s3.eu-central-1.amazonaws.com Open in urlscan Pro
52.219.171.177  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/	291 KB 291 KB	73ms 62ms	Document text/html	52.219.171.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/index.html Protocol HTTP/1.1 Server 52.219.171.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash 9b0d6ce23bad260f9e961b4cf3e97853ffd609ad0602276a6526872a05a4f854 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers x-amz-id-2 NPRgrch8nco9MvMXURenGDYe57AjRhUSRFNJMPq8gCRsdsp4YbHAAmFcO4Bfolga6YBo4cd/YbM= x-amz-request-id GGC8C4DZAJK2K7XR Date Thu, 06 Jan 2022 13:13:37 GMT Last-Modified Wed, 29 Dec 2021 22:00:21 GMT ETag "edfa069e1f8c3425794cbf832a7dc12b" Accept-Ranges bytes Content-Type text/html Server AmazonS3 Content-Length 297984
GET H/1.1	200 OK	lbkddierjfnsakdirjwj.png s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/	7 KB 7 KB	37ms 37ms	Image image/png	52.219.171.177 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/lbkddierjfnsakdirjwj.png Requested by Host: s3.eu-central-1.amazonaws.com URL: http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/index.html Protocol HTTP/1.1 Server 52.219.171.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash 46dd46e86d48900afbc2c6b5ca6610ac743f02686275d6247380d181617488f1 Request headers Accept-Language de-DE,de;q=0.9 Referer http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Thu, 06 Jan 2022 13:13:37 GMT Last-Modified Wed, 29 Dec 2021 22:00:21 GMT Server AmazonS3 x-amz-request-id GGC1JPAKAGPYJMD7 ETag "f2fcff55eef419cd3bb4cfcb505ffa9e" Content-Type image/png Accept-Ranges bytes Content-Length 6842 x-amz-id-2 q/MECrwfiNmOX5DxllijgXdHH9nBYHQizGnmNB0B0OYJqMIvKwdzEWtpW3JpJX/XqJBjaSW5gk8=
GET H2	200	jquery-3.3.1.min.js Show response code.jquery.com/	85 KB 30 KB	42ms 13ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.min.js Requested by Host: s3.eu-central-1.amazonaws.com URL: http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers Accept-Language de-DE,de;q=0.9 Referer http://s3.eu-central-1.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 06 Jan 2022 13:13:36 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-1538f" vary Accept-Encoding x-hw 1641474816.dop053.fr8.t,1641474816.cds206.fr8.hn,1641474816.cds057.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30288
GET H/1.1	200 OK	ZJH_2F3Xi0SopxxCuN7EKeDY.jpg s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/	17 KB 17 KB	55ms 49ms	Image image/jpeg	52.219.171.177 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/ZJH_2F3Xi0SopxxCuN7EKeDY.jpg Requested by Host: s3.eu-central-1.amazonaws.com URL: http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/index.html Protocol HTTP/1.1 Server 52.219.171.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3 Request headers Accept-Language de-DE,de;q=0.9 Referer http://s3.eu-central-1.amazonaws.com/hghsggsbjnd.mjhfcrodkfjhsotfnmdbff.kuuss/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Thu, 06 Jan 2022 13:13:37 GMT Last-Modified Wed, 29 Dec 2021 22:00:22 GMT Server AmazonS3 x-amz-request-id GGCE1348KYK79T7Z ETag "7916a894ebde7d29c2cc29b267f1299f" Content-Type image/jpeg Accept-Ranges bytes Content-Length 17453 x-amz-id-2 ZIjWbJXVZlYBP79xjIyRlGutujsFdGIkhCbSWuJAoUUBv47rKUMPLugbMS0ng9W2Y1ojP8/aQ6k=

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onsecuritypolicyviolation object| onslotchange function| $ function| jQuery function| goNext function| closeBox function| checkSubmit function| isEmail function| iserror string| queryString string| email object| urlParams object| domain string| urlLink boolean| check

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
s3.eu-central-1.amazonaws.com
2001:4de0:ac18::1:a:3b
52.219.171.177
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
46dd46e86d48900afbc2c6b5ca6610ac743f02686275d6247380d181617488f1
9b0d6ce23bad260f9e961b4cf3e97853ffd609ad0602276a6526872a05a4f854
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3