connecting-severs-west2signing-east365.s3.amazonaws.com Open in urlscan Pro
52.217.166.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0S...
Effective URL:
https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html
Submission Tags: falconsandbox
Submission: On September 20 via api (September 20th 2021, 4:21:05 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 16 HTTP transactions. The main IP is 52.217.166.185, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is connecting-severs-west2signing-east365.s3.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on January 11th 2021. Valid for: a year.

This is the only time connecting-severs-west2signing-east365.s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.231.80.194 18.231.80.194	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:17cf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6812:16cf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	52.217.166.185 52.217.166.185	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
2	13.32.121.28 13.32.121.28	16509 (AMAZON-02) (AMAZON-02)
16	6

1 18.231.80.194 (São Paulo, Brazil) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-231-80-194.sa-east-1.compute.amazonaws.com

nt.embluemail.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:17cf (United States)

ASN13335 (CLOUDFLARENET, US)

h34xy.codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:16cf (United States)

ASN13335 (CLOUDFLARENET, US)

codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.217.166.185 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

connecting-severs-west2signing-east365.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.121.28 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-28.fra60.r.cloudfront.net

logo.clearbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	codesandbox.io h34xy.codesandbox.io codesandbox.io	2 MB
3	amazonaws.com connecting-severs-west2signing-east365.s3.amazonaws.com	316 KB
2	clearbit.com logo.clearbit.com	7 KB
1	jquery.com code.jquery.com	30 KB
1	cloudflareinsights.com static.cloudflareinsights.com	5 KB
1	embluemail.com 1 redirects nt.embluemail.com	227 B
16	6

	Domain	Requested by
5	codesandbox.io	h34xy.codesandbox.io codesandbox.io
4	h34xy.codesandbox.io
3	connecting-severs-west2signing-east365.s3.amazonaws.com	h34xy.codesandbox.io connecting-severs-west2signing-east365.s3.amazonaws.com
2	logo.clearbit.com	code.jquery.com connecting-severs-west2signing-east365.s3.amazonaws.com
1	code.jquery.com	connecting-severs-west2signing-east365.s3.amazonaws.com
1	static.cloudflareinsights.com	h34xy.codesandbox.io
1	nt.embluemail.com	1 redirects
16	7

This site contains no links.

Subject Issuer	Validity	Valid
codesandbox.io Cloudflare Inc ECC CA-3	`2021-05-19` - `2022-05-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-11` - `2022-06-10`	a year	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
clearbit.com Amazon	`2021-04-22` - `2022-05-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html
Frame ID: 51739A7EDCD3DBFE95A510E323DFCDC9
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2... HTTP 302
https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Page URL
https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Page URL

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

2212 kB
Transfer

6668 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fh34xy.codesandbox.io%3Fdg%3DbWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t HTTP 302
https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Page URL
https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fh34xy.codesandbox.io%3Fdg%3DbWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t HTTP 302
https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response h34xy.codesandbox.io/ Redirect Chain https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fh34... https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t	1 KB 1 KB	136ms 56ms	Document text/html	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `15eaf24dce0ad5168e9def3624a9cd50bf7268ca727eae80d963c99c5802af50` Request headers :method GET :authority h34xy.codesandbox.io :scheme https :path /?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Mon, 20 Sep 2021 16:20:59 GMT content-type text/html vary Accept-Encoding cache-control private, max-age=0, no-cache, no-store x-request-id FqaUMoP46gerhsQdRZrB set-cookie signedIn=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; max-age=0; HttpOnly via 1.1 google alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 691c62609af64dd0-FRA content-encoding br Redirect headers date Mon, 20 Sep 2021 16:20:59 GMT content-type application/json content-length 0 location https://h34xy.codesandbox.io?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t x-amzn-requestid 56f7df8c-2c6e-41f7-908b-8128d78d66c1 x-amz-apigw-id F-E0yHm-mjQFfmw= x-amzn-trace-id Root=1-6148b4eb-01aa2caf234fae931e9a335b;Sampled=0
GET H2	200	vendors~app~embed~sandbox~sandbox-startup.bcc15d438.chunk.js Show response codesandbox.io/static/js/	9 KB 4 KB	74ms 34ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/vendors~app~embed~sandbox~sandbox-startup.bcc15d438.chunk.js Requested by Host: h34xy.codesandbox.io URL: https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d7aba76ea78655e33e814070d24579da91f68a78a2c026c6d58d5cda8aec3f` Request headers Referer https://h34xy.codesandbox.io/ Origin https://h34xy.codesandbox.io Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT age 26196 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Fri, 17 Sep 2021 13:32:09 GMT server cloudflare etag W/"614498d9-2312" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 691c62615876696f-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	vendors~app~embed~sandbox-startup.6e3433fd3.chunk.js codesandbox.io/static/js/	17 KB 5 KB	77ms 37ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/vendors~app~embed~sandbox-startup.6e3433fd3.chunk.js Requested by Host: h34xy.codesandbox.io URL: https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://h34xy.codesandbox.io/ Origin https://h34xy.codesandbox.io Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT age 26196 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Fri, 17 Sep 2021 13:32:09 GMT server cloudflare etag W/"614498d9-423b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 691c62615877696f-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sandbox-startup.56e143351.js Show response codesandbox.io/static/js/	24 KB 8 KB	75ms 35ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/sandbox-startup.56e143351.js Requested by Host: h34xy.codesandbox.io URL: https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `769ea02d0872fab7b52516883a96084bed2ea2490fafad022195c7ea34b6a183` Request headers Referer https://h34xy.codesandbox.io/ Origin https://h34xy.codesandbox.io Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT age 26197 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Fri, 17 Sep 2021 13:32:09 GMT server cloudflare etag W/"614498d9-5eba" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 691c62615879696f-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	browserfs.min.js Show response codesandbox.io/static/browserfs12/	232 KB 59 KB	50ms 35ms	Script application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/browserfs12/browserfs.min.js Requested by Host: h34xy.codesandbox.io URL: https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT age 5134103 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 22 Jul 2021 13:01:29 GMT server cloudflare etag W/"60f96c29-39fc5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 691c62613bfb4dd0-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	beacon.min.js static.cloudflareinsights.com/	13 KB 5 KB	79ms 58ms	Script text/javascript	2606:4700::6810:5f41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js Requested by Host: h34xy.codesandbox.io URL: https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:20:59 GMT content-encoding gzip last-modified Tue, 14 Sep 2021 15:43:35 GMT server cloudflare etag W/2021.8.2 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin cf-ray 691c6261baf105ed-FRA
GET H2	200	babel.7.12.12.min.js codesandbox.io/static/js/	0 360 KB	33ms 31ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/babel.7.12.12.min.js Requested by Host: codesandbox.io URL: https://codesandbox.io/static/js/sandbox-startup.56e143351.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT age 13438083 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Fri, 16 Apr 2021 07:19:12 GMT server cloudflare etag W/"60793a70-190d43" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 691c6261ace74dd0-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	Primary Request index.html Show response connecting-severs-west2signing-east365.s3.amazonaws.com/	291 KB 291 KB	499ms 129ms	Document text/html	52.217.166.185 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Requested by Host: h34xy.codesandbox.io URL: https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.166.185 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `33413f3d1bff5ac6ec75e512e7e9a7ee074e2ce94b120373ea189a2cb456ac66` Request headers Host connecting-severs-west2signing-east365.s3.amazonaws.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://h34xy.codesandbox.io/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/ Response headers x-amz-id-2 ZOycGp43OTSdq0+6l5NGXZLumcDYr3jJIPGcmCsz+j8tfnzjJXmS2MJlBfxsM4yggMdBi/myfu8= x-amz-request-id XF57CF4RJ2DSMYA1 Date Mon, 20 Sep 2021 16:21:01 GMT Last-Modified Mon, 20 Sep 2021 10:12:19 GMT ETag "ea4eae7429d8de2d644d7f5fc373c01d" Accept-Ranges bytes Content-Type text/html Server AmazonS3 Content-Length 298001
GET H2	200	babel-transpiler.d2ef5dbd.worker.js h34xy.codesandbox.io/	2 MB 472 KB	49ms 48ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://h34xy.codesandbox.io/babel-transpiler.d2ef5dbd.worker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /babel-transpiler.d2ef5dbd.worker.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode same-origin accept / cache-control no-cache sec-fetch-dest worker :authority h34xy.codesandbox.io referer https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers cf-ray 691c6261bd044dd0-FRA date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT last-modified Fri, 17 Sep 2021 13:32:09 GMT server cloudflare age 19 etag W/"614498d9-1f1277" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	babel-transpiler.d2ef5dbd.worker.js h34xy.codesandbox.io/	2 MB 472 KB	45ms 44ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://h34xy.codesandbox.io/babel-transpiler.d2ef5dbd.worker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /babel-transpiler.d2ef5dbd.worker.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode same-origin accept / cache-control no-cache sec-fetch-dest worker :authority h34xy.codesandbox.io referer https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers cf-ray 691c6261bd064dd0-FRA date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT last-modified Fri, 17 Sep 2021 13:32:09 GMT server cloudflare age 19 etag W/"614498d9-1f1277" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	babel-transpiler.d2ef5dbd.worker.js h34xy.codesandbox.io/	2 MB 473 KB	38ms 37ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://h34xy.codesandbox.io/babel-transpiler.d2ef5dbd.worker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /babel-transpiler.d2ef5dbd.worker.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode same-origin accept / cache-control no-cache sec-fetch-dest worker :authority h34xy.codesandbox.io referer https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://h34xy.codesandbox.io/?dg=bWFuamEudHVzZWtAbWFubi1odW1tZWwuY29t User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers cf-ray 691c6261bd0a4dd0-FRA date Mon, 20 Sep 2021 16:20:59 GMT via 1.1 google cf-cache-status HIT last-modified Fri, 17 Sep 2021 13:32:09 GMT server cloudflare age 19 etag W/"614498d9-1f1277" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H/1.1	200 OK	lbkddierjfnsakdirjwj.png connecting-severs-west2signing-east365.s3.amazonaws.com/	7 KB 7 KB	114ms 114ms	Image image/png	52.217.166.185 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://connecting-severs-west2signing-east365.s3.amazonaws.com/lbkddierjfnsakdirjwj.png Requested by Host: connecting-severs-west2signing-east365.s3.amazonaws.com URL: https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.166.185 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `46dd46e86d48900afbc2c6b5ca6610ac743f02686275d6247380d181617488f1` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host connecting-severs-west2signing-east365.s3.amazonaws.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 20 Sep 2021 16:21:01 GMT Last-Modified Mon, 20 Sep 2021 10:12:19 GMT Server AmazonS3 x-amz-request-id XF5976VRN25PTQRJ ETag "f2fcff55eef419cd3bb4cfcb505ffa9e" Content-Type image/png Accept-Ranges bytes Content-Length 6842 x-amz-id-2 TIVIEZkWBfmi7wnyeJhRb71nvkZB3L3LtXxq+rEiAClpM/AKTdur7IpGzMFWukUBEGXqArl/atY=
GET H/1.1	200 OK	ZJH_2F3Xi0SopxxCuN7EKeDY.jpg connecting-severs-west2signing-east365.s3.amazonaws.com/	17 KB 17 KB	223ms 117ms	Image image/jpeg	52.217.166.185 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://connecting-severs-west2signing-east365.s3.amazonaws.com/ZJH_2F3Xi0SopxxCuN7EKeDY.jpg Requested by Host: connecting-severs-west2signing-east365.s3.amazonaws.com URL: https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.166.185 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash `d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host connecting-severs-west2signing-east365.s3.amazonaws.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 20 Sep 2021 16:21:01 GMT Last-Modified Mon, 20 Sep 2021 10:12:20 GMT Server AmazonS3 x-amz-request-id XF500FT7KH6DYPDX ETag "7916a894ebde7d29c2cc29b267f1299f" Content-Type image/jpeg Accept-Ranges bytes Content-Length 17453 x-amz-id-2 zX/i9VYtxF2rMJl9hkocDBGqIH98FuUigPoziZET7nq97e0cTl7pNJOXuBb2Ysy/e9DiG3HF//o=
GET H2	200	jquery-3.3.1.min.js Show response code.jquery.com/	85 KB 30 KB	57ms 19ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.min.js Requested by Host: connecting-severs-west2signing-east365.s3.amazonaws.com URL: https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers Accept-Language de-DE,de;q=0.9 Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 20 Sep 2021 16:21:00 GMT content-encoding gzip last-modified Sat, 20 Jan 2018 17:26:44 GMT server nginx etag W/"5a637bd4-1538f" vary Accept-Encoding x-hw 1632154860.dop008.ml1.t,1632154860.cds215.ml1.hn,1632154860.cds213.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30288
GET H2	200	mann-hummel.com Show response logo.clearbit.com/	3 KB 4 KB	76ms 8ms	XHR image/png	13.32.121.28 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://logo.clearbit.com/mann-hummel.com Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.3.1.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.28 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-28.fra60.r.cloudfront.net Software envoy / Resource Hash `8643e3365380a733a44c93bc1d46cc551091783107837cfe088da4382d68669c` Request headers Accept / Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 03 Sep 2021 07:12:53 GMT via 1.1 df3b3b9f4fa0f79195c56a91cf242364.cloudfront.net (CloudFront) server envoy age 1501687 x-cache Hit from cloudfront content-type image/png access-control-allow-origin * cache-control public, max-age=2592000 x-amz-cf-pop FRA60-P1 x-amz-cf-id xJCCD6eq8WeSBKqZFv3ynEio7zD38YIJZZDFJem9UYGbyJK_aob18A==
GET H2	200	mann-hummel.com logo.clearbit.com/	3 KB 4 KB	25ms 9ms	Image image/png	13.32.121.28 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://logo.clearbit.com/mann-hummel.com Requested by Host: connecting-severs-west2signing-east365.s3.amazonaws.com URL: https://connecting-severs-west2signing-east365.s3.amazonaws.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.28 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-28.fra60.r.cloudfront.net Software envoy / Resource Hash `8643e3365380a733a44c93bc1d46cc551091783107837cfe088da4382d68669c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://connecting-severs-west2signing-east365.s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 03 Sep 2021 07:12:53 GMT via 1.1 a49c26e403f2dac09629dceb6dac5741.cloudfront.net (CloudFront) server envoy age 1501687 x-cache Hit from cloudfront content-type image/png access-control-allow-origin * cache-control public, max-age=2592000 x-amz-cf-pop FRA60-P1 x-amz-cf-id zSutFgjyC2noAxNcH0g1EhqSpPxeRkDYUmDgldtfPQuvIAcoi6ARjA==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
worker	warning	URL: https://codesandbox.io/static/js/babel.7.12.12.min.js Message: Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating
worker	warning	URL: https://codesandbox.io/static/js/babel.7.12.12.min.js Message: Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating
worker	warning	URL: https://codesandbox.io/static/js/babel.7.12.12.min.js Message: Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
codesandbox.io
connecting-severs-west2signing-east365.s3.amazonaws.com
h34xy.codesandbox.io
logo.clearbit.com
nt.embluemail.com
static.cloudflareinsights.com
13.32.121.28
18.231.80.194
2001:4de0:ac18::1:a:3b
2606:4700::6810:5f41
2606:4700::6812:16cf
2606:4700::6812:17cf
52.217.166.185
04d7aba76ea78655e33e814070d24579da91f68a78a2c026c6d58d5cda8aec3f
15eaf24dce0ad5168e9def3624a9cd50bf7268ca727eae80d963c99c5802af50
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
33413f3d1bff5ac6ec75e512e7e9a7ee074e2ce94b120373ea189a2cb456ac66
46dd46e86d48900afbc2c6b5ca6610ac743f02686275d6247380d181617488f1
62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7
769ea02d0872fab7b52516883a96084bed2ea2490fafad022195c7ea34b6a183
8643e3365380a733a44c93bc1d46cc551091783107837cfe088da4382d68669c
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

connecting-severs-west2signing-east365.s3.amazonaws.com Open in urlscan Pro 52.217.166.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

57 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

2212 kBTransfer

6668 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

connecting-severs-west2signing-east365.s3.amazonaws.com Open in urlscan Pro
52.217.166.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

2212 kB
Transfer

6668 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!