awsmetrics.com Open in urlscan Pro
2600:3c00::f03c:93ff:feed:349c  Malicious Activity! Public Scan

5 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response awsmetrics.com/	726 KB 216 KB	984ms 137ms	Document text/html	2600:3c00::f03c:93ff:feed:349c AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://awsmetrics.com/?rid=7ux8klZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:3c00::f03c:93ff:feed:349c Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash 9c63f3cbcba6e59cfa6905e609d16216d83b4aaf6acf13b6c01bc606d75efaf2 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Wed, 07 Jun 2023 17:05:37 GMT vary Accept-Encoding x-server gophish
GET H2	404	panorama-nav-init.js awsmetrics.com/js/	0 0	125ms 124ms	Script text/plain	2600:3c00::f03c:93ff:feed:349c AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://awsmetrics.com/js/panorama-nav-init.js Requested by Host: awsmetrics.com URL: https://awsmetrics.com/?rid=7ux8klZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:3c00::f03c:93ff:feed:349c Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://awsmetrics.com/?rid=7ux8klZ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 17:05:37 GMT x-content-type-options nosniff content-length 19 vary Accept-Encoding content-type text/plain; charset=utf-8
GET H2	404	AWSMarketingTargetServiceAnalyticsClientSignin.js awsmetrics.com/js/	0 0	130ms 128ms	Script text/plain	2600:3c00::f03c:93ff:feed:349c AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://awsmetrics.com/js/AWSMarketingTargetServiceAnalyticsClientSignin.js Requested by Host: awsmetrics.com URL: https://awsmetrics.com/?rid=7ux8klZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:3c00::f03c:93ff:feed:349c Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://awsmetrics.com/?rid=7ux8klZ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 17:05:37 GMT x-content-type-options nosniff content-length 19 vary Accept-Encoding content-type text/plain; charset=utf-8
GET		components.min.css awsmetrics.com/css/	0 0
GET		utilities.min.css awsmetrics.com/css/	0 0
GET		grid.min.css awsmetrics.com/css/	0 0
GET		secondary_button.css awsmetrics.com/css/	0 0
GET		vpce_error_page.css awsmetrics.com/css/	0 0
GET H2	200	Site-Merch_AWS-Certification-Propel_Console-Sign-In.38703e5d6aaef403076700b453c82e6efe487b71.png d1.awsstatic.com/Digital%20Marketing/sitemerch/sign-in/en/	42 KB 42 KB	46ms 8ms	Image image/png	2600:9000:223c:1c00:19:2ae8:f748:f7e1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1.awsstatic.com/Digital%20Marketing/sitemerch/sign-in/en/Site-Merch_AWS-Certification-Propel_Console-Sign-In.38703e5d6aaef403076700b453c82e6efe487b71.png Requested by Host: awsmetrics.com URL: https://awsmetrics.com/?rid=7ux8klZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:223c:1c00:19:2ae8:f748:f7e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 06a62dfc262f8aaf73fd55f9e44869c0e887d5b56134f1c11505db8679f92c15 Request headers accept-language de-DE,de;q=0.9 Referer https://awsmetrics.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 11 May 2023 03:59:51 GMT x-amz-version-id sMBLJXT8wt6qh3E1Z2gVQe5BMW8o5rzF via 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P2 age 2379947 x-amz-meta-version 2022-04-14T21:22:53.237Z x-cache Hit from cloudfront x-amz-replication-status COMPLETED content-length 42844 last-modified Thu, 14 Apr 2022 21:23:41 GMT server AmazonS3 etag "4bd4aace03da36800b6fe23391493bb7" content-type image/png cache-control max-age=31536000 accept-ranges bytes x-amz-cf-id li182Yqg4hYdlF0CgZongKTFlRlayY1zs-kp5WKzRBNAlL7SU9l2bQ==
GET H2	404	privatelink_unauth.svg awsmetrics.com/fonts/	19 B 19 B	125ms 125ms	Image text/plain	2600:3c00::f03c:93ff:feed:349c AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://awsmetrics.com/fonts/privatelink_unauth.svg Requested by Host: awsmetrics.com URL: https://awsmetrics.com/?rid=7ux8klZ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:3c00::f03c:93ff:feed:349c Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://awsmetrics.com/?rid=7ux8klZ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 17:05:37 GMT x-content-type-options nosniff content-length 19 vary Accept-Encoding content-type text/plain; charset=utf-8
GET		components.min.css awsmetrics.com/css/	0 0
GET		utilities.min.css awsmetrics.com/css/	0 0
GET		grid.min.css awsmetrics.com/css/	0 0
GET		secondary_button.css awsmetrics.com/css/	0 0
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/components.min.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/utilities.min.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/grid.min.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/secondary_button.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/vpce_error_page.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/components.min.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/utilities.min.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/grid.min.css

Domain

awsmetrics.com

URL

https://awsmetrics.com/css/secondary_button.css

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AWS (Online)

64 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend object| u2f undefined| js_api_version function| getParameterByName function| loadInlineJSON function| isIOSWebview function| isBrowserWebAuthnCompatible function| reportMetric function| reportMetrics string| U2F_METRICS_PATH string| CANDIDATE_METRICS_PATH string| U2F_COUPLED_ROOT string| U2F_DECOUPLED_ROOT string| U2F_CANDIDATE_COUPLED_ROOT string| CANDIDATE_ROOT_LOGIN string| U2F_IAM_USER string| U2F_ERROR_CODE string| U2F_CLIENT_LIBRARY_ERROR string| CANDIDATE_MFA_CANCEL string| COMPATIBLE string| INCOMPATIBLE string| UNKNOWN string| INVALID string| IAM_USER_AUTHENTICATION string| IAM_USER_RESET_PASSWORD string| GET_CAPTCHA string| RESET_PASSWORD_REQUEST string| OPT_IN_REGION_FAILURE string| VPCE_FAILURE object| angular boolean| __fwcimLoaded object| fwcim object| AwsUi object| _AwsUiJsxHelpers function| Zepto function| $ string| isU2FCompatible string| contactUsMfaUrl string| passwordExpired string| resyncMfaMessage string| smsMfaLostDeviceHeader string| smsMfaLostDeviceMessage string| smsMfaLostDeviceButton string| u2fAuthenticationError string| forceMobileApp function| requestParameters object| analyticsConfig undefined| targetServiceAnalyticsClient object| response object| targetedContentJson object| eventDetail object| customEvent string| iamChangePasswordUrl object| changePasswordButton undefined| app undefined| account undefined| username undefined| checkboxEnabled undefined| mfaCheckboxEnabled function| IamController function| getMetadata undefined| isFlashDisabled

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://awsmetrics.com/js/panorama-nav-init.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to execute script from 'https://awsmetrics.com/js/panorama-nav-init.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/components.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/utilities.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://awsmetrics.com/js/AWSMarketingTargetServiceAnalyticsClientSignin.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to execute script from 'https://awsmetrics.com/js/AWSMarketingTargetServiceAnalyticsClientSignin.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ(Line 4353) Message: Refused to apply style from 'https://awsmetrics.com/css/grid.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ(Line 4353) Message: Refused to apply style from 'https://awsmetrics.com/css/secondary_button.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/vpce_error_page.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/components.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/utilities.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/grid.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://awsmetrics.com/?rid=7ux8klZ Message: Refused to apply style from 'https://awsmetrics.com/css/secondary_button.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://awsmetrics.com/fonts/privatelink_unauth.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

awsmetrics.com
d1.awsstatic.com
awsmetrics.com
2600:3c00::f03c:93ff:feed:349c
2600:9000:223c:1c00:19:2ae8:f748:f7e1
06a62dfc262f8aaf73fd55f9e44869c0e887d5b56134f1c11505db8679f92c15
8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38
9c63f3cbcba6e59cfa6905e609d16216d83b4aaf6acf13b6c01bc606d75efaf2
b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793