s3.us-east-1.wasabisys.com Open in urlscan Pro
38.27.106.53  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response s3.us-east-1.wasabisys.com/server-2/maj/	289 KB 290 KB	110ms 46ms	Document text/html	38.27.106.53 BLUEARCHIVE-ZONE-1
General Check archive.org Show headers Download Go to Full URL https://s3.us-east-1.wasabisys.com/server-2/maj/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.27.106.53 Kennedyville, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US), Reverse DNS Software WasabiS3/7.7.900-2022-08-19-6bff245bcf (head14) / Resource Hash 2bd45ffbb4b10061c08064f56037e9f221e74340dd5f64cfe3fa8d2f7da8bd3e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-Ranges bytes Content-Length 296172 Content-Type text/html Date Mon, 31 Oct 2022 04:56:12 GMT ETag "8b94fa970702ee17bf3957c3c8656ef1" Last-Modified Wed, 26 Oct 2022 21:03:25 GMT Server WasabiS3/7.7.900-2022-08-19-6bff245bcf (head14) x-amz-id-2 YImX4aC1zG+tGafniONOzQWCGdutGvQdqnz/fGNykgUdt7+EGFpmm4vOohFKajcHfDY9dYTeC9lL x-amz-request-id 9B3EFEF788A914E7
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 09f2af8997dcf4c4754b78bf337519d137537f5e08a3e31fbe989ff1e4dec6ba Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/png
GET H2	200	jquery-1.12.4.min.js Show response code.jquery.com/	95 KB 33 KB	34ms 7ms	Script application/javascript	2001:4de0:ac18::1:a:3b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.12.4.min.js Requested by Host: s3.us-east-1.wasabisys.com URL: https://s3.us-east-1.wasabisys.com/server-2/maj/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Request headers Referer https://s3.us-east-1.wasabisys.com/ Origin https://s3.us-east-1.wasabisys.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 04:56:12 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-17b8b" vary Accept-Encoding x-hw 1667192172.dop213.ny3.t,1667192172.cds244.ny3.hn,1667192172.cds236.ny3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 33738
GET DATA	200 OK	truncated /	17 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/jpeg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| displaySecondLoginForm function| isEmail

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
s3.us-east-1.wasabisys.com
2001:4de0:ac18::1:a:3b
38.27.106.53
09f2af8997dcf4c4754b78bf337519d137537f5e08a3e31fbe989ff1e4dec6ba
2bd45ffbb4b10061c08064f56037e9f221e74340dd5f64cfe3fa8d2f7da8bd3e
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3