s3.amazonaws.com Open in urlscan Pro
52.217.198.0  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Page URL
2. https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	index%20(1).html Show response t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/	62 KB 62 KB	538ms 232ms	Document text/html	54.209.145.60 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.209.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-209-145-60.compute-1.amazonaws.com Software / Resource Hash 1a0ee0360578be5137c30973b24b6cd1580259b6df1f5004c7c253520721101e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-length 63433 content-type text/html; charset=utf-8 date Mon, 06 Mar 2023 14:57:14 GMT referrer-policy strict-origin-when-cross-origin strict-transport-security max-age=63072000; includeSubDomains x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN x-permitted-cross-domain-policies none x-request-id 3f854f8c-aeb4-4308-ac82-6e0a2c5c49c0 x-robots-tag noindex x-runtime 0.004876 x-xss-protection 1; mode=block
GET H2	200	async-api.6bb277af-1225.min.js js-agent.newrelic.com/	2 KB 1 KB	141ms 40ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/async-api.6bb277af-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id ccu4IA9M.iSFjMQAJQZ9WRC6vNK74xfk content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQ7G23HYJFFEG0A x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 1094 x-amz-id-2 5Qqse1BeTshWTSN2ctEsnE1kyvJIYlUBfWKe01V0Or1hMRWiqQKhrD1Zvl0N+7td6aP7gvzl058= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.054187,VS0,VE0 etag "dd573d973dfb2a2559befdfb616d511d" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12485
GET H2	200	lazy-loader.48127245-1225.min.js js-agent.newrelic.com/	2 KB 1002 B	140ms 39ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/lazy-loader.48127245-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id x72sIi24uKUpr9UhD5QY7PCKtNgMfeY4 content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQC7BN664QTK74M x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 520 x-amz-id-2 YGZXhhZ0s2CUCmfry19xec270AUzzQ8zT2hY6qmZ2UtPTHnaaR4tSYHttPolpqmeWgkk9jfdtqU= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.054141,VS0,VE0 etag "a3759bbbd15fffd73531bda1e8166ae7" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12491
GET H/1.1	200 OK	Primary Request index%20(1).html Show response s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/	141 KB 142 KB	439ms 187ms	Document text/html	52.217.198.0 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.198.0 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 3f399f57efbf91fce2bea45b78a0f6a8caed037e8f3d9e808e79bd51f1b967e4 Request headers Referer https://t.yesware.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control public,max-age=86400 Content-Length 144888 Content-Type text/html Date Mon, 06 Mar 2023 14:57:16 GMT ETag "15fdd99cab7b70f70a8ac636ff883fe2" Last-Modified Thu, 02 Mar 2023 23:25:45 GMT Server AmazonS3 x-amz-id-2 1UoNSFqEwXTR7b6R+ukCWYIJrfGl/QSjsKFKUPU5pkTJcouy4rsXu+1q8OtHry4Yr2mI68qS3ZA= x-amz-meta-app-version test x-amz-meta-appname lvstfvrlife x-amz-request-id VKJPC4EPAD6NTP44 x-amz-server-side-encryption AES256 x-amz-storage-class INTELLIGENT_TIERING x-amz-version-id MBPCQ1_LKNKeGylPxO7YaZ1tlRJhazvN
GET H2	200	118.d37755e4-1225.min.js js-agent.newrelic.com/	8 KB 4 KB	40ms 40ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/118.d37755e4-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id 8iuwUwYODDWrlAN7lGJW4CKaVaPtd.FC content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQ5AKQ25RZ95X79 x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 3412 x-amz-id-2 QXnmszoR1ztN4E5cqgqZu6v5hC/3hxGhiMKuVq6Z6DihTHVx1mmDEt7FcUCvESQ6vBAaVAOwLoU= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.097493,VS0,VE0 etag "9c8a05b5703a1c30e0418f9ba42337df" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12424
GET H2	200	page_view_event-aggregate.29613e65-1225.min.js js-agent.newrelic.com/	4 KB 2 KB	42ms 41ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/page_view_event-aggregate.29613e65-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id Q2wYJMaFVSMNo7QiSpnsS727o5X3kt_1 content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQB2WEBATXJBKQT x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 1682 x-amz-id-2 i3axP9uZaw1yQX94OVhA3XCytJ5mXEhntQtt7PdhM4JWoSmcAQ6WXZpnkvmQyOhOIMYwlbsEsPw= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.098522,VS0,VE0 etag "0743ee0ec30428f3654ee07d779efb64" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12406
GET H2	200	page_view_timing-aggregate.e791ce32-1225.min.js js-agent.newrelic.com/	5 KB 3 KB	43ms 42ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/page_view_timing-aggregate.e791ce32-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id 5Hc0bLUe_lA8zF4035AV9Xl5FkevBdYq content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQ5P3MSY60P5STC x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 2248 x-amz-id-2 dUFqJNB5lxLLghf/VDwg4z4Nwdbkfihn0uHLJkHqG9bDrJJRb+iwkt+xyWC0tzWEjXHNNKy7Nqg= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.098686,VS0,VE0 etag "84ba19034cf0206a49ecf68893086bdd" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12391
GET H2	200	metrics-aggregate.b4a54ed9-1225.min.js js-agent.newrelic.com/	1 KB 936 B	45ms 44ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/metrics-aggregate.b4a54ed9-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id 0sI71h2BU2Q4FabSOYi.9wzegJNG1fuh content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQ5J2G5893VRXBX x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 730 x-amz-id-2 WKJy7Tk9DLO+QuA4f4k15izJHb3GuYduD3Lb7iNfOCXqKq5gcQMz4QguLSlOy5VI40k5o/HttwU= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.100163,VS0,VE0 etag "395608505dac1e4fbe08bd146e09f5c0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12418
GET H2	200	jserrors-aggregate.ef250e1c-1225.min.js js-agent.newrelic.com/	8 KB 3 KB	47ms 46ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/jserrors-aggregate.ef250e1c-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id ZOM52KkW0qOLL2pO6zep8b6LBe5eLeAu content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQ5NQCRHVKTGTQ4 x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 2947 x-amz-id-2 m499zk1hi2OaBP37DjndI0pvJ+GPx0yYLoVurod22gwbIh/cqlQrf5aYpVeDqyxuAXkjTGCfnbY= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.101667,VS0,VE0 etag "57226211458d66408fe8e6f2a870ac73" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 8821
GET H2	200	ajax-aggregate.fc672923-1225.min.js js-agent.newrelic.com/	5 KB 3 KB	46ms 45ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/ajax-aggregate.fc672923-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id frHq3kL0RCG6sqBZr8JQrpE1DTcTY4r. content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQ7FES9HPEYEW6S x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 2384 x-amz-id-2 HP7kBy3DLR7MN4D1GPetcy7hgeBKYR126JCoPnWlFopky0iekM9EQWL93h/JuFGOUIGsDiOPPxA= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.101986,VS0,VE0 etag "166e664a45eea3f57f277bbe4c918943" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 8833
GET H2	200	session_trace-aggregate.94c80cda-1225.min.js js-agent.newrelic.com/	10 KB 4 KB	48ms 48ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/session_trace-aggregate.94c80cda-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id VTTWLoMb09kYDpNhQPhusVScECFKJVwU content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQFRPCY5SQYVS3E x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 3743 x-amz-id-2 cZctQ/NW843FykXzd3prexGFMarDaLwuZ7CczrpRnIAz9jlsQW+bMOgsNjTFCqh+NXA+r6SEfCo= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.102557,VS0,VE0 etag "424a549cc28afe269b792b20fdae0acb" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 8794
GET H2	200	page_action-aggregate.92657d87-1225.min.js js-agent.newrelic.com/	3 KB 1 KB	49ms 48ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/page_action-aggregate.92657d87-1225.min.js Requested by Host: t.yesware.com URL: https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://t.yesware.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers x-amz-version-id LWJLU5TdVV0.TfnYrT4knyPvYg1S141q content-encoding gzip via 1.1 varnish date Mon, 06 Mar 2023 14:57:15 GMT x-amz-request-id ZNQCG02QSV2ADF1M x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 1200 x-amz-id-2 afEduAXf018gun2MGcnV0eUL1OwWT+ZZiLd0I9bl4gVXYpuTUZf6FurISKV5+hoI3nUwhUpKWs8= x-served-by cache-hhn-etou8220064-HHN last-modified Fri, 10 Feb 2023 20:23:02 GMT server AmazonS3 x-timer S1678114635.102371,VS0,VE1 etag "44fd542c32559790db696a8ee7ade0b1" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 8833
GET		1a5da492d2 bam.nr-data.net/1/	0 0
GET H/1.1	403 Forbidden	style.css s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/	0 0	362ms 126ms	Stylesheet application/xml	52.217.198.0 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/style.css Requested by Host: s3.amazonaws.com URL: https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.198.0 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Mon, 06 Mar 2023 14:57:15 GMT Server AmazonS3 x-amz-request-id VKJM6PAC79TK185N x-amz-id-2 8dXoRZOdA3WzWMevu93IoYTAqPYYAETZyr6dWugA9QfE4fV7SA2J12w/+hrZ/fn+BAN/7B9rfAM= Transfer-Encoding chunked Content-Type application/xml
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	655ms 40ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: s3.amazonaws.com URL: https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Mon, 06 Mar 2023 13:23:45 GMT content-encoding gzip x-content-type-options nosniff age 5611 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 05 Mar 2024 13:23:45 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	665ms 50ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: s3.amazonaws.com URL: https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%20(1).html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://s3.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Mon, 06 Mar 2023 14:57:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 723 age 519512 cdn-cachedat 11/15/2021 23:30:00 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:06 GMT cdn-proxyver 1.0 cdn-requestpullcode 200 server cloudflare vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid a35b0179a28ed953258d0fb41376a09c timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 7a3b733b1d999b7c-FRA cdn-requestpullsuccess True
GET DATA	200 OK	truncated /	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

bam.nr-data.net

URL

https://bam.nr-data.net/1/1a5da492d2?a=2164051&v=1225.PROD&to=Il9eRkQKCVtSERkICA9bH1FaDAZc&rst=862&ck=0&s=a2cd941b1442f3f9&ref=https://t.yesware.com/tt/a7af9f054087edb7fe11004aae076a670f6f25bc/c08496eb15611fb326fc7f8cd419ccef/b27dee5433a19413c058ca3f6274db90/s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/index%2520(1).html&ap=5&be=660&fe=11&dc=10&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1678114634261,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:71,%22c%22:71,%22s%22:187,%22ce%22:307,%22rq%22:307,%22rp%22:539,%22rpe%22:656,%22dl%22:542,%22di%22:670,%22ds%22:670,%22de%22:670,%22dc%22:670,%22l%22:670,%22le%22:672%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery object| bootstrap function| _0x26dbbd function| _0x4fad function| _0x575f function| hidediv1

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.yesware.com/	1970-01-20 19:44:34	Name: t Value: lbZbIVgnoBCCJiQEOWnJWA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://s3.amazonaws.com/appforest_uf/f1677799544082x427081342139291400/style.css Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bam.nr-data.net
js-agent.newrelic.com
s3.amazonaws.com
stackpath.bootstrapcdn.com
t.yesware.com
bam.nr-data.net
151.101.194.137
2606:4700::6812:bcf
2a00:1450:4001:811::200a
52.217.198.0
54.209.145.60
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1a0ee0360578be5137c30973b24b6cd1580259b6df1f5004c7c253520721101e
3f399f57efbf91fce2bea45b78a0f6a8caed037e8f3d9e808e79bd51f1b967e4
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
8b4defd065d7ff9fbe6c45e74f2ada9660724d3c80db586bf3adb82dd0c37f36