s3.us-west-1.amazonaws.com Open in urlscan Pro
52.219.117.160  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request edo25c-870e-444e-a74e-eab09c83784c.html Show response s3.us-west-1.amazonaws.com/set365poliblob.core.windows.net/	3 KB 4 KB	311ms 126ms	Document text/html	52.219.117.160 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.us-west-1.amazonaws.com/set365poliblob.core.windows.net/edo25c-870e-444e-a74e-eab09c83784c.html?add=nowayhose%40gmail.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.219.117.160 San Jose, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-1.amazonaws.com Software AmazonS3 / Resource Hash db578669af15dbbf0ef3148a541d23b1d4db2f601f1a0c73b98294f461e35887 Request headers Accept-Language en-US,en;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes Content-Length 3264 Content-Type text/html Date Thu, 04 Jul 2024 15:14:56 GMT ETag "4dea8c237329675071bf3fa04c70413e" Last-Modified Wed, 03 Jul 2024 21:42:26 GMT Server AmazonS3 x-amz-id-2 6OG904QiVjfkZ38JzSGD6M9TIJ5UUmZ7HgQyJb/g8sBuviqUWlvqz3e47yDNRqZFryFk3PiznR8= x-amz-request-id 5B4ZHRDXBHA5CEJR x-amz-server-side-encryption AES256
GET H3	200	sc.php Show response setbygrace.atlabheattreat.info/graceinbulk/admin/js/	2 KB 2 KB	249ms 148ms	Script application/javascript	2606:4700:3032::6815:6089 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://setbygrace.atlabheattreat.info/graceinbulk/admin/js/sc.php?r=ZW0sZW1haWwsYWRkLGVsZW1lbnRub3Rl Requested by Host: s3.us-west-1.amazonaws.com URL: https://s3.us-west-1.amazonaws.com/set365poliblob.core.windows.net/edo25c-870e-444e-a74e-eab09c83784c.html?add=nowayhose%40gmail.com Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:6089 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f870dcb740912649939c90826e9c020835dc63152f7cff197f540502999d6563 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://s3.us-west-1.amazonaws.com/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 15:14:55 GMT content-encoding gzip cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GR%2BnlEYnlpnOTXr7KGxgVitxYxtYzySo%2FQTc20g9wZFkH5NdjHkWci%2Fxpp7%2Fs08QTf%2BnQzhJIf4qhyl%2BE3UtcOImbUNzU5wmT7eFvT9c8OJ9PmJCrCkfM1ySDULgVUEOgviR1RvHMXMqVgWb2%2FyiqfkkkaqNifmWB5bQe%2BY%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-credentials true cf-ray 89e011579d0441f5-EWR alt-svc h3=":443"; ma=86400 content-length 1055
GET H2	200	off.png wait.inoliketowastetimeoo.pages.dev/	228 KB 229 KB	85ms 34ms	Image image/png	2606:4700:310c::ac42:2ef5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wait.inoliketowastetimeoo.pages.dev/off.png Requested by Host: s3.us-west-1.amazonaws.com URL: https://s3.us-west-1.amazonaws.com/set365poliblob.core.windows.net/edo25c-870e-444e-a74e-eab09c83784c.html?add=nowayhose%40gmail.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2ef5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b9a35dc746d275ed71f610f20bb5c70b7293d1ec60e9534b15c2231bf7dc38c0 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://s3.us-west-1.amazonaws.com/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 15:14:55 GMT referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "d2642c4a90546fed45ba869bb9da9351" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mbYYhCXZIKYVBJ%2BvbZL3TyY1BUrQalbWxVOjSPvLw0GoDpYv9QYJjHdHumFToSAYXGXGEDYSY03yq4vpr%2FS7w5O4MWJfy4ph7k4d4SETJaelk77fDITCdkmpvZciMWMBQUHikf4aG%2B%2B50eLCVzEjdqyV5fQBGdbcPxhcjmL9xUFoCQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=0, must-revalidate x-robots-tag noindex cf-ray 89e011574d9d438a-EWR content-length 233462 alt-svc h3=":443"; ma=86400
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	74ms 10ms	Script application/javascript	2a04:4e42::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: setbygrace.atlabheattreat.info URL: https://setbygrace.atlabheattreat.info/graceinbulk/admin/js/sc.php?r=ZW0sZW1haWwsYWRkLGVsZW1lbnRub3Rl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://s3.us-west-1.amazonaws.com/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 15:14:55 GMT content-encoding gzip via 1.1 varnish age 3835739 x-cache HIT content-length 30070 x-served-by cache-lga21932-LGA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1720106096.512012,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 16295
GET H3	200	crypto-js.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/	47 KB 14 KB	36ms 18ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js Requested by Host: setbygrace.atlabheattreat.info URL: https://setbygrace.atlabheattreat.info/graceinbulk/admin/js/sc.php?r=ZW0sZW1haWwsYWRkLGVsZW1lbnRub3Rl Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://s3.us-west-1.amazonaws.com/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 15:14:55 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 238749 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 14107 last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-bb78" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MjUKZM8wL4ciWvg%2FvFSbWsk6h%2FQczniyOG3rsL1Cia7rqaRYB0Tf7KpmXXj%2FEdsdrx1SrKxUqiW9jIpLvTY7r%2BYdHrWccLAIpfT1wvWsaWrJO%2BbA9SxQLbynioboy%2BtsLnqKVhY%2B8sb7uVT%2FldkZD3JH"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 89e01158ad4f8cec-EWR expires Tue, 24 Jun 2025 15:14:55 GMT
POST H3	200	6f7f6e1.php setbygrace.atlabheattreat.info/graceinbulk/	15 KB 0	1931ms 1916ms	XHR text/html	2606:4700:3032::6815:6089 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://setbygrace.atlabheattreat.info/graceinbulk/6f7f6e1.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:6089 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Accept */* Referer https://s3.us-west-1.amazonaws.com/ sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 15:14:57 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 pragma no-cache server cloudflare vary Accept-Encoding access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS content-type text/html; charset=UTF-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8z5hQ%2FXX83zVSDTmE2Ux8I1WD1%2FepwoVYD51HaxmmrWEsKVAhYySsQSnxtyD8dQuONeofyKyC4qjwQSovGLZ9xRWmpniMTuPT6WPd9Fu1Z2jaeIjApeTKDNWJ6f2AZRH%2F7PSnm%2BuqR8VBO8QDWNoqDkLWqiDI2eIhFXCF2c%3D"}],"group":"cf-nel","max_age":604800} cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true cf-ray 89e01159381143c9-EWR expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	403 Forbidden	favicon.ico s3.us-west-1.amazonaws.com/	243 B 520 B	84ms 84ms	Other application/xml	52.219.117.160 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.us-west-1.amazonaws.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.219.117.160 San Jose, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-1.amazonaws.com Software AmazonS3 / Resource Hash 2f3033378d4bfac2265a545ae16d015402cea6cf0581b2239049924a1761c4fc Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://s3.us-west-1.amazonaws.com/set365poliblob.core.windows.net/edo25c-870e-444e-a74e-eab09c83784c.html?add=nowayhose%40gmail.com Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 04 Jul 2024 15:14:55 GMT Server AmazonS3 x-amz-request-id 5B4Z2BWERBG6HW9M x-amz-id-2 JvHn5gO+ITsKKAbSKYknaofKtTOoFMoEukYFKLenkr3KykbDBiZFtVQMyIYdcabvHvGxdBZgTPM= Transfer-Encoding chunked Content-Type application/xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| decodeBase64 function| changeBackgroundImage function| loadScriptAndChangeBackground object| v4d3df4a6 number| autograb object| ve0c904 object| CryptoJS function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://s3.us-west-1.amazonaws.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
s3.us-west-1.amazonaws.com
setbygrace.atlabheattreat.info
wait.inoliketowastetimeoo.pages.dev
2606:4700:3032::6815:6089
2606:4700:310c::ac42:2ef5
2606:4700::6811:180e
2a04:4e42::649
52.219.117.160
2f3033378d4bfac2265a545ae16d015402cea6cf0581b2239049924a1761c4fc
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
b9a35dc746d275ed71f610f20bb5c70b7293d1ec60e9534b15c2231bf7dc38c0
db578669af15dbbf0ef3148a541d23b1d4db2f601f1a0c73b98294f461e35887
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
f870dcb740912649939c90826e9c020835dc63152f7cff197f540502999d6563