s3.amazonaws.com Open in urlscan Pro
52.216.225.43  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.xhtml Show response s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/	1 KB 2 KB	244ms 139ms	Document application/xhtml+xml	52.216.225.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml Protocol HTTP/1.1 Server 52.216.225.43 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash db54c2c19f649c63be74e6af6d6a81fe2855c37978692a636168da661ded4934 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control public,max-age=86400 Content-Length 1252 Content-Type application/xhtml+xml Date Mon, 16 Jan 2023 14:26:53 GMT ETag "93ff95638ed06b775d77ee68f7a9303d" Last-Modified Fri, 13 Jan 2023 00:17:12 GMT Server AmazonS3 x-amz-id-2 oIHNHp+l9A7FzJASI0NGIhyTDoxWab7IaksOZyGJJ9hYtf+DX2HvbvXiuYf/xnMz5yZb3XnjhLA= x-amz-meta-app-version test x-amz-meta-appname sharefilepoiye79 x-amz-request-id S13WS0RC9F86MZG9 x-amz-server-side-encryption AES256 x-amz-version-id _ZBz2NaVyxAFggjNO6PRjzqenXlqWG2B
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/	88 KB 28 KB	33ms 15ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Mon, 16 Jan 2023 14:26:52 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1758190 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27990 last-modified Fri, 26 Aug 2022 18:34:13 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "63091225-6d56" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5YOIjtB2IZOC6K9DLo5ALUHZmIvXBIAQ%2FEUQnAmYMXNUttki3gjVXfwaU07mRbmtD4RXo17buGdUK9EO2TRcouRYy767zDj%2FxAr5NxzbHRo0INAsfjk2%2B%2BG9ar%2BgeEqnuqYq%2FMrAWy7HosOiNu6XpiE"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 78a78755ba9cbba7-FRA expires Sat, 06 Jan 2024 14:26:52 GMT
GET H/1.1	200 OK	index.js Show response s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/	48 KB 49 KB	348ms 140ms	Script text/javascript	54.231.203.16 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?jjnkn=dGVzdEBtYWlsLmNvbQ-- Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.231.203.16 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021 Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Mon, 16 Jan 2023 14:26:53 GMT x-amz-meta-appname sharefilepoiye79 x-amz-version-id Th_416BG4mAehxtJUPNRlOc5AsjjNvQd Last-Modified Fri, 13 Jan 2023 00:15:02 GMT Server AmazonS3 x-amz-request-id S13P628E669MNGRJ ETag "fd675655d10d765b14f6df1f8198a8a6" x-amz-server-side-encryption AES256 x-amz-meta-app-version test Content-Type text/javascript Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 49412 x-amz-id-2 00ydcM/uK2RNVxK2+tnbehxwGVX+0CR1MpF3kiGwHuT7suqdmcGhsKSrp3CU7nLo7o0KwNwZw2w=
GET H/1.1	200 OK	index.js Show response s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/	48 KB 49 KB	122ms 122ms	Script text/javascript	54.231.203.16 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?hijiji=dGVzdEBtYWlsLmNvbQ-- Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.231.203.16 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021 Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Mon, 16 Jan 2023 14:26:53 GMT x-amz-meta-appname sharefilepoiye79 x-amz-version-id Th_416BG4mAehxtJUPNRlOc5AsjjNvQd Last-Modified Fri, 13 Jan 2023 00:15:02 GMT Server AmazonS3 x-amz-request-id S13PV2YZ4M2271PS ETag "fd675655d10d765b14f6df1f8198a8a6" x-amz-server-side-encryption AES256 x-amz-meta-app-version test Content-Type text/javascript Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 49412 x-amz-id-2 VAHU1BCQMzP0Ymsa4nKdhZDYKWyRITy8KelW3Hl9VKXtJhNYTI63XJoQiJe2wtBOjJR1pI3NrLU=
POST H2	200	error.php Show response careers.sweetgreen.com/vendor/monolog/	260 B 336 B	594ms 514ms	XHR text/html	83.223.113.113 GYRON
General Check archive.org Show headers Download Go to Full URL https://careers.sweetgreen.com/vendor/monolog/error.php Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 83.223.113.113 Luton, United Kingdom, ASN29017 (GYRON , GB), Reverse DNS svr01.boldidentities.com Software Apache / Resource Hash df752bccd0ae736aaeb09b9e683752d63aa1c105c3c043951349d3f5057180cd Request headers Accept */* Referer http://s3.amazonaws.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers access-control-allow-origin * date Mon, 16 Jan 2023 14:26:53 GMT server Apache content-type text/html; charset=UTF-8
GET H2	200	download_35.jpeg api.vope.uk/pics/	277 KB 277 KB	613ms 249ms	Image image/jpeg	162.213.255.79 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://api.vope.uk/pics/download_35.jpeg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server283-1.web-hosting.com Software LiteSpeed / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Mon, 16 Jan 2023 14:26:54 GMT last-modified Thu, 24 Nov 2022 17:55:49 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 283351 expires Mon, 23 Jan 2023 14:26:54 GMT
GET H2	200	download02.png api.vope.uk/pics/	1 KB 1 KB	607ms 243ms	Image image/png	162.213.255.79 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://api.vope.uk/pics/download02.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server283-1.web-hosting.com Software LiteSpeed / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Mon, 16 Jan 2023 14:26:54 GMT last-modified Thu, 24 Nov 2022 17:55:54 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1057 expires Mon, 23 Jan 2023 14:26:54 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery string| result function| addJS function| fn1 function| fn2 function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.vope.uk
careers.sweetgreen.com
cdnjs.cloudflare.com
s3.amazonaws.com
162.213.255.79
2606:4700::6811:190e
52.216.225.43
54.231.203.16
83.223.113.113
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
db54c2c19f649c63be74e6af6d6a81fe2855c37978692a636168da661ded4934
df752bccd0ae736aaeb09b9e683752d63aa1c105c3c043951349d3f5057180cd
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c