alfred8.s3.us-east-2.amazonaws.com Open in urlscan Pro
52.219.105.226  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://alfred9.s3.us-east-2.amazonaws.com/red.htm Page URL
2. https://alfred8.s3.us-east-2.amazonaws.com/index.htm Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	red.htm Show response alfred9.s3.us-east-2.amazonaws.com/	470 B 826 B	488ms 130ms	Document text/html	52.219.96.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://alfred9.s3.us-east-2.amazonaws.com/red.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.96.88 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.us-east-2.amazonaws.com Software AmazonS3 / Resource Hash f2bdc6ed8f1a62fe14b13f8b1eb00d212328bba31df15ad178a826fab9db164a Request headers Host alfred9.s3.us-east-2.amazonaws.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-id-2 TTfE/wTCXunzHp2uIvHw03P+PZL4dpCXMIh+gc6YOLH9nVwhUz2ndihOjQgxtahSWnKd3/FwU7c= x-amz-request-id FHZ3A3PQ65357RDG Date Thu, 04 Mar 2021 02:00:07 GMT Last-Modified Wed, 03 Mar 2021 13:31:43 GMT ETag "8ced180f002a0445f3de996ff1d707f7" Accept-Ranges bytes Content-Type text/html Content-Length 470 Server AmazonS3
GET H/1.1	200 OK	Primary Request index.htm Show response alfred8.s3.us-east-2.amazonaws.com/	2 KB 2 KB	490ms 128ms	Document text/html	52.219.105.226 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://alfred8.s3.us-east-2.amazonaws.com/index.htm Requested by Host: alfred9.s3.us-east-2.amazonaws.com URL: https://alfred9.s3.us-east-2.amazonaws.com/red.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.105.226 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.us-east-2.amazonaws.com Software AmazonS3 / Resource Hash 467c7f7704ee779f91887cc12b5063c7492ca49b2ed8baf3eba4bfe395153b39 Request headers Host alfred8.s3.us-east-2.amazonaws.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://alfred9.s3.us-east-2.amazonaws.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://alfred9.s3.us-east-2.amazonaws.com/ Response headers x-amz-id-2 ln8MSl+a5cCsBSke1gtvlvaCcLofAC3TBHHhOjgji/cjegc/Lm/8qGOY8opJnMtQXomwUO+tss0= x-amz-request-id KNF63J7PRD7JJC1G Date Thu, 04 Mar 2021 02:00:08 GMT Last-Modified Wed, 03 Mar 2021 13:22:06 GMT ETag "d1f12ddb9814a942a32006388604bf68" Accept-Ranges bytes Content-Type text/html Content-Length 2094 Server AmazonS3
GET H/1.1	200 OK	style.css alfred8.s3.us-east-2.amazonaws.com/	3 KB 3 KB	125ms 124ms	Stylesheet text/css	52.219.105.226 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://alfred8.s3.us-east-2.amazonaws.com/style.css Requested by Host: alfred8.s3.us-east-2.amazonaws.com URL: https://alfred8.s3.us-east-2.amazonaws.com/index.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.105.226 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.us-east-2.amazonaws.com Software AmazonS3 / Resource Hash 77a077645387f31d3c0c823b3f278066b382f4068011ce72e8ca43f68bb28c45 Request headers Referer https://alfred8.s3.us-east-2.amazonaws.com/index.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 02:00:08 GMT Last-Modified Wed, 03 Mar 2021 13:22:11 GMT Server AmazonS3 x-amz-request-id KNFDGY59Q69NFG6A ETag "1258600ebd44117689236917db48f646" Content-Type text/css Accept-Ranges bytes Content-Length 2982 x-amz-id-2 yaxsHKzLeCz2U6+iuvgs11n4HDX/EOVQfOe8r3RhQujkMiQv1zGqT4+VoZ96CL3DeOPwGEp5OEM=
GET H/1.1	200 OK	microsoft_logo.png alfred8.s3.us-east-2.amazonaws.com/	1 KB 1 KB	250ms 124ms	Image image/png	52.219.105.226 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://alfred8.s3.us-east-2.amazonaws.com/microsoft_logo.png Requested by Host: alfred8.s3.us-east-2.amazonaws.com URL: https://alfred8.s3.us-east-2.amazonaws.com/index.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.105.226 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.us-east-2.amazonaws.com Software AmazonS3 / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Request headers Referer https://alfred8.s3.us-east-2.amazonaws.com/index.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 02:00:08 GMT Last-Modified Wed, 03 Mar 2021 13:22:07 GMT Server AmazonS3 x-amz-request-id KNFA1CYT200SRAVQ ETag "ed9c9eb0dce17d752bedea6b5acda6d9" Content-Type image/png Accept-Ranges bytes Content-Length 1057 x-amz-id-2 /uw/EWyZbR/K9uars1eKynM+lyKtM/MD76aKayWwte5jX6sN8gGzfMmmcr9dPfuFgDRGOBQpxAs=
GET H/1.1	200 OK	arrow_left.svg alfred8.s3.us-east-2.amazonaws.com/	513 B 873 B	374ms 124ms	Image image/svg+xml	52.219.105.226 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://alfred8.s3.us-east-2.amazonaws.com/arrow_left.svg Requested by Host: alfred8.s3.us-east-2.amazonaws.com URL: https://alfred8.s3.us-east-2.amazonaws.com/index.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.105.226 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.us-east-2.amazonaws.com Software AmazonS3 / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer https://alfred8.s3.us-east-2.amazonaws.com/index.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 02:00:08 GMT Last-Modified Wed, 03 Mar 2021 13:22:03 GMT Server AmazonS3 x-amz-request-id KNF52D6WM17JCRZX ETag "a9cc2824ef3517b6c4160dcf8ff7d410" Content-Type image/svg+xml Accept-Ranges bytes Content-Length 513 x-amz-id-2 XMwzdCzx3YN9tm3L66i4ZKos2t6YA/NklsXAhi/ISlZb41j7zB2SLtkXoLjudCP8TUaRN3FsKxU=
GET H/1.1	200 OK	pool.PNG alfred8.s3.us-east-2.amazonaws.com/	47 KB 48 KB	365ms 142ms	Image image/png	52.219.105.226 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://alfred8.s3.us-east-2.amazonaws.com/pool.PNG Requested by Host: alfred8.s3.us-east-2.amazonaws.com URL: https://alfred8.s3.us-east-2.amazonaws.com/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.105.226 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.us-east-2.amazonaws.com Software AmazonS3 / Resource Hash 9ad5de4d4f58a6ded48ca76851d8beaf0cf66a7c2e17106877489b4951a28276 Request headers Referer https://alfred8.s3.us-east-2.amazonaws.com/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 02:00:08 GMT Last-Modified Wed, 03 Mar 2021 13:22:08 GMT Server AmazonS3 x-amz-request-id KNF4KN1B12495KD2 ETag "4fefdcea77fed05bab68403785c79bca" Content-Type image/png Accept-Ranges bytes Content-Length 48473 x-amz-id-2 5HCdEc2lBrIs85NZZUSe9fkYxs8rm2ZDjsV2qWmjd3o8R9zVkySJ9pRZAx10nTyMMj67wA0/0uU=

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| feedUpdateResponse object| feedUpdateSplit number| x string| che

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alfred8.s3.us-east-2.amazonaws.com
alfred9.s3.us-east-2.amazonaws.com
52.219.105.226
52.219.96.88
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
467c7f7704ee779f91887cc12b5063c7492ca49b2ed8baf3eba4bfe395153b39
77a077645387f31d3c0c823b3f278066b382f4068011ce72e8ca43f68bb28c45
9ad5de4d4f58a6ded48ca76851d8beaf0cf66a7c2e17106877489b4951a28276
f2bdc6ed8f1a62fe14b13f8b1eb00d212328bba31df15ad178a826fab9db164a
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c