pure-cove-15532.herokuapp.com Open in urlscan Pro
52.200.11.93 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://pure-cove-15532.herokuapp.com/
Submission: On September 10 via manual (September 10th 2019, 6:16:18 pm UTC) from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 52.200.11.93, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is pure-cove-15532.herokuapp.com.

This is the only time pure-cove-15532.herokuapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	52.200.11.93 52.200.11.93	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
13	4

9 52.200.11.93 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-200-11-93.compute-1.amazonaws.com

pure-cove-15532.herokuapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	herokuapp.com pure-cove-15532.herokuapp.com	423 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	29 KB
1	googleapis.com ajax.googleapis.com	30 KB
1	jquery.com code.jquery.com	33 KB
13	4

	Domain	Requested by
9	pure-cove-15532.herokuapp.com	pure-cove-15532.herokuapp.com code.jquery.com
2	maxcdn.bootstrapcdn.com	pure-cove-15532.herokuapp.com
1	ajax.googleapis.com	pure-cove-15532.herokuapp.com
1	code.jquery.com	pure-cove-15532.herokuapp.com
13	4

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA	`2018-10-03` - `2019-10-12`	a year	crt.sh
*.googleapis.com GTS CA 1O1	`2019-08-23` - `2019-11-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://pure-cove-15532.herokuapp.com/
Frame ID: CFA9EAB843555F4EA9A15A0F95A1EECB
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

31 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

515 kB
Transfer

755 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
pure-cove-15532.herokuapp.com/ 5 KB
5 KB 209ms
185ms Document
text/html 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://pure-cove-15532.herokuapp.com/
Protocol: HTTP/1.1
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 6b32ad7d2b816178a0c7a81352efdc428534a53d034073f4c7b959c4dbc7d3dc

Request headers

Host: pure-cove-15532.herokuapp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 10 Sep 2019 18:16:01 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Via: 1.1 vegur

GET
H/1.1 200
OK shakeppfl.css
pure-cove-15532.herokuapp.com/jinku/ 5 KB
6 KB 105ms
103ms Stylesheet
text/css 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://pure-cove-15532.herokuapp.com/jinku/shakeppfl.css
Requested by: Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 50eb1781f88cdb801fa745a413c90809a328ce97ea9295555a2e52099612372b

Request headers

Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:01 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "152d-5923266f67040"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5421

GET
H/1.1 200
OK jquery.min.js Show response
code.jquery.com/ 94 KB
33 KB 1859ms
1856ms Script
application/javascript 2001:4de0:ac18::1:a:3b
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery.min.js
Requested by: Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:03 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:08 GMT
Server: nginx
ETag: W/"54499a48-1764d"
Vary: Accept-Encoding
X-HW: 1568139354.dop004.fr8.shc,1568139354.dop004.fr8.t,1568139362.cds137.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 33226

GET
H/1.1 200
OK jquert7.js Show response
pure-cove-15532.herokuapp.com/jinku/ 85 KB
85 KB 204ms
186ms Script
application/javascript 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://pure-cove-15532.herokuapp.com/jinku/jquert7.js
Requested by: Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855

Request headers

Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:01 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "1538e-5923266f67040"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86926

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/ 119 KB
19 KB 14ms
12ms Stylesheet
text/css 2001:4de0:ac19::1:b:1a
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css
Requested by: Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: /
Resource Hash: 1f429f4e2829515fb4ff9b67d875c2d023f08610e15a049ac0976715dd02182a

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Sep 2019 18:16:01 GMT
content-encoding: gzip
last-modified: Fri, 14 Dec 2018 05:14:43 GMT
status: 200
etag: "1544764483"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 19736

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:81d::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 26 Aug 2019 10:27:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1324124
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 30399
x-xss-protection: 0
last-modified: Thu, 25 Jan 2018 15:33:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Aug 2020 10:27:17 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/ 37 KB
10 KB 11ms
10ms Script
text/javascript 2001:4de0:ac19::1:b:1a
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js
Requested by: Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: /
Resource Hash: 909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 10 Sep 2019 18:16:01 GMT
content-encoding: gzip
last-modified: Fri, 14 Dec 2018 05:14:43 GMT
status: 200
etag: "1544764483"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 10035

GET
H/1.1 200
OK side2.png
pure-cove-15532.herokuapp.com/jinku/ 52 KB
52 KB 201ms
183ms Image
image/png 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pure-cove-15532.herokuapp.com/jinku/side2.png
Requested by: Host: pure-cove-15532.herokuapp.com
URL: http://pure-cove-15532.herokuapp.com/
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 418019d168be0b2926def4bccd3f573c79489a736cb12b8277ec6ef423819582

Request headers

Referer: http://pure-cove-15532.herokuapp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:01 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "d0c2-5923266f67040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 53442

GET
H/1.1 200
OK run.png
pure-cove-15532.herokuapp.com/jinku/ 50 KB
50 KB 105ms
104ms Image
image/png 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pure-cove-15532.herokuapp.com/jinku/run.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 387e2eaa68dbdd9f8e42c82099cdf8a8d594b71e07810f3a7337989023e25770

Request headers

Referer: http://pure-cove-15532.herokuapp.com/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:03 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "c8b9-5923266f67040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 51385

GET
H/1.1 200
OK side1.png
pure-cove-15532.herokuapp.com/jinku/ 49 KB
49 KB 102ms
101ms Image
image/png 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pure-cove-15532.herokuapp.com/jinku/side1.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: b8953f2ea0efd62e46e65782785223b47e185e90b076fd5f35659be1498061af

Request headers

Referer: http://pure-cove-15532.herokuapp.com/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:03 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "c4f0-5923266f67040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50416

GET
H/1.1 200
OK side3.png
pure-cove-15532.herokuapp.com/jinku/ 73 KB
73 KB 103ms
102ms Image
image/png 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pure-cove-15532.herokuapp.com/jinku/side3.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9d65a2723cb391bb30084a73addd71eed842868db177658892af4c4f0d864258

Request headers

Referer: http://pure-cove-15532.herokuapp.com/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:03 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "1238b-5923266f67040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 74635

GET
H/1.1 200
OK side4.png
pure-cove-15532.herokuapp.com/jinku/ 52 KB
52 KB 211ms
194ms Image
image/png 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pure-cove-15532.herokuapp.com/jinku/side4.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e9b4fe843eda020b02e3cc8298903e9b3e64c96e5e88307ab07ae666681a396e

Request headers

Referer: http://pure-cove-15532.herokuapp.com/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:03 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "cfbb-5923266f67040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 53179

GET
H/1.1 200
OK soide1.png
pure-cove-15532.herokuapp.com/jinku/ 50 KB
50 KB 209ms
192ms Image
image/png 52.200.11.93
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pure-cove-15532.herokuapp.com/jinku/soide1.png
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery.min.js
Protocol: HTTP/1.1
Security: , ,
Server: 52.200.11.93 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-200-11-93.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ba637cdcb265213c86f775d0e251aa33ea0dc87507ff978f98ecbc3d6b916253

Request headers

Referer: http://pure-cove-15532.herokuapp.com/jinku/shakeppfl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Sep 2019 18:16:03 GMT
Via: 1.1 vegur
Last-Modified: Tue, 10 Sep 2019 12:54:17 GMT
Server: Apache
Etag: "c61a-5923266f67040"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50714

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
maxcdn.bootstrapcdn.com
pure-cove-15532.herokuapp.com
2001:4de0:ac18::1:a:3b
2001:4de0:ac19::1:b:1a
2a00:1450:4001:81d::200a
52.200.11.93
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f429f4e2829515fb4ff9b67d875c2d023f08610e15a049ac0976715dd02182a
387e2eaa68dbdd9f8e42c82099cdf8a8d594b71e07810f3a7337989023e25770
418019d168be0b2926def4bccd3f573c79489a736cb12b8277ec6ef423819582
4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376
50eb1781f88cdb801fa745a413c90809a328ce97ea9295555a2e52099612372b
6b32ad7d2b816178a0c7a81352efdc428534a53d034073f4c7b959c4dbc7d3dc
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
9d65a2723cb391bb30084a73addd71eed842868db177658892af4c4f0d864258
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
b8953f2ea0efd62e46e65782785223b47e185e90b076fd5f35659be1498061af
ba637cdcb265213c86f775d0e251aa33ea0dc87507ff978f98ecbc3d6b916253
e9b4fe843eda020b02e3cc8298903e9b3e64c96e5e88307ab07ae666681a396e

pure-cove-15532.herokuapp.com Open in urlscan Pro 52.200.11.93 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

31 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

515 kBTransfer

755 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

pure-cove-15532.herokuapp.com Open in urlscan Pro
52.200.11.93 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

31 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

515 kB
Transfer

755 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!