urlscan.io logo urlscan.io
SecurityTrails logo

s3.amazonaws.com Open in urlscan Pro
52.216.237.69  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?1959756389175776766112236492035193084...
Submission: On January 16 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 52.216.237.69, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on December 6th 2022. Valid for: a year.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 52.216.237.69 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 83.223.113.113 29017 (GYRON )
2 162.213.255.79 ()
7 4
Apex Domain
Subdomains		 Transfer
3 amazonaws.com
s3.amazonaws.com
99 KB
2 vope.uk
api.vope.uk
1 KB
1 sweetgreen.com
careers.sweetgreen.com
336 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 199
28 KB
7 4
Domain Requested by
3 s3.amazonaws.com s3.amazonaws.com
2 api.vope.uk
1 careers.sweetgreen.com cdnjs.cloudflare.com
1 cdnjs.cloudflare.com s3.amazonaws.com
7 4

This site contains no links.

Subject Issuer Validity Valid
s3.amazonaws.com
Amazon RSA 2048 M01		 2022-12-06 -
2023-12-05		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh
careers.sweetgreen.com
R3		 2022-12-01 -
2023-03-01		 3 months crt.sh
*.vope.uk
R3		 2022-11-24 -
2023-02-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
Frame ID: A9BAB5103436015EEFC29E43B8791F55
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to continue

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

129 kB
Transfer

297 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.xhtml
s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.237.69 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
db54c2c19f649c63be74e6af6d6a81fe2855c37978692a636168da661ded4934

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public,max-age=86400
Content-Length
1252
Content-Type
application/xhtml+xml
Date
Mon, 16 Jan 2023 13:23:20 GMT
ETag
"93ff95638ed06b775d77ee68f7a9303d"
Last-Modified
Fri, 13 Jan 2023 00:17:12 GMT
Server
AmazonS3
x-amz-id-2
hBAD8REOHKbVWOnu2XGqsvfAu0Qd5kTcfFtdhkx+k4sVDRQYG8/SvhSC54hw/eXZMxs6cHj6MnM=
x-amz-meta-app-version
test
x-amz-meta-appname
sharefilepoiye79
x-amz-request-id
R81XVZVSW6TWCKE9
x-amz-server-side-encryption
AES256
x-amz-version-id
_ZBz2NaVyxAFggjNO6PRjzqenXlqWG2B
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 		88 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 13:23:19 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
840817
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27990
last-modified
Fri, 26 Aug 2022 18:34:13 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"63091225-6d56"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CXFTHVIhqp7Q8P%2Fd4jlzYAxrbPPUjL7Y%2BEY9OqED0Bjgv5bF7bVlOvRn1GW4%2Boy0Xr3ikm4jx38GwVFRiRQ%2BEqxsFy19DIdKg89pEuRXuX8dC9agK2zcSX09UlNzftglYY43msCtojVmW0HGo0rU5XSU"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
78a72a3d1d602c7b-FRA
expires
Sat, 06 Jan 2024 13:23:19 GMT
index.js
s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/ 		48 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?jjnkn=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.237.69 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Mon, 16 Jan 2023 13:23:20 GMT
x-amz-meta-appname
sharefilepoiye79
x-amz-version-id
Th_416BG4mAehxtJUPNRlOc5AsjjNvQd
Last-Modified
Fri, 13 Jan 2023 00:15:02 GMT
Server
AmazonS3
x-amz-request-id
R81GB41948PM5CWV
ETag
"fd675655d10d765b14f6df1f8198a8a6"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
49412
x-amz-id-2
T9ZyGOvtIawH6ckKRLbw2q40oIID3qOTVddS2BXwNlxOIYPwvOQ+tXJijS/m4gg1VgJYqZPnLWU=
index.js
s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/ 		48 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?hijiji=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.237.69 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml?19597563891757767661122364920351930845283404115195227357178194104635662901198714838518153456412215637962141769192113694606319931038234726862662522044779572348578219528644285073610371789972036535371143802405992646436638907780315153699451748104513159650892141689484815345432398964330646070794981385900406=!!ERROR%20IN%20FUNCTION%20PARAMETERS!!
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Mon, 16 Jan 2023 13:23:20 GMT
x-amz-meta-appname
sharefilepoiye79
x-amz-version-id
Th_416BG4mAehxtJUPNRlOc5AsjjNvQd
Last-Modified
Fri, 13 Jan 2023 00:15:02 GMT
Server
AmazonS3
x-amz-request-id
R81WA9628WVE4XCR
ETag
"fd675655d10d765b14f6df1f8198a8a6"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
49412
x-amz-id-2
LaBn3Pc5Oz167l42O+Dd4a7x96awGo6PSBT9KhY63gqFuRLxkvtE+hyrOwiKL6YYmmosbkjCTVU=
error.php
careers.sweetgreen.com/vendor/monolog/ 		260 B
336 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://careers.sweetgreen.com/vendor/monolog/error.php
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
83.223.113.113 Luton, United Kingdom, ASN29017 (GYRON , GB),
Reverse DNS
svr01.boldidentities.com
Software
Apache /
Resource Hash
df752bccd0ae736aaeb09b9e683752d63aa1c105c3c043951349d3f5057180cd

Request headers

Accept
*/*
Referer
https://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 16 Jan 2023 13:23:19 GMT
server
Apache
content-type
text/html; charset=UTF-8
download_35.jpeg
api.vope.uk/pics/ 		111 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.vope.uk/pics/download_35.jpeg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 -, , ASN (),
Reverse DNS
Software
LiteSpeed /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 13:23:20 GMT
last-modified
Thu, 24 Nov 2022 17:55:49 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
283351
expires
Mon, 23 Jan 2023 13:23:20 GMT
download02.png
api.vope.uk/pics/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.vope.uk/pics/download02.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 -, , ASN (),
Reverse DNS
Software
LiteSpeed /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 13:23:20 GMT
last-modified
Thu, 24 Nov 2022 17:55:54 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
1057
expires
Mon, 23 Jan 2023 13:23:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery string| result function| addJS function| fn1 function| fn2 function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies