s3.amazonaws.com Open in urlscan Pro
52.217.104.86  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response s3.amazonaws.com/appforest_uf/f1678897451838x868072834114727700/	6 KB 7 KB	229ms 124ms	Document text/html	52.217.104.86 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://s3.amazonaws.com/appforest_uf/f1678897451838x868072834114727700/index.html Protocol HTTP/1.1 Server 52.217.104.86 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash ea2348e2db86afffedf93bc4e5c11d6953a0f1f11f886eb349334d90e51fa667 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control public,max-age=86400 Content-Length 6318 Content-Type text/html Date Thu, 23 Mar 2023 22:29:20 GMT ETag "460bbd800114b263f96c6837eea87b90" Last-Modified Wed, 15 Mar 2023 16:24:13 GMT Server AmazonS3 x-amz-id-2 SIAlelzWK9zmwOkcxMcXW+rB08WlVQ7quagEyD/CNYTyud2YTVYIxW1jyowcFtG045sUyJeqHFg= x-amz-meta-app-version test x-amz-meta-appname techserver11 x-amz-request-id FD6QYW5NF8QBWEAR x-amz-server-side-encryption AES256 x-amz-version-id jdGFk7I.1EEhmKH1_kUJHxpqoObKcJd3
GET H/1.1	200 OK	style.js Show response s3.amazonaws.com/appforest_uf/f1678897368380x509961050228902700/	34 KB 34 KB	355ms 145ms	Script text/javascript	52.217.78.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1678897368380x509961050228902700/style.js Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1678897451838x868072834114727700/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.78.110 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 0dfed86a976700a92b69642d220d823128f49dd7cdcc7dfcbb45ea2c3af3b111 Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Thu, 23 Mar 2023 22:29:21 GMT x-amz-meta-appname techserver11 x-amz-version-id 8WgOEGwCfuhCLLmgXQeRF_x_VMMjo7OW Last-Modified Wed, 15 Mar 2023 16:22:49 GMT Server AmazonS3 x-amz-request-id G1Z8E02FEJ0NHF5T ETag "378dbd902c711fdfd9812e34bfc8ee73" x-amz-server-side-encryption AES256 x-amz-meta-app-version test Content-Type text/javascript Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 34710 x-amz-id-2 mv/jXe/Icpcm3vDYrK5OgUV720WN7VqLSln3waos9aNJ8bYARPqOBPMiDT6ypIyTBqUEdR4Kjyo=
GET H/1.1	200 OK	style.css s3.amazonaws.com/appforest_uf/f1678897376576x889700146189377700/	60 KB 60 KB	302ms 108ms	Stylesheet text/css	52.217.78.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1678897376576x889700146189377700/style.css Requested by Host: s3.amazonaws.com URL: http://s3.amazonaws.com/appforest_uf/f1678897451838x868072834114727700/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.78.110 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash d821b8c489cce8225e2426092268ea570c115869213cf654eae559a828a2b8aa Request headers accept-language de-DE,de;q=0.9 Referer http://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Thu, 23 Mar 2023 22:29:21 GMT x-amz-meta-appname techserver11 x-amz-version-id Fk8qTo8iTHJLmsiCiJxJQqbMAE_eOlA9 Last-Modified Wed, 15 Mar 2023 16:22:57 GMT Server AmazonS3 x-amz-request-id G1Z46ZZRF6FJ3X48 ETag "3b558262599658cb91628aa1f34cca88" x-amz-server-side-encryption AES256 x-amz-meta-app-version test Content-Type text/css Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 61106 x-amz-id-2 BYTlFMTxrClJzvq+StHH+9TY1mEaZuKx8VxyaMRf8+SPh8csh5VkuSzeq0W/nXPEqh1nXGhtFBY=
POST H/1.1	200 OK	send.php Show response e-y-a.com.ar/wp-includes/web/base/ses/	465 B 705 B	2887ms 1412ms	XHR text/html	200.110.132.141 IFX18747
General Check archive.org Show headers Download Go to Full URL https://e-y-a.com.ar/wp-includes/web/base/ses/send.php Requested by Host: s3.amazonaws.com URL: https://s3.amazonaws.com/appforest_uf/f1678897368380x509961050228902700/style.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 200.110.132.141 Buenos Aires, Argentina, ASN18747 (IFX18747, US), Reverse DNS cartagena.hosting-ar.com Software Apache / Resource Hash e66d8f1437eaead687a5714763f5baa36c9955f8e3e02a7f344368b3f49b4e44 Request headers Referer http://s3.amazonaws.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Access-Control-Allow-Origin * Date Thu, 23 Mar 2023 22:29:22 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| url_land function| sendData function| GetLogoBanner function| ForLanG function| LoginErrors number| maxPasswordLength function| getUrlVars function| InputUtil object| paginationManager object| Login function| check_email undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage object| PaginationUtil object| PaginationManager object| LoginManager object| options object| _self

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

e-y-a.com.ar
s3.amazonaws.com
200.110.132.141
52.217.104.86
52.217.78.110
0dfed86a976700a92b69642d220d823128f49dd7cdcc7dfcbb45ea2c3af3b111
8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36
d821b8c489cce8225e2426092268ea570c115869213cf654eae559a828a2b8aa
e66d8f1437eaead687a5714763f5baa36c9955f8e3e02a7f344368b3f49b4e44
ea2348e2db86afffedf93bc4e5c11d6953a0f1f11f886eb349334d90e51fa667