onedriv.d1om08l0kay4iy.amplifyapp.com Open in urlscan Pro
216.137.44.123  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response onedriv.d1om08l0kay4iy.amplifyapp.com/	164 KB 81 KB	453ms 367ms	Document text/html	216.137.44.123 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.137.44.123 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-216-137-44-123.lhr61.r.cloudfront.net Software AmazonS3 / Resource Hash 3c77eb8ce48b659d6c1cdeb1d25c7ecbdd27a5259f4575a558ba6e9addabbed2 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Wed, 24 Apr 2024 15:17:49 GMT etag W/"f617f23321557941bb0e44e862b8595a" last-modified Wed, 24 Apr 2024 09:28:05 GMT server AmazonS3 vary Accept-Encoding via 1.1 f4d9e5aa78d9bbc69bc2a7f8ca614182.cloudfront.net (CloudFront) x-amz-cf-id D5JFhxwA7DnSjq9ZYbOsLQcq8mm-F4xNOB6djNSHaWlujKexyQDMVg== x-amz-cf-pop LHR61-P2 x-cache Miss from cloudfront
GET H2	200	w3.css www.w3schools.com/w3css/4/	23 KB 5 KB	80ms 11ms	Stylesheet text/css	192.229.133.221 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://www.w3schools.com/w3css/4/w3.css Requested by Host: onedriv.d1om08l0kay4iy.amplifyapp.com URL: https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.221 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6796) / ASP.NET Resource Hash c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://mycourses.w3schools.com; X-Content-Security-Policy frame-ancestors 'self' https://mycourses.w3schools.com; Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy frame-ancestors 'self' https://mycourses.w3schools.com; content-encoding gzip date Wed, 24 Apr 2024 15:17:49 GMT last-modified Wed, 24 Apr 2024 12:38:36 GMT server ECS (frb/6796) age 3184 etag "0ae47534496da1:0+gzip" x-powered-by ASP.NET vary Accept-Encoding x-cache HIT content-type text/css cache-control public,max-age=14400,public accept-ranges bytes content-length 5256 x-content-security-policy frame-ancestors 'self' https://mycourses.w3schools.com;
GET H3	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/	98 KB 17 KB	43ms 25ms	Stylesheet text/css	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css Requested by Host: onedriv.d1om08l0kay4iy.amplifyapp.com URL: https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Origin https://onedriv.d1om08l0kay4iy.amplifyapp.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 24 Apr 2024 15:17:49 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 578912 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 17041 last-modified Tue, 22 Mar 2022 17:32:26 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "623a082a-4291" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2E4JSabvViE7M3UOUoDC4qjrCcTR%2FHMdYVIZE4j4VRB5MITeMoS7urMbshlE673GreKpo8YJYYZ8g8LNdz95aoCP1sw75pYNdOeDVxHqf6q%2FPTCkDgLKTkW%2Fe4DOW5Jt9Zj%2BRHWH"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 87970ff889ca1c85-FRA expires Mon, 14 Apr 2025 15:17:49 GMT
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 72824f3fe09c1e718f8ef2726b7ac44591443f2e6d6c68cc2faf2a2a042dd933 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H3	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/	151 KB 151 KB	23ms 22ms	Font application/octet-stream	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css Origin https://onedriv.d1om08l0kay4iy.amplifyapp.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 24 Apr 2024 15:17:49 GMT strict-transport-security max-age=15780000 x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 581670 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 154228 last-modified Tue, 22 Mar 2022 17:32:26 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "623a082a-25a74" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=olM2T1CvGH3E%2FXybmXc2PhmEhtAwUbE6Pkg2eTzr4OhPomYT2WH9xboK%2Bc92W54jmlQ0sjMY1tXvHU18570QZffcvsAyQFqVrRZ%2FoeYyBdTw8o5op8OCx%2FQwvRgqHHgZ8d0VNykp"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 87970ff99b301c85-FRA expires Mon, 14 Apr 2025 15:17:49 GMT
GET DATA	200 OK	truncated /	10 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c387092aa56fb5837772d45151eb6aead41d77472959d8c14dc2df043d50e3c3 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d06241f1eebbe8cf9c32e2fd9fcede046757997ae44d122ea6756474d3af05a Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b6801179664e6f0c5a76912cc463466cb9a3539168b2b0b71de26fd307af7384 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	40 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3c980cd344c939662b52e4fa1c4e5a5f987d4323205a264212a32bf161e07597 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET H2	200	microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png aadcdn.msauth.net/shared/1.0/content/images/	1 KB 2 KB	237ms 179ms	Image image/png	2620:1ec:46::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png Requested by Host: onedriv.d1om08l0kay4iy.amplifyapp.com URL: https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:46::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 24 Apr 2024 15:17:49 GMT x-cache TCP_MISS x-fd-int-roxy-purgeid 4554691 content-length 1057 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT etag 0x8D79B8373D6EAF6 x-azure-ref 20240424T151749Z-15ff4544644g4k4tctctgz5q1g00000008eg000000001qn9 content-type image/png access-control-allow-origin * x-ms-request-id 87788059-101e-0017-5d5a-9684b2000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg logincdn.msauth.net/shared/1.0/content/images/	513 B 839 B	99ms 35ms	Image image/svg+xml	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: onedriv.d1om08l0kay4iy.amplifyapp.com URL: https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 24 Apr 2024 15:17:49 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 67912908 content-length 276 x-ms-lease-status unlocked last-modified Wed, 22 Jan 2020 00:38:00 GMT etag 0x8D79ED35591CF44 x-azure-ref 20240424T151749Z-15ff454464479kj857gs9au3e400000000eg00000001ax8h content-type image/svg+xml access-control-allow-origin * x-ms-request-id b6d615aa-301e-0005-27c8-956294000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png aadcdn.msauth.net/shared/1.0/content/images/	1 KB 0	0ms 0ms	Other image/png	2620:1ec:46::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:46::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 24 Apr 2024 15:17:49 GMT x-cache TCP_MISS x-fd-int-roxy-purgeid 4554691 content-length 1057 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT etag 0x8D79B8373D6EAF6 x-azure-ref 20240424T151749Z-15ff4544644g4k4tctctgz5q1g00000008eg000000001qn9 content-type image/png access-control-allow-origin * x-ms-request-id 87788059-101e-0017-5d5a-9684b2000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _0xd209 string| email_var object| bodyDIV function| ValidateEmail function| redirrectPage number| counter function| backArrow function| onChangeFunction

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://onedriv.d1om08l0kay4iy.amplifyapp.com/ Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
cdnjs.cloudflare.com
logincdn.msauth.net
onedriv.d1om08l0kay4iy.amplifyapp.com
www.w3schools.com
104.17.25.14
192.229.133.221
216.137.44.123
2620:1ec:46::64
2620:1ec:bdf::64
0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3c77eb8ce48b659d6c1cdeb1d25c7ecbdd27a5259f4575a558ba6e9addabbed2
3c980cd344c939662b52e4fa1c4e5a5f987d4323205a264212a32bf161e07597
5d06241f1eebbe8cf9c32e2fd9fcede046757997ae44d122ea6756474d3af05a
72824f3fe09c1e718f8ef2726b7ac44591443f2e6d6c68cc2faf2a2a042dd933
b6801179664e6f0c5a76912cc463466cb9a3539168b2b0b71de26fd307af7384
c387092aa56fb5837772d45151eb6aead41d77472959d8c14dc2df043d50e3c3
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c