45.32.66.91 Open in urlscan Pro
45.32.66.91  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 45.32.66.91/	10 KB 3 KB	338ms 169ms	Document text/html	45.32.66.91 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL http://45.32.66.91/ Protocol HTTP/1.1 Server 45.32.66.91 Los Angeles, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 45.32.66.91.vultrusercontent.com Software Apache/2.4.52 (Ubuntu) / Resource Hash e7626587ae7dc9d0ca9e98ff052f95f09f5440888aff11fc0731c72922f4f5ee Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 3153 Content-Type text/html Date Tue, 30 Jan 2024 07:09:25 GMT ETag "29a2-6101d5f771680-gzip" Keep-Alive timeout=5, max=100 Last-Modified Mon, 29 Jan 2024 22:43:22 GMT Server Apache/2.4.52 (Ubuntu) Vary Accept-Encoding
GET H2	200	okta-sign-in.min.js Show response ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/js/	2 MB 477 KB	152ms 60ms	Script application/javascript	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/js/okta-sign-in.min.js Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash 0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:14 GMT x-amz-meta-sha1sum 0ebce80c1902181c4eeac9cb6c3cd229f44cadde content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 ae0d2a327c332a4081a71ea179abdd70.cloudfront.net (CloudFront) x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront last-modified Mon, 25 Sep 2023 22:41:04 GMT server nginx etag W/"b065fc11fb7d64a21c36a93e2b9a4c7a" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id lzbPXuy1kufoqqCxM5U2av93ktbxYQC1saEjMtOu5LpIv4K4uXQDsQ== expires Fri, 17 Jan 2025 19:33:14 GMT
GET H2	200	okta-sign-in.min.css ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/	217 KB 37 KB	125ms 33ms	Stylesheet text/css	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash 31ec6b02dfe1de9903c0688f4dc9d33bcf49d6fff8003da7a74c3d30b38f13f9 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:13 GMT x-amz-meta-sha1sum d05ffdde7a9f1a519770c8209de521a2a4fff863 content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 ae0d2a327c332a4081a71ea179abdd70.cloudfront.net (CloudFront) x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront last-modified Mon, 25 Sep 2023 22:39:52 GMT server nginx etag W/"bb726b407a54ee7d118fbfaf8b302895" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id sliOWNmHy-RXq5Pox3Hm-2uRhhN20569-D6F8dEMZrfSGeFXyoLIKA== expires Fri, 17 Jan 2025 19:33:13 GMT
GET H2	200	loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css ok1static.oktacdn.com/assets/loginpage/css/	3 KB 2 KB	148ms 56ms	Stylesheet text/css	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/loginpage/css/loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:14 GMT x-amz-meta-sha1sum db76514c4942184db3baedf6ac119ff9538368fc content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 ae0d2a327c332a4081a71ea179abdd70.cloudfront.net (CloudFront) x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront last-modified Tue, 07 Feb 2023 00:39:41 GMT server nginx etag W/"c1227d73b70be13e51aae80fe238b0ae" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id 44wGp_EcWmVI8WixSCFKwzarANRAwdIvvGu82Y0L49xltQZQP0qO7g== expires Fri, 17 Jan 2025 19:33:14 GMT
GET H/1.1	404 Not Found	style-sheet 45.32.66.91/api/internal/brand/theme/	0 0	169ms 168ms	Stylesheet text/html	45.32.66.91 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL http://45.32.66.91/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=f991ebb043f05a9393f38ace2d7dafefc25baa57484ea41b8969a14da06b2d45c27314de737b7014d6aad7d515925099 Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol HTTP/1.1 Server 45.32.66.91 Los Angeles, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 45.32.66.91.vultrusercontent.com Software Apache/2.4.52 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Tue, 30 Jan 2024 07:09:25 GMT Server Apache/2.4.52 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 273 Content-Type text/html; charset=iso-8859-1
GET H2	200	initLoginPage.pack.d05a8c2e6bdf6d212b92af4d6b9cfefe.js Show response ok1static.oktacdn.com/assets/js/mvc/loginpage/	204 KB 76 KB	125ms 33ms	Script application/javascript	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.d05a8c2e6bdf6d212b92af4d6b9cfefe.js Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash bb7b04fe7a146c5260e3f1a82db4c675c3d41f53f0fe4fb7517840cef54f2b0b Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer http://45.32.66.91/ Origin http://45.32.66.91 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:14 GMT x-amz-meta-sha1sum 34f075e4d0f6b20eb712a2053d423869bb60771b content-encoding gzip strict-transport-security max-age=315360000; includeSubDomains via 1.1 8c6af47a034eacd38f7f934dfc1eaa40.cloudfront.net (CloudFront) x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront last-modified Mon, 10 Jul 2023 22:04:34 GMT server nginx etag W/"d05a8c2e6bdf6d212b92af4d6b9cfefe" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id HMOcL1qA7KselbS8wwZEKp3Du27z6tE3IcD54uabQgWosAqIgWQM2w== expires Fri, 17 Jan 2025 19:33:14 GMT
GET H2	200	fs0jj8gmsafWktwwF357 ok7static.oktacdn.com/fs/bco/1/	7 KB 8 KB	132ms 53ms	Image image/png	18.65.39.13 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok7static.oktacdn.com/fs/bco/1/fs0jj8gmsafWktwwF357 Requested by Host: 45.32.66.91 URL: http://45.32.66.91/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.65.39.13 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-65-39-13.ams1.r.cloudfront.net Software nginx / Resource Hash 8f3a0dea62e5870beb1447f6076ddbec080e2ecf6fbe751419f32a6ce3f49203 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer http://45.32.66.91/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 29 Jan 2024 11:39:27 GMT strict-transport-security max-age=315360000; includeSubDomains via 1.1 045d55468661252b6be78e701e36b492.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P1 age 70198 x-cache Hit from cloudfront content-length 7499 last-modified Mon, 27 Jun 2022 18:40:51 GMT server nginx etag "8b3e3dd0c6a0e86390e47606d28bfc1f" content-type image/png access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id Jre_6ytBojAO9cdPIta9bl5iT6x-c99K4_McUkgxrT__unn5h3sZKA== expires Tue, 28 Jan 2025 11:39:27 GMT
GET H2	200	default.png ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/img/security/	2 KB 2 KB	29ms 29ms	Image image/png	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/img/security/default.png Requested by Host: ok1static.oktacdn.com URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:15 GMT x-amz-meta-sha1sum 8db73b75bc7547a90aebd1377852ea3bf7cbc5ea via 1.1 ae0d2a327c332a4081a71ea179abdd70.cloudfront.net (CloudFront) strict-transport-security max-age=315360000; includeSubDomains x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront content-length 1800 last-modified Mon, 25 Sep 2023 22:40:04 GMT server nginx etag "04eeeba5b3538c4524d8e6828ba2c405" content-type image/png access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id FD5L1qon5cs-eF9yJpvJAFKp7quhEHD4wf2sKpgocVJesHJaQN7O-w== expires Fri, 17 Jan 2025 19:33:15 GMT
GET H2	200	montserrat-okta-light-webfont.woff ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/	22 KB 22 KB	32ms 32ms	Font application/font-woff	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/montserrat-okta-light-webfont.woff Requested by Host: ok1static.oktacdn.com URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Origin http://45.32.66.91 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:15 GMT x-amz-meta-sha1sum 3449db1ccdfe0aeaf89101cc28ecafaecae9fc89 via 1.1 8c6af47a034eacd38f7f934dfc1eaa40.cloudfront.net (CloudFront) strict-transport-security max-age=315360000; includeSubDomains x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront content-length 22112 last-modified Mon, 25 Sep 2023 22:39:54 GMT server nginx etag "6225f3ca44b83090833064727a09cc95" content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id MeUXHKSvbpzO33CR0E_imWqkuDrelXEbvATW5fANkK6n81c0gvoUhQ== expires Fri, 17 Jan 2025 19:33:15 GMT
GET H2	200	montserrat-okta-regular-webfont.woff ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/	21 KB 22 KB	35ms 34ms	Font application/font-woff	18.239.36.20 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/font/montserrat-okta-regular-webfont.woff Requested by Host: ok1static.oktacdn.com URL: https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.239.36.20 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-239-36-20.ams58.r.cloudfront.net Software nginx / Resource Hash 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.10.1/css/okta-sign-in.min.css Origin http://45.32.66.91 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Thu, 18 Jan 2024 19:33:15 GMT x-amz-meta-sha1sum b838e30072520735c49eda52cb2d3a0f4b30f0f2 via 1.1 8c6af47a034eacd38f7f934dfc1eaa40.cloudfront.net (CloudFront) strict-transport-security max-age=315360000; includeSubDomains x-amz-cf-pop AMS58-P2 age 992171 x-cache Hit from cloudfront content-length 21980 last-modified Mon, 25 Sep 2023 22:39:54 GMT server nginx etag "8f2822b73b5f9c106c6f2e0db820bcbb" content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id oL1qz4G-4uH4cj0K0BvGKD8RVJFqC6lvBnSht7bVdP9PKjVHEV-5Xw== expires Fri, 17 Jan 2025 19:33:15 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mailgun (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| cspNonce object| regeneratorRuntime function| jQueryCourage object| u2f function| OktaSignIn object| okta object| OktaLogin object| jQBrowser

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://45.32.66.91/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=f991ebb043f05a9393f38ace2d7dafefc25baa57484ea41b8969a14da06b2d45c27314de737b7014d6aad7d515925099 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ok1static.oktacdn.com
ok7static.oktacdn.com
18.239.36.20
18.65.39.13
45.32.66.91
0acb0fc9762e4359f562794011d77317c78f7b68cec08b715d98ed16ba761fac
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
31ec6b02dfe1de9903c0688f4dc9d33bcf49d6fff8003da7a74c3d30b38f13f9
8f3a0dea62e5870beb1447f6076ddbec080e2ecf6fbe751419f32a6ce3f49203
bb7b04fe7a146c5260e3f1a82db4c675c3d41f53f0fe4fb7517840cef54f2b0b
da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434
e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51
e7626587ae7dc9d0ca9e98ff052f95f09f5440888aff11fc0731c72922f4f5ee
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace