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299 HTTP/1.1
Host: lm7lwm4oq0y7685.s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: wUgO4hA0IskZ5Qfa9TVzsLIKk9yNfFoTGkYaXgro2nG7lKifUXdPll/71r2pqjK0+DVWVXGHxz0nqgnok5uTstfJmZhUiC2y
x-amz-request-id: HCHM0FSAZDXR02KF
Date: Tue, 06 May 2025 11:35:30 GMT
Last-Modified: Mon, 05 May 2025 13:58:20 GMT
ETag: "8ae7b78fb104641a7bcbcd9cc90bfdd6"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 39998
Server: AmazonS3

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

104.17.24.14

200 OK

48 kB

URL GET
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC
ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT

File type
JavaScript source, ASCII text, with very long lines (47992), with no line terminators
Size
48 kB (47992 bytes)
Hash
cf3402d7483b127ded4069d651ea4a22
bde186152457cacf9c35477b5bdda5bcb56b1f45
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc

HTTP Headers

GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lm7lwm4oq0y7685.s3.amazonaws.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 May 2025 11:35:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 14107
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 93b82cac3dbb0b31-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e2d-bb78"
last-modified: Mon, 04 May 2020 16:09:17 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 276616
expires: Sun, 26 Apr 2026 11:35:29 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UjY7Mcm1%2FwZz75I3xgfeMm0y%2Fo2%2BYwh9hTmblolcVUwPxBNjv84qtcTgu8UMN5qEXdbx38b588tgqE1jKKtNVsHuaj52%2FO34Kwhs1uQtX2WAT7PvwcnjFDv8gswh9YEisoEQ4f0m"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

142.250.74.170

200 OK

88 kB

URL GET
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Certificate
IssuerGoogle Trust Services
Subjectupload.video.google.com
Fingerprint06:13:4C:49:F4:23:BB:58:C3:31:41:0E:F9:E0:C5:EF:74:A9:0C:67
ValidityMon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
88 kB (88145 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

HTTP Headers

GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lm7lwm4oq0y7685.s3.amazonaws.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 01 May 2025 10:21:27 GMT
expires: Fri, 01 May 2026 10:21:27 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Mon, 13 May 2019 14:37:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 436443
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

webdevtrick.com/wp-content/uploads/recaptcha.png

96.125.163.17

200 OK

1.4 kB

URL GET
webdevtrick.com/wp-content/uploads/recaptcha.png
IP
96.125.163.17:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Certificate
IssuerLet's Encrypt
Subjectwebdevtrick.com
FingerprintD2:35:48:E6:68:E3:93:85:9E:8F:9D:EE:19:C0:43:F4:49:D3:FC:FF
ValiditySat, 22 Mar 2025 18:18:21 GMT - Fri, 20 Jun 2025 18:18:20 GMT

File type
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1361 bytes)
Hash
79e8793baeeda07cf26e88ca58e7e77b
5e415593860a0d1e8a5e5ca958b091f30347cabc
392afa82eff8aa95d3e744a5da7454aa23db92f05f583652563539d2ba9fe91d

HTTP Headers

GET /wp-content/uploads/recaptcha.png HTTP/1.1
Host: webdevtrick.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lm7lwm4oq0y7685.s3.amazonaws.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Thu, 07 Nov 2019 05:05:41 GMT
accept-ranges: bytes
content-length: 1361
vary: User-Agent
content-type: image/png
date: Tue, 06 May 2025 11:35:30 GMT
server: Apache
X-Firefox-Spdy: h2

webdevtrick.com/wp-content/uploads/captchaback.jpg

96.125.163.17

200 OK

30 kB

URL GET
webdevtrick.com/wp-content/uploads/captchaback.jpg
IP
96.125.163.17:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Certificate
IssuerLet's Encrypt
Subjectwebdevtrick.com
FingerprintD2:35:48:E6:68:E3:93:85:9E:8F:9D:EE:19:C0:43:F4:49:D3:FC:FF
ValiditySat, 22 Mar 2025 18:18:21 GMT - Fri, 20 Jun 2025 18:18:20 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, progressive, precision 8, 500x250, components 3
Size
30 kB (29795 bytes)
Hash
2009aecaa18c739eec0ab5de3bf712c1
73557d30717dae7581088c96700179abc5bb18da
d9be0cdd290226f04d634f4142166514dd69082bae6d93771e76919203d730d1

HTTP Headers

GET /wp-content/uploads/captchaback.jpg HTTP/1.1
Host: webdevtrick.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lm7lwm4oq0y7685.s3.amazonaws.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Thu, 07 Nov 2019 05:12:33 GMT
accept-ranges: bytes
content-length: 29795
vary: User-Agent
content-type: image/jpeg
date: Tue, 06 May 2025 11:35:30 GMT
server: Apache
X-Firefox-Spdy: h2

lm7lwm4oq0y7685.s3.amazonaws.com/favicon.ico

16.15.200.72

403 Forbidden

263 B

URL GET
lm7lwm4oq0y7685.s3.amazonaws.com/favicon.ico
IP
16.15.200.72:443
ASN
#14618 AMAZON-AES

Requested by
https://lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Certificate
IssuerAmazon
Subject*.s3.amazonaws.com
Fingerprint2E:BA:63:64:95:A8:CE:55:DD:7E:EB:A9:98:83:14:B1:6F:6B:61:69
ValidityFri, 14 Feb 2025 00:00:00 GMT - Sat, 07 Feb 2026 23:59:59 GMT

File type
XML 1.0 document, ASCII text
Size
263 B (263 bytes)
Hash
9d979534bbbda70082de079b1ef0c4ca
4b1c90f8470600968bfe5f95100e2a23232871d0
324b313fc9129338e29ac852072994ef9ce7ab0b565acee0348860ceb34a5d80

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lm7lwm4oq0y7685.s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lm7lwm4oq0y7685.s3.amazonaws.com/ise0gl/zv1llr1sknddh70.html?AWSAccessKeyId=AKIA2UC3C63BUABXSSP6&Signature=R%2Bg21kl2HlSL5LF3NhzIQGPjinM%3D&Expires=1747058299
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
x-amz-request-id: M3PESB76748TFCS5
x-amz-id-2: EoDcmZTHcQOH/nCTie3dUp4EtfhX1o1Z8YJP2GVW2zg3RBf7Ecj+7k92Kfp7mWUAKSzdQWRM4yPdLbHmLZWdErLTSOo5jtjj
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Tue, 06 May 2025 11:35:29 GMT
Server: AmazonS3

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (6)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET