urlscan.io logo urlscan.io
SecurityTrails logo

s3.amazonaws.com Open in urlscan Pro
54.231.202.72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://libk.dongguk.ac.kr/outlink?moduleId=html&linkType=site_link&targetUrl=http%3A%2F%2FR36.durabletilingservices.com.au...
Effective URL: https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?...
Submission: On February 15 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 8 domains to perform 9 HTTP transactions. The main IP is 54.231.202.72, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on December 6th 2022. Valid for: a year.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 210.94.174.193 9323 (DGUNET-AS...)
1 210.94.174.194 9323 (DGUNET-AS...)
1 1 192.185.113.27 19871 (NETWORK-S...)
1 54.231.202.72 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 192.185.182.179 19871 (NETWORK-S...)
2 162.213.255.79 22612 (NAMECHEAP...)
2 67.223.118.126 22612 (NAMECHEAP...)
9 6
1    210.94.174.193 (Namyangju, Korea, Republic Of)

ASN9323 (DGUNET-AS DONGGUK University, KR)
libk.dongguk.ac.kr
1    210.94.174.194 (Namyangju, Korea, Republic Of)

ASN9323 (DGUNET-AS DONGGUK University, KR)
PTR: kproxy.dongguk.edu
kproxy.dongguk.edu
1    192.185.113.27 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-113-27.unifiedlayer.com
r36.durabletilingservices.com.au
1    54.231.202.72 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    192.185.182.179 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-182-179.unifiedlayer.com
cashmereblues.com
2    162.213.255.79 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server283-1.web-hosting.com
hgh.abbeyhlli-int.com
2    67.223.118.126 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server326-5.web-hosting.com
api.ahfineartsinc.com
Domain Requested by
2 api.ahfineartsinc.com
2 hgh.abbeyhlli-int.com cdnjs.cloudflare.com
2 cashmereblues.com s3.amazonaws.com
1 cdnjs.cloudflare.com s3.amazonaws.com
1 s3.amazonaws.com kproxy.dongguk.edu
1 r36.durabletilingservices.com.au 1 redirects
1 kproxy.dongguk.edu
1 libk.dongguk.ac.kr 1 redirects
9 8

This site contains no links.

Subject Issuer Validity Valid
*.kproxy.dongguk.edu
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2022-11-09 -
2023-11-10		 a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01		 2022-12-06 -
2023-12-05		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh
www.old.cashmereblues.com
R3		 2023-02-01 -
2023-05-02		 3 months crt.sh
*.abbeyhlli-int.com
R3		 2023-02-06 -
2023-05-07		 3 months crt.sh
*.ahfineartsinc.com
R3		 2023-02-14 -
2023-05-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW
Frame ID: F30EC89CA1D8113B731963ED4D2BACF1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to continue

Page URL History Show full URLs

  1. https://libk.dongguk.ac.kr/outlink?moduleId=html&linkType=site_link&targetUrl=http%3A%2F%2FR36.durablet... HTTP 302
    https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiX... Page URL
  2. http://r36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFu... HTTP 302
    https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon0987654324567890987654... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

13 %
IPv6

8
Domains

8
Subdomains

6
IPs

2
Countries

337 kB
Transfer

463 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://libk.dongguk.ac.kr/outlink?moduleId=html&linkType=site_link&targetUrl=http%3A%2F%2FR36.durabletilingservices.com.au%2Fappforest_uf%2Ff4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN%2Findex.xhtml%3FlDlB%3DbWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t HTTP 302
    https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t Page URL
  2. http://r36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t HTTP 302
    https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://libk.dongguk.ac.kr/outlink?moduleId=html&linkType=site_link&targetUrl=http%3A%2F%2FR36.durabletilingservices.com.au%2Fappforest_uf%2Ff4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN%2Findex.xhtml%3FlDlB%3DbWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t HTTP 302
  • https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.xhtml
kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/
Redirect Chain
  • https://libk.dongguk.ac.kr/outlink?moduleId=html&linkType=site_link&targetUrl=http%3A%2F%2FR36.durabletilingservices.com.au%2Fappforest_uf%2Ff4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN%2Findex.xhtml%3FlDlB%3...
  • https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t
219 B
538 B 		Document
General
Check archive.org
Download Go to
Full URL
https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
210.94.174.194 Namyangju, Korea, Republic Of, ASN9323 (DGUNET-AS DONGGUK University, KR),
Reverse DNS
kproxy.dongguk.edu
Software
HUSS/2.0 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin
*
Connection
close
Content-Length
219
Content-Type
text/html
Server
HUSS/2.0
X-Content-Type-Options
nosniff
X-UA-Compatible
IE=Edge
X-XSS-Protection
1; mode=block

Redirect headers

Connection
Keep-Alive
Content-Language
ko-KR
Content-Length
0
Content-Type
text/plain; charset=UTF-8
Date
Wed, 15 Feb 2023 03:41:07 GMT
Keep-Alive
timeout=2, max=100
Location
https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t
Server
Apache
Primary Request logonon098765432456789098765435678909876543.html
s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/
Redirect Chain
  • http://r36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t
  • https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjli...
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW
Requested by
Host: kproxy.dongguk.edu
URL: https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.202.72 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
49b7a99c50a53ceb60946409f81a20254ac57ec05ffa0c5a0284ab6a829d54a4

Request headers

Referer
https://kproxy.dongguk.edu/_Lib_Proxy_Url/http://R36.durabletilingservices.com.au/appforest_uf/f4NnEeiXfOMgoDx2jcHPxJEfuQPYHUbBN/index.xhtml?lDlB=bWFyeV9jaGFuQGNhdGhheXBhY2lmaWMuY29t
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public,max-age=86400
Content-Length
1359
Content-Type
text/html
Date
Wed, 15 Feb 2023 03:43:40 GMT
ETag
"59c038e038f58b0c00c051f7be7a1da8"
Last-Modified
Wed, 15 Feb 2023 02:04:02 GMT
Server
AmazonS3
x-amz-id-2
JGxD/LXH3PLthYZ933rT5vxawdvhIPE7V/XXwGBiSrNlTmtXYlPdFPMMk6kys/o2kdRpcGpz3Zw=
x-amz-meta-app-version
test
x-amz-meta-appname
office0987654323456789iuj
x-amz-request-id
229R4W08R7EJ8ZDJ
x-amz-server-side-encryption
AES256
x-amz-version-id
vHRvr2GeBKqkDo9ssq6vcsIUszvhGUVJ

Redirect headers

Connection
Upgrade, Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Wed, 15 Feb 2023 03:43:39 GMT
Keep-Alive
timeout=5, max=75
Server
Apache
Upgrade
h2,h2c
location
https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 		88 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 03:43:40 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
27325
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27990
last-modified
Fri, 26 Aug 2022 18:34:13 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"63091225-6d56"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ujpIXsJdUo3IFD3Qa%2F7Jcf7fV9Ct7VDh0xoI3wfC7wQ4Eb1FOeOEv3zIdvGmQyY3M7mRQx4ykBsQjF2T2a1P8a1oKCB8aEIp6aiQzY%2FeTTexBh5Akkh23RSK%2BsSs7Uj4COOlp18ASPR54aAc6Rp1%2BbEy"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
799b0a634b103a98-FRA
expires
Mon, 05 Feb 2024 03:43:40 GMT
setoffice.js
cashmereblues.com/wp-jsfile/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cashmereblues.com/wp-jsfile/setoffice.js?jjnkn=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.182.179 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-182-179.unifiedlayer.com
Software
Apache /
Resource Hash
216ad084f862337088b8437e4cd92d75baf2abfeaf3fa68fd966c54d4a0071d8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 03:43:40 GMT
content-encoding
gzip
last-modified
Tue, 14 Feb 2023 12:38:06 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
14139
setoffice.js
cashmereblues.com/wp-jsfile/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cashmereblues.com/wp-jsfile/setoffice.js?hijiji=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/appforest_uf/f1676426641125x609889106781206300/logonon098765432456789098765435678909876543.html?s8HUAqckws3WsnAGMhxkxjEymSALlAx1DV8FFeswSsjVzy377z9AVZNW2KpPYUfxwrC6DzRbSjliRRzwdtnSDRvJqAh0MZmapEg6ErrPtoqr8As7r61U3aC5RuPnnG8erusU38xQ15Jw9FjYqHthwYpC5qMwJK8VmtTef89TI0rd9j5Oje4btexRlrJYqIvifyhS13j0&email=mary_chan@cathaypacific.com&GnwkM83YTadlkAhzemwmmH3hSRDX4KiFJ1Nk3daM2mr055J40AQxnQ5FowyTPC583zo8erRCaSd2HogWv6ZekwnVsjHRlLgNfTlMmuZNKpmLOKru26E0bI4KWrFvc8E4BquyiNJf6Nr34mnDW9C7r52NZu35mDuTPt8BSYnrjUAnfaggAgzYl9E7i4Cu7K4wMlVgvBcW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.182.179 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-182-179.unifiedlayer.com
Software
Apache /
Resource Hash
216ad084f862337088b8437e4cd92d75baf2abfeaf3fa68fd966c54d4a0071d8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 03:43:40 GMT
content-encoding
gzip
last-modified
Tue, 14 Feb 2023 12:38:06 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
14139
sendoffice.php
hgh.abbeyhlli-int.com/sendmail/outboxmails/ 		320 B
317 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hgh.abbeyhlli-int.com/sendmail/outboxmails/sendoffice.php
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed / PHP/7.1.33
Resource Hash
c7c8487328400adfdf265712e06a08c85bdeeeae7d7461a091d1bfa87da1eeda

Request headers

Accept
*/*
Referer
https://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 15 Feb 2023 03:43:41 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.1.33
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-turbo-charged-by
LiteSpeed
content-length
146
sendoffice.php
hgh.abbeyhlli-int.com/sendmail/outboxmails/ 		149 B
253 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hgh.abbeyhlli-int.com/sendmail/outboxmails/sendoffice.php
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed / PHP/7.1.33
Resource Hash
9d530d1cf89fedac2625fd767b3fb6528e6ca3ea2dd629727c405300e2410e96

Request headers

Accept
*/*
Referer
https://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 15 Feb 2023 03:43:44 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.1.33
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-turbo-charged-by
LiteSpeed
content-length
83
download_35.jpeg
api.ahfineartsinc.com/api/pics/ 		277 KB
277 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.ahfineartsinc.com/api/pics/download_35.jpeg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.223.118.126 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server326-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 03:43:42 GMT
last-modified
Tue, 02 Aug 2022 20:40:02 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
283351
expires
Wed, 22 Feb 2023 03:43:42 GMT
download02.png
api.ahfineartsinc.com/api/pics/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.ahfineartsinc.com/api/pics/download02.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.223.118.126 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server326-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36

Response headers

date
Wed, 15 Feb 2023 03:43:42 GMT
last-modified
Tue, 02 Aug 2022 20:40:02 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
1057
expires
Wed, 22 Feb 2023 03:43:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery string| result string| themain function| addJS function| fn1 function| fn2 function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

1 Cookies

Domain/Path Name / Value
libk.dongguk.ac.kr/ Name: JSESSIONID
Value: 32B8C406DEC24C45C97EB57DB7CC5E1E

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block