audilit04.s3.amazonaws.com Open in urlscan Pro
52.217.133.49 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://protect-us.mimecast.com/s/N8KgC1wY7VC4mBD5ukqcfg?domain=audilit04.s3.amazonaws.com
Effective URL:
https://audilit04.s3.amazonaws.com/ind3x.html
Submission: On April 05 via api (April 5th 2022, 4:36:26 pm UTC) from US — Scanned from US

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 1 countries across 6 domains to perform 18 HTTP transactions. The main IP is 52.217.133.49, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is audilit04.s3.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on December 13th 2021. Valid for: a year.

This is the only time audilit04.s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 2	205.139.111.113 205.139.111.113	30031 (MIMECAST-) (MIMECAST-)
10	52.217.133.49 52.217.133.49	16509 (AMAZON-02) (AMAZON-02)
2	2620:1ec:40::69 2620:1ec:40::69	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	68.66.226.75 68.66.226.75	55293 (A2HOSTING) (A2HOSTING)
3	2606:4700:303... 2606:4700:3034::ac43:9689	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.216.229.227 52.216.229.227	16509 (AMAZON-02) (AMAZON-02)
1	13.226.31.70 13.226.31.70	16509 (AMAZON-02) (AMAZON-02)
18	7

2 205.139.111.113 (United States) 2 redirects

ASN30031 (MIMECAST-, US)
PTR: us-api.mimecast.com

protect-us.mimecast.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 52.217.133.49 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

audilit04.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rep0.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:40::69 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.66.226.75 (United States)

ASN55293 (A2HOSTING, US)
PTR: az1-ts1.a2hosting.com

aronwebsolutions.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3034::ac43:9689 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.229.227 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

imageere.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.31.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-31-70.ewr53.r.cloudfront.net

logo.clearbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	amazonaws.com audilit04.s3.amazonaws.com rep0.s3.amazonaws.com imageere.s3.amazonaws.com	904 KB
3	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 3577	97 KB
2	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1422	21 KB
2	mimecast.com 2 redirects protect-us.mimecast.com — Cisco Umbrella Rank: 9602	2 KB
1	clearbit.com logo.clearbit.com — Cisco Umbrella Rank: 27639	7 KB
1	aronwebsolutions.com aronwebsolutions.com	1 KB
18	6

	Domain	Requested by
9	rep0.s3.amazonaws.com	audilit04.s3.amazonaws.com
3	ka-f.fontawesome.com	rep0.s3.amazonaws.com audilit04.s3.amazonaws.com
2	aadcdn.msauth.net	audilit04.s3.amazonaws.com
2	protect-us.mimecast.com	2 redirects
1	logo.clearbit.com	audilit04.s3.amazonaws.com
1	imageere.s3.amazonaws.com	audilit04.s3.amazonaws.com
1	aronwebsolutions.com	audilit04.s3.amazonaws.com
1	audilit04.s3.amazonaws.com
18	8

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-12-13` - `2022-12-13`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2022-02-22` - `2023-02-22`	a year	crt.sh
aronwebsolutions.com cPanel, Inc. Certification Authority	`2022-02-02` - `2022-05-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-12` - `2022-09-11`	a year	crt.sh
clearbit.com Amazon	`2022-03-23` - `2023-04-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://audilit04.s3.amazonaws.com/ind3x.html
Frame ID: E859188609B8858FD14DB4C2AF1D7273
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

https://protect-us.mimecast.com/s/N8KgC1wY7VC4mBD5ukqcfg?domain=audilit04.s3.amazonaws.com HTTP 307
https://protect-us.mimecast.com/redirect/eNrtVllv20YQ_isC-yrSex9GUdjIQ9G0DdykAdJWhbCnREc8wF3GsQP_9w4pJZaVBH7... HTTP 307
https://audilit04.s3.amazonaws.com/ind3x.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

29 %
IPv6

6
Domains

8
Subdomains

7
IPs

1
Countries

1031 kB
Transfer

1184 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://protect-us.mimecast.com/s/N8KgC1wY7VC4mBD5ukqcfg?domain=audilit04.s3.amazonaws.com HTTP 307
https://protect-us.mimecast.com/redirect/eNrtVllv20YQ_isC-yrSex9GUdjIQ9G0DdykAdJWhbCnREc8wF3GsQP_9w4pJZaVBH7xY_lAcOfa2W-_meGnYnB9Ls6La9O2prozGzPUF9tm67rKdU2xLHadK87xshiCC3Wfc90EWAumseSaE4QQ6CACWRYmZ-O2dRs7CPhpdVg3oc1pVZz_A5JY78Ir0wRYrgo3BF9nM-Zttc3NblUsV0XaGjwrpXeW4MhpxMxKbwlylkqNNQvRRua5xsQIrz57ES5mP-uptD5KZLhHkVsdjfEKi2CcUFTK6AQm2AdChZJIaC2lZsxr5COz3PI5XuP5HIxwrBSiQRDivXZGRKeFxs4yaxSLYTYeui6_ee4EAOU_b_s9Tjl8zKuzB4jqu0muqL5fnkJqO387gfkYy6BpDE4IyCYgSIEoYqzjWDgrg0dWCm49cvwUS0oixhpRhScn7OEERHESnUdBRiqV5lw7eEQUgvhoXdQca08Q04aj-AhLE7wPzAgN1-ocCtb44CQNikvO5h2_xvJ5Engay-kKvgYzD6ZNTZ1S3bVVOCVoZFJYLqQgYsJU4iAdUJY6w61zXGChaXCEnoLqDMGEchstZgrIEgONkTuMOcHaWeGI9pFEZTSQjEaClNVEcwAM5FAGj0FlwTGMgDeGM06RiCREwBgkTnhNvwXq8yRwDGoTUjKbsDobolOElCmP1gZ_jDBl5H-6Pitd_72H5uxraMtT-_6lhVVfe1BCr-4N9Ozixds3l4xeYgoqM1u92Ab3_u3r3_YCoDXILp2DZWpM2sLKKyuj95YiT0gIEppYgPbkKFHAG8qB3BLulk0urR_AIzRD5d2Fb4wbygTdP1Tp_W1K2Qw5HWZIGu01mF6Z24kai9gNi8t-qHcLxJcLgggBm9zk37uxhRMUY8phaKa0p-H0ME_grHVfH42T9jOR_p7n1nLxcppiM1ShMfVu1n17ss1GvgOrdrY6UuyhDWlCU1CCFVGC4v2BH5L5svfV0G0GqIDF69B3Qz7Z_Ul4ThN5wrLuZyvOKsJQxSq8Z-K2S_nQEUosqtTkvuzGXIWxvAkpl7gyjbnr2hQOoe73kL_qPIzzAqHpRusePo8ig6hJmwmG4keEEUFYxmgUdA6PS-2FxxixcmoSJVMMlcYzXyqYYTAwHRIIl2h-Lr6TxU_TBvvekRNsMjEBMcQxIZwTpaYExmEHmm3OfTpfna3OzOjrXZ0RqxI9RDM3-zOd1a2nH-d_iR---zsTpjrYrF0Z1mNCeI0lWn_w8C7J-kvBrA-Z4DVbH8gIR2GlxIIyioXUEGkzzsi8u3n5YVxfj1dXBv_8lxze6evy1z9A78Cza8Lg9hAfV-MQNvvi64cuQwGXY6qmuncm5TnP-_8A3Rjigw HTTP 307
https://audilit04.s3.amazonaws.com/ind3x.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request ind3x.html Show response
audilit04.s3.amazonaws.com/
Redirect Chain

https://protect-us.mimecast.com/s/N8KgC1wY7VC4mBD5ukqcfg?domain=audilit04.s3.amazonaws.com
https://protect-us.mimecast.com/redirect/eNrtVllv20YQ_isC-yrSex9GUdjIQ9G0DdykAdJWhbCnREc8wF3GsQP_9w4pJZaVBH7xY_lAcOfa2W-_meGnYnB9Ls6La9O2prozGzPUF9tm67rKdU2xLHadK87xshiCC3Wfc90EWAumseSaE4QQ6CACWRYm...
https://audilit04.s3.amazonaws.com/ind3x.html

113 KB
113 KB

150ms
44ms

Document
text/html

52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: ace4c1ca6cfad87960612242fbee168dec8dbbfae8659f86b0b69c78037ad608

Request headers

Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges: bytes
Content-Length: 115448
Content-Type: text/html
Date: Tue, 05 Apr 2022 16:36:22 GMT
ETag: "11b7facaee743c1c0380b5aef5861b29"
Last-Modified: Tue, 05 Apr 2022 15:08:31 GMT
Server: AmazonS3
x-amz-id-2: y29jYW1MQGhfVpYAfe6PtAwD+P24USRV8h5RlKFlo9NmuyTpUAw6yB7cKdoNaSzu4QPOsXtmvGs=
x-amz-request-id: RRPD2AG771190HPW
x-amz-version-id: sDMomDuy13Bjvr5LPLCGRgA.vx6vOrIH

Redirect headers

Cache-control: no-store
Connection: keep-alive
Content-Length: 0
Date: Tue, 05 Apr 2022 16:36:21 GMT
Location: https://audilit04.s3.amazonaws.com/ind3x.html#janna.zagari@hmhco.com
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

GET
H/1.1 200
OK jquery.min.js Show response
rep0.s3.amazonaws.com/g1t/ 84 KB
84 KB 124ms
43ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/jquery.min.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: e302f49181251a403177480c80f677dd129c566e693443453e2bc14db47c51ea

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:18 GMT
Server: AmazonS3
x-amz-request-id: RRPB3PMFS3NG8SR5
ETag: "ae32e3a8b23b3c22e9954018a8f50771"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 85628
x-amz-id-2: OiusrBv25wRrbfpc29CC6avDv3dW+eBH5cWksSkpRpg7BPZSblV4krDAtZZn51sBBgGsPcNbi9E=

GET
H/1.1 200
OK jquery-3.1.1.min.js Show response
rep0.s3.amazonaws.com/g1t/ 85 KB
85 KB 121ms
42ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/jquery-3.1.1.min.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 17c6f5cb588cf68e1d846863b21ccd1261b61a955d28c40caa3cee6f4942935b

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:20 GMT
Server: AmazonS3
x-amz-request-id: RRPESFWGPA67MBCX
ETag: "d72b3148cc9e1ad1e428aea9d7a03565"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 86759
x-amz-id-2: Z0vmaCTalz/FMIDAoRUi3LcnsRxZLZNtDdxw/7wHtmiT+ZM+fo3xeVtV4vthuLi6hY9k+Ni3hDQ=

GET
H/1.1 200
OK jquery-3.3.1.js Show response
rep0.s3.amazonaws.com/g1t/ 276 KB
276 KB 125ms
45ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/jquery-3.3.1.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 53847ae03a6d9bceb4f438cf1b50a7a37d7105130835208cd0b887d90ba46def

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:24 GMT
Server: AmazonS3
x-amz-request-id: RRPE7XJMQ1J67X5D
ETag: "e445669af64b8a010cd0cb09c1e0c1d0"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 282165
x-amz-id-2: D3Uj7QTtZK2vLFiNhrwVslayynmrwoZbPo7p1SwlGJcf6iw0exXxsL0JnWBOb+0zAi8ol+eBnQo=

GET
H2 200 converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 106 KB
20 KB 103ms
31ms Stylesheet
text/css 2620:1ec:40::69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::69 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: a96b2b12489a80eafe62cc4bcc04cb367e2b54efc3039e484211c7deec12c0b8

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Origin: https://audilit04.s3.amazonaws.com
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Apr 2022 16:36:21 GMT
content-encoding: gzip
x-azure-ref-originshield: 0ovJGYgAAAACd6V6k4SRuTasQrIULQt7/RVdSMzBFREdFMDUxOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: /7H4IR1YAHBHDqgAZw2T1Q==
x-cache: TCP_HIT
content-length: 19750
x-ms-lease-status: unlocked
last-modified: Tue, 18 Aug 2020 21:44:27 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D843BFE1586E6F
x-azure-ref: 0BXBMYgAAAAA+lEFOym2IRLfOpxHgtJJqTU5aMjIxMDYwNjEyMDA5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 34490bf1-401e-002b-346f-458357000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

GET
H/1.1 200
OK bootstrap.min.css
rep0.s3.amazonaws.com/g1t/ 142 KB
142 KB 130ms
52ms Stylesheet
text/css 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/bootstrap.min.css
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: efaf2cabafd973e92f54e8b8ba760018ffa02bcdb63cdab01c219b570c21a2fc

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:10 GMT
Server: AmazonS3
x-amz-request-id: RRPETYC1AQNPVRJ0
ETag: "1e5b180ea96b35ab0a33865ab541cfee"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 144934
x-amz-id-2: eFrm2N6mNvy64EI175mUad1SBjIUXEDzuRw8ja1k3/JeRx3cZ7R4QpabwSQvPVxCraOsjMax4/c=

GET
H/1.1 403
Forbidden family=Archivo+Narrow&display=swap.css
rep0.s3.amazonaws.com/g1t/ 0
0 114ms
36ms Stylesheet
application/xml 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

GET
H2 200 main.style.css
aronwebsolutions.com//git/bg123a/ 3 KB
1 KB 208ms
68ms Stylesheet
text/css 68.66.226.75
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://aronwebsolutions.com//git/bg123a/main.style.css

Requested by

Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

68.66.226.75 , United States, ASN55293 (A2HOSTING, US),

Reverse DNS

az1-ts1.a2hosting.com

Software

LiteSpeed /

Resource Hash

5edb096bc6785e2c64dc0b41cf8900abab6d4819cc02a983c281a53d5b26110e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 16:36:16 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 09 Nov 2021 18:46:49 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent,Accept-Encoding,Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60480000, public
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
content-length: 853
expires: Tue, 12 Apr 2022 16:36:16 GMT

GET
H/1.1 200
OK 5051251.js Show response
rep0.s3.amazonaws.com/g1t/ 11 KB
11 KB 274ms
101ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/5051251.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 450fca8a717252e0b5820af945aa199405db752bde94a452e6612441768d44f4

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:07 GMT
Server: AmazonS3
x-amz-request-id: RRP8A6Z095JYPWD5
ETag: "ecc21637437ade8afa1bf3cea287e18a"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 10914
x-amz-id-2: D75hW3I01/5WYzwQf7YmsTVyHESZAHBvkwcTXu4V2Ovsq+30YrER301KaANp7U8rLghEUWIWNUU=

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v5.15.2/css/ 59 KB
13 KB 83ms
38ms Fetch
text/css 2606:4700:3034::ac43:9689
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.2/css/free.min.css?token=585b051251
Requested by: Host: rep0.s3.amazonaws.com
URL: https://rep0.s3.amazonaws.com/g1t/5051251.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:9689 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 16:36:21 GMT
via: 1.1 075ecc80ea8e9352008139ab9fd7a592.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1015
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 13 Jan 2021 18:32:18 GMT
server: cloudflare
etag: W/"4ecc071b77d6b1790fa9fb8a5173f972"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q%2BGFEj8NjrwTiytbo2%2B0jkhjGhBvu9opss2Hnr%2BjuvNxbYdqFWMPJHmAw0rXVUjCkwP9vWkRpjuNAfCgKE5NF6HrNa16PsjpW54S7L7q6sq1zCml9h3MvXV6XII%2FD6ThiW88FIS2o0fO7zC%2BbDKxM4ihsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: EWR52-C4
cf-ray: 6f73b3c409ca1821-EWR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: 2mBFlp5a4UXQR7pO0Sh_oYcgN-xVq9Z0p5DX4FT6zwl5GpcALjthBA==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v5.15.2/css/ 26 KB
5 KB 82ms
37ms Fetch
text/css 2606:4700:3034::ac43:9689
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.2/css/free-v4-shims.min.css?token=585b051251
Requested by: Host: rep0.s3.amazonaws.com
URL: https://rep0.s3.amazonaws.com/g1t/5051251.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:9689 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 16:36:21 GMT
via: 1.1 95e9f369e54eb77c8abfd772b46c5a7a.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1055
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 13 Jan 2021 18:32:17 GMT
server: cloudflare
etag: W/"1848e71668f42835079e5fa2af6cf4a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FSV8SefWdTgWq9oH1KH3lU3IbW3pVy%2BdirLfR7Ohqulk9hCgeKLfbicHzLQSMgocPSROQIuokjwupMVnQ3v7dx%2Bda46lHh7t5dpDtOaPiGvDtOSFQ%2FgyauJriYQp4N4dVJSpIe%2BOWHlKdZOnWhc36mg4mg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: EWR52-C4
cf-ray: 6f73b3c409cc1821-EWR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: ykmg82i_BoPxi4JZqbOroqMTm1Y6hE3L4o5oxIwqW5HpDEaipoZymQ==

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f508cf3427fbb7e4ad8650b6d8fc8ba0d186e4e3e62eb9a257295f45291c9260

Request headers

Accept-Language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK jquery-3.2.1.slim.min.js Show response
rep0.s3.amazonaws.com/g1t/ 68 KB
68 KB 34ms
34ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/jquery-3.2.1.slim.min.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: ba19c068b1fa0a891da87472bb85e4da56b9b36d935908ecda075aee04991204

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:21 GMT
Server: AmazonS3
x-amz-request-id: RRP7KE4ZN564N0XM
ETag: "50d7eb415683330006cf8e7eb71b4e4c"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 69647
x-amz-id-2: XV6fjO8UTFx5DzI/qFlS0wu0BDi/wPcna+FyxPgz6VaK0w2Ovnrs0vExX1jYe0L0ldB7/H0LRmQ=

GET
H2 200 signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn.msauth.net/shared/1.0/content/images/ 2 KB
1 KB 87ms
31ms Image
image/svg+xml 2620:1ec:40::69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::69 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Apr 2022 16:36:21 GMT
content-encoding: gzip
x-azure-ref-originshield: 0miRHYgAAAACQgtF8blkyQ5oKhejH0y11RVdSMzBFREdFMDYxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: R2FAVxfpONfnQAuxVxXbHg==
x-cache: TCP_HIT
content-length: 621
x-ms-lease-status: unlocked
last-modified: Tue, 10 Nov 2020 03:41:24 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D8852A7FA6B761
x-azure-ref: 0BXBMYgAAAAD00886CU0xSrKCyTqm7q1tTU5aMjIxMDYwNjEzMDUxADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a37f9bfd-a01e-0035-7090-459168000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

GET
H/1.1 200
OK popper.min.js Show response
rep0.s3.amazonaws.com/g1t/ 19 KB
19 KB 37ms
37ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/popper.min.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7fe4cb65ec5651dd7c64a8118ce631fdbbd62bdd6fb16b8e54faed836c55b122

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:28 GMT
Server: AmazonS3
x-amz-request-id: RRP6J076CQD3DZAA
ETag: "577d614cc3e2a9ed0c9114da411d2fa0"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 19243
x-amz-id-2: MyOcBUHIV5YUK0L6OkFgQh7rLdiQ0fJEhuMuVXxy7Wboo7pTkjkGU8OgTEutIEWe8Hg6wZlwBG0=

GET
H/1.1 200
OK bootstrap.min.js Show response
rep0.s3.amazonaws.com/g1t/ 48 KB
48 KB 34ms
33ms Script
application/javascript 52.217.133.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rep0.s3.amazonaws.com/g1t/bootstrap.min.js
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.133.49 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 29db8702986257883443c8772092f6e9e6e33e6e180093f939c6c86b54039f25

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 05 Apr 2022 16:36:22 GMT
Last-Modified: Tue, 08 Mar 2022 00:16:12 GMT
Server: AmazonS3
x-amz-request-id: RRP0BR8WCXZ7CFE6
ETag: "917feccddd1f412fcda6516ee248ee1b"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 48998
x-amz-id-2: IrIN3SEVaSOAtBGaU7O9DN9aQOiyJJHW9WdJ15+eKtpu2HdbMpVYrin4hiOhyf+O/NSui4KBQ8E=

GET
H/1.1 200
OK paystub.jpg
imageere.s3.amazonaws.com/ 57 KB
58 KB 379ms
46ms Image
image/jpeg 52.216.229.227
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imageere.s3.amazonaws.com/paystub.jpg
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.229.227 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: b1691cf2b01a3d84baeae66813c15ca7ef5ac8e89f2fcfa934b520d8d1d5fc9b

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Tue, 05 Apr 2022 16:36:23 GMT
Last-Modified: Tue, 05 Apr 2022 15:02:11 GMT
Server: AmazonS3
x-amz-request-id: 56EXTDTGFQ01GVAT
ETag: "7a7d006104ae8837778ed00cdb6a5dd8"
Content-Type: image/jpeg
x-amz-version-id: 3n0K7bTaVNhHhO.NJBHTQCGzP8.B6fik
Accept-Ranges: bytes
Content-Length: 58591
x-amz-id-2: JMqF7WcYf9XZ1AfPJE7V+jjuopx1WjS+D4pBOwBQsmDERO0Y5wy6yEuH/LBkNgFbWRt0rXlMxJY=

GET
H2 200 hmhco.com
logo.clearbit.com/ 7 KB
7 KB 72ms
24ms Image
image/png 13.226.31.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logo.clearbit.com/hmhco.com

Requested by

Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.31.70 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-31-70.ewr53.r.cloudfront.net

Software

envoy /

Resource Hash

1fee1df126a06406a1a39d95db73a49a0bca833a01eb5be04bc0a2d38cc43855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://audilit04.s3.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 17:02:08 GMT
via: 1.1 47f167ca4b48d927b2e7abade7ebfcfc.cloudfront.net (CloudFront)
x-content-type-options: nosniff
server: envoy
age: 1553653
content-security-policy-report-only: default-src: 'self'; report-uri https://o13610.ingest.sentry.io/api/6173537/security/?sentry_key=7ac906c405c04da0bad984892f88d1bb
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-amz-cf-pop: EWR53-C2
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: 5SK2E4175MIlZLG83YDr7CM0xiNNuwyTZZKaXn_DHdW0UZ5_SGIxVA==

GET
H2 200 free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.2/webfonts/ 78 KB
79 KB 30ms
30ms Font
font/woff2 2606:4700:3034::ac43:9689
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.2/webfonts/free-fa-solid-900.woff2
Requested by: Host: audilit04.s3.amazonaws.com
URL: https://audilit04.s3.amazonaws.com/ind3x.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:9689 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b94af5a5be53424e948d36a705a1169d952ba6b23761aea3098967a643765454

Request headers

Referer: https://audilit04.s3.amazonaws.com/
Origin: https://audilit04.s3.amazonaws.com
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 16:36:21 GMT
via: 1.1 ba93d64cb248ed4a264c9ee401175456.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1015
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 80272
last-modified: Wed, 13 Jan 2021 18:39:13 GMT
server: cloudflare
etag: "a156119daf157b8244f7c816f85638cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZxMeoq%2BUPcz94au%2FYG2%2BgLhH5ya8wWB0EpASHelNqtd0YHDUjzL4JDLik7YtGOM0SVBoRzdAkJALQ0952o%2B1DaKIRMzlxTpFyVZcXiSkK1Fns5ZysvHtFskt3k7GsrhZ2v27%2BowTgdsBkv%2B7ye8rqJfRPA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
cf-ray: 6f73b3c4db421821-EWR
access-control-allow-headers: fa-kit-token
x-amz-cf-id: 0WvuxX8OM3mtSn0mYxP3rbFYd1fbnfntX8br5vcAIB87cZCwWdvFpQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/jquery-3.3.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/5051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://rep0.s3.amazonaws.com/g1t/family=Archivo+Narrow&display=swap.css Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 25) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 25) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 25) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://audilit04.s3.amazonaws.com/ind3x.html(Line 25) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rep0.s3.amazonaws.com/g1t/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aronwebsolutions.com
audilit04.s3.amazonaws.com
imageere.s3.amazonaws.com
ka-f.fontawesome.com
logo.clearbit.com
protect-us.mimecast.com
rep0.s3.amazonaws.com
13.226.31.70
205.139.111.113
2606:4700:3034::ac43:9689
2620:1ec:40::69
52.216.229.227
52.217.133.49
68.66.226.75
17c6f5cb588cf68e1d846863b21ccd1261b61a955d28c40caa3cee6f4942935b
1fee1df126a06406a1a39d95db73a49a0bca833a01eb5be04bc0a2d38cc43855
29db8702986257883443c8772092f6e9e6e33e6e180093f939c6c86b54039f25
450fca8a717252e0b5820af945aa199405db752bde94a452e6612441768d44f4
53847ae03a6d9bceb4f438cf1b50a7a37d7105130835208cd0b887d90ba46def
5edb096bc6785e2c64dc0b41cf8900abab6d4819cc02a983c281a53d5b26110e
7fe4cb65ec5651dd7c64a8118ce631fdbbd62bdd6fb16b8e54faed836c55b122
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a96b2b12489a80eafe62cc4bcc04cb367e2b54efc3039e484211c7deec12c0b8
ace4c1ca6cfad87960612242fbee168dec8dbbfae8659f86b0b69c78037ad608
b1691cf2b01a3d84baeae66813c15ca7ef5ac8e89f2fcfa934b520d8d1d5fc9b
b94af5a5be53424e948d36a705a1169d952ba6b23761aea3098967a643765454
ba19c068b1fa0a891da87472bb85e4da56b9b36d935908ecda075aee04991204
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101
e302f49181251a403177480c80f677dd129c566e693443453e2bc14db47c51ea
efaf2cabafd973e92f54e8b8ba760018ffa02bcdb63cdab01c219b570c21a2fc
f508cf3427fbb7e4ad8650b6d8fc8ba0d186e4e3e62eb9a257295f45291c9260

audilit04.s3.amazonaws.com Open in urlscan Pro 52.217.133.49 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

29 %IPv6

6 Domains

8 Subdomains

7 IPs

1 Countries

1031 kBTransfer

1184 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

41 JavaScript Global Variables

0 Cookies

10 Console Messages

Indicators

audilit04.s3.amazonaws.com Open in urlscan Pro
52.217.133.49 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

29 %
IPv6

6
Domains

8
Subdomains

7
IPs

1
Countries

1031 kB
Transfer

1184 kB
Size

0
Cookies

18 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!