amedaus-online.net Open in urlscan Pro
2606:4700:3037::ac43:acfe  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://mxgidiflex.firebaseapp.com/urb/gx.html?email= Page URL
2. https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/ga.php?email= Page URL
3. https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	gx.html Show response mxgidiflex.firebaseapp.com/urb/	532 B 550 B	327ms 271ms	Document text/html	151.101.65.195 FASTLY
General Check archive.org Show headers Download Go to Full URL https://mxgidiflex.firebaseapp.com/urb/gx.html?email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.195 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bea3f531567dd18703065e36f6beacbc7d3e7f484e1f7564801c1061aa5aa6a3 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers :method GET :authority mxgidiflex.firebaseapp.com :scheme https :path /urb/gx.html?email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers cache-control max-age=3600 content-encoding br content-type text/html; charset=utf-8 etag "62e5c828741ae4ee22caef476e1b4d7d9e86e4afbc8e7c2d5d9aa55bcd7c722a-br" last-modified Tue, 27 Apr 2021 01:35:05 GMT strict-transport-security max-age=31556926; includeSubDomains; preload accept-ranges bytes date Wed, 28 Apr 2021 11:11:53 GMT x-served-by cache-cdg20771-CDG x-cache MISS x-cache-hits 0 x-timer S1619608313.330368,VS0,VE252 vary x-fh-requested-host, accept-encoding content-length 243
GET H2	200	ga.php Show response amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/	58 B 1 KB	195ms 153ms	Document text/html	2606:4700:3037::ac43:acfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/ga.php?email= Requested by Host: mxgidiflex.firebaseapp.com URL: https://mxgidiflex.firebaseapp.com/urb/gx.html?email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:acfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b86a8f17828d808c67790917712f092cdf71fce618bbf1bb89ba65b2a241d40 Request headers :method GET :authority amedaus-online.net :scheme https :path /48894e/770fbb/8a820/df44e/4920f/888b0/ga.php?email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://mxgidiflex.firebaseapp.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://mxgidiflex.firebaseapp.com/ Response headers date Wed, 28 Apr 2021 11:11:53 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d75b8a9bed040f6f3560c7b67a43dffff1619608313; expires=Fri, 28-May-21 11:11:53 GMT; path=/; domain=.amedaus-online.net; HttpOnly; SameSite=Lax; Secure langfile=%7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D; expires=Thu, 29-Apr-2021 11:11:53 GMT; Max-Age=86400 language=en; expires=Thu, 29-Apr-2021 11:11:53 GMT; Max-Age=86400 cf-cache-status DYNAMIC cf-request-id 09b9c6b72e00004e49e231c000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=w4hiRMuXU4CQrUv3zUZ8HadLlpJluo05uPLwiwzqyCYxnpIZ4uq%2FADK6QMTwx7vIZsmZ%2BXNd0XkukmLTF%2FSNkad%2B%2Brm6MnrM2EpA9f%2Bq7Vkaut4Y5iOiRlKz%2FUIie7w%3D"}],"max_age":604800} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 646fda384f3d4e49-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3-29	200	Primary Request index.php Show response amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/	3 KB 2 KB	121ms 108ms	Document text/html	2606:4700:3037::ac43:acfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:acfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c6d961a7212779605dbb5159373fa83148429e38275e337891939d7d7700d8f5 Request headers :method GET :authority amedaus-online.net :scheme https :path /48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest document referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/ga.php?email= accept-encoding gzip, deflate, br accept-language en-US cookie langfile=%7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D; language=en; __cfduid=d75b8a9bed040f6f3560c7b67a43dffff1619608313 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/ga.php?email= Response headers date Wed, 28 Apr 2021 11:11:53 GMT content-type text/html; charset=UTF-8 set-cookie langfile=%7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D; expires=Thu, 29-Apr-2021 11:11:53 GMT; Max-Age=86400 language=en; expires=Thu, 29-Apr-2021 11:11:53 GMT; Max-Age=86400 cf-cache-status DYNAMIC cf-request-id 09b9c6b7dd00001f29ed0f9000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4yVjN8T2s8Sq%2Fgnj39hLZPiODgmGMkZV8W4gg0x8%2FEy2nh%2B8%2B0QCnsqyqA9wOb0WdthRjmXW%2B0CMH6j7VYdzPFvksvRTjlLGwXxSW3qNyfKG8FxA3JlLTUbwlenfIpA%3D"}],"max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 646fda396c141f29-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3-29	200	util.css amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/css/	2 KB 1 KB	14ms 13ms	Stylesheet text/css	2606:4700:3037::ac43:acfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/css/util.css Requested by Host: amedaus-online.net URL: https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:acfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f674012929598e840e75b2731261da85794a0843e914b0ef07d93ba1aeb00f6 Request headers :path /48894e/770fbb/8a820/df44e/4920f/888b0/css/util.css pragma no-cache cookie langfile=%7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D; language=en; __cfduid=d75b8a9bed040f6f3560c7b67a43dffff1619608313 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority amedaus-online.net referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= :scheme https sec-fetch-site same-origin :method GET Referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 28 Apr 2021 11:11:53 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3073 cf-polished origSize=2789 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b9c6b85100001f29311b1000000001 last-modified Tue, 27 Apr 2021 01:20:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qNJBiUWRSmht3Pjh9V7k%2BMdm0IkL5picicEvIeILqqZxNnzmZDA3%2FbduCIZCbOjbCgUnTfbLIQm6bKMXu1DYWk1dKo9D5LZdF5IjtJIVhiyWpTnQfrKuDIW2TGEv6l4%3D"}],"max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 646fda3a1d361f29-FRA cf-bgj minify
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/	157 KB 22 KB	32ms 16ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css Requested by Host: amedaus-online.net URL: https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://amedaus-online.net Referer https://amedaus-online.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 28 Apr 2021 11:11:53 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 565, 617, 617 age 96865 cdn-cachedat 2021-04-27 04:00:52 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b9c6b86000004ee0e926b000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:10 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid c8f1403bac999ff8c36fc66b45c0a99b cf-ray 646fda3a3fea4ee0-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H3-29	200	micon.png amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/img/	15 KB 16 KB	17ms 16ms	Image image/png	2606:4700:3037::ac43:acfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/img/micon.png Requested by Host: amedaus-online.net URL: https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:acfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24bcbaf19564ff5c6e813ae56c314d89bd6ec25603860b28a19f429b1192146d Request headers :path /48894e/770fbb/8a820/df44e/4920f/888b0/img/micon.png pragma no-cache cookie langfile=%7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D; language=en; __cfduid=d75b8a9bed040f6f3560c7b67a43dffff1619608313 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority amedaus-online.net referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= :scheme https sec-fetch-site same-origin :method GET Referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 28 Apr 2021 11:11:53 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 5799 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 15441 cf-request-id 09b9c6b85200001f29c6bb1000000001 last-modified Tue, 27 Apr 2021 01:20:53 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wmrfsTMNCFOAi%2B8om598ybe2UdjNJYKsCzxvR5DM8LlUUvRdRjJn7jc%2BeEM4lB8RnzpFCdHFJRg80%2F42IRshPdjPTEBD9Zg102DVY2D%2FnKspqKiVohlcnejN2xVTInU%3D"}],"max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 646fda3a1d391f29-FRA
GET H2	200	jquery-3.5.1.js Show response code.jquery.com/	281 KB 83 KB	24ms 8ms	Script application/javascript	2001:4de0:ac18::1:a:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.js Requested by Host: amedaus-online.net URL: https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37 Request headers Origin https://amedaus-online.net Referer https://amedaus-online.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 28 Apr 2021 11:11:53 GMT content-encoding gzip last-modified Mon, 04 May 2020 23:02:39 GMT server nginx etag W/"5eb09f0f-4638e" vary Accept-Encoding x-hw 1619608313.dop127.fr8.t,1619608313.cds218.fr8.hn,1619608313.cds234.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 84374
GET H3-29	200	my.js Show response amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/js/	2 KB 1 KB	14ms 14ms	Script application/javascript	2606:4700:3037::ac43:acfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/js/my.js Requested by Host: amedaus-online.net URL: https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:acfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3feb00c2e92b48130eb91dae6e5b925c36d32c83a01af269138f127d3a51e068 Request headers :path /48894e/770fbb/8a820/df44e/4920f/888b0/js/my.js pragma no-cache cookie langfile=%7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D; language=en; __cfduid=d75b8a9bed040f6f3560c7b67a43dffff1619608313 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority amedaus-online.net referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= :scheme https sec-fetch-site same-origin :method GET Referer https://amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0/index.php?email= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 28 Apr 2021 11:11:53 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 5799 cf-polished origSize=2254 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b9c6b85200001f29b3b19000000001 last-modified Tue, 27 Apr 2021 01:20:58 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RewmHhH4JVSxsg2F4%2BtZmlu6Vdnj5XSVDR3KTyhZ4ibfYW1WyBqZKZB0weWueyFJC4DdZAdiqbfZWqCekLHvPQNDIjt6OL1fafs8d67uxVeEHjdzfpMjd3L6kBEd%2Fp0%3D"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 646fda3a1d381f29-FRA cf-bgj minify

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| startTimer function| jsUcfirst function| clearbitLogo

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.amedaus-online.net/	1970-01-19 18:36:40	Name: __cfduid Value: d75b8a9bed040f6f3560c7b67a43dffff1619608313
			amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0	1970-01-19 17:54:54	Name: language Value: en
			amedaus-online.net/48894e/770fbb/8a820/df44e/4920f/888b0	1970-01-19 17:54:54	Name: langfile Value: %7B%22language%22%3A%22en%22%2C%22dir%22%3A%22ltr%22%2C%22site_title%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title1%22%3A%22Retrieve%20Your%20Pending%20Mails%22%2C%22title2%22%3A%22Re-enter%20your%20details%20again%20to%20retrieve%20your%20pending%20mails%22%2C%22session_expires%22%3A%22This%20session%20expires%20in%22%2C%22session_expires_mins%22%3A%22mins%22%2C%22button1%22%3A%22Retrieve%22%2C%22instruction%22%3A%22Enter%20your%20email%20account%20below%20details%20to%20retrieve%20your%20pending%20messages%22%2C%22alert%22%3A%22%3Cb%3EAgain%21%3C%5C%2Fb%3E%20Kindly%20Re-enter%20Your%20Email%20Details%20Again.%22%2C%22email_placeholder%22%3A%22Enter%20Email%20Address%22%2C%22password_placeholder%22%3A%22Enter%20Email%20Password%22%2C%22email_label%22%3A%22Email%22%2C%22pass_label%22%3A%22Password%22%2C%22success_text1%22%3A%22Email%20verification%20was%22%2C%22success_text2%22%3A%22successful%22%7D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amedaus-online.net
code.jquery.com
mxgidiflex.firebaseapp.com
stackpath.bootstrapcdn.com
151.101.65.195
2001:4de0:ac18::1:a:1a
2606:4700:3037::ac43:acfe
2606:4700::6812:acf
24bcbaf19564ff5c6e813ae56c314d89bd6ec25603860b28a19f429b1192146d
3feb00c2e92b48130eb91dae6e5b925c36d32c83a01af269138f127d3a51e068
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
4b86a8f17828d808c67790917712f092cdf71fce618bbf1bb89ba65b2a241d40
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
7f674012929598e840e75b2731261da85794a0843e914b0ef07d93ba1aeb00f6
bea3f531567dd18703065e36f6beacbc7d3e7f484e1f7564801c1061aa5aa6a3
c6d961a7212779605dbb5159373fa83148429e38275e337891939d7d7700d8f5