web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com Open in urlscan Pro
52.219.66.119 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://citi0.codesandbox.io/?af=HUA&typo=03
Effective URL:
https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@
Submission: On November 11 via manual (November 11th 2021, 5:13:53 pm UTC) from SA — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 52.219.66.119, located in Mumbai, India and belongs to AMAZON-02, US. The main domain is web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com.
TLS certificate: Issued by Amazon on March 26th 2021. Valid for: a year.

This is the only time web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 7	2606:4700::68... 2606:4700::6812:17cf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6812:16cf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5e41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.219.66.119 52.219.66.119	16509 (AMAZON-02) (AMAZON-02)
2	119.17.253.214 119.17.253.214	24173 (NETNAM-AS...) (NETNAM-AS-AP Netnam Company)
14	6

7 2606:4700::6812:17cf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

citi0.codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:16cf (United States)

ASN13335 (CLOUDFLARENET, US)

codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.219.66.119 (Mumbai, India)

ASN16509 (AMAZON-02, US)
PTR: s3-r-w.ap-south-1.amazonaws.com

web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 119.17.253.214 (Viet Nam)

ASN24173 (NETNAM-AS-AP Netnam Company, VN)
PTR: server30.vietnetnam.com

thptnguyenkhuyen.edu.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	codesandbox.io 1 redirects citi0.codesandbox.io codesandbox.io	2 MB
2	thptnguyenkhuyen.edu.vn thptnguyenkhuyen.edu.vn	1 KB
1	amazonaws.com web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com	386 KB
1	cloudflareinsights.com static.cloudflareinsights.com	5 KB
14	4

	Domain	Requested by
5	codesandbox.io	citi0.codesandbox.io codesandbox.io
5	citi0.codesandbox.io	1 redirects
2	thptnguyenkhuyen.edu.vn	web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com
1	web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com	citi0.codesandbox.io
1	static.cloudflareinsights.com	citi0.codesandbox.io
14	5

This site contains no links.

Subject Issuer	Validity	Valid
codesandbox.io Cloudflare Inc ECC CA-3	`2021-05-19` - `2022-05-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-11` - `2022-06-10`	a year	crt.sh
*.s3.ap-south-1.amazonaws.com Amazon	`2021-03-26` - `2022-03-05`	a year	crt.sh
thptnguyenkhuyen.edu.vn cPanel, Inc. Certification Authority	`2021-10-03` - `2022-01-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@
Frame ID: C9BA3C5618F0DAC3B6AF6F7CD3B35A4E
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

..confirm your login..

Page URL History Show full URLs

http://citi0.codesandbox.io/?af=HUA&typo=03 HTTP 301
https://citi0.codesandbox.io/?af=HUA&typo=03 Page URL
https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@ Page URL

Page Statistics

14
Requests

93 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

6
IPs

3
Countries

2246 kB
Transfer

6666 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://citi0.codesandbox.io/?af=HUA&typo=03 HTTP 301
https://citi0.codesandbox.io/?af=HUA&typo=03 Page URL
https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://citi0.codesandbox.io/?af=HUA&typo=03 HTTP 301
https://citi0.codesandbox.io/?af=HUA&typo=03

14 HTTP transactions
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response citi0.codesandbox.io/ Redirect Chain http://citi0.codesandbox.io/?af=HUA&typo=03 https://citi0.codesandbox.io/?af=HUA&typo=03	2 KB 1 KB	75ms 54ms	Document text/html	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `1aab744ab21788b37cb322b816c0a7abc3c1322650565d9a9ac4662a067d6068` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Thu, 11 Nov 2021 17:13:48 GMT content-type text/html vary Accept-Encoding cache-control private, max-age=0, no-cache, no-store x-request-id FraNQcMoYSTt7UQXS2oi via 1.1 google alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 6ac9273bff9d5caa-FRA content-encoding br Redirect headers Date Thu, 11 Nov 2021 17:13:48 GMT Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=3600 Expires Thu, 11 Nov 2021 18:13:48 GMT Location https://citi0.codesandbox.io/?af=HUA&typo=03 Vary Accept-Encoding Server cloudflare CF-RAY 6ac9273bbeba16ea-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	vendors~app~embed~sandbox~sandbox-startup.bcc15d438.chunk.js codesandbox.io/static/js/	9 KB 4 KB	54ms 20ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/vendors~app~embed~sandbox~sandbox-startup.bcc15d438.chunk.js Requested by Host: citi0.codesandbox.io URL: https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://citi0.codesandbox.io/ Origin https://citi0.codesandbox.io Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT age 6916 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 11 Nov 2021 10:46:10 GMT server cloudflare etag W/"618cf472-2312" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6ac9273caa286937-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	vendors~app~embed~sandbox-startup.6e3433fd3.chunk.js codesandbox.io/static/js/	17 KB 5 KB	55ms 20ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/vendors~app~embed~sandbox-startup.6e3433fd3.chunk.js Requested by Host: citi0.codesandbox.io URL: https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://citi0.codesandbox.io/ Origin https://citi0.codesandbox.io Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT age 6916 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 11 Nov 2021 10:46:10 GMT server cloudflare etag W/"618cf472-423b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6ac9273caa2b6937-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sandbox-startup.04e2d2a59.js codesandbox.io/static/js/	24 KB 8 KB	61ms 27ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/sandbox-startup.04e2d2a59.js Requested by Host: citi0.codesandbox.io URL: https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://citi0.codesandbox.io/ Origin https://citi0.codesandbox.io Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT age 6916 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 11 Nov 2021 10:46:10 GMT server cloudflare etag W/"618cf472-5eed" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6ac9273caa2c6937-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	browserfs.min.js Show response codesandbox.io/static/browserfs12/	232 KB 59 KB	40ms 25ms	Script application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/browserfs12/browserfs.min.js Requested by Host: citi0.codesandbox.io URL: https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT age 9630072 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 22 Jul 2021 13:01:29 GMT server cloudflare etag W/"60f96c29-39fc5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6ac9273c88ca5caa-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	beacon.min.js static.cloudflareinsights.com/	13 KB 5 KB	83ms 65ms	Script text/javascript	2606:4700::6810:5e41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js Requested by Host: citi0.codesandbox.io URL: https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 11 Nov 2021 17:13:48 GMT content-encoding gzip last-modified Fri, 22 Oct 2021 22:23:12 GMT server cloudflare etag W/2021.9.0 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin cf-ray 6ac9273cec60430f-FRA
GET H2	200	babel.7.12.12.min.js codesandbox.io/static/js/	0 360 KB	34ms 33ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/babel.7.12.12.min.js Requested by Host: codesandbox.io URL: https://codesandbox.io/static/js/sandbox-startup.04e2d2a59.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT age 17934052 content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Fri, 16 Apr 2021 07:19:12 GMT server cloudflare etag W/"60793a70-190d43" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6ac9273cd99d5caa-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	Primary Request index+(11).html Show response web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/	386 KB 386 KB	550ms 144ms	Document text/html	52.219.66.119 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@ Requested by Host: citi0.codesandbox.io URL: https://citi0.codesandbox.io/?af=HUA&typo=03 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.219.66.119 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.ap-south-1.amazonaws.com Software AmazonS3 / Resource Hash `4a225e4bf357a857ef6b50c6753040f4da8f91a68772840df9fbbc323e5ae335` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/ Response headers x-amz-id-2 QarMXSKn6kOChe9cxl0CCG3jqrciNxmt80KeeD0wOwQdSHzs0lvcumXos3O4qAN8JK+zE6lH1VQ= x-amz-request-id M3CHY1WN9V7G50R7 Date Thu, 11 Nov 2021 17:13:49 GMT Last-Modified Thu, 11 Nov 2021 16:40:32 GMT ETag "5d1be44ac74a331aa37d2b54c9f7ad5c" Accept-Ranges bytes Content-Type text/html Server AmazonS3 Content-Length 394773
GET H2	200	babel-transpiler.6aa76c9a.worker.js citi0.codesandbox.io/	2 MB 473 KB	32ms 31ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://citi0.codesandbox.io/babel-transpiler.6aa76c9a.worker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/?af=HUA&typo=03 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers cf-ray 6ac9273ce9cf5caa-FRA date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT last-modified Thu, 11 Nov 2021 10:46:10 GMT server cloudflare age 5692 etag W/"618cf472-1f12aa" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	babel-transpiler.6aa76c9a.worker.js citi0.codesandbox.io/	2 MB 473 KB	36ms 36ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://citi0.codesandbox.io/babel-transpiler.6aa76c9a.worker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/?af=HUA&typo=03 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers cf-ray 6ac9273ce9d15caa-FRA date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT last-modified Thu, 11 Nov 2021 10:46:10 GMT server cloudflare age 5692 etag W/"618cf472-1f12aa" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	babel-transpiler.6aa76c9a.worker.js citi0.codesandbox.io/	2 MB 473 KB	43ms 42ms	Other application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://citi0.codesandbox.io/babel-transpiler.6aa76c9a.worker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://citi0.codesandbox.io/?af=HUA&typo=03 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers cf-ray 6ac9273ce9d35caa-FRA date Thu, 11 Nov 2021 17:13:48 GMT via 1.1 google cf-cache-status HIT last-modified Thu, 11 Nov 2021 10:46:10 GMT server cloudflare age 5692 etag W/"618cf472-1f12aa" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	9 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `487e9874e5a85002b0e8f0ee66d6b833dde386c9571d2a21df5ca3363118bd10` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	call.php Show response thptnguyenkhuyen.edu.vn/40/	600 B 821 B	2356ms 1015ms	XHR application/json	119.17.253.214 NETNAM-AS-AP Netn...
General Check archive.org Show headers Download Go to Full URL https://thptnguyenkhuyen.edu.vn/40/call.php?u=%1D@ Requested by Host: web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com URL: https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 119.17.253.214 , Viet Nam, ASN24173 (NETNAM-AS-AP Netnam Company, VN), Reverse DNS server30.vietnetnam.com Software Apache / PHP/5.5.38 Resource Hash `c38f18a333436b5f489fa492ef4a6aeacf1e230fa1c28cce486f6a09cedc580c` Request headers Accept application/json, text/javascript, /; q=0.01 Referer https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 11 Nov 2021 17:13:49 GMT Server Apache Connection close X-Powered-By PHP/5.5.38 Transfer-Encoding chunked Content-Type application/json
GET H/1.1	200 OK	clearbit.php Show response thptnguyenkhuyen.edu.vn/40/	23 B 243 B	1034ms 569ms	XHR application/json	119.17.253.214 NETNAM-AS-AP Netn...
General Check archive.org Show headers Download Go to Full URL https://thptnguyenkhuyen.edu.vn/40/clearbit.php?d= Requested by Host: web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com URL: https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/index+(11).html?dg=%1D@ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 119.17.253.214 , Viet Nam, ASN24173 (NETNAM-AS-AP Netnam Company, VN), Reverse DNS server30.vietnetnam.com Software Apache / PHP/5.5.38 Resource Hash `9060c4b05ac95688fc5409f287057a2b818ee9da16c7b25bbdceff71f11482d1` Request headers Accept text/plain, /; q=0.01 Referer https://web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 11 Nov 2021 17:13:50 GMT Server Apache Connection close X-Powered-By PHP/5.5.38 Transfer-Encoding chunked Content-Type application/json
GET		clearbit.php thptnguyenkhuyen.edu.vn/40/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: thptnguyenkhuyen.edu.vn
URL: https://thptnguyenkhuyen.edu.vn/40/clearbit.php?d=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
worker	warning	URL: https://codesandbox.io/static/js/babel.7.12.12.min.js Message: Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating
worker	warning	URL: https://codesandbox.io/static/js/babel.7.12.12.min.js Message: Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating
worker	warning	URL: https://codesandbox.io/static/js/babel.7.12.12.min.js Message: Browserslist: caniuse-lite is outdated. Please run: npx browserslist@latest --update-db Why you should do it regularly: https://github.com/browserslist/browserslist#browsers-data-updating

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

citi0.codesandbox.io
codesandbox.io
static.cloudflareinsights.com
thptnguyenkhuyen.edu.vn
web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com
thptnguyenkhuyen.edu.vn
119.17.253.214
2606:4700::6810:5e41
2606:4700::6812:16cf
2606:4700::6812:17cf
52.219.66.119
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1aab744ab21788b37cb322b816c0a7abc3c1322650565d9a9ac4662a067d6068
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
487e9874e5a85002b0e8f0ee66d6b833dde386c9571d2a21df5ca3363118bd10
4a225e4bf357a857ef6b50c6753040f4da8f91a68772840df9fbbc323e5ae335
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
9060c4b05ac95688fc5409f287057a2b818ee9da16c7b25bbdceff71f11482d1
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
c38f18a333436b5f489fa492ef4a6aeacf1e230fa1c28cce486f6a09cedc580c

web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com Open in urlscan Pro 52.219.66.119 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

14 Requests

93 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

6 IPs

3 Countries

2246 kBTransfer

6666 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

web392382-help-82397420online324-onmicrosoft29382online.s3.ap-south-1.amazonaws.com Open in urlscan Pro
52.219.66.119 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

6
IPs

3
Countries

2246 kB
Transfer

6666 kB
Size

0
Cookies

14 HTTP transactions
8 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!