main.dd37ngr3k2s2a.amplifyapp.com Open in urlscan Pro
13.32.99.95  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://main.dd37ngr3k2s2a.amplifyapp.com/?bcda=09-70-38-05-79 Page URL
2. https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ main.dd37ngr3k2s2a.amplifyapp.com/	1 KB 916 B	345ms 309ms	Document text/html	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/?bcda=09-70-38-05-79 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Tue, 19 Mar 2024 11:11:44 GMT etag W/"667b0a22eae31539263aaa2ba9244300" last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 vary Accept-Encoding via 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront) x-amz-cf-id Pgb0cJcVR4Q8M3d9m9sE9iHoerw70PT8HqLQED7GosOoJp8T0Q8Aow== x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront
GET H2	200	Primary Request / Show response main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/	19 KB 6 KB	300ms 299ms	Document text/html	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/?bcda=09-70-38-05-79 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 0af591f764cdc63c13e37f794a850d95f74d5f49a26b685a49197f9e3aad89fe Request headers Referer https://main.dd37ngr3k2s2a.amplifyapp.com/?bcda=09-70-38-05-79 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Tue, 19 Mar 2024 11:11:44 GMT etag W/"e9db93ee237f762cdff65225eec57c94" last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 vary Accept-Encoding via 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront) x-amz-cf-id 7Uo8I8vq8DpwS-azbb-241HRA-HD1-FMdgmQsdojhOlGks4-A_MjNg== x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront
GET H3	200	pstyle.css main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/	33 KB 7 KB	360ms 359ms	Stylesheet text/css	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/pstyle.css Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 1c350e5a28202ceb9a43a70e679316e10edc49a23661ed54b90db5d45084237a Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:44 GMT content-encoding gzip via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag W/"4af2b60ba37e3bb71fed8ef1a03a2e7a" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id EeZk0EyQZzaMUlqpPdSEeW7gk93PtRcv3YyOuQkj-57LP4_4RsqLdg==
GET H2	200	js Show response www.googletagmanager.com/gtag/	181 KB 67 KB	51ms 31ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-xxx-x Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a67f3164bd4f4d4b7506332020c1f7bc6e998dc3dfc1c50bd08ceda22578e07f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 67820 x-xss-protection 0 last-modified Tue, 19 Mar 2024 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 19 Mar 2024 11:11:44 GMT
GET H3	200	msmm.png main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/	168 B 463 B	315ms 315ms	Image image/png	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/msmm.png Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:44 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "acb05ebcd5f488fc99169cff02b6dd04" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 168 x-amz-cf-id njdJWuRLJwhIjWoHmzd-iegyg5nuj1S3WSbhtUDRkV1pw9ngboW9UQ==
GET H3	200	dm.png main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/	332 B 626 B	302ms 302ms	Image image/png	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/dm.png Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 7df9f467d23ee1887edb2123cca10a1a9c4624cdcf7199c64e78a8430031f9f5 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:44 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "9d8a90a63d20f05d27e5d6abb35e0cd0" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 332 x-amz-cf-id 4SyXfAs5QjuIFYCBVM3yINoXtgJo8yxOuQ4kW0p4XdscdAvHcoNlOA==
GET H3	200	cs.png main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/	3 KB 3 KB	316ms 316ms	Image image/png	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/cs.png Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash b67a7c07a045d7cb0f2e216a557aec0d99405e17c36d1a6b1ff3e2733aa35348 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "b01a30d354bfcf51edf33e0b0ea07402" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 2681 x-amz-cf-id DyxxY8y5oViUj2qpqTbm1mGEKPlfEv0ffkuCK3ZkSPnHTFkLkYTPEA==
GET H3	200	re.gif main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/	14 KB 15 KB	307ms 307ms	Image image/gif	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/re.gif Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "6fcb78e0cd7933a70eea2cf071f82118" x-cache Miss from cloudfront content-type image/gif cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 14751 x-amz-cf-id v_9GCKIHro3M6cqeynpP2_vB5y3tKWcPOvFj8n92hLqh97fjvtt9Zw==
GET H3	200	wall.png main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/images/	1 KB 1 KB	395ms 394ms	Image image/png	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/images/wall.png Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "bf2b460590fbb9d8e9611a6e9006b816" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 1045 x-amz-cf-id p88peMhCJQ8VWnfjup451hHDYUwH7-TBtnCQStf3AkAc2rN_JJtQrA==
GET H3	200	pscript.js Show response main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/js/	9 KB 3 KB	300ms 299ms	Script application/javascript	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/js/pscript.js Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 4ef01e4af70d28c3a12c54ed17c9ca0b8d1a5b39b42dde46ce7206000f947edf Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT content-encoding gzip via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag W/"e9f0c63dae7a69ef0ffea6badaf47dcb" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id sJ4crGY91V1CtI0H3S21ZrthkVW3uFZnVvyXqKeMCcjUezRcgrT48Q==
GET H3	200	jquery-3.2.1.min.js Show response main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/js/	85 KB 30 KB	654ms 653ms	Script application/javascript	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/js/jquery-3.2.1.min.js Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash ba7d154e5ef77906946f6ae267c919a96df47cf7abbb1f7f4fb36a434493ee65 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT content-encoding gzip via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag W/"0f62753e9462c9b2b7b2260e0f22f866" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id wlsc3uxawJGNJfFTi4NkqCN8RhNCmUDi4PyNuOGEo90qL0Wt_mcVfQ==
GET H3	200	5f205bb74a5eb_v.css main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/	215 B 509 B	299ms 298ms	Stylesheet text/css	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/5f205bb74a5eb_v.css Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash bde6a5369760d9427c6d72a624f3087740cfbe00cb421f381cff78733d0fe52e Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "8d09a7c2d5bbfbc6eb22fbc87d94f1e5" x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 215 x-amz-cf-id rb2J22q_Rlm5eZt07KgBNHtOBwJYcBOEi4wkFZSaGk79UY14HZGrlA==
GET H3	200	froala_style.min.css main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/	7 KB 2 KB	305ms 304ms	Stylesheet text/css	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/froala_style.min.css Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 1cfc73a6db9523c12b6b7f5d009bed19c8799eed001f607bd891a1fd838b7739 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT content-encoding gzip via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag W/"8d4fba5186f02a0c4458986b0cf91667" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id QCsMPNU2hZqENVgj-c2rL_ag176VAIsY65ia0kK2J4UGzk1Lam9BHw==
GET H3	200	5f205bb63ccd2_v.css main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/	215 B 508 B	308ms 307ms	Stylesheet text/css	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/5f205bb63ccd2_v.css Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash b2e3bab239ceeccef12af09a16dad170ced312a26e918b8b6ee808e150dc598f Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "6404d14881bace88f82a98ca0661a5f4" x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 215 x-amz-cf-id hTdOlWpVBQEIS6RLtdhtcGghKfYbxbKE6LuYEeTQfZkmK13_eppc8g==
GET H3	200	5f205bc497791_v.css main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/	215 B 509 B	306ms 305ms	Stylesheet text/css	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/css/5f205bc497791_v.css Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash eeea3053ace1602a6f2582bcccb90fac1191ecce1c49a0370bef53299a7b44a6 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "54adb5388fee62773142b044262b0c9b" x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 215 x-amz-cf-id uEUwg7u_BlXAWVOr48YfRMn1BjXvur2WpqdJQe5qAPCGjlhgp4nbNg==
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	30ms 7ms	Script text/javascript	2a00:1450:4001:81d::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-xxx-x Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 19 Mar 2024 09:48:08 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 5017 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Tue, 19 Mar 2024 11:48:08 GMT
GET H3	200	website2.png main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/images/	111 KB 111 KB	296ms 295ms	Image image/png	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/images/website2.png Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "5e20d8c5bd6c7a06298a2663a1cc8403" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 113635 x-amz-cf-id 41juaSR7H9TuyYGPTn9JNp-Bsh2NqPzFlsZ-IfTt3J5G1tJUREcwZw==
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 219 B	15ms 14ms	XHR text/plain	2a00:1450:4001:81d::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1816915645&t=pageview&_s=1&dl=https%3A%2F%2Fmain.dd37ngr3k2s2a.amplifyapp.com%2Fwerrx01USAHTML%2F%3Fbcda%3D09-70-38-05-79&ul=en-us&de=UTF-8&dt=La%20s%C3%A9curit%C3%A9%20n%C3%A9cessite%20une%20action&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=174135586&gjid=2022625596&cid=1233913075.1710846705&tid=UA-xxx-x&_gid=2064210067.1710846705&_r=1&gtm=457e43d0za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&jsscut=1&npa=1&z=945760012 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://main.dd37ngr3k2s2a.amplifyapp.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 19 Mar 2024 11:11:45 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://main.dd37ngr3k2s2a.amplifyapp.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	206	en.wav main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/media/	303 KB 0	298ms 298ms	Media audio/wave	13.32.99.95 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/media/en.wav Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Protocol H3 Security QUIC, , AES_128_GCM Server 13.32.99.95 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-95.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Accept-Encoding identity;q=1, *;q=0 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Range bytes=0- Response headers date Tue, 19 Mar 2024 11:11:45 GMT via 1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 10:22:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P3 etag "07327eeb7f99ecab31e07525272a125a" x-cache Miss from cloudfront content-type audio/wave Content-Range bytes 0-1820869/1820870 cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id 7bExwIfO8EvC2qunm3alurAZJsdUZUC7RxQ6ULR-Pzmf7GZ6iOBhJQ== Content-Length 1820870
GET H2	200	script.js Show response userstatics.com/get/	133 B 714 B	98ms 60ms	Script text/html	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://userstatics.com/get/script.js?referrer=https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/?bcda=09-70-38-05-79 Requested by Host: main.dd37ngr3k2s2a.amplifyapp.com URL: https://main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML/js/jquery-3.2.1.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/8.2.1 Resource Hash df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26 Request headers accept-language de-DE,de;q=0.9 Referer https://main.dd37ngr3k2s2a.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Tue, 19 Mar 2024 11:11:46 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/8.2.1 vary Accept-Encoding access-control-allow-methods GET, POST content-type text/html; charset=utf-8 access-control-allow-origin https://main.dd37ngr3k2s2a.amplifyapp.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XSGWBd7WmP6XVj6o6EIxRictulq85I9ZVA89BePsFUsK6Bg2N5uX7SRthiovGIa%2Bv8uRLAY%2Bx5X8Tn3lDls%2BwtRpUk3Qbo%2Fd0xSfar0qLQSyeih0wjMQFbho4SuObbgm7TU%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-credentials true cf-ray 866d060e581e3a80-FRA access-control-allow-headers X-Requested-With,content-type alt-svc h3=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| google_tag_manager object| google_tag_data object| dataLayer function| gtag string| GoogleAnalyticsObject function| ga function| getVariableFromURl string| bcda object| gaplugins object| gaGlobal object| gaData function| showBlueDescriptionPopupWithDelay function| showerrorTelecast function| closeFirstPopup function| changeBackground function| showDisclaimerPopup function| cancelFirstPopup function| okFirstPopup function| simulateF11Key function| showBlueDescriptionPopup function| showSecondPopup function| showSupportNotificationWithDelay function| hideSecondPopup function| showKeyCodePopup function| submitKeyCode function| closeSecondPopup function| getRandomSupportResponse function| handleSuggestion function| getSupportResponse object| modal object| btn object| span number| e number| isNS function| mischandler function| mousehandler function| $ function| jQuery function| myFunction function| addEvent

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			main.dd37ngr3k2s2a.amplifyapp.com/werrx01USAHTML	1970-01-20 19:14:46	Name: PHPREFS Value: full
			.amplifyapp.com/	1970-01-21 04:50:06	Name: _ga Value: GA1.2.1233913075.1710846705
			.amplifyapp.com/	1970-01-20 19:15:33	Name: _gid Value: GA1.2.2064210067.1710846705
			.amplifyapp.com/	1970-01-20 19:14:06	Name: _gat_gtag_UA_xxx_x Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

main.dd37ngr3k2s2a.amplifyapp.com
userstatics.com
www.google-analytics.com
www.googletagmanager.com
13.32.99.95
188.114.97.3
2a00:1450:4001:80e::2008
2a00:1450:4001:81d::200e
0af591f764cdc63c13e37f794a850d95f74d5f49a26b685a49197f9e3aad89fe
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115
1c350e5a28202ceb9a43a70e679316e10edc49a23661ed54b90db5d45084237a
1cfc73a6db9523c12b6b7f5d009bed19c8799eed001f607bd891a1fd838b7739
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86
4ef01e4af70d28c3a12c54ed17c9ca0b8d1a5b39b42dde46ce7206000f947edf
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7df9f467d23ee1887edb2123cca10a1a9c4624cdcf7199c64e78a8430031f9f5
948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342
a67f3164bd4f4d4b7506332020c1f7bc6e998dc3dfc1c50bd08ceda22578e07f
b2e3bab239ceeccef12af09a16dad170ced312a26e918b8b6ee808e150dc598f
b67a7c07a045d7cb0f2e216a557aec0d99405e17c36d1a6b1ff3e2733aa35348
ba7d154e5ef77906946f6ae267c919a96df47cf7abbb1f7f4fb36a434493ee65
bde6a5369760d9427c6d72a624f3087740cfbe00cb421f381cff78733d0fe52e
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03
eeea3053ace1602a6f2582bcccb90fac1191ecce1c49a0370bef53299a7b44a6