filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com Open in urlscan Pro
52.95.155.36  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://r.search.yahoo.com/_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/RS=ULYFaRCLNaQh111hovdeQ3411Bw- Page URL
2. http://ramramcg.com/ Page URL
3. https://filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com/jboypag/index+(2).html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	RS=ULYFaRCLNaQh111hovdeQ3411Bw- r.search.yahoo.com/_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/	360 B 802 B	107ms 34ms	Document text/html	2a00:1288:110:c104::2000 YAHOO-IRD
General Check archive.org Show headers Download Go to Full URL https://r.search.yahoo.com/_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/RS=ULYFaRCLNaQh111hovdeQ3411Bw- Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:110:c104::2000 , United Kingdom, ASN34010 (YAHOO-IRD, GB), Reverse DNS Software ATS / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block; report=https://csp.search.yahoo.com/xssreport Request headers :method GET :authority r.search.yahoo.com :scheme https :path /_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/RS=ULYFaRCLNaQh111hovdeQ3411Bw- pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 04 May 2021 19:28:33 GMT p3p policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" vary Accept-Encoding content-type text/html; charset="UTF-8" content-length 360 age 0 strict-transport-security max-age=31536000 server ATS expect-ct max-age=31536000, enforce x-content-type-options nosniff x-xss-protection 1; mode=block; report=https://csp.search.yahoo.com/xssreport referrer-policy no-referrer-when-downgrade
GET H/1.1	200 OK	/ ramramcg.com/	7 KB 3 KB	318ms 300ms	Document text/html	139.59.74.23 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL http://ramramcg.com/ Requested by Host: r.search.yahoo.com URL: https://r.search.yahoo.com/_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/RS=ULYFaRCLNaQh111hovdeQ3411Bw- Protocol HTTP/1.1 Server 139.59.74.23 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software LiteSpeed / Resource Hash Request headers Host ramramcg.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer https://r.search.yahoo.com/_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/RS=ULYFaRCLNaQh111hovdeQ3411Bw- Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://r.search.yahoo.com/_ylt=AwrJ7JYamJFgmzAAhv1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1620183195/RO=10/RU=http%3A%2F%2Framramcg.com%2F/RK=2/RS=ULYFaRCLNaQh111hovdeQ3411Bw- Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 3243 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Tue, 04 May 2021 19:28:34 GMT Server LiteSpeed
GET H/1.1	404 Not Found	install.css ramramcg.com/wp-admin/css/	0 0	160ms 158ms	Stylesheet text/html	139.59.74.23 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL http://ramramcg.com/wp-admin/css/install.css?ver=20100228 Requested by Host: ramramcg.com URL: http://ramramcg.com/ Protocol HTTP/1.1 Server 139.59.74.23 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software LiteSpeed / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ramramcg.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://ramramcg.com/ Connection keep-alive Cache-Control no-cache Referer http://ramramcg.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Tue, 04 May 2021 19:28:34 GMT Server LiteSpeed Vary User-Agent Content-Type text/html Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Content-Length 1237
GET		wordpress-logo.png ramramcg.com/wp-admin/images/	0 0
GET H/1.1	200 OK	Primary Request index+(2).html Show response filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com/jboypag/	597 KB 597 KB	160ms 49ms	Document text/html	52.95.155.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com/jboypag/index+(2).html Requested by Host: ramramcg.com URL: http://ramramcg.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.95.155.36 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash b4c0f9e0e8f919d2e8364777a9aabd08c219ca6be47d4b4f8e26ee9f5fb1e201 Request headers Host filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer http://ramramcg.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://ramramcg.com/ Response headers x-amz-id-2 VUv/jJGIUuVfq2W/4icjbGA84KWMZ+5bMLl94swYah48UcHQ4LzMTREUW37iblScmEhnABRN8dc= x-amz-request-id VP0BXXZRK35668RA Date Tue, 04 May 2021 19:28:35 GMT Last-Modified Tue, 04 May 2021 18:31:59 GMT ETag "357b800e46ad6c8e791823cbb5970ea3" Accept-Ranges bytes Content-Type text/html Content-Length 611037 Server AmazonS3
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	25ms 24ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com URL: https://filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com/jboypag/index+(2).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin https://filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com Referer https://filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 04 May 2021 19:28:34 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 992588 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27938 cf-request-id 09da7398240000c2b3cd1ee000000001 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zIRbQAuRiJi3CB3xlR5f8AmVRxF3rp22Z2YGUTEG8S50U2ZrtRM37ODTJR7MLgcypr1fEDMdKOfzMNoZSJGwXdNvftWrgk8x%2BrejrAXQ3a%2BtBbj%2FULyA6RfwqtNvSJbdbQ%3D%3D"}]} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 64a422069e0bc2b3-FRA expires Sun, 24 Apr 2022 19:28:34 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	277 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET H2	200	call.php Show response nutlers.in/	579 B 845 B	1073ms 732ms	XHR application/json	103.86.176.6 WEBWERKS-AS-IN We...
General Check archive.org Show headers Download Go to Full URL https://nutlers.in/call.php?u=null Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.86.176.6 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN), Reverse DNS zoom.herosite.pro Software LiteSpeed / Resource Hash 2fa4be1a8031d79f645daf902d5f8ceb7cc8793c31f008f830b9c917ad899f1d Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 04 May 2021 19:28:36 GMT alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 server LiteSpeed content-type application/json access-control-allow-origin * cache-control no-cache access-control-allow-headers *

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ramramcg.com

URL

http://ramramcg.com/wp-admin/images/wordpress-logo.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| lc function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block; report=https://csp.search.yahoo.com/xssreport

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
filescovid208209-1392820-q9-319-31.s3.eu-west-3.amazonaws.com
nutlers.in
r.search.yahoo.com
ramramcg.com
ramramcg.com
103.86.176.6
139.59.74.23
2606:4700::6810:135e
2a00:1288:110:c104::2000
52.95.155.36
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
2fa4be1a8031d79f645daf902d5f8ceb7cc8793c31f008f830b9c917ad899f1d
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
b4c0f9e0e8f919d2e8364777a9aabd08c219ca6be47d4b4f8e26ee9f5fb1e201
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e