urlscan.io logo urlscan.io
SecurityTrails logo

malicious.swgt.io Open in urlscan Pro
44.199.92.62  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://malicious.swgt.io/
Effective URL: https://malicious.swgt.io/login.jsp
Submission: On December 22 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 32 HTTP transactions. The main IP is 44.199.92.62, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is malicious.swgt.io.
TLS certificate: Issued by Amazon RSA 2048 M02 on June 22nd 2023. Valid for: a year.
This is the only time malicious.swgt.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 52.21.182.193 14618 (AMAZON-AES)
1 4 44.199.92.62 14618 (AMAZON-AES)
27 2600:9000:268... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
32 4
1    52.21.182.193 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-182-193.compute-1.amazonaws.com
malicious.swgt.io
4    44.199.92.62 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-199-92-62.compute-1.amazonaws.com
malicious.swgt.io
27    2600:9000:2684:7200:1a:7894:e640:93a1 (United States)

ASN16509 (AMAZON-02, US)
do9d4mpqk497d.cloudfront.net
1    2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
Apex Domain
Subdomains		 Transfer
27 cloudfront.net
do9d4mpqk497d.cloudfront.net
450 KB
5 swgt.io
malicious.swgt.io
73 KB
1 gstatic.com
www.gstatic.com
203 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 2
1 KB
32 4
Domain Requested by
27 do9d4mpqk497d.cloudfront.net malicious.swgt.io
do9d4mpqk497d.cloudfront.net
5 malicious.swgt.io 2 redirects malicious.swgt.io
1 www.gstatic.com www.google.com
1 www.google.com malicious.swgt.io
32 4

This site contains links to these domains. Also see Links.

Domain
www.patreon.com
Subject Issuer Validity Valid
*.swgt.io
Amazon RSA 2048 M02		 2023-06-22 -
2024-07-19		 a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2023-10-10 -
2024-09-19		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://malicious.swgt.io/login.jsp
Frame ID: 6D55B303225CAC4DD09F1DD1A91205E3
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

SWGT Malicious

Page URL History Show full URLs

  1. http://malicious.swgt.io/ HTTP 302
    https://malicious.swgt.io/ HTTP 302
    https://malicious.swgt.io/login.jsp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery-ui.*\.js
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

32
Requests

100 %
HTTPS

60 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

726 kB
Transfer

1890 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://malicious.swgt.io/ HTTP 302
    https://malicious.swgt.io/ HTTP 302
    https://malicious.swgt.io/login.jsp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.jsp
malicious.swgt.io/
Redirect Chain
  • http://malicious.swgt.io/
  • https://malicious.swgt.io/
  • https://malicious.swgt.io/login.jsp
27 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.199.92.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-199-92-62.compute-1.amazonaws.com
Software
SWGT /
Resource Hash
00d4d132629b1d6819588e2a844829c3bea88639893f7ede4a2768fbfe2ef44a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache no-store max-age=0
content-encoding
gzip
content-type
text/html;charset=ISO-8859-1
date
Fri, 22 Dec 2023 20:14:15 GMT
expires
-1
pragma
No-cache
server
SWGT
vary
Accept-Encoding

Redirect headers

cache-control
no-cache
content-length
0
content-type
text/html;charset=ISO-8859-1
date
Fri, 22 Dec 2023 20:14:15 GMT
expires
Thu, 01 Jan 1970 00:00:00 UTC
location
https://malicious.swgt.io/login.jsp
pragma
No-cache
server
SWGT
flag-icon.min.css
do9d4mpqk497d.cloudfront.net/common/includes/flag-icon/css/ 		33 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/flag-icon/css/flag-icon.min.css?2021-08-23
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f67da83d7dc6da8d06990b885930a515f3441d1a802964ed056b70c1dd3c5890

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:33:54 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Tue, 24 Aug 2021 14:12:12 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
45623
etag
W/"3052222810c95c7882c003451fe3ee83"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
jOqWqMNeg7_bOsgNZ0bDgLIAtZyLqESUpkDcYAFjnDGW4_cwPlKBew==
jquery-3.3.1.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/jquery-3.3.1.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:24:49 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:46 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
46168
etag
W/"a09e13ee94d51c524b7e2a728c7d4039"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
mKRbqc_XMpYLt5FDVPLn4fmxJMxqgbrkhIftmwoHRM_FYpO1UEO4dg==
popper.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/popper.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:33:54 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:45 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
45623
etag
W/"83fb8c4d9199dce0224da0206423106f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
UbJmaNXv0_sB2AAsd0srJlDRRFLjjXhpc9MZ2DBhv6Yji-HWgco2PA==
jquery-ui.min.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ui/1.11.4/scopedata/ 		29 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ui/1.11.4/scopedata/jquery-ui.min.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b7ce04b2b18f75376a97208c7b8a5509c3149444c05b294b1a55c7c332b2209

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 14:05:37 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:17:28 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
22120
etag
W/"fe74062e17dd377c262614b2dbfda9ac"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
hpncoN1dmgn8Da5sxsvnhFHmNbcCfsTijfQF8kChno3n48arGwFM_g==
jquery-ui.theme.min.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ui/1.11.4/scopedata/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ui/1.11.4/scopedata/jquery-ui.theme.min.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b137377438dc40955fccd2fcc0edb79a96c68aad03f594f2ac099dacb4c262dd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 06:24:17 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:17:30 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
49800
etag
W/"4519c0e7b7fedfd635a0f3ae3977eb36"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
0dJ9ErRCfebXwFbG0V9cs79kdbSm2ahztTZ7qvMUewfai9NQOJtFfA==
jquery-ui.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ui/1.11.4/scopedata/ 		235 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/ui/1.11.4/scopedata/jquery-ui.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
32711edb43ed190695726090d40a488acdeb217cdba519610ff17d023a306204

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:33:53 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:17:28 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
46168
etag
W/"e4368ab5a490c89087102b8827b1e188"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
PKkGTz8ilJ8AaM1WbaxPB8fchqducJZT2CqpIERRD7xpBANkjhVrXw==
jquery.ui.touch-punch-0.2.3a.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/touchPunch/ 		1 KB
975 B 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/touchPunch/jquery.ui.touch-punch-0.2.3a.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f09d3a0a5c21c070be0c91e8bebb9ff915824bb8c4750bbe0030144472909d48

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 00:07:46 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:17:32 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
72391
etag
W/"9aaf03754fd49964f2db705e7c551c8c"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
SeL0HBVwrCiV4R_XEVURYYKAKD5lOgLM8_TgUkojAKh0n4tCY_8A3A==
jquery.blockUI-2.70.0.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/blockUI/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/jquery/blockUI/jquery.blockUI-2.70.0.js?2020-01-20_1605
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24db8e1fe1b9331a34300df78d2a79dc37a8cc0309613bfe4e316be36c51b2ef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 00:07:46 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:17:37 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
72391
etag
W/"a7267cef1d2fb720960829d10eb4f84a"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
6C0rJtHr-QK2TidWsrfOsdbkSaUhMBo6u9VBkYoqK7QHf81M0a2_pA==
tooltipster.css
do9d4mpqk497d.cloudfront.net/common/includes/jquery/tooltipster/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/jquery/tooltipster/tooltipster.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
05a3a4f12e5eddee86f025d380e96666c1f8adf7fc0e1796467c45ddb6c827fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 06:24:17 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:33 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
49800
etag
W/"8d7f11f44e0a3c9685274ef9e367941d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
zqLLeVVF-hKTWnThDoEo9Hb12L0EzH47-KSOdyzydWdc1foB-Ke4Lg==
jquery.tooltipster.min.js
do9d4mpqk497d.cloudfront.net/common/includes/jquery/tooltipster/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/jquery/tooltipster/jquery.tooltipster.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
95e9e3ea5a0771d7eeead1503d41cde92d8eec6da0bfbc97fcff4e9d173c967a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 11:12:18 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:32 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
32519
etag
W/"ff2f685494b400ea2098c79332759a8f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
HMLLbD8T0Y26tSzYvsU9tW0fFvMnTTSdodDyIHnIkjzABqueiAUqjQ==
tooltipster-shadow.css
do9d4mpqk497d.cloudfront.net/common/includes/jquery/tooltipster/themes/ 		261 B
594 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/jquery/tooltipster/themes/tooltipster-shadow.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
159a2a40880e0cbba4807371ea291b5af23c981187603ae9fb706e8dfe620de1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:33:54 GMT
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:34 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
45623
etag
"5ac53c95f247585328d4509d0b33c3c8"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
accept-ranges
bytes
content-length
261
x-amz-cf-id
5XSlAW971Kx60ZKVNIxg_fp3wBNCV01ix035Sup23UPL9xhZIFoSGw==
bootstrap.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/4.4.1/css/ 		193 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/4.4.1/css/bootstrap.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
038ecec312ff9c0374c9d8831534865fb7ed6df4c94ca822274cea0ae4cf0e1e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 12:08:09 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Wed, 16 Mar 2022 15:53:32 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
29168
etag
W/"df40d6e4c661bcd1790dce6861e34ce4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
tM4bR5dgHLL_nsMndYmsFJ02On3DUEGPkXZYuOIRiW2hjbgpxixD4Q==
bootstrap.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/4.4.1/js/ 		59 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/4.4.1/js/bootstrap.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 11:12:18 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Wed, 16 Mar 2022 15:53:29 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
32519
etag
W/"61f338f870fcd0ff46362ef109d28533"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
rQmzBSuEv8_DSg_5GrxPwwertuBLGh80zQyyRCnQeh2kWuVa_ZvC4A==
bootstrap-dialog.custom-2022-03-17.min.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-dialog/ 		2 KB
852 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-dialog/bootstrap-dialog.custom-2022-03-17.min.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c51377dfe900eca83e5064faa276f2a3b7baa36d30439922aa9b0f5bceca4ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:33:54 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Thu, 17 Mar 2022 17:09:29 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
45623
etag
W/"b224878eeb2334a1af5121c770a44124"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
uao0X5m-s2VpvGxB14u91zkejEkKKKpNHPeSxOJsIQqjxwM-ho7Ogg==
bootstrap-dialog.custom-2022-03-17.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-dialog/ 		50 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-dialog/bootstrap-dialog.custom-2022-03-17.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9bd1f467fd31648c6ad735393584e02921fdd3273366d7023a5a0e90807f898f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 15:11:40 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Thu, 17 Mar 2022 17:09:30 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
18157
etag
W/"d0b0ee75922bb95fe76b005dfd308613"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
3CIC3OZ9F2op4-kRWxvbfjyC4IOhQJiNLKsEOQGRenhuoE_AiYSHdA==
bootstrap-select.min.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-select/1.13.14/css/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-select/1.13.14/css/bootstrap-select.min.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
69279bee49c5f3502f7a3f07358da1562cc0a10d57e8a56cfc0f8977d367c99f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 06:24:17 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:23:15 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
49800
etag
W/"2d868f5f03695620ad1c172dfb4ebbdc"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
RmKqNLR-TerjY8RZgZADzPEpLmcDgnmB-aVZaj4n6P6j-spfYq7GrA==
bootstrap-select.min.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-select/1.13.14/js/ 		51 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/bootstrap-select/1.13.14/js/bootstrap-select.min.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6763de73150d26e3296cd0154ff12dede3b5d39251c734c0ae4f8af4e437e4cc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 15:11:40 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:22:40 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
18157
etag
W/"ba9d5bbe072f5626909db4e31da3ba4d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
aYeOaJ_3SFvWPA0p4k06NC-9UMwwzGiUQPFkO-RpFDF7ktF2zB74ow==
webslidemenu.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v1.0/ 		65 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v1.0/webslidemenu.css?2019-08-28_0000
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b071671f2aba9d538c1b94d08a0f76c1eebf5aeb7e7aebd589c055380ee36c00

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 12:18:12 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:45 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
28565
etag
W/"73b053e27eaaee134e49019253f646e0"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
BMRKv4OolbKdF0uYV6pZU86CeP9-SdWNTHXitWysxfOHrhUuQ3AifQ==
webslidemenu.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v1.0/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v1.0/webslidemenu.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fcff9fcf1f5f915310194af349c696c3fdce4fec6ee421b8ffe954999e59fa80

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 08:33:00 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Sat, 13 Mar 2021 00:16:46 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
42077
etag
W/"7bc11eeaabecdb23c24474851961d445"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
ZXBNN399NS9kWjmGMqpTc-4e4sg_GP2S_2jzuy-RbTCAJyid1A6O8A==
webslidemenu.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v2.5/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v2.5/webslidemenu.css?2022-03-16_0000
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ff9e38e211cc8869a020021c8c2d1ee5cad73f943f3914da2041c6cac8ce42ba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 04:19:27 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Wed, 16 Mar 2022 19:32:43 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
57290
etag
W/"d5a2a6b60298615ab1c8b65d7820f175"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
B0JjY4gol8N5w9YC43QY_p8X4_aR_LBbjaR-muLeNT9owSvDf_lqhA==
webslidemenu.js
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v2.5/ 		158 B
501 B 		Script
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/webslidemenu/v2.5/webslidemenu.js?2022-03-16_0000
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8e616dd7b994bcfa50e539d0744599f7f8072b307eaa2ca0794735cb7ca69fcd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 07:33:54 GMT
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Wed, 16 Mar 2022 19:32:42 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
45623
etag
"5e5156866f54db3ab3579ad91419f3d1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
158
x-amz-cf-id
1oUvZqnlAT_QzIUzFM0Ox0z49tJb65cYhXEd9xTahgpw5VouxIl79Q==
all.min.css
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/fontawesome/pro-5.15.3/css/ 		170 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/fontawesome/pro-5.15.3/css/all.min.css
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
839ce8e32e994f4fb4af526183b8f41ba67e47c7025746cc94e7e6a53d3d3453

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 11:12:18 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Tue, 20 Apr 2021 16:18:46 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
32518
etag
W/"a28e912c1a41becec7f68848d739d5c0"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
T20k-nQfyP3CpYLT7fD8kILYxQvHqSIsBczJScAtMnPcD0135CxxEA==
common.js
malicious.swgt.io/common/includes/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://malicious.swgt.io/common/includes/common.js?2023-11-04_0000
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.199.92.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-199-92-62.compute-1.amazonaws.com
Software
SWGT /
Resource Hash
bab813efe696c0c27f66758d50023a67f9da1a29e4e612f1f1e6286294693c70

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
No-cache
date
Fri, 22 Dec 2023 20:14:16 GMT
content-encoding
gzip
last-modified
Fri, 22 Dec 2023 17:52:19 GMT
server
SWGT
etag
W/"15663-1703267539000"
vary
Accept-Encoding
content-type
text/javascript
cache-control
no-cache
expires
Thu, 01 Jan 1970 00:00:00 UTC
common.css
malicious.swgt.io/common/includes/ 		58 KB
59 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://malicious.swgt.io/common/includes/common.css?2023-12-22_0000
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.199.92.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-199-92-62.compute-1.amazonaws.com
Software
SWGT /
Resource Hash
d2a3709e5b6484f424802d4c4262dfd3787c5d9e5062c144782de3101dbd9d58

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
No-cache
date
Fri, 22 Dec 2023 20:14:16 GMT
last-modified
Fri, 22 Dec 2023 17:52:19 GMT
server
SWGT
etag
W/"59852-1703267539000"
content-type
text/css
cache-control
no-cache
content-length
59852
expires
Thu, 01 Jan 1970 00:00:00 UTC
api.js
www.google.com/recaptcha/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
25b0db3d3b80dc803b5354bc6d22e96b849b83d53671517ae3f70119ec155bc7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 20:14:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Fri, 22 Dec 2023 20:14:16 GMT
swgt_malicious_site_top_logo_7a8800ae-3d4f-434c-9600-7bb75a6eb7c0.png
do9d4mpqk497d.cloudfront.net/common/images/custom_logos/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://do9d4mpqk497d.cloudfront.net/common/images/custom_logos/swgt_malicious_site_top_logo_7a8800ae-3d4f-434c-9600-7bb75a6eb7c0.png
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ef3a0f4bc1b5b74148504b408167bbf958320a3c3bb0d79b643ac120ea5daad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 20:14:17 GMT
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Thu, 15 Sep 2022 10:50:05 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
etag
"b2d4dd636c99dbbb6cbe0b6bd3dfc747"
x-cache
Miss from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
3941
x-amz-cf-id
lZO-KoIcgeLmwh7-OORUtHmmma1tvrsVIwj3ITN3aI2DgvXKDgnjuw==
SWGT_Banner_v4a_rightonly_transparent.png
do9d4mpqk497d.cloudfront.net/common/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://do9d4mpqk497d.cloudfront.net/common/images/SWGT_Banner_v4a_rightonly_transparent.png
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
18bfc17af08a3c234f355120c67e29cf18f24602e19d4e43f3b6736ceef1dcaf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 20:14:16 GMT
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Thu, 16 Jun 2022 19:17:45 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
269
etag
"b86e842d3c91374f4affb45025b59054"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
2306
x-amz-cf-id
ttTYghyKyIEMRe8gfWdjMJX7NUg3PnVb0KynoOufNYqy4-EAu52qOQ==
swgt_malicious_site_logo_6a538fd2-b0ca-4610-b9bb-7521665d4e34.png
do9d4mpqk497d.cloudfront.net/common/images/custom_logos/ 		65 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://do9d4mpqk497d.cloudfront.net/common/images/custom_logos/swgt_malicious_site_logo_6a538fd2-b0ca-4610-b9bb-7521665d4e34.png
Requested by
Host: malicious.swgt.io
URL: https://malicious.swgt.io/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d786552fff2c94ed04550e1c736903c4e5d3e98a55a2a625caf86e17f15d9630

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://malicious.swgt.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 20:14:17 GMT
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Thu, 15 Sep 2022 10:50:04 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
etag
"ff1864db72f773dd9fd7ff997fd4cba5"
x-cache
Miss from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
66230
x-amz-cf-id
g7Br1yGUgDRPWTTdz1GnNCoPdtO2TXDQwg25ogy9-Y6GghsGQWDV9g==
recaptcha__de.js
www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/ 		505 KB
203 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
122bd7b997b91e56e9efd54743ffbeccefca5b8bb59c566d6ec63adf14be896e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://malicious.swgt.io/
Origin
https://malicious.swgt.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 21 Dec 2023 20:45:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
84512
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
207437
x-xss-protection
0
last-modified
Mon, 11 Dec 2023 05:01:12 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 20 Dec 2024 20:45:44 GMT
us.svg
do9d4mpqk497d.cloudfront.net/common/includes/flag-icon/flags/4x3/ 		4 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/flag-icon/flags/4x3/us.svg
Requested by
Host: do9d4mpqk497d.cloudfront.net
URL: https://do9d4mpqk497d.cloudfront.net/common/includes/flag-icon/css/flag-icon.min.css?2021-08-23
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c70ba1cb67cc649da2b1f5dc4a26891437d8bba2cc098c88461e6bfc23949d9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://do9d4mpqk497d.cloudfront.net/common/includes/flag-icon/css/flag-icon.min.css?2021-08-23
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 04:19:30 GMT
content-encoding
gzip
via
1.1 568c42efdde2fe2144b713a4d9e485d2.cloudfront.net (CloudFront)
last-modified
Tue, 24 Aug 2021 14:11:09 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
age
57287
etag
W/"ae65659236a7e348402799477237e6fa"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-cf-id
04hgi5aV-e9SvbrIbVvDNcXNJ-p2vaSvk9YCni4wfe9yWBDhxJnOpA==
fa-solid-900.woff2
do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/fontawesome/pro-5.15.3/webfonts/ 		134 KB
134 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/fontawesome/pro-5.15.3/webfonts/fa-solid-900.woff2
Requested by
Host: do9d4mpqk497d.cloudfront.net
URL: https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/fontawesome/pro-5.15.3/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2684:7200:1a:7894:e640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
943efdb4b38963df0653d778f233b55db3e19f44794e4ff944e33b8849dcdb3c

Request headers

Referer
https://do9d4mpqk497d.cloudfront.net/common/includes/bootstrap4/fontawesome/pro-5.15.3/css/all.min.css
Origin
https://malicious.swgt.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 20:14:17 GMT
via
1.1 851879d53a84651e63e2408132976dfe.cloudfront.net (CloudFront)
last-modified
Tue, 20 Apr 2021 15:29:08 GMT
server
AmazonS3
x-amz-cf-pop
LHR5-P6
etag
"978b27ec5d8b81d2b15aa28aaaae1fcb"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET, HEAD
content-type
binary/octet-stream
access-control-allow-origin
https://malicious.swgt.io
x-cache
Miss from cloudfront
access-control-allow-credentials
true
accept-ranges
bytes
content-length
136824
x-amz-cf-id
NW2aKfJ0ERwBZ99VobgY6sT18nl9K5ENiq8AkX-alC3s-m_sgfiIvQ==

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery function| Popper object| bootstrap function| BootstrapDialog function| getElement string| agt boolean| is_op boolean| is_ie boolean| is_mac boolean| is_gk boolean| is_sf function| isBrowserCompatible function| gff number| phone_field_length function| TabNext function| popUp function| popUpUniqueName function| popUpWithDimension function| popUpWithDimensionResize function| strNullCheck function| compareDates function| parseDate function| isFolderOrFileName function| isNonblank function| isWhole function| isInteger function| isDecimal function| isCurrency function| isEmail function| getDigits function| googleMapsPOPUP function| selectTextboxContent function| doTooltip function| hideTip function| directURLLaunch function| launchURL function| daydiff function| function_print function| function_reloadPage function| function_closeAll function| getRandomColor object| colorMap function| function_getColor function| sortFunction2DAscending function| sortFunction2DDescending object| hexDigits function| rgb2hex function| hex function| function_toggleCheckboxCheckmark function| function_selectCheckboxCheckmark function| function_trimHTMLWhitespaceAndCondense boolean| formChanged function| setFormChanged function| function_viewPicture function| function_viewCarousel function| function_discord function| function_help function| function_changeLanguage function| function_viewChangeDarkMode function| function_register function| function_pinMenu function| function_refreshPinnedMenu function| function_login function| function_recruitmentApplyNow object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| function_common_modal_alert object| recaptcha

4 Cookies

Domain/Path Name / Value
malicious.swgt.io/ Name: JSESSIONID
Value: EBF6DABFCEC3A125A465E8BE95FB1449
malicious.swgt.io/ Name: __Host-PERSISTANCE
Value: BF547F8FC7E41F01774D776B5CA61239E74E84D029669A247257EC1A43925737A8451A212E390782A08594EA2C3B06B5EECB87E3D415F6B3AF19F286A916B035650F0D219E2E0B41F7B1FF141F6C5702E9025B3CE986A11D34DE89EB8A2173347C634B82C515144C4A5B3F517928DD77
malicious.swgt.io/ Name: AWSALB
Value: noyIsBcym9F18x6nv8o8K8+PdzL0ZQ6nBTbBL+pV8JjQkDnRBiMGjeFvDg+u12na2475pKO+GsG1oMZ1fciM6ks1hdfdxP7QcbxHP7ascIBxqRlemN7eLLHlAEzsM/HO50Pv991NgV4mgvvTVE7ioDdNgGfZNyfdwKHbKW/xCfSd1NnkIi+qAtZfhpjblw==
malicious.swgt.io/ Name: AWSALBCORS
Value: noyIsBcym9F18x6nv8o8K8+PdzL0ZQ6nBTbBL+pV8JjQkDnRBiMGjeFvDg+u12na2475pKO+GsG1oMZ1fciM6ks1hdfdxP7QcbxHP7ascIBxqRlemN7eLLHlAEzsM/HO50Pv991NgV4mgvvTVE7ioDdNgGfZNyfdwKHbKW/xCfSd1NnkIi+qAtZfhpjblw==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

do9d4mpqk497d.cloudfront.net
malicious.swgt.io
www.google.com
www.gstatic.com
2600:9000:2684:7200:1a:7894:e640:93a1
2a00:1450:4001:809::2003
2a00:1450:4001:828::2004
44.199.92.62
52.21.182.193
00d4d132629b1d6819588e2a844829c3bea88639893f7ede4a2768fbfe2ef44a
038ecec312ff9c0374c9d8831534865fb7ed6df4c94ca822274cea0ae4cf0e1e
05a3a4f12e5eddee86f025d380e96666c1f8adf7fc0e1796467c45ddb6c827fb
122bd7b997b91e56e9efd54743ffbeccefca5b8bb59c566d6ec63adf14be896e
159a2a40880e0cbba4807371ea291b5af23c981187603ae9fb706e8dfe620de1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
18bfc17af08a3c234f355120c67e29cf18f24602e19d4e43f3b6736ceef1dcaf
24db8e1fe1b9331a34300df78d2a79dc37a8cc0309613bfe4e316be36c51b2ef
25b0db3d3b80dc803b5354bc6d22e96b849b83d53671517ae3f70119ec155bc7
2ef3a0f4bc1b5b74148504b408167bbf958320a3c3bb0d79b643ac120ea5daad
32711edb43ed190695726090d40a488acdeb217cdba519610ff17d023a306204
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
5c51377dfe900eca83e5064faa276f2a3b7baa36d30439922aa9b0f5bceca4ce
6763de73150d26e3296cd0154ff12dede3b5d39251c734c0ae4f8af4e437e4cc
69279bee49c5f3502f7a3f07358da1562cc0a10d57e8a56cfc0f8977d367c99f
7b7ce04b2b18f75376a97208c7b8a5509c3149444c05b294b1a55c7c332b2209
839ce8e32e994f4fb4af526183b8f41ba67e47c7025746cc94e7e6a53d3d3453
8e616dd7b994bcfa50e539d0744599f7f8072b307eaa2ca0794735cb7ca69fcd
943efdb4b38963df0653d778f233b55db3e19f44794e4ff944e33b8849dcdb3c
95e9e3ea5a0771d7eeead1503d41cde92d8eec6da0bfbc97fcff4e9d173c967a
9bd1f467fd31648c6ad735393584e02921fdd3273366d7023a5a0e90807f898f
b071671f2aba9d538c1b94d08a0f76c1eebf5aeb7e7aebd589c055380ee36c00
b137377438dc40955fccd2fcc0edb79a96c68aad03f594f2ac099dacb4c262dd
bab813efe696c0c27f66758d50023a67f9da1a29e4e612f1f1e6286294693c70
c70ba1cb67cc649da2b1f5dc4a26891437d8bba2cc098c88461e6bfc23949d9e
d2a3709e5b6484f424802d4c4262dfd3787c5d9e5062c144782de3101dbd9d58
d786552fff2c94ed04550e1c736903c4e5d3e98a55a2a625caf86e17f15d9630
f09d3a0a5c21c070be0c91e8bebb9ff915824bb8c4750bbe0030144472909d48
f67da83d7dc6da8d06990b885930a515f3441d1a802964ed056b70c1dd3c5890
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
fcff9fcf1f5f915310194af349c696c3fdce4fec6ee421b8ffe954999e59fa80
ff9e38e211cc8869a020021c8c2d1ee5cad73f943f3914da2041c6cac8ce42ba