proposal-file008.s3.amazonaws.com Open in urlscan Pro
16.182.38.145 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://surl.li/skwis
Effective URL:
https://proposal-file008.s3.amazonaws.com/index3x.html
Submission: On April 09 via manual (April 9th 2024, 5:58:15 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 16.182.38.145, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is proposal-file008.s3.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on October 10th 2023. Valid for: 9 months.

This is the only time proposal-file008.s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::681a:513	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	16.182.38.145 16.182.38.145	16509 (AMAZON-02) (AMAZON-02)
9	2607:f8b0:400... 2607:f8b0:4006:80b::200a	15169 (GOOGLE) (GOOGLE)
2	142.250.64.106 142.250.64.106	15169 (GOOGLE) (GOOGLE)
12	4

1 2606:4700:20::681a:513 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

surl.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 16.182.38.145 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

proposal-file008.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:80b::200a (United States)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.64.106 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s31-in-f10.1e100.net

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	googleapis.com firebasestorage.googleapis.com — Cisco Umbrella Rank: 5514	488 KB
1	amazonaws.com proposal-file008.s3.amazonaws.com	30 KB
1	surl.li 1 redirects surl.li — Cisco Umbrella Rank: 893494	1 KB
12	3

	Domain	Requested by
11	firebasestorage.googleapis.com	proposal-file008.s3.amazonaws.com
1	proposal-file008.s3.amazonaws.com
1	surl.li	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.amazonaws.com Amazon RSA 2048 M01	`2023-10-10` - `2024-07-03`	9 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://proposal-file008.s3.amazonaws.com/index3x.html
Frame ID: 0A500ED1424D20037EB36F249A010F66
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in

Page URL History Show full URLs

http://surl.li/skwis HTTP 307
https://surl.li/skwis HTTP 301
https://proposal-file008.s3.amazonaws.com/index3x.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

518 kB
Transfer

518 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://surl.li/skwis HTTP 307
https://surl.li/skwis HTTP 301
https://proposal-file008.s3.amazonaws.com/index3x.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index3x.html Show response proposal-file008.s3.amazonaws.com/ Redirect Chain http://surl.li/skwis https://surl.li/skwis https://proposal-file008.s3.amazonaws.com/index3x.html	29 KB 30 KB	149ms 50ms	Document text/html	16.182.38.145 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://proposal-file008.s3.amazonaws.com/index3x.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 16.182.38.145 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `2e3342967b98769f76798cc11855f12e0abe7bbdd3199fa75340538b941cf813` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-Ranges bytes Content-Length 29851 Content-Type text/html Date Tue, 09 Apr 2024 17:58:07 GMT ETag "26aa4d31be92dd1eb3a8684c2ecf630c" Last-Modified Tue, 09 Apr 2024 16:43:25 GMT Server AmazonS3 x-amz-id-2 aUplopIPXYwFzDCAH3egEidE0aE86/FaVJ+4bMDHO8aDS6pFwayxllvVqCBZgNl07EY8lJ3ipIg= x-amz-request-id NAKQQJ12DHQ07TRV x-amz-server-side-encryption AES256 x-amz-version-id ihp6iUYjqV32HOOuTl5ijwR.dbzkNcDj Redirect headers cf-cache-status DYNAMIC cf-ray 871c622179684bc9-BUF content-type text/html date Tue, 09 Apr 2024 17:58:06 GMT location https://proposal-file008.s3.amazonaws.com/index3x.html nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V2EEBC4P4B1YO4cCCnEApgEaeRmWWNtaeRPoZi1wUVl3Wbt2WQpGAliV4a2mpXejtZPc%2BoO%2F2J7Qo6aDUVy4KG6wk7KWzMv6qpte8f7vb1iUzYxqh0Y0e2GwjUjGfSMxFF9FsAs%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options SAMEORIGIN x-powered-by PHP/8.2.15
GET H2	200	bootstrap.min.css firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	141 KB 142 KB	2945ms 2869ms	Stylesheet text/css	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/bootstrap.min.css?alt=media&token=1c96563c-dfb6-43f5-ab4a-8a0e9354af83 Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:09 GMT x-guploader-uploadid ABPtcPrQxvIwhljJRMU_XIGTp5bAAcbZHne1stuucQP12Fwam7VXD7-g5152ibh_LLjOmLWoGcw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''bootstrap.min.css alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 144877 last-modified Fri, 25 Feb 2022 11:13:43 GMT server UploadServer etag "450fc463b8b1a349df717056fbb3e078" x-goog-generation 1645787623293879 content-type text/css x-goog-hash crc32c=MMBbVA==, md5=RQ/EY7ixo0nfcXBW+7PgeA== cache-control private, max-age=0 x-goog-stored-content-length 144877 x-goog-meta-firebasestoragedownloadtokens 1c96563c-dfb6-43f5-ab4a-8a0e9354af83 accept-ranges bytes expires Tue, 09 Apr 2024 17:58:09 GMT
GET H2	200	all.css firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	52 KB 53 KB	2144ms 2068ms	Stylesheet text/css	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/all.css?alt=media&token=cb0c01e8-b8c9-42f0-8469-6998e2e85f36 Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `ee9dfe22eff777bc4f3a91c5291755046dd933ccf0c8a2e2d193982905f1c558` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:08 GMT x-guploader-uploadid ABPtcPrL08eFTivPeDYs2Sn96KehdWUjqvxBCflw2z7YrHR2cDk3pAXLHHCNKEZgXsjE7xowvpY x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''all.css alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 53745 last-modified Fri, 25 Feb 2022 11:13:27 GMT server UploadServer etag "12ee2a8b66fb4d5e1bd16b7ff5c2d73d" x-goog-generation 1645787607290065 content-type text/css x-goog-hash crc32c=+oDPrg==, md5=Eu4qi2b7TV4b0Wt/9cLXPQ== cache-control private, max-age=0 x-goog-stored-content-length 53745 x-goog-meta-firebasestoragedownloadtokens cb0c01e8-b8c9-42f0-8469-6998e2e85f36 accept-ranges bytes expires Tue, 09 Apr 2024 17:58:08 GMT
GET H2	200	app.css firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	1 KB 2 KB	2086ms 2011ms	Stylesheet text/css	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/app.css?alt=media&token=0bf671f3-c2c4-4ba5-8924-0438602757e8 Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `a6972131a0103b925fd83a7ad5320d31bb9d521cad6dd8b5207cc78a18386019` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:08 GMT x-guploader-uploadid ABPtcPqKpbZw_yX9g-oGtW9iKgK5Ys40USBhf9KKreleOLLCvnFMWnuaiHg1rS7iRHjnHK9sIs4 x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''app.css alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1107 last-modified Fri, 25 Feb 2022 11:13:05 GMT server UploadServer etag "0a89794db770f27b9d1ce1d8780e43b0" x-goog-generation 1645787585627077 content-type text/css x-goog-hash crc32c=1sUY3w==, md5=Col5Tbdw8nudHOHYeA5DsA== cache-control private, max-age=0 x-goog-stored-content-length 1107 x-goog-meta-firebasestoragedownloadtokens 0bf671f3-c2c4-4ba5-8924-0438602757e8 accept-ranges bytes expires Tue, 09 Apr 2024 17:58:08 GMT
GET H2	200	dot.svg firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	900 B 1 KB	2196ms 2121ms	Image image/svg+xml	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/dot.svg?alt=media&token=f4bddc0b-7f13-4495-a87b-b428d1ffc5ec Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `61d7ccc5d2c41bf86be6cefb0063405067849ba64e9f219f60596ef09a54a942` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:08 GMT x-guploader-uploadid ABPtcPqJjbVdlvs1yMAJ3wBwG62Iyy011HUUf4tHwVpPW-RPBtqoBXOKaH_h4efCL8gupuSYbSk x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''dot.svg alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 900 last-modified Fri, 25 Feb 2022 11:13:05 GMT server UploadServer etag "635a63d500a92a0b8497cdc58d0f66b1" x-goog-generation 1645787585586580 content-type image/svg+xml x-goog-hash crc32c=gOtD/Q==, md5=Y1pj1QCpKguEl83FjQ9msQ== cache-control private, max-age=0 x-goog-stored-content-length 900 x-goog-meta-firebasestoragedownloadtokens f4bddc0b-7f13-4495-a87b-b428d1ffc5ec accept-ranges bytes expires Tue, 09 Apr 2024 17:58:08 GMT
GET H2	200	logo.svg firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	4 KB 4 KB	2106ms 2031ms	Image image/svg+xml	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/logo.svg?alt=media&token=e407753b-303e-414f-8421-18793929721a Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:08 GMT x-guploader-uploadid ABPtcPoNB1Olm71aOPrXQPLkOf_qgO2u1U_0GqTz919nOYTbanHtUMer_wPZUNiW-Ol4eyPYdlA x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''logo.svg alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3651 last-modified Fri, 25 Feb 2022 11:13:08 GMT server UploadServer etag "ee5c8d9fb6248c938fd0dc19370e90bd" x-goog-generation 1645787588144308 content-type image/svg+xml x-goog-hash crc32c=c/EO4g==, md5=7lyNn7YkjJOP0NwZNw6QvQ== cache-control private, max-age=0 x-goog-stored-content-length 3651 x-goog-meta-firebasestoragedownloadtokens e407753b-303e-414f-8421-18793929721a accept-ranges bytes expires Tue, 09 Apr 2024 17:58:08 GMT
GET H2	200	arrow.svg firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	513 B 800 B	2075ms 2024ms	Image image/svg+xml	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/arrow.svg?alt=media&token=b37114ca-28e7-4c0e-83a0-a774e4997036 Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:08 GMT x-guploader-uploadid ABPtcPrf2AfEhV8U3xP2IEJsvkA_ThJrMNWn6XUw8Rx2GS7foIZSKZ33Hop1IU12EwxC2H2ZaB8 x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''arrow.svg alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 513 last-modified Fri, 25 Feb 2022 11:13:05 GMT server UploadServer etag "a9cc2824ef3517b6c4160dcf8ff7d410" x-goog-generation 1645787585993468 content-type image/svg+xml x-goog-hash crc32c=m5iFlQ==, md5=qcwoJO81F7bEFg3Pj/fUEA== cache-control private, max-age=0 x-goog-stored-content-length 513 x-goog-meta-firebasestoragedownloadtokens b37114ca-28e7-4c0e-83a0-a774e4997036 accept-ranges bytes expires Tue, 09 Apr 2024 17:58:08 GMT
GET H2	200	documentation_9628e22a6bfb1edc59e81064a666b614.png firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	355 B 674 B	1072ms 1071ms	Image image/png	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/documentation_9628e22a6bfb1edc59e81064a666b614.png?alt=media&token=87d4a96e-246a-450e-a903-fccf5474be03 Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `85eb7e94db9425fd39e3a6d89e5abaf398611529a3d25d078015cc11e055260b` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:09 GMT x-guploader-uploadid ABPtcPoIS9P_6epuRhSqUf1o4g0zDYmAOR-gyTebMGwB4h-AfMcZDXYQ0x2TBsJcFNHDGFzKTOA x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''documentation_9628e22a6bfb1edc59e81064a666b614.png alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 355 last-modified Fri, 25 Feb 2022 11:13:05 GMT server UploadServer etag "9628e22a6bfb1edc59e81064a666b614" x-goog-generation 1645787585531599 content-type image/png x-goog-hash crc32c=/kujnA==, md5=lijiKmv7HtxZ6BBkpma2FA== cache-control private, max-age=0 x-goog-stored-content-length 355 x-goog-meta-firebasestoragedownloadtokens 87d4a96e-246a-450e-a903-fccf5474be03 accept-ranges bytes expires Tue, 09 Apr 2024 17:58:09 GMT
GET DATA	200 OK	truncated /	4 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9abab0b217d4a65f16b3a0ecc5b0dd87595ef96fda07c4746f0dc5e52785060d` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET H2	200	bootstrap.min.js Show response firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	48 KB 48 KB	2105ms 2057ms	Script text/javascript	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/bootstrap.min.js?alt=media&token=e680762d-20fa-47ed-8053-924b4c7f2ea2 Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:08 GMT x-guploader-uploadid ABPtcPpDAjIMaYaJYFRWcqsMqWVQiJmg16UUZcvKE5PSRq7RO_WkFPWGmDkFeHFgdWxrP1sc-qU x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''bootstrap.min.js alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48944 last-modified Fri, 25 Feb 2022 11:13:24 GMT server UploadServer etag "14d449eb8876fa55e1ef3c2cc52b0c17" x-goog-generation 1645787604595937 content-type text/javascript x-goog-hash crc32c=+p811g==, md5=FNRJ64h2+lXh7zwsxSsMFw== cache-control private, max-age=0 x-goog-stored-content-length 48944 x-goog-meta-firebasestoragedownloadtokens e680762d-20fa-47ed-8053-924b4c7f2ea2 accept-ranges bytes expires Tue, 09 Apr 2024 17:58:08 GMT
GET H2	200	jquery.min.js Show response firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	84 KB 84 KB	2069ms 2069ms	Script text/javascript	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/jquery.min.js?alt=media&token=66434016-e900-478c-a3ff-4a853006615a Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:10 GMT x-guploader-uploadid ABPtcPrxgh_FSjpUnBqHTVHJo104Mkd7tjJzQvS3SWxVqebQmOU6bDARGwL7FpTXFD22WygTwa0 x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''jquery.min.js alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 85578 last-modified Fri, 25 Feb 2022 11:13:38 GMT server UploadServer etag "2f6b11a7e914718e0290410e85366fe9" x-goog-generation 1645787618401780 content-type text/javascript x-goog-hash crc32c=eY3dRA==, md5=L2sRp+kUcY4CkEEOhTZv6Q== cache-control private, max-age=0 x-goog-stored-content-length 85578 x-goog-meta-firebasestoragedownloadtokens 66434016-e900-478c-a3ff-4a853006615a accept-ranges bytes expires Tue, 09 Apr 2024 17:58:10 GMT
GET H3	200	image-modified.png firebasestorage.googleapis.com/v0/b/trtm-fe451.appspot.com/o/	136 KB 137 KB	476ms 476ms	Image image/png	142.250.64.106 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://firebasestorage.googleapis.com/v0/b/trtm-fe451.appspot.com/o/image-modified.png?alt=media&token=1ec00bb9-0333-4c6b-ae27-abf74c8a2a1d Requested by Host: proposal-file008.s3.amazonaws.com URL: https://proposal-file008.s3.amazonaws.com/index3x.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.64.106 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s31-in-f10.1e100.net Software UploadServer / Resource Hash `dba7afee52c3959e0fcd2434e57285e993a99eb768a923c2323234a434e97db7` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:10 GMT x-guploader-uploadid ABPtcPoNdYFzhQRSfQ9CzDikkJD0cRBmAw8dONUxZXMLZoHSkbTUO2oijhBB6Lz6baNOgQ7hyZI x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''image-modified.png alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 139712 last-modified Mon, 28 Feb 2022 04:00:57 GMT server UploadServer etag "11663e58a7fd5a812f26942115b358b8" x-goog-generation 1646020857501970 content-type image/png x-goog-hash crc32c=fvz0Ag==, md5=EWY+WKf9WoEvJpQhFbNYuA== cache-control private, max-age=0 x-goog-stored-content-length 139712 x-goog-meta-firebasestoragedownloadtokens 1ec00bb9-0333-4c6b-ae27-abf74c8a2a1d accept-ranges bytes expires Tue, 09 Apr 2024 17:58:10 GMT
GET H3	200	icon.ico firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/	17 KB 17 KB	2895ms 2894ms	Other image/x-icon	142.250.64.106 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/angus-4128d.appspot.com/o/icon.ico?alt=media&token=b4bba35f-95c7-42c8-87d8-92e37bba728d Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.64.106 Plainview, United States, ASN15169 (GOOGLE, US), Reverse DNS lga34s31-in-f10.1e100.net Software UploadServer / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proposal-file008.s3.amazonaws.com/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 09 Apr 2024 17:58:14 GMT x-guploader-uploadid ABPtcPpO9MB_4Am0nZels-jkfrWyzgV4-IZLIMTRRXfPtBxm-AlsabplRzZPDBUD54sKR3bbV44 x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename=utf-8''icon.ico alt-svc* h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17174 last-modified Fri, 25 Feb 2022 11:13:08 GMT server UploadServer etag "12e3dac858061d088023b2bd48e2fa96" x-goog-generation 1645787588159698 content-type image/x-icon x-goog-hash crc32c=cY8cYA==, md5=EuPayFgGHQiAI7K9SOL6lg== cache-control private, max-age=0 x-goog-stored-content-length 17174 x-goog-meta-firebasestoragedownloadtokens b4bba35f-95c7-42c8-87d8-92e37bba728d accept-ranges bytes expires Tue, 09 Apr 2024 17:58:14 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			surl.li/	1970-01-20 19:44:52	Name: XSRF-TOKEN Value: eyJpdiI6IlQ2bnV1c29oN1luL2ZROXlESDNiQXc9PSIsInZhbHVlIjoiUUNNMVBEUFU0eTNJckVIYjEyRm5QYitrMmkyK1BoVFgrY2ZtazZUSE0rU1BHWEdWcGhrTlZGeWY0K0I0L2FvZ1FFV3I1cVBjUHlqRmRUei9uNmxBUHJTZytOUU8wRnYwb3NSR3ZlWVRXMzRnVWRiRUx0SjA4OUVhc29FYm5BL1QiLCJtYWMiOiI5NDc3MjdjZWJiYTZhODdhNzBkYzI1ODViNmRlZTVkNDQ4NTNhZWI1ZTZjNzMzNjBiM2JiZDQyMWIxOGFkOTVmIiwidGFnIjoiIn0%3D
			surl.li/	1970-01-20 19:44:52	Name: surli_application_session Value: eyJpdiI6Ijl2ekJSSk9ENW03eTZrdmw1Y3BqdFE9PSIsInZhbHVlIjoiNDMra21ZQTFmVHBaUUxsTEJPV0gyNkFaZ2VwWEJrMDJENlQyVjFmRHJCWTF2WDMyYVBtcndaOGFJUVcwT2d4UllXcnFreGdwSjg3UkE1VnZaMWZsRzE3UGxueGU3aTZHSXZ1cytRaWRWdXY4ZzNxUTROLzQrSG5KL0wxV25qMkciLCJtYWMiOiI0Yjg5OGQ2ODRiMDcxZDJjZjg5NWRhZmY3MmQ5MzA5OTIyYTQzNzVjMDUyMzUzZjU5Yzk2NjM4NzE3NjVlNmUyIiwidGFnIjoiIn0%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://proposal-file008.s3.amazonaws.com/index3x.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

firebasestorage.googleapis.com
proposal-file008.s3.amazonaws.com
surl.li
142.250.64.106
16.182.38.145
2606:4700:20::681a:513
2607:f8b0:4006:80b::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
2e3342967b98769f76798cc11855f12e0abe7bbdd3199fa75340538b941cf813
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
61d7ccc5d2c41bf86be6cefb0063405067849ba64e9f219f60596ef09a54a942
85eb7e94db9425fd39e3a6d89e5abaf398611529a3d25d078015cc11e055260b
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
9abab0b217d4a65f16b3a0ecc5b0dd87595ef96fda07c4746f0dc5e52785060d
a6972131a0103b925fd83a7ad5320d31bb9d521cad6dd8b5207cc78a18386019
dba7afee52c3959e0fcd2434e57285e993a99eb768a923c2323234a434e97db7
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
ee9dfe22eff777bc4f3a91c5291755046dd933ccf0c8a2e2d193982905f1c558

proposal-file008.s3.amazonaws.com Open in urlscan Pro 16.182.38.145 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

518 kBTransfer

518 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

proposal-file008.s3.amazonaws.com Open in urlscan Pro
16.182.38.145 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

518 kB
Transfer

518 kB
Size

2
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!