urlscan.io logo urlscan.io
SecurityTrails logo

log4rewardis.herokuapp.com Open in urlscan Pro
54.159.116.102  Public Scan

Go To Rescan Add Verdict Report
URL: https://log4rewardis.herokuapp.com/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Submission: On March 02 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 6 domains to perform 8 HTTP transactions. The main IP is 54.159.116.102, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is log4rewardis.herokuapp.com.
TLS certificate: Issued by Amazon on June 1st 2021. Valid for: a year.
This is the only time log4rewardis.herokuapp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 54.159.116.102 14618 (AMAZON-AES)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:214... 16509 (AMAZON-02)
8 6
1    54.159.116.102 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-116-102.compute-1.amazonaws.com
log4rewardis.herokuapp.com
2    2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
2    2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)
wm-shadow.xyz
1    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2600:9000:214f:c00:1c:b3e3:eb40:21 (United States)

ASN16509 (AMAZON-02, US)
d13pxqgp3ixdbh.cloudfront.net
Apex Domain
Subdomains		 Transfer
2 wm-shadow.xyz
wm-shadow.xyz
3 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 403
49 KB
1 cloudfront.net
d13pxqgp3ixdbh.cloudfront.net
29 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 194
27 KB
1 herokuapp.com
log4rewardis.herokuapp.com
2 KB
0 itempurl.com Failed
pcgifts-001-site1.itempurl.com Failed
8 6
Domain Requested by
2 wm-shadow.xyz log4rewardis.herokuapp.com
cdnjs.cloudflare.com
2 cdn.jsdelivr.net log4rewardis.herokuapp.com
1 d13pxqgp3ixdbh.cloudfront.net
1 cdnjs.cloudflare.com wm-shadow.xyz
1 log4rewardis.herokuapp.com
0 pcgifts-001-site1.itempurl.com Failed
8 6

This site contains no links.

Subject Issuer Validity Valid
*.herokuapp.com
Amazon		 2021-06-01 -
2022-06-30		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-03 -
2022-07-02		 a year crt.sh
*.cloudfront.net
Amazon		 2022-02-01 -
2023-01-31		 a year crt.sh

This page contains 2 frames:

Primary Page: https://log4rewardis.herokuapp.com/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Frame ID: 2ACF47596D3AE2C8AAEABA126BC8A0D8
Requests: 3 HTTP requests in this frame

Frame: https://wm-shadow.xyz/reff_id-1359/logsup/?u=arPmI4SsieMcH-P6fpL5a80ScgfqjQ==&uc=1a7ac619dfb792225bb0e79fcc6c6a6d
Frame ID: 8618EA666A3A34522121C71BC63EA431
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login To Continue

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • \.herokuapp\.com
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

88 %
HTTPS

80 %
IPv6

6
Domains

6
Subdomains

6
IPs

1
Countries

110 kB
Transfer

358 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
log4rewardis.herokuapp.com/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://log4rewardis.herokuapp.com/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.159.116.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-159-116-102.compute-1.amazonaws.com
Software
Apache /
Resource Hash
66de0967294ecebb74634570218ce0ebbe7f753f1713bbc610769f933dcf5528

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Date
Wed, 02 Mar 2022 13:25:45 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Via
1.1 vegur
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/ 		160 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css
Requested by
Host: log4rewardis.herokuapp.com
URL: https://log4rewardis.herokuapp.com/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://log4rewardis.herokuapp.com/
Origin
https://log4rewardis.herokuapp.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 13:25:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
168420
x-jsd-version
5.1.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19124-FRA, cache-hhn4071-HHN
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"28021-7Ba9Gb9K6bwuIzasQJpQO7varK0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
6e5a75d2eb509158-FRA
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/ 		76 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js
Requested by
Host: log4rewardis.herokuapp.com
URL: https://log4rewardis.herokuapp.com/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://log4rewardis.herokuapp.com/
Origin
https://log4rewardis.herokuapp.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 13:25:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
168327
x-jsd-version
5.1.3
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19152-FRA
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"13131-qF5oFiTJGhBqUUwx6s+A3oF7LMM"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
6e5a75d2eb599158-FRA
/
wm-shadow.xyz/reff_id-1359/logsup/ Frame 8618 		474 B
941 B 		Document
General
Check archive.org
Download Go to
Full URL
https://wm-shadow.xyz/reff_id-1359/logsup/?u=arPmI4SsieMcH-P6fpL5a80ScgfqjQ==&uc=1a7ac619dfb792225bb0e79fcc6c6a6d
Requested by
Host: log4rewardis.herokuapp.com
URL: https://log4rewardis.herokuapp.com/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
373d040f3db74be7863b017d7437b484adf85c95fcd5f5980422d5b40a98a909

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://log4rewardis.herokuapp.com/

Response headers

date
Wed, 02 Mar 2022 13:25:46 GMT
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://themplatetestwis.blogspot.com/ *
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-headers
*
access-control-allow-credentials
true
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VHts%2F%2BP4G2Lr%2FvJYlhOpRJ8ZEjmYoh2gQ%2Buo4hw1BsDm72jyWcAQtXpNXhl6BG8GNVYQWf70dyM%2B3nyuOnnP0vRbPh%2FYhkmO9vt%2BEVNwFm2QBlRlCxoMnsfSHNhK1PxC41tnS7V713Kk%2Ff75"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e5a75d3594d0dfe-MXP
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ Frame 8618 		85 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: wm-shadow.xyz
URL: https://wm-shadow.xyz/reff_id-1359/logsup/?u=arPmI4SsieMcH-P6fpL5a80ScgfqjQ==&uc=1a7ac619dfb792225bb0e79fcc6c6a6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://wm-shadow.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 13:25:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
509367
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27277
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15283"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QTZxIvM0Ja0jetmQ0bNCUlhUMLPDpGnkS067iEQsskEagAlVC4%2FJjf3YQZPllcQthEXSCuv8vIwUX9lkYSEgrH0tXcToZv3M9N28surd%2FCcqPDnP4ebazvmohr64Uq3%2BSD%2Fk2no22Tn%2BBSPLaCAHv9bG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6e5a75d44be46958-FRA
expires
Mon, 20 Feb 2023 13:25:46 GMT
index.php
wm-shadow.xyz/reff_id-1359/logsup/mobile_fab/ Frame 8618 		6 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://wm-shadow.xyz/reff_id-1359/logsup/mobile_fab/index.php?t=mobile_fab
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd7539c5d9a7fd81a97da59a2360e38c7d7d656c2033e40402a50cb166d6565a

Request headers

Accept
text/html, */*; q=0.01
Referer
https://wm-shadow.xyz/reff_id-1359/logsup/?u=arPmI4SsieMcH-P6fpL5a80ScgfqjQ==&uc=1a7ac619dfb792225bb0e79fcc6c6a6d
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 02 Mar 2022 13:25:46 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-headers
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EM5TMTNNFTJYUxGVt63TmACaEKQRe%2FE2SbTxw25y5KkeBZ00i8gLheUhGfU3X5HWveF%2FCFRVuzU76cBuW3xYf5IuMZtCRdyILlejET1FVFeLwPcvAYBJwBlZvO2TjOO1U%2FYtN8AmvnuCIlZO"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
6e5a75d4abf00dfe-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
1642789832f5e6d6ec65269188219f3e69724867cc.png
d13pxqgp3ixdbh.cloudfront.net/uploads/ Frame 8618 		28 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d13pxqgp3ixdbh.cloudfront.net/uploads/1642789832f5e6d6ec65269188219f3e69724867cc.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:c00:1c:b3e3:eb40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://wm-shadow.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 02 Mar 2022 03:39:54 GMT
via
1.1 89cb19c6f2c9ed0983294d3b12e80e42.cloudfront.net (CloudFront)
last-modified
Fri, 21 Jan 2022 18:30:34 GMT
server
AmazonS3
age
35153
etag
"74190b93fc4f5d88f0c8e6411ba20bd8"
x-cache
Hit from cloudfront
x-amz-version-id
3txQ5SaYMKOr5SbJgWNILFQFnpYgvZ_5
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
image/png
content-length
28789
x-amz-cf-id
2Bjo9vRMkWm_Fsc3q8ENL2QL2IUAphD_ps_q7Ol150S9HicQGFzanQ==
oldlogo.png
pcgifts-001-site1.itempurl.com/Assets/imgs/face/ Frame 8618 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pcgifts-001-site1.itempurl.com
URL
https://pcgifts-001-site1.itempurl.com/Assets/imgs/face/oldlogo.png

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored number| uidEvent object| bootstrap object| myModal

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: https://wm-shadow.xyz/getlogid/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==
Message:
Mixed Content: The page at 'https://wm-shadow.xyz/getlogid/arPmI4SsieMcH-P6fpL5a80ScgfqjQ==' was loaded over HTTPS, but requested an insecure element 'http://pcgifts-001-site1.itempurl.com/Assets/imgs/face/oldlogo.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network error URL: https://pcgifts-001-site1.itempurl.com/Assets/imgs/face/oldlogo.png
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED