45.32.66.91 Open in urlscan Pro
45.32.66.91  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 45.32.66.91/	11 KB 3 KB	339ms 170ms	Document text/html	45.32.66.91 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL http://45.32.66.91/ Protocol HTTP/1.1 Server 45.32.66.91 Los Angeles, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 45.32.66.91.vultrusercontent.com Software Apache/2.4.52 (Ubuntu) / Resource Hash d50a253f61053954ce4ed3f2b8391b3dfcf60acbf74d52a2a9d53b9b18fa94e9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 3149 Content-Type text/html Date Wed, 31 Jan 2024 07:05:01 GMT ETag "2a8d-60ff144149b00-gzip" Keep-Alive timeout=5, max=100 Last-Modified Sat, 27 Jan 2024 18:06:04 GMT Server Apache/2.4.52 (Ubuntu) Vary Accept-Encoding
GET H2	200	okta-sign-in.min.js Show response ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/js/	2 MB 477 KB	125ms 44ms	Script application/javascript	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/js/okta-sign-in.min.js Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash 0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:14 GMT x-amz-meta-sha1sum 0ebce80c1902181c4eeac9cb6c3cd229f44cadde content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 age 1078307 x-cache Hit from cloudfront last-modified Mon, 25 Sep 2023 22:41:04 GMT server nginx etag W/"b065fc11fb7d64a21c36a93e2b9a4c7a" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id 7fMCrvc-Gju7LTLyZX8asUty8glyxYVTUcG8SGWLWaOmS5obXsmFYQ== expires Fri, 17 Jan 2025 19:33:14 GMT
GET H2	200	okta-sign-in.min.css ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/	217 KB 37 KB	106ms 25ms	Stylesheet text/css	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash 31ec6b02dfe1de9903c0688f4dc9d33bcf49d6fff8003da7a74c3d30b38f13f9 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:13 GMT x-amz-meta-sha1sum d05ffdde7a9f1a519770c8209de521a2a4fff863 content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 age 1078307 x-cache Hit from cloudfront last-modified Mon, 25 Sep 2023 22:39:52 GMT server nginx etag W/"bb726b407a54ee7d118fbfaf8b302895" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id mg1cMAnyXFdfYW5xhBOnVlGq-NH3qlyNVvDN1EMvTQeR442txSnRKw== expires Fri, 17 Jan 2025 19:33:13 GMT
GET H2	200	loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css ok1static.oktacdn.com/assets/loginpage/css/	3 KB 2 KB	102ms 22ms	Stylesheet text/css	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/loginpage/css/loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:14 GMT x-amz-meta-sha1sum db76514c4942184db3baedf6ac119ff9538368fc content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 age 1078307 x-cache Hit from cloudfront last-modified Tue, 07 Feb 2023 00:39:41 GMT server nginx etag W/"c1227d73b70be13e51aae80fe238b0ae" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id evnj2Nhzq5XhUVne7wkueSu_h04y5QiO5TzP245s6-D6QfwIOOZzKQ== expires Fri, 17 Jan 2025 19:33:14 GMT
GET H/1.1	404 Not Found	style-sheet 45.32.66.91/api/internal/brand/theme/	0 0	170ms 169ms	Stylesheet text/html	45.32.66.91 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL http://45.32.66.91/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=f991ebb043f05a9393f38ace2d7dafefc25baa57484ea41b8969a14da06b2d45c27314de737b7014d6aad7d515925099 Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol HTTP/1.1 Server 45.32.66.91 Los Angeles, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 45.32.66.91.vultrusercontent.com Software Apache/2.4.52 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Wed, 31 Jan 2024 07:05:01 GMT Server Apache/2.4.52 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 273 Content-Type text/html; charset=iso-8859-1
GET H2	200	initLoginPage.pack.d05a8c2e6bdf6d212b92af4d6b9cfefe.js Show response ok1static.oktacdn.com/assets/js/mvc/loginpage/	204 KB 76 KB	104ms 24ms	Script application/javascript	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.d05a8c2e6bdf6d212b92af4d6b9cfefe.js Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash bb7b04fe7a146c5260e3f1a82db4c675c3d41f53f0fe4fb7517840cef54f2b0b Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer http://45.32.66.91/ Origin http://45.32.66.91 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:14 GMT x-amz-meta-sha1sum 34f075e4d0f6b20eb712a2053d423869bb60771b content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 e8b17f734954ee4d46d26cf302323482.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 age 1078307 x-cache Hit from cloudfront last-modified Mon, 10 Jul 2023 22:04:34 GMT server nginx etag W/"d05a8c2e6bdf6d212b92af4d6b9cfefe" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id k1bYcpxpfUoIfn099LQ1se8fLJHa0_X-kA2vs_zMgRqS9dUlG7c53w== expires Fri, 17 Jan 2025 19:33:14 GMT
GET H/1.1	200 OK	logo.png 45.32.66.91/img/	15 KB 15 KB	339ms 169ms	Image image/png	45.32.66.91 AS-CHOOPA
General Check archive.org Show headers Download Go to Show image Full URL http://45.32.66.91/img/logo.png Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol HTTP/1.1 Server 45.32.66.91 Los Angeles, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 45.32.66.91.vultrusercontent.com Software Apache/2.4.52 (Ubuntu) / Resource Hash bbb96674bcaa60a79c88037b1f55067588dfeb544ee34302b85c3508ae7d6353 Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Wed, 31 Jan 2024 07:05:01 GMT Last-Modified Sat, 27 Jan 2024 18:06:46 GMT Server Apache/2.4.52 (Ubuntu) ETag "3a9a-60ff146957980" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 15002
GET H2	200	default.png ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/img/security/	2 KB 2 KB	21ms 21ms	Image image/png	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/img/security/default.png Requested by Host: ok1static.oktacdn.com URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Wed, 24 Jan 2024 02:55:54 GMT x-amz-meta-sha1sum 8db73b75bc7547a90aebd1377852ea3bf7cbc5ea via 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront) strict-transport-security max-age=315360000; includeSubDomains x-amz-cf-pop FRA53-C1 age 619747 x-cache Hit from cloudfront content-length 1800 last-modified Mon, 25 Sep 2023 22:40:04 GMT server nginx etag "04eeeba5b3538c4524d8e6828ba2c405" content-type image/png access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id iLNCLd9P8nbikMcis3xyUdYu5n3BD5kZpDFQLVz0h1lE3lySxmI6uA== expires Thu, 23 Jan 2025 02:55:54 GMT
GET H2	200	montserrat-okta-light-webfont.woff ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/	22 KB 22 KB	25ms 24ms	Font application/font-woff	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/montserrat-okta-light-webfont.woff Requested by Host: ok1static.oktacdn.com URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Origin http://45.32.66.91 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:15 GMT x-amz-meta-sha1sum 3449db1ccdfe0aeaf89101cc28ecafaecae9fc89 via 1.1 e8b17f734954ee4d46d26cf302323482.cloudfront.net (CloudFront) strict-transport-security max-age=315360000; includeSubDomains x-amz-cf-pop FRA53-C1 age 1078306 x-cache Hit from cloudfront content-length 22112 last-modified Mon, 25 Sep 2023 22:39:54 GMT server nginx etag "6225f3ca44b83090833064727a09cc95" content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id MGR-Rbz8IPQlvTQKPj3_yxQr__R1JoQ-hPcc8Lo1Z22JujR6X5STEA== expires Fri, 17 Jan 2025 19:33:15 GMT
GET H2	200	montserrat-okta-regular-webfont.woff ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/	21 KB 22 KB	26ms 26ms	Font application/font-woff	143.204.215.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/montserrat-okta-regular-webfont.woff Requested by Host: ok1static.oktacdn.com URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.54 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-54.fra53.r.cloudfront.net Software nginx / Resource Hash 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Origin http://45.32.66.91 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:15 GMT x-amz-meta-sha1sum b838e30072520735c49eda52cb2d3a0f4b30f0f2 via 1.1 e8b17f734954ee4d46d26cf302323482.cloudfront.net (CloudFront) strict-transport-security max-age=315360000; includeSubDomains x-amz-cf-pop FRA53-C1 age 1078306 x-cache Hit from cloudfront content-length 21980 last-modified Mon, 25 Sep 2023 22:39:54 GMT server nginx etag "8f2822b73b5f9c106c6f2e0db820bcbb" content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id 2SDJNjTYyI9F2oGP-8Vsa99JBEH0KVSunlbTnTmfaMTpXNrWqylX1Q== expires Fri, 17 Jan 2025 19:33:15 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Cellular (Telecommunication)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| cspNonce object| regeneratorRuntime function| jQueryCourage object| u2f function| OktaSignIn object| okta object| OktaLogin object| jQBrowser

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://45.32.66.91/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=f991ebb043f05a9393f38ace2d7dafefc25baa57484ea41b8969a14da06b2d45c27314de737b7014d6aad7d515925099 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ok1static.oktacdn.com
143.204.215.54
45.32.66.91
0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
31ec6b02dfe1de9903c0688f4dc9d33bcf49d6fff8003da7a74c3d30b38f13f9
bb7b04fe7a146c5260e3f1a82db4c675c3d41f53f0fe4fb7517840cef54f2b0b
bbb96674bcaa60a79c88037b1f55067588dfeb544ee34302b85c3508ae7d6353
d50a253f61053954ce4ed3f2b8391b3dfcf60acbf74d52a2a9d53b9b18fa94e9
da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434
e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace