urlscan.io logo urlscan.io
SecurityTrails logo

nereus.s3.amazonaws.com Open in urlscan Pro
52.219.152.145  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Submission: On January 15 via manual from AU — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 13 HTTP transactions. The main IP is 52.219.152.145, located in Tokyo, Japan and belongs to AMAZON-02, US. The main domain is nereus.s3.amazonaws.com.
TLS certificate: Issued by Amazon on September 21st 2022. Valid for: a year.
This is the only time nereus.s3.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 52.219.152.145 16509 (AMAZON-02)
8 2a04:4e42:200... 54113 (FASTLY)
1 2404:6800:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 162.159.130.233 13335 (CLOUDFLAR...)
13 5
1    52.219.152.145 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: s3-ap-northeast-1-w.amazonaws.com
nereus.s3.amazonaws.com
8    2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    2404:6800:4004:81e::200a (Australia)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    162.159.130.233 (None, )

ASN13335 (CLOUDFLARENET, US)
cdn.discordapp.com
Apex Domain
Subdomains		 Transfer
8 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 357
151 KB
2 discordapp.com
cdn.discordapp.com — Cisco Umbrella Rank: 3568
12 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 199
6 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 292
31 KB
1 amazonaws.com
nereus.s3.amazonaws.com
15 KB
13 5
Domain Requested by
8 cdn.jsdelivr.net nereus.s3.amazonaws.com
2 cdn.discordapp.com nereus.s3.amazonaws.com
1 cdnjs.cloudflare.com nereus.s3.amazonaws.com
1 ajax.googleapis.com nereus.s3.amazonaws.com
1 nereus.s3.amazonaws.com
13 5

This site contains links to these domains. Also see Links.

Domain
banking.bendigobank.com.au
www.bendigobank.com.au
Subject Issuer Validity Valid
*.s3.amazonaws.com
Amazon		 2022-09-21 -
2023-08-26		 a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-23 -
2024-01-24		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://nereus.s3.amazonaws.com/coupon/index1.html
Frame ID: 2A7CE2563F67E6FA018D970F31764505
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bendigo Bank - Log in to e-banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

13
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

215 kB
Transfer

824 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index1.html
nereus.s3.amazonaws.com/coupon/ 		15 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.219.152.145 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-ap-northeast-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
8f04400ab995af959c7887aee00c8e35c3d5a0614e685242ad9bdeb84a949977

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
14928
Content-Type
text/html
Date
Sun, 15 Jan 2023 23:17:51 GMT
ETag
"f2f9a3ccc20a67ba659ef819464e9143"
Last-Modified
Fri, 13 Jan 2023 22:52:49 GMT
Server
AmazonS3
x-amz-id-2
fQHZhO0SUpRa7RwC6pCUxbFNRYQoB4QJQM0GLtmkvF8Kct1LKd/IAXYY+ib0x3zBjtCa0NM/xVo=
x-amz-request-id
ZHW58C9EAHQVKEF1
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.6.2/dist/css/ 		158 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@4.6.2/dist/css/bootstrap.min.css
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
7491083
x-jsd-version
4.6.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
24176
x-served-by
cache-fra-eddf8230127-FRA, cache-nrt-rjtf7700036-NRT
x-jsd-version-type
version
etag
W/"279d8-G+N7YjBsjAxndbtMk8XkxOE9l3U"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
jquery.slim.min.js
cdn.jsdelivr.net/npm/jquery@3.6.1/dist/ 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/jquery@3.6.1/dist/jquery.slim.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c3c0af845b3b88735552d9d23f460a120d34a7d221d77ae52fdcc6aaf2dd78f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
7424327
x-jsd-version
3.6.1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
24725
x-served-by
cache-fra-eddf8230093-FRA, cache-nrt-rjtf7700036-NRT
x-jsd-version-type
version
etag
W/"11b57-UFBN2V43SI65hxvuZhxYj4TgTJw"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
7491253
x-jsd-version
1.16.1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
7503
x-served-by
cache-fra-eddf8230069-FRA, cache-nrt-rjtf7700036-NRT
x-jsd-version-type
version
etag
W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.6.2/dist/js/ 		81 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@4.6.2/dist/js/bootstrap.bundle.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
19126b874a32753d42c12dfa6c17892bfd93820a5a5100ba1b34da4d07599b49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
3515888
x-jsd-version
4.6.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
22129
x-served-by
cache-fra-eddf8230044-FRA, cache-nrt-rjtf7700036-NRT
x-jsd-version-type
version
etag
W/"145b0-MjP9Adh/ukV+qtjcvCifdbFw+BQ"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.1/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:81e::200a , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Sun, 15 Jan 2023 10:38:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
45591
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31100
x-xss-protection
0
last-modified
Thu, 08 Sep 2022 18:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 15 Jan 2024 10:38:00 GMT
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/ 		32 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.css
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
082b0736a3408950e50fd65a090921003fe83d89ec6e3084549a01d5dfa9e854
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://nereus.s3.amazonaws.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Sun, 15 Jan 2023 23:17:51 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
278005
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5195
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-81d1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jQWz%2FzP5m72NWs1IKRr6fHXgE7wt88fBXUB7XwTaL3Z%2BMwCWfLQAkHyghu6t57sbvF77w86RCMt%2FWSPHtBW0BznnIW%2FVlv5Sqm7iSRgUUOTVM96HXVKLQzKc9j1a6sIv2XGPDjK4VR6GRPl9LLYEW70z"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
78a253c1c80aaff4-NRT
expires
Fri, 05 Jan 2024 23:17:51 GMT
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 		190 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nereus.s3.amazonaws.com/
Origin
https://nereus.s3.amazonaws.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
4721040
x-jsd-version
5.2.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
27506
x-served-by
cache-fra-eddf8230113-FRA, cache-nrt-rjtf7700060-NRT
x-jsd-version-type
version
etag
W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/ 		79 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.bundle.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
061f0b1ea79e6e2ca24f4603e55d3e909f7471ba0b279cdb6dea40554106c6a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nereus.s3.amazonaws.com/
Origin
https://nereus.s3.amazonaws.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
1924371
x-jsd-version
5.3.0-alpha1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
23372
x-served-by
cache-fra-eddf8230057-FRA, cache-nrt-rjtf7700060-NRT
x-jsd-version-type
version
etag
W/"13ad7-v/eN2cAqUAirQ2QpSHOc5Yx2GyE"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
popper.min.js
cdn.jsdelivr.net/npm/@popperjs/core@2.11.6/dist/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.6/dist/umd/popper.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
051a8137b75880006ab58f47778ca713ed6c967130faba043c5cd0ed34517dc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nereus.s3.amazonaws.com/
Origin
https://nereus.s3.amazonaws.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
3941802
x-jsd-version
2.11.6
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
7353
x-served-by
cache-fra-eddf8230114-FRA, cache-nrt-rjtf7700060-NRT
x-jsd-version-type
version
etag
W/"4e7f-YDO5/9GsCmSrp3VxzVXmgduuK5k"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/ 		59 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.min.js
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
34f2409f58b3fd380f8efcde331e18531e6c4bce3ac22ffaa01ef2a8ed2efd4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nereus.s3.amazonaws.com/
Origin
https://nereus.s3.amazonaws.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 15 Jan 2023 23:17:51 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
1924139
x-jsd-version
5.3.0-alpha1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
16187
x-served-by
cache-fra-eddf8230036-FRA, cache-nrt-rjtf7700060-NRT
x-jsd-version-type
version
etag
W/"ec8a-z/PmJCRGsgLcOzQ/ORPiUuHO4kQ"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bendigologo.JPG
cdn.discordapp.com/attachments/1063572301276250132/1063586705879343134/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.discordapp.com/attachments/1063572301276250132/1063586705879343134/bendigologo.JPG
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.130.233 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a21c5d2559ff67d914d25cfe880bc059371b0c339428853bdb3fffd687e9b3

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Sun, 15 Jan 2023 23:17:51 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycdt54Gb8LTaljRqlpN796bXvxrikV-OF98TsdIsJICJ9Sya5RoDzkCTGlkKgjrjba9iSrCeWw9hIK1QUKHfzyTzskQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6685
last-modified
Fri, 13 Jan 2023 22:33:51 GMT
server
cloudflare
etag
"a1df108b18900cb980a88cead71139a3"
vary
Accept-Encoding
x-goog-generation
1673649231207071
content-type
image/jpeg
x-goog-hash
crc32c=F85jMA==, md5=od8QixiQDLmAqIzq1xE5ow==
cache-control
public, max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t18RZ0UTR1BvQ3wnHfAk0APXVdKCtOU2DCSBNcyaQw7YQqJs%2F8P2fSDFTIIv7VdVRtlBdLQ231osJj%2FhoSCjvoBF55HytwWVUBA95Sbri2X4%2FGNwl2qXX2fM%2BafnPtxBQZiWrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
6685
accept-ranges
bytes
cf-ray
78a253c20dac3517-NRT
x-robots-tag
noindex, nofollow, noarchive, nocache, noimageindex, noodp
expires
Mon, 15 Jan 2024 23:17:51 GMT
user.JPG
cdn.discordapp.com/attachments/1063572301276250132/1063586829149945887/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.discordapp.com/attachments/1063572301276250132/1063586829149945887/user.JPG
Requested by
Host: nereus.s3.amazonaws.com
URL: https://nereus.s3.amazonaws.com/coupon/index1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.130.233 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
68c46ca940686aaea0e08afc862b09153b8561569d928014294bc1ad3c0736ce

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://nereus.s3.amazonaws.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Sun, 15 Jan 2023 23:17:51 GMT
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycdtMSvoKVE8_ilk4Gx9GVS14NxZMPzhHRr6ldFqffz3PzzgQQKwSrcVr0GeoLnRjxpD4cSx9ylYwzd4-Lu5WQ2DNWA
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3800
last-modified
Fri, 13 Jan 2023 22:34:20 GMT
server
cloudflare
etag
"e5008e51ce29076ed8caef2a8a83796b"
vary
Accept-Encoding
x-goog-generation
1673649260601438
content-type
image/jpeg
x-goog-hash
crc32c=3c5csw==, md5=5QCOUc4pB27Yyu8qioN5aw==
cache-control
public, max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wtaZGZRGONpB7uMrqhjDrfMEmJUXCj81KtX56HEHed1ls%2BC25AXCTu0EuAYvuZvkwBU%2FGtqEoT%2FR9%2FGrtmJSwsUzSSkzAbVQ0%2BfUAoAqGdE0J%2FrcbE%2FmuHmIU0uGisL3gGcylw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
3800
accept-ranges
bytes
cf-ray
78a253c21dae3517-NRT
x-robots-tag
noindex, nofollow, noarchive, nocache, noimageindex, noodp
expires
Mon, 15 Jan 2024 23:17:51 GMT

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on January 15th 2023, 11:18:43 pm UTC — From India

Threats: Phishing
Brands: Bendigo Bank AU
Comment: confirmed phishing url targeting bendigo bank

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery object| Popper object| bootstrap number| uidEvent

1 Cookies

Domain/Path Name / Value
.discordapp.com/ Name: __cf_bm
Value: tefMowAoKnimovMp2ygjPNnKKq36IziZ2uAJgMHOZT4-1673824671-0-AZh2EdN2OaLrT+V9zu7/wxRFUQDa09hj2Av00nA3/SJBUwuwZWjWWb/7nJsu/DnUKrJ2oVp1n7x1rZReDej3bwk=