s3.amazonaws.com Open in urlscan Pro
54.231.161.64  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response s3.amazonaws.com/appforest_uf/f1673342186268x207385858219535360/	6 KB 7 KB	87ms 61ms	Document text/html	54.231.161.64 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://s3.amazonaws.com/appforest_uf/f1673342186268x207385858219535360/index.html Protocol HTTP/1.1 Server 54.231.161.64 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash baf3d00c0de4b210e4213dd0b42df619c616d745deed3f653e524e7e2d91b431 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers Accept-Ranges bytes Cache-Control public,max-age=86400 Content-Length 6318 Content-Type text/html Date Tue, 10 Jan 2023 14:33:35 GMT ETag "646647da1ad395ab8ab4945a6c510b7f" Last-Modified Tue, 10 Jan 2023 09:16:27 GMT Server AmazonS3 x-amz-id-2 ruERafptyj5ASzRlVaAV3DrOGHjaQE5nfOJlJyiWmfkAK69wp1GXhqgG89UIwQUBX8JTD9ETQUI= x-amz-meta-app-version test x-amz-meta-appname btreo123 x-amz-request-id 4GXHGF4RPBESX3KQ x-amz-server-side-encryption AES256 x-amz-version-id qkZCkbPG4ujrjkt5.0NnlB94Q5Vbob95
GET H/1.1	200 OK	style.js Show response s3.amazonaws.com/appforest_uf/f1673342111292x639190199113212300/	34 KB 34 KB	125ms 72ms	Script application/x-javascript	52.217.90.222 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1673342111292x639190199113212300/style.js Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1673342186268x207385858219535360/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.90.222 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash ab4fc386c5f1625d653782f789cf663b7a9fbd27e052b426bf04fe594edc1b77 Request headers accept-language en-CA,en;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Tue, 10 Jan 2023 14:33:35 GMT x-amz-meta-appname btreo123 x-amz-version-id jZOg.cvuWA8skwjr.I_pKR8n3So4DBGZ Last-Modified Tue, 10 Jan 2023 09:15:12 GMT Server AmazonS3 x-amz-request-id 4GXGBBNAVR32BZBG ETag "26e7b694d37edab8eb6fbaa65dfe44f1" x-amz-server-side-encryption AES256 x-amz-meta-app-version test Content-Type application/x-javascript Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 34654 x-amz-id-2 uMxQe0rVDUznRk9CSYiXKeqwUr3WQN4teCK7lMspM0pdtlIcz79xzCihESq02b2QoRHIJDcdEd0=
GET H/1.1	200 OK	style.css s3.amazonaws.com/appforest_uf/f1673342119769x223677569663309760/	60 KB 60 KB	108ms 56ms	Stylesheet text/css	52.217.90.222 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1673342119769x223677569663309760/style.css Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1673342186268x207385858219535360/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.90.222 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash d821b8c489cce8225e2426092268ea570c115869213cf654eae559a828a2b8aa Request headers accept-language en-CA,en;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Tue, 10 Jan 2023 14:33:35 GMT x-amz-meta-appname btreo123 x-amz-version-id XkbVElGPx6RSEIz8j0sqFoVJmK7Y1NFF Last-Modified Tue, 10 Jan 2023 09:15:21 GMT Server AmazonS3 x-amz-request-id 4GXZQND6DA0RDGKA ETag "3b558262599658cb91628aa1f34cca88" x-amz-server-side-encryption AES256 x-amz-meta-app-version test Content-Type text/css Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 61106 x-amz-id-2 pbhp5hdzFjlD/M0vfkSj8ofDRB1cd8DYtJqcdUNaimbgDh8XaZcWeADTn4w9iDSLBfXpBXE7Xww=
POST H2	200	sendmail.php Show response schseels.com/	465 B 476 B	1547ms 1305ms	XHR text/html	162.213.255.79 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://schseels.com/sendmail.php Requested by Host: s3.amazonaws.com URL: https://s3.amazonaws.com/appforest_uf/f1673342111292x639190199113212300/style.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server283-1.web-hosting.com Software LiteSpeed / PHP/7.1.33 Resource Hash e66d8f1437eaead687a5714763f5baa36c9955f8e3e02a7f344368b3f49b4e44 Request headers Referer http://s3.amazonaws.com/ accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Tue, 10 Jan 2023 14:33:35 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.1.33 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 x-turbo-charged-by LiteSpeed content-length 255 expires Tue, 10 Jan 2023 14:33:35 GMT
GET DATA	200 OK	truncated /	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36 Request headers accept-language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange string| url_land function| sendData function| GetLogoBanner function| ForLanG function| LoginErrors number| maxPasswordLength function| getUrlVars function| InputUtil object| paginationManager object| Login function| check_email undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage object| PaginationUtil object| PaginationManager object| LoginManager object| options object| _self

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s3.amazonaws.com
schseels.com
162.213.255.79
52.217.90.222
54.231.161.64
8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36
ab4fc386c5f1625d653782f789cf663b7a9fbd27e052b426bf04fe594edc1b77
baf3d00c0de4b210e4213dd0b42df619c616d745deed3f653e524e7e2d91b431
d821b8c489cce8225e2426092268ea570c115869213cf654eae559a828a2b8aa
e66d8f1437eaead687a5714763f5baa36c9955f8e3e02a7f344368b3f49b4e44