meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe6e:7ea0  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com/	205 KB 206 KB	366ms 14ms	Document text/html	2600:3c03::f03c:92ff:fe6e:7ea0 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:3c03::f03c:92ff:fe6e:7ea0 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash af66b193e314e966c5137d4785db09411a093af3fc11f97bcc604d0eaf9f11b3 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 210196 Content-Type text/html Date Fri, 25 Oct 2024 17:27:24 GMT ETag "3b172f13d479df2ee978c75821a21531" Last-Modified Fri, 25 Oct 2024 14:38:06 GMT x-amz-request-id tx000003b9c6066c0895337-00671bd4fc-bbe3335c-default x-rgw-object-type Normal
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ff7e5e56d160f3343b712e018f7aea4ac6c544f8c73d9b6509550fbd5b341d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H3	200	pdf.png manymanythinkingbutmoneneed.pages.dev/	189 KB 190 KB	208ms 49ms	Image image/png	2606:4700:310c::ac42:2c86 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://manymanythinkingbutmoneneed.pages.dev/pdf.png Requested by Host: meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com URL: https://meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c86 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43f0de982c3ef8109d11e6d256e833e4eea55e2421a2e5c68a905118c1d12f65 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com/ Response headers etag "d2ec86f50d307765750ebbaabfd7611a" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zkf4NtbCm4jwVmecHW60e%2BcMx0DJO8q54%2FaikjTikyFwVGVvBBw%2FiyTBG3Vaz5RkNlnD3ASs7R6ug5AnixXcv9uVUoTjePZl9CrmNwNgQGsrjR1R9d6L6jX1YrLwuSEXVkjC8mJ3e2ByAhnaFLgn4i2%2BzjehxTambiTQLIl0Zv%2Bm6g91"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=8010&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4230&recv_bytes=4438&delivery_rate=73482&cwnd=12000&unsent_bytes=0&cid=7ad07db83f5e97b3&ts=133&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 25 Oct 2024 17:27:24 GMT content-type image/png vary Accept-Encoding priority u=1,i cache-control public, max-age=0, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin cf-ray 8d83eacc6dfd41bd-EWR access-control-allow-origin * content-length 194024 server cloudflare
GET H2	200	pat_logo.svg.png enableuseraccessfunction.diaopd3tw6w1f.amplifyapp.com/	2 KB 2 KB	113ms 10ms	Other image/png	108.139.47.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://enableuseraccessfunction.diaopd3tw6w1f.amplifyapp.com/pat_logo.svg.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.139.47.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-139-47-2.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash 710c5f6f45c2efd5fc851f93b4898a0d1982a209811bc27581401419e4ea2e17 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com/ Response headers cache-control public, max-age=0, s-maxage=31536000 etag "4ba9a89f47c21e1639ab038f9793a941" age 2764052 via 1.1 1d2861d9b6c0fd303c8b7539b394c190.cloudfront.net (CloudFront) accept-ranges bytes alt-svc h3=":443"; ma=86400 x-cache Hit from cloudfront content-length 1584 x-amz-cf-id GsyczIbxj0CsN7HUJBN4iutxyUS2bjBZZPMr_QBsUe1eBka5A9spXA== date Mon, 23 Sep 2024 17:39:53 GMT content-type image/png last-modified Sat, 21 Sep 2024 17:34:42 GMT server AmazonS3 x-amz-cf-pop JFK50-P1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0xd4f1b6 function| _0x257c1b function| _0x15dd function| _0x42d554 function| _0x1fa404 function| _0x1b353f function| _0x3749 function| _0x48c967 function| continueLoading function| validateEmail function| generateRandomParameters function| _0x1621 function| _0xed44 function| _0x8b5735 function| _0xf686ba function| _0x261cc0 function| _0x5ef20f function| fetchRandomWiki function| showLoadingMessage function| hideLoadingMessage function| _0x4a03 function| showError function| _0x2a7f2c function| _0x19848c function| _0x43f9ae function| _0x3140

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

enableuseraccessfunction.diaopd3tw6w1f.amplifyapp.com
manymanythinkingbutmoneneed.pages.dev
meramzxtvnkrpdufcsywjgetpgzndcuyewq.us-east-1.linodeobjects.com
108.139.47.2
2600:3c03::f03c:92ff:fe6e:7ea0
2606:4700:310c::ac42:2c86
43f0de982c3ef8109d11e6d256e833e4eea55e2421a2e5c68a905118c1d12f65
67ff7e5e56d160f3343b712e018f7aea4ac6c544f8c73d9b6509550fbd5b341d
710c5f6f45c2efd5fc851f93b4898a0d1982a209811bc27581401419e4ea2e17
af66b193e314e966c5137d4785db09411a093af3fc11f97bcc604d0eaf9f11b3