urlscan.io logo urlscan.io
SecurityTrails logo

s3.amazonaws.com Open in urlscan Pro
52.217.9.22  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Submission: On January 17 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 52.217.9.22, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is s3.amazonaws.com.
This is the only time s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 52.217.9.22 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 52.217.48.94 16509 (AMAZON-02)
1 83.223.113.113 29017 (GYRON )
2 162.213.255.79 22612 (NAMECHEAP...)
7 5
1    52.217.9.22 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    52.217.48.94 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
1    83.223.113.113 (Luton, United Kingdom)

ASN29017 (GYRON , GB)
PTR: svr01.boldidentities.com
careers.sweetgreen.com
2    162.213.255.79 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server283-1.web-hosting.com
api.vope.uk
Apex Domain
Subdomains		 Transfer
3 amazonaws.com
s3.amazonaws.com
99 KB
2 vope.uk
api.vope.uk
278 KB
1 sweetgreen.com
careers.sweetgreen.com
336 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 199
28 KB
7 4
Domain Requested by
3 s3.amazonaws.com s3.amazonaws.com
2 api.vope.uk
1 careers.sweetgreen.com cdnjs.cloudflare.com
1 cdnjs.cloudflare.com s3.amazonaws.com
7 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01		 2022-12-06 -
2023-12-05		 a year crt.sh
careers.sweetgreen.com
R3		 2022-12-01 -
2023-03-01		 3 months crt.sh
*.vope.uk
R3		 2022-11-24 -
2023-02-22		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Frame ID: C9269CC587CFBBC71467B6BD3B80BB46
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to continue

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

20 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

406 kB
Transfer

463 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.xhtml
s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
HTTP/1.1
Server
52.217.9.22 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
db54c2c19f649c63be74e6af6d6a81fe2855c37978692a636168da661ded4934

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public,max-age=86400
Content-Length
1252
Content-Type
application/xhtml+xml
Date
Tue, 17 Jan 2023 12:22:13 GMT
ETag
"93ff95638ed06b775d77ee68f7a9303d"
Last-Modified
Fri, 13 Jan 2023 00:17:12 GMT
Server
AmazonS3
x-amz-id-2
P6gb1WhLDeti03soWOAXhycgLVBiDSBsLBCXUnEClDtjT44gLp+gKeKwS7fFXfsza8b79GkbdEU=
x-amz-meta-app-version
test
x-amz-meta-appname
sharefilepoiye79
x-amz-request-id
63JD7RZ77VNGVB2C
x-amz-server-side-encryption
AES256
x-amz-version-id
_ZBz2NaVyxAFggjNO6PRjzqenXlqWG2B
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/ 		88 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: s3.amazonaws.com
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 17 Jan 2023 12:22:12 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4803519
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27990
last-modified
Fri, 26 Aug 2022 18:34:13 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"63091225-6d56"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CP2PHDw7WutSXuAobAa7UJTDuRrHnXbnCv7kafwiihEGMoNYaCSyxiJbTK5eQy2XaIVkKynx3VC8NPaJNShHtHYvIMBqXmWIwho%2BXBTbAmltM8BMU0tEGoHG7MFAtiL8q24nrJLKKaXQSagcADpWrWlb"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
78af0e1acdc590f4-FRA
expires
Sun, 07 Jan 2024 12:22:12 GMT
index.js
s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/ 		48 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?jjnkn=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.48.94 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Tue, 17 Jan 2023 12:22:14 GMT
x-amz-meta-appname
sharefilepoiye79
x-amz-version-id
Th_416BG4mAehxtJUPNRlOc5AsjjNvQd
Last-Modified
Fri, 13 Jan 2023 00:15:02 GMT
Server
AmazonS3
x-amz-request-id
9EE00F3XQZWBM50B
ETag
"fd675655d10d765b14f6df1f8198a8a6"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
49412
x-amz-id-2
psP/ypdmFg86bEJf+dJfLu0tJXsTFDMfSbPCQHRp+yP1y4d1nsVLoi4iFATDREcEV92RBXfWznM=
index.js
s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/ 		48 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/appforest_uf/f1673568900735x282132772109802800/index.js?hijiji=dGVzdEBtYWlsLmNvbQ--
Requested by
Host: s3.amazonaws.com
URL: http://s3.amazonaws.com/appforest_uf/f1673569031431x837044964462498200/index.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.48.94 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
585b586d0574df84e8035d103f86f933c2973b5c233d5fe8115adb39b84ba021

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date
Tue, 17 Jan 2023 12:22:14 GMT
x-amz-meta-appname
sharefilepoiye79
x-amz-version-id
Th_416BG4mAehxtJUPNRlOc5AsjjNvQd
Last-Modified
Fri, 13 Jan 2023 00:15:02 GMT
Server
AmazonS3
x-amz-request-id
9EE50MQEVP6RVZYT
ETag
"fd675655d10d765b14f6df1f8198a8a6"
x-amz-server-side-encryption
AES256
x-amz-meta-app-version
test
Content-Type
text/javascript
Cache-Control
public,max-age=86400
Accept-Ranges
bytes
Content-Length
49412
x-amz-id-2
7xLsDv5Q65tW/xQJhCO/0GAirC7mf8Y3ocZTG98MvM2t3oyf3xvghgVNG0A0gUpVP26MQruWMZo=
error.php
careers.sweetgreen.com/vendor/monolog/ 		260 B
336 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://careers.sweetgreen.com/vendor/monolog/error.php
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
83.223.113.113 Luton, United Kingdom, ASN29017 (GYRON , GB),
Reverse DNS
svr01.boldidentities.com
Software
Apache /
Resource Hash
df752bccd0ae736aaeb09b9e683752d63aa1c105c3c043951349d3f5057180cd

Request headers

Accept
*/*
Referer
http://s3.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 17 Jan 2023 12:22:13 GMT
server
Apache
content-type
text/html; charset=UTF-8
download_35.jpeg
api.vope.uk/pics/ 		277 KB
277 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.vope.uk/pics/download_35.jpeg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 17 Jan 2023 12:22:14 GMT
last-modified
Thu, 24 Nov 2022 17:55:49 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
283351
expires
Tue, 24 Jan 2023 12:22:14 GMT
download02.png
api.vope.uk/pics/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.vope.uk/pics/download02.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.213.255.79 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server283-1.web-hosting.com
Software
LiteSpeed /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Tue, 17 Jan 2023 12:22:14 GMT
last-modified
Thu, 24 Nov 2022 17:55:54 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
1057
expires
Tue, 24 Jan 2023 12:22:14 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery string| result function| addJS function| fn1 function| fn2 function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies