URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Submission: On January 16 via manual from US — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 52.216.225.43, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 52.216.225.43 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 54.231.203.16 16509 (AMAZON-02)
1 83.223.113.113 29017 (GYRON )
2 162.213.255.79 22612 (NAMECHEAP...)
7 5
Apex Domain
Subdomains
Transfer
3 amazonaws.com
s3.amazonaws.com
99 KB
2 vope.uk
api.vope.uk
278 KB
1 sweetgreen.com
careers.sweetgreen.com
336 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 199
28 KB
7 4
Domain Requested by
3 s3.amazonaws.com s3.amazonaws.com
2 api.vope.uk
1 careers.sweetgreen.com cdnjs.cloudflare.com
1 cdnjs.cloudflare.com s3.amazonaws.com
7 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-03 -
2023-08-02
a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2022-12-06 -
2023-12-05
a year crt.sh
careers.sweetgreen.com
R3
2022-12-01 -
2023-03-01
3 months crt.sh
*.vope.uk
R3
2022-11-24 -
2023-02-22
3 months crt.sh

This page contains 1 frames:

Primary Page: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Frame ID: D0C471FA53810146FE1908AFB06DC9DB
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Sign in to continue

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

20 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

406 kB
Transfer

463 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.xhtml
s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/
1 KB
2 KB
Document
General
Full URL
http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
HTTP/1.1
Server
52.216.225.43 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
db54c2c19f649c63be74e6af6d6a81fe2855c37978692a636168da661ded4934

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public,max-age=86400
Content-Length
1252
Content-Type
application/xhtml+xml
Date
Mon, 16 Jan 2023 14:26:53 GMT
ETag
"93ff95638ed06b775d77ee68f7a9303d"
Last-Modified
Fri, 13 Jan 2023 00:17:12 GMT
Server
AmazonS3
x-amz-id-2
oIHNHp+l9A7FzJASI0NGIhyTDoxWab7IaksOZyGJJ9hYtf+DX2HvbvXiuYf/xnMz5yZb3XnjhLA=
x-amz-meta-app-version
test
x-amz-meta-appname
sharefilepoiye79
x-amz-request-id
S13WS0RC9F86MZG9
x-amz-server-side-encryption
AES256
x-amz-version-id
_ZBz2NaVyxAFggjNO6PRjzqenXlqWG2B
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/
88 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: s3.amazonaws.com
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 14:26:52 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1758190
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27990
last-modified
Fri, 26 Aug 2022 18:34:13 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"63091225-6d56"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5YOIjtB2IZOC6K9DLo5ALUHZmIvXBIAQ%2FEUQnAmYMXNUttki3gjVXfwaU07mRbmtD4RXo17buGdUK9EO2TRcouRYy767zDj%2FxAr5NxzbHRo0INAsfjk2%2B%2BG9ar%2BgeEqnuqYq%2FMrAWy7HosOiNu6XpiE"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
78a78755ba9cbba7-FRA
expires
Sat, 06 Jan 2024 14:26:52 GMT
index.js
s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/
48 KB
49 KB
Script
General
Full URL
https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?jjnkn=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.203.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Mon, 16 Jan 2023 14:26:53 GMT
x-amz-meta-appname
sharefilepoiye79
x-amz-version-id
Th_416BG4mAehxtJUPNRlOc5AsjjNvQd
Last-Modified
Fri, 13 Jan 2023 00:15:02 GMT
Server
AmazonS3
x-amz-request-id
S13P628E669MNGRJ
ETag
"fd675655d10d765b14f6df1f8198a8a6"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
49412
x-amz-id-2
00ydcM/uK2RNVxK2+tnbehxwGVX+0CR1MpF3kiGwHuT7suqdmcGhsKSrp3CU7nLo7o0KwNwZw2w=
index.js
s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/
48 KB
49 KB
Script
General
Full URL
https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?hijiji=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.203.16 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Mon, 16 Jan 2023 14:26:53 GMT
x-amz-meta-appname
sharefilepoiye79
x-amz-version-id
Th_416BG4mAehxtJUPNRlOc5AsjjNvQd
Last-Modified
Fri, 13 Jan 2023 00:15:02 GMT
Server
AmazonS3
x-amz-request-id
S13PV2YZ4M2271PS
ETag
"fd675655d10d765b14f6df1f8198a8a6"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
49412
x-amz-id-2
VAHU1BCQMzP0Ymsa4nKdhZDYKWyRITy8KelW3Hl9VKXtJhNYTI63XJoQiJe2wtBOjJR1pI3NrLU=
error.php
careers.sweetgreen.com/vendor/monolog/
260 B
336 B
XHR
General
Full URL
https://careers.sweetgreen.com/vendor/monolog/error.php
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
83.223.113.113 Luton, United Kingdom, ASN29017 (GYRON , GB),
Reverse DNS
svr01.boldidentities.com
Software
Apache /
Resource Hash
df752bccd0ae736aaeb09b9e683752d63aa1c105c3c043951349d3f5057180cd

Request headers

Accept
*/*
Referer
http://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 16 Jan 2023 14:26:53 GMT
server
Apache
content-type
text/html; charset=UTF-8
download_35.jpeg
api.vope.uk/pics/
277 KB
277 KB
Image
General
Full URL
https://api.vope.uk/pics/download_35.jpeg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 14:26:54 GMT
last-modified
Thu, 24 Nov 2022 17:55:49 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
283351
expires
Mon, 23 Jan 2023 14:26:54 GMT
download02.png
api.vope.uk/pics/
1 KB
1 KB
Image
General
Full URL
https://api.vope.uk/pics/download02.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 14:26:54 GMT
last-modified
Thu, 24 Nov 2022 17:55:54 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
1057
expires
Mon, 23 Jan 2023 14:26:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery string| result function| addJS function| fn1 function| fn2 function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies