Report - mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm

Report Overview

Submitted URL
mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm
IP
3.5.132.124
ASN
#16509 AMAZON-02
Submitted
2024-04-18 04:15:21
Access
public
Website Title
Webmail :: Welcome to Webmail
Final URL
mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm
Tags
suspicious
urlquery detections
Suspicious - Suspicious Javascript code
Suspicious - Anti-debugging code

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mshsuyu.s3.us-east-2.amazonaws.com	unknown	unknown	No data	No data	498 B	11 kB	52.219.232.138
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-17	449 B	32 kB	142.250.74.138
api.ipify.org	3267	2014-01-05	2014-10-06	2024-04-17	510 B	267 B	172.67.74.152

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm	Webmail Providers

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js	88 kB	2023-03-07	2024-05-01
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js IP 142.250.74.138 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-05-01 05:51:03 Times Seen96301 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

	mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm	124 B	2023-03-14	2024-04-18
Pretty URL mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm IP 52.219.232.138 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-14 16:10:41 Last Seen2024-04-18 06:15:28 Times Seen110 Hash def39b703494203f6cb7c26678f0d8a4 00c7f001024d1f99a7ae7b16b034131cd903b608 ebb59e0d802be12605a7440b403ce35e74d2d1d85070916c3f32d5572dba537b Loading...

	mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm	2.1 kB	2024-04-18	2024-04-18
Pretty URL mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm IP 52.219.232.138 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 06:15:28 Last Seen2024-04-18 06:15:28 Times Seen1 Hash 8f2f0464fb87c1abaa9a7073dfd010b4 b93d20216da7c8cf14888799cea913c53da467fb b616bcd48f5eedbff1241424b541634c2edc3b061fb9d1b1b57692302c2f278d Loading...

	mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm	2.4 kB	2023-03-14	2024-04-18
Pretty URL mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm IP 52.219.232.138 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-14 16:10:41 Last Seen2024-04-18 06:15:28 Times Seen7 Hash eac4a4626690ac44eccbf73eacc09837 82ac18443e91b34c5d134bb05ee50af8edbb5614 0b926733e157d72017d6a2b1e8c9594f8f5a0581fd7de8ca3c831bf52efc1dc9 Loading...

HTTP Transactions (3)

URL IP Response Size

mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm

52.219.232.138

200 OK

11 kB

URL User Request GET HTTP/1.1
mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm
IP
52.219.232.138:443
ASN
#16509 AMAZON-02

Certificate
IssuerAmazon
Subject*.s3.us-east-2.amazonaws.com
Fingerprint40:BF:36:14:45:F6:3D:12:C3:E4:1A:78:65:F3:B1:81:07:4F:84:E8
ValidityThu, 29 Feb 2024 00:00:00 GMT - Wed, 12 Feb 2025 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (1913)
Size
11 kB (10686 bytes)
Hash
eb66916ab55da2d36b72de06e6b2f8b5
2ac51256679c2af89462aa7aacad3fca683157f7
fab385e02551b53cc0a416cf2fe4405eaaa5ac472ee0e6dd4a7d87481b08e3f9

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
urlquery	suspicious	Suspicious - Anti-debugging code
OpenPhish	phishing	Webmail Providers

HTTP Headers

GET /ds1en.htm HTTP/1.1
Host: mshsuyu.s3.us-east-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: cZdKmiFiiSEDBZvTwKRyjsOpW+ks50nVOMdg8E+h3Ut8VI4UglhokQHm2BpCJRrygAlG9Ha4O6o=
x-amz-request-id: P84ZSGTA15Z10TNM
Date: Thu, 18 Apr 2024 04:14:57 GMT
Last-Modified: Wed, 17 Apr 2024 09:30:49 GMT
ETag: "eb66916ab55da2d36b72de06e6b2f8b5"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/html
Server: AmazonS3
Content-Length: 10686

ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

142.250.74.138

200 OK

31 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP
142.250.74.138:443
ASN
#15169 GOOGLE

Requested by
https://mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
31 kB (30774 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

HTTP Headers

GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mshsuyu.s3.us-east-2.amazonaws.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 02:35:08 GMT
expires: Fri, 18 Apr 2025 02:35:08 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 5989
last-modified: Mon, 13 May 2019 14:37:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

api.ipify.org/?format=json

172.67.74.152

200 OK

21 B

URL GET HTTP/2
api.ipify.org/?format=json
IP
172.67.74.152:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mshsuyu.s3.us-east-2.amazonaws.com/ds1en.htm
Certificate
IssuerGoogle Trust Services LLC
Subjectipify.org
FingerprintC8:1A:05:47:C5:73:C6:CE:DF:1D:A6:DE:00:11:A9:9A:8C:DB:EF:A7
ValidityThu, 21 Mar 2024 19:56:02 GMT - Wed, 19 Jun 2024 19:56:01 GMT

File type
JSON text data
Size
21 B (21 bytes)
Hash
7d69c71af0f191e9a72db6153f8018d1
f67c5f2887bc05654b47f76e9621e53a4091aed1
5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65

HTTP Headers

GET /?format=json HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://mshsuyu.s3.us-east-2.amazonaws.com
DNT: 1
Connection: keep-alive
Referer: https://mshsuyu.s3.us-east-2.amazonaws.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 04:14:57 GMT
content-type: application/json
content-length: 21
access-control-allow-origin: *
vary: Origin
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8761d4b9c96c0b51-OSL
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (3)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size