critical-update-id0183113.s3.amazonaws.com Open in urlscan Pro
52.216.142.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://critical-update-id0183113.s3.amazonaws.com/index.html
Submission: On March 31 via manual (March 31st 2020, 5:50:00 am UTC) from GB

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 5 countries across 6 domains to perform 14 HTTP transactions. The main IP is 52.216.142.52, located in Ashburn, United States and belongs to AMAZON-02, US. The main domain is critical-update-id0183113.s3.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on November 9th 2019. Valid for: a year.

This is the only time critical-update-id0183113.s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer) Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
8	52.216.142.52 52.216.142.52	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9d	15169 (GOOGLE) (GOOGLE)
1	147.75.102.203 147.75.102.203	54825 (PACKET) (PACKET)
1	147.75.102.239 147.75.102.239	54825 (PACKET) (PACKET)
1	147.75.33.229 147.75.33.229	54825 (PACKET) (PACKET)
14	8

8 52.216.142.52 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

critical-update-id0183113.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.203 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress3

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.239 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress2

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.229 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress11

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	amazonaws.com critical-update-id0183113.s3.amazonaws.com	503 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	72 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
1	doubleclick.net stats.g.doubleclick.net	102 B
1	googletagmanager.com www.googletagmanager.com	28 KB
0	Failed function sub() { [native code] }. Failed
14	6

	Domain	Requested by
8	critical-update-id0183113.s3.amazonaws.com	critical-update-id0183113.s3.amazonaws.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	static.hotjar.com	critical-update-id0183113.s3.amazonaws.com
1	stats.g.doubleclick.net	critical-update-id0183113.s3.amazonaws.com
1	www.googletagmanager.com	critical-update-id0183113.s3.amazonaws.com
0	truncated Failed	critical-update-id0183113.s3.amazonaws.com
14	8

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2021-03-12`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-02-03` - `2020-05-03`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-02-03` - `2020-05-03`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-02-03` - `2020-05-03`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://critical-update-id0183113.s3.amazonaws.com/index.html
Frame ID: E223AF9EC0484F6990890F095C8EDA7A
Requests: 15 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 3C9577D7EF3E931D7834BC9E6F565DBA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

14
Requests

100 %
HTTPS

43 %
IPv6

6
Domains

8
Subdomains

8
IPs

5
Countries

620 kB
Transfer

989 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=413918092&t=pageview&_s=1&dl=https%3A%2F%2Fcritical-update-id0183113.s3.amazonaws.com%2Findex.html&ul=en-us&de=windows-1252&dt=Windows%20Official%20Support&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1902148992&gjid=1341405772&cid=2058387003.1585633784&tid=UA-114773682-1&_gid=670689958.1585633784&_r=1&gtm=2ou3i0&z=1740741110 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-114773682-1&cid=2058387003.1585633784&jid=1902148992&_gid=670689958.1585633784&gjid=1341405772&_v=j81&z=1740741110

14 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
critical-update-id0183113.s3.amazonaws.com/ 115 KB
116 KB 497ms
179ms Document
text/html 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 45394e51ceda144d5ec8569246a7b2a0b17b21e0cc58edcfb81e0d3ddaed5911

Request headers

Host: critical-update-id0183113.s3.amazonaws.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

x-amz-id-2: L1DPjEVzWTCSR0cJcsbzfJkOxbLeHrXK072FNbwrrr8Yr9xHglK2B/exQ5jGYQGj1A0LelQji24=
x-amz-request-id: 15B535E7C003695C
Date: Tue, 31 Mar 2020 05:49:44 GMT
Last-Modified: Mon, 30 Mar 2020 16:35:55 GMT
ETag: "82d33937dc6fd10c2cd0e897a64617d9"
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 118119
Server: AmazonS3

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 75 KB
28 KB 47ms
46ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-114773682-1

Requested by

Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

89b311864ad71e7bddee0bfbe7f75052d2c92141db09e509c4dde4a1651cb17b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 31 Mar 2020 05:49:43 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28643
x-xss-protection: 0
last-modified: Tue, 31 Mar 2020 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 31 Mar 2020 05:49:43 GMT

GET
H/1.1 200
OK bootstrap.css
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 118 KB
119 KB 289ms
127ms Stylesheet
text/css 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/bootstrap.css
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: f5f3901b0ee572551114982d1d816dfa7bfb2545c112284fbbbe353cdbbc6d6e

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Tue, 31 Mar 2020 05:49:44 GMT
Last-Modified: Mon, 30 Mar 2020 09:49:53 GMT
Server: AmazonS3
x-amz-request-id: C462C1F2813C0E5D
ETag: "000c9c80eef1378e0c8261dba4cc8adb"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 121291
x-amz-id-2: vwqNCjVaUTRqY28RdCT6jiW787/6sdayzhp1des8NfhCUnOwAm1Zp/CZeMc5t1hqGSlcC55vEv8=

GET
H/1.1 200
OK style.css
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 23 KB
23 KB 469ms
155ms Stylesheet
text/css 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/style.css
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: bbfd0cb1353e68621567113f15a5842f63518876e11781a59bc9184d3249d53a

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Tue, 31 Mar 2020 05:49:44 GMT
Last-Modified: Mon, 30 Mar 2020 09:49:55 GMT
Server: AmazonS3
x-amz-request-id: 3BBC6A7B01AB23E3
ETag: "c68658ed51054f654afe1e28b69340b3"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 23548
x-amz-id-2: FPN/GecJ4m1Pwz1WmBDDx5QccuXor6E4JR1vV2gl3bAsjOMuB0TDh0gxb08nGUiB1HNsjdrunPY=

GET
H/1.1 200
OK translator.css
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 21 KB
21 KB 449ms
133ms Stylesheet
text/css 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/translator.css
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 25d2d73c6c16c53a9934872e079ebf265f1a70e1df0e5d9190664f0acf12510d

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Tue, 31 Mar 2020 05:49:44 GMT
Last-Modified: Mon, 30 Mar 2020 09:49:55 GMT
Server: AmazonS3
x-amz-request-id: 4C81DA3A06964B53
ETag: "00c7719f627dcf52ed26d09f5f460e6b"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 21080
x-amz-id-2: uu8QteqWxkbE2mwJxeqh9rNYaiRYSxpDHHbc1sMl876WkDzT4NtyPHwRWJoj26n7wYTB+f37fDg=

GET
H/1.1 200
OK alert.css
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 3 KB
3 KB 465ms
148ms Stylesheet
text/css 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/alert.css
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 1257bf3ff800c9ce0da27dcea3a6c2ec4871de33d251f127eb915c3c1b47822b

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Tue, 31 Mar 2020 05:49:44 GMT
Last-Modified: Mon, 30 Mar 2020 09:49:54 GMT
Server: AmazonS3
x-amz-request-id: 5A6770EE568D8065
ETag: "ce7832a538b94a7f49b35286484f6ccb"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 3070
x-amz-id-2: 4AwefjzKT1CEV6hCE9vWHGl7joUqmrlB0V3ag7T54RvioI5ZQLm0A7GN5uXABZ5+W2HbhGxlXnc=

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-114773682-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 4571
date: Tue, 31 Mar 2020 04:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Tue, 31 Mar 2020 06:33:32 GMT

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=413918092&t=pageview&_s=1&dl=https%3A%2F%2Fcritical-update-id0183113.s3.amazonaws.com%2Findex.html&ul=en-us&de=windows-1252&dt=Windows%20Offi...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-114773682-1&cid=2058387003.1585633784&jid=1902148992&_gid=670689958.1585633784&gjid=1341405772&_v=j81&z=1740741110

35 B
102 B

15ms
15ms

Image
image/gif

2a00:1450:400c:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-114773682-1&cid=2058387003.1585633784&jid=1902148992&_gid=670689958.1585633784&gjid=1341405772&_v=j81&z=1740741110

Requested by

Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Tue, 31 Mar 2020 05:49:43 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 31 Mar 2020 05:49:43 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-114773682-1&cid=2058387003.1585633784&jid=1902148992&_gid=670689958.1585633784&gjid=1341405772&_v=j81&z=1740741110
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 420
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK app.png
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 21 KB
21 KB 376ms
221ms Image
image/png 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/app.png
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: fecb582cb09be9dad7723f212cbd99f306bf8af8c206d19183e2fa96a5ff7a72

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 31 Mar 2020 05:49:44 GMT
Last-Modified: Mon, 30 Mar 2020 09:49:54 GMT
Server: AmazonS3
x-amz-request-id: 64E3C44B99C08CE3
ETag: "6f0c99b39f36d1706d6a65902294a898"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 21109
x-amz-id-2: XuHaC9k/X8+m72j5qr7Jodq43ie0FlxPhLlqxGoNoUFd0uUBdrdC2bZYl9tS0cIjGNwLySRk6M0=

GET truncated
/ 0
0

GET
H2 200 hotjar-638878.js Show response
static.hotjar.com/c/ 4 KB
2 KB 134ms
92ms Script
application/javascript 147.75.102.203
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-638878.js?sv=5

Requested by

Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.102.203 Central, Hong Kong, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress3

Software

Resource Hash

253197cca413f9a7767808ea16a1f6edaed7f77f44cfc0c1199f9c37e8fed056

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 31 Mar 2020 05:49:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjar
age: 0
status: 200
access-control-max-age: 600
section-io-cache: Miss
x-cache-hit: 1
x-frame-options: SAMEORIGIN
etag: W/f52c765490ecc88990c3b566456e08dd
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=60
section-io-origin-time-seconds: 0.073
accept-ranges: bytes
section-io-id: 32691adcfaa5d50f024ab01211d0d51d
section-origin-responded: true

GET
DATA 200
OK truncated
/ 239 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK 121.png
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 141 KB
141 KB 145ms
144ms Image
image/png 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/121.png
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2e2ca7304632b79c8a20ccb43ea40554ac489483acf7683f830a698e56687933

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 31 Mar 2020 05:49:45 GMT
Last-Modified: Mon, 30 Mar 2020 16:30:50 GMT
Server: AmazonS3
x-amz-request-id: 14169A2CA4760BD8
ETag: "75b73497e062299787c3acc7406b2b37"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 143955
x-amz-id-2: a6R7TjGlBcKE66R0tmEMuwmVy9BkfPHQ6s/XM4fDqX3/xJ0XPQdHzIDVScGyQm73QJugl363A9k=

GET
H/1.1 206
Partial Content kk.mp3
critical-update-id0183113.s3.amazonaws.com/chrome-assests/ 58 KB
59 KB 117ms
117ms Media
audio/mp3 52.216.142.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://critical-update-id0183113.s3.amazonaws.com/chrome-assests/kk.mp3
Requested by: Host: critical-update-id0183113.s3.amazonaws.com
URL: https://critical-update-id0183113.s3.amazonaws.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.142.52 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 26ddacb2ab4e8a3e0e6242ac05c896aabd340e6a0f573500c9c67e185c76da29

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
Sec-Fetch-Dest: audio
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 31 Mar 2020 05:49:45 GMT
Last-Modified: Mon, 30 Mar 2020 09:49:54 GMT
Server: AmazonS3
x-amz-request-id: 8886D9A6DD944794
ETag: "0e67839d0e57c105a74381a29c22666f"
Content-Type: audio/mp3
Content-Range: bytes 0-59881/59882
Accept-Ranges: bytes
Content-Length: 59882
x-amz-id-2: 3dmxQyAoiod1IWQy7XO+jElyvjVUbvOx/m8ZHJ90T4TuZbLidc4rHLTHmmyL9z6rKRHn2JwHiOY=

GET
H2 200 modules.17c97750a9d093b794df.js Show response
script.hotjar.com/ 366 KB
69 KB 60ms
20ms Script
application/javascript 147.75.102.239
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.17c97750a9d093b794df.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-638878.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.239 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress2
Software: /
Resource Hash: 0f9b6f33f064f378e7f390a41dd5f22adecbc56a8d40c6e219a086f5f4ef1f16

Request headers

Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 31 Mar 2020 05:49:44 GMT
content-encoding: br
content-type: application/javascript
age: 412459
status: 200
section-io-cache: Hit
content-length: 70645
last-modified: Thu, 26 Mar 2020 11:12:31 GMT
etag: "3a5a4807e54283bcadc4388cb084ad93"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.095
accept-ranges: bytes
section-io-id: 3396cd9d34a3ae55158c2acf7110cb50
section-origin-responded: true

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 3C95 0
0 55ms
18ms Document
text/html 147.75.33.229
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-638878.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.229 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress11
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://critical-update-id0183113.s3.amazonaws.com/index.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://critical-update-id0183113.s3.amazonaws.com/index.html

Response headers

status: 200
date: Tue, 31 Mar 2020 05:49:44 GMT
content-type: text/html
content-length: 851
last-modified: Wed, 25 Mar 2020 15:18:29 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.093
section-origin-responded: true
age: 434548
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: a4ea6c245b4c89e2c797897ba706a26c

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: truncated
URL: data:truncated

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer) Generic (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.critical-update-id0183113.s3.amazonaws.com/	1970-01-19 16:59:52	Name: _hjid Value: 2418d586-4aee-4906-bdd3-cd2374f092e2
.critical-update-id0183113.s3.amazonaws.com/	1970-01-19 08:28:40	Name: _gid Value: GA1.4.670689958.1585633784
.critical-update-id0183113.s3.amazonaws.com/	1970-01-19 08:27:13	Name: _gat_gtag_UA_114773682_1 Value: 1
.critical-update-id0183113.s3.amazonaws.com/	1970-01-20 01:58:25	Name: _ga Value: GA1.4.2058387003.1585633784

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

critical-update-id0183113.s3.amazonaws.com
script.hotjar.com
static.hotjar.com
stats.g.doubleclick.net
truncated
vars.hotjar.com
www.google-analytics.com
www.googletagmanager.com
truncated
147.75.102.203
147.75.102.239
147.75.33.229
2a00:1450:4001:81d::2008
2a00:1450:4001:81d::200e
2a00:1450:400c:c08::9d
52.216.142.52
0f9b6f33f064f378e7f390a41dd5f22adecbc56a8d40c6e219a086f5f4ef1f16
1257bf3ff800c9ce0da27dcea3a6c2ec4871de33d251f127eb915c3c1b47822b
253197cca413f9a7767808ea16a1f6edaed7f77f44cfc0c1199f9c37e8fed056
25d2d73c6c16c53a9934872e079ebf265f1a70e1df0e5d9190664f0acf12510d
26ddacb2ab4e8a3e0e6242ac05c896aabd340e6a0f573500c9c67e185c76da29
2e2ca7304632b79c8a20ccb43ea40554ac489483acf7683f830a698e56687933
45394e51ceda144d5ec8569246a7b2a0b17b21e0cc58edcfb81e0d3ddaed5911
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89b311864ad71e7bddee0bfbe7f75052d2c92141db09e509c4dde4a1651cb17b
bbfd0cb1353e68621567113f15a5842f63518876e11781a59bc9184d3249d53a
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
f5f3901b0ee572551114982d1d816dfa7bfb2545c112284fbbbe353cdbbc6d6e
fecb582cb09be9dad7723f212cbd99f306bf8af8c206d19183e2fa96a5ff7a72

critical-update-id0183113.s3.amazonaws.com Open in urlscan Pro 52.216.142.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

43 %IPv6

6 Domains

8 Subdomains

8 IPs

5 Countries

620 kBTransfer

989 kBSize

4 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

4 Cookies

Indicators

critical-update-id0183113.s3.amazonaws.com Open in urlscan Pro
52.216.142.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

43 %
IPv6

6
Domains

8
Subdomains

8
IPs

5
Countries

620 kB
Transfer

989 kB
Size

4
Cookies

14 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!