d3n4e6gbgf49di.cloudfront.net Open in urlscan Pro
13.224.89.31 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://d3n4e6gbgf49di.cloudfront.net/
Submission: On May 24 via api (May 24th 2020, 1:55:09 am UTC) from BE

Summary HTTP 16 Redirects Links 2 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 13.224.89.31, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is d3n4e6gbgf49di.cloudfront.net.

This is the only time d3n4e6gbgf49di.cloudfront.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) Generic (Online) Tech Support Scam (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
13	13.224.89.31 13.224.89.31		16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:814::200a		15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::200e		15169 (GOOGLE) (GOOGLE)
16	4

13 13.224.89.31 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-89-31.zrh50.r.cloudfront.net

d3n4e6gbgf49di.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	cloudfront.net d3n4e6gbgf49di.cloudfront.net	582 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	googleapis.com fonts.googleapis.com	2 KB
16	3

	Domain	Requested by
13	d3n4e6gbgf49di.cloudfront.net	d3n4e6gbgf49di.cloudfront.net
2	www.google-analytics.com	d3n4e6gbgf49di.cloudfront.net
1	fonts.googleapis.com	d3n4e6gbgf49di.cloudfront.net
16	3

This site contains links to these domains. Also see Links.

Domain
senzav.us
www.google.com

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-05-05` - `2020-07-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://d3n4e6gbgf49di.cloudfront.net/
Frame ID: 8EE9AEFABACB37B2A2BF1AA67AB1E189
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers via /\(CloudFront\)$/i
headers server /^AmazonS3$/i

Amazon Cloudfront (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /\(CloudFront\)$/i

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

19 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

603 kB
Transfer

751 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://senzav.us/kub/wpojapwjdoo/
Title: ×

Search URL Search Domain Scan URL

URL: https://www.google.com/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
d3n4e6gbgf49di.cloudfront.net/ 24 KB
24 KB 387ms
344ms Document
text/html 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d1d5ab92034a85150d0061a22f6821f236b09403c6ea78e5811a318efed089d0

Request headers

Host: d3n4e6gbgf49di.cloudfront.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/html
Content-Length: 24381
Connection: keep-alive
Date: Sun, 24 May 2020 01:54:44 GMT
Last-Modified: Tue, 02 Apr 2019 22:44:29 GMT
ETag: "7fa2648c415902c93d1f205ecb649a34"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Miss from cloudfront
Via: 1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ZRH50-C1
X-Amz-Cf-Id: sJM6QoKVoGH5R00Ldcr0qkduKKRjAmCUjsKIjQjBgW8LtLYMTYc8Fg==

GET
H/1.1 200
OK bootstrap.min.css
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 118 KB
119 KB 235ms
220ms Stylesheet
text/css 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/bootstrap.min.css
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://d3n4e6gbgf49di.cloudfront.net/
Origin: http://d3n4e6gbgf49di.cloudfront.net

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 449f2b51e83bf8ba5fa5e65ce60bc277.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "ec3bb52a00e176a7181d454dffaea219"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: text/css
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 121200
X-Amz-Cf-Id: 4s9Jshhxw8RXNkc0V24fvj-Y4YP3ngLlj7mMZK6hOZhC0zxs3OSN8w==

GET
H/1.1 200
OK bootstrap-theme.min.css
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 23 KB
23 KB 264ms
250ms Stylesheet
text/css 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/bootstrap-theme.min.css
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://d3n4e6gbgf49di.cloudfront.net/
Origin: http://d3n4e6gbgf49di.cloudfront.net

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:29 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "ab6b02efeaf178e0247b9504051472fb"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: text/css
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23409
X-Amz-Cf-Id: Y-vTMoOnkAHm09vzhrjOIAAKLPmabc38nuWqn_AL6FtHBKii5toW4A==

GET
H/1.1 200
OK style.css
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 4 KB
4 KB 209ms
195ms Stylesheet
text/css 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/style.css
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 143e1c0ed6cc6582749c9d73680356200d02b37fd0c66372cd2a1ea20a62b5fd

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 a63182cf51dce7998774e112bf9ee7c6.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "53c853df2d50bd29b8b0f2321c0df925"
X-Cache: Miss from cloudfront
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4154
X-Amz-Cf-Id: NERIITCxLSGTvfF0JK5Q3a24IqN0ShjYaCCH8Wf5J_HR0O7s2rsC1w==

GET
H/1.1 200
OK analytics.js.download Show response
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 39 KB
39 KB 179ms
178ms Script
application/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/analytics.js.download
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ed17a6e7532cc3065f9fbd8f607dfd30e09b4531ada9f7cb5732a2bf6cf6744c

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "3e6b905ecebeaa42a4104a25faa2ebdf"
X-Cache: Miss from cloudfront
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 39695
X-Amz-Cf-Id: TJFMRtznCvMUs4SIj0BexLEgoo7qmlT5r8gzWhoLbJw3kGaIO9gOWg==

GET
H/1.1 200
OK js Show response
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 77 KB
77 KB 243ms
229ms Script
binary/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/js
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9c39668fb6c7102f38bdd66aec1cc7000430d126cf8665f84fa81a40b619a2ff

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:27 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "dc546fee5ec9abf1c7684bf16e834e9c"
X-Cache: Miss from cloudfront
Content-Type: binary/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 78525
X-Amz-Cf-Id: Wi6TUFNRCTUrshbOOz3WyOV1gmuLFzW1JhCrou0MXRCM8zNB_f-R5A==

GET
H/1.1 200
OK support.svg
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 16 KB
16 KB 257ms
243ms Image
image/svg+xml 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/support.svg
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ea2cefd1f0e8aaac01aa58121d8e5e763b42965325b97f11ba504bf8e1ed8081

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "d72c42cffff91f9e7ee41a782b12ae8b"
X-Cache: Miss from cloudfront
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16047
X-Amz-Cf-Id: 18Mbo57YrJVcuIIK4-hms73K_JsInjiP7lZ6EpreBYxlkaVwlPrjzA==

GET
H/1.1 200
OK 335158-windows-8-window.png
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 28 KB
28 KB 406ms
176ms Image
application/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/335158-windows-8-window.png
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 312c6606235f1ba63b2141b812fef5398536390a76c85f5ab8bcc35a7aa8737e

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:45 GMT
Via: 1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "2ac90f76ef5c91f3f49e6a74cfc88484"
X-Cache: Miss from cloudfront
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28697
X-Amz-Cf-Id: Ocs2RDojLmwnQ2C5wKE-VwFXvqRbizFGoBCEQPOGuf3XHj4WX2Cphg==

GET
H/1.1 200
OK jquery-3.3.1.min.js.download Show response
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 85 KB
85 KB 299ms
299ms Script
application/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/jquery-3.3.1.min.js.download
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://d3n4e6gbgf49di.cloudfront.net/
Origin: http://d3n4e6gbgf49di.cloudfront.net

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "a09e13ee94d51c524b7e2a728c7d4039"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86927
X-Amz-Cf-Id: Y4XWTindL0TFs1oMmdyuvDHLqGYyNmcjxzPolBZv-xqkJi-bdP-CMg==

GET
H/1.1 200
OK jquery-3.3.1.min.js(1).download Show response
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 85 KB
85 KB 377ms
377ms Script
application/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/jquery-3.3.1.min.js(1).download
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://d3n4e6gbgf49di.cloudfront.net/
Origin: http://d3n4e6gbgf49di.cloudfront.net

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 449f2b51e83bf8ba5fa5e65ce60bc277.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:27 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "a09e13ee94d51c524b7e2a728c7d4039"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, POST, PUT
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86927
X-Amz-Cf-Id: Q4XnejdcbBbSyAUgeurMcC1cHMrPxBt8v94FDjAwYMHdoBQRhQ2BMw==

GET
H/1.1 200
OK script.js.download Show response
d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/ 8 KB
8 KB 186ms
185ms Script
application/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/script.js.download
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f82295b547363edb2e2b49609f3231db095b29c756c9069d37271b65e837d90a

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:44 GMT
Via: 1.1 a63182cf51dce7998774e112bf9ee7c6.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:29 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "9f9b223d28f307368ccf80b1c81222e3"
X-Cache: Miss from cloudfront
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7929
X-Amz-Cf-Id: AvujvS40zkkbu3xv8dRZGLOyH86zU9Jn3KgUuyG-GjtopI_xPkQ9CA==

GET
H2 200 css
fonts.googleapis.com/ 33 KB
2 KB 48ms
47ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Comfortaa:300|Cormorant+Garamond|Cormorant+Infant|Cormorant+SC|Cormorant+Unicase|EB+Garamond|El+Messiri|Forum|Jura|Lobster|Neucha|Open+Sans+Condensed:300|PT+Sans|PT+Sans+Narrow|Philosopher|Playfair+Display+SC|Poiret+One|Ruslan+Display|Russo+One|Ubuntu&subset=cyrillic

Requested by

Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

194e3cea1157a5cb62a34f76bcde3e02810f47aaa52495ffbf830cf21548c8a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 24 May 2020 01:54:43 GMT
server: ESF
date: Sun, 24 May 2020 01:54:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 24 May 2020 01:54:43 GMT

GET
DATA 200
OK truncated
/ 239 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK background.png
d3n4e6gbgf49di.cloudfront.net/images/ 71 KB
71 KB 338ms
202ms Image
application/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://d3n4e6gbgf49di.cloudfront.net/images/background.png
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dfc8c355a709de9239f10b162cbbe46b6862c0f6def9bfbfc2b5d2b815bd79a0

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 May 2020 01:54:45 GMT
Via: 1.1 a63182cf51dce7998774e112bf9ee7c6.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "ba8844af103a6faf0570f8f27788c9c9"
X-Cache: Miss from cloudfront
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 72536
X-Amz-Cf-Id: pkvloYP89QMBuhphIUxzdZ_8Alvzeh9ZxJtj-OP4MBj9gGmaq_pL6A==

GET
H/1.1 206
Partial Content sound.mp3
d3n4e6gbgf49di.cloudfront.net/assets/audio/ 96 KB
0 208ms
207ms Media
binary/octet-stream 13.224.89.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d3n4e6gbgf49di.cloudfront.net/assets/audio/sound.mp3
Requested by: Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/
Protocol: HTTP/1.1
Server: 13.224.89.31 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-31.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Sun, 24 May 2020 01:54:45 GMT
Via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Apr 2019 22:44:29 GMT
Server: AmazonS3
X-Amz-Cf-Pop: ZRH50-C1
ETag: "f5cccea12f9f12ece21579313aaf791b"
X-Cache: Miss from cloudfront
Content-Type: binary/octet-stream
Content-Range: bytes 0-251341/251342
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 251342
X-Amz-Cf-Id: 9ICeCW_Ae4O_Dxe-iQFyjmPki0wRRyJWZJ7-dY4K_K1Q_qS9nwNcow==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/Microsoft%20Official%20Support_files/js

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 4569
date: Sun, 24 May 2020 00:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Sun, 24 May 2020 02:38:35 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
98 B 14ms
13ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j69&a=170843435&t=pageview&_s=1&dl=http%3A%2F%2Fd3n4e6gbgf49di.cloudfront.net%2F&ul=en-us&de=UTF-8&dt=Microsoft%20Official%20Support&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KEBAAUABE~&jid=1944003387&gjid=294132&cid=1977690755.1590285284&tid=UA-126764599-1&_gid=1784921901.1590285284&_r=1&gtm=u9o&z=32236034

Requested by

Host: d3n4e6gbgf49di.cloudfront.net
URL: http://d3n4e6gbgf49di.cloudfront.net/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://d3n4e6gbgf49di.cloudfront.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 May 2020 01:54:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) Generic (Online) Tech Support Scam (Consumer)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| gtag object| dataLayer boolean| isOpera boolean| isFirefox boolean| isSafari boolean| isChrome boolean| isIE object| google_tag_data function| ga object| gaplugins function| $ function| jQuery object| google_tag_manager string| GoogleAnalyticsObject object| sa object| gaGlobal object| gaData function| fillForm function| closeCode function| getCode function| modalClose function| getModal function| _toggleFullScreen function| open1 function| isPlaying function| forceDownload function| catchControlKeys function| prevent boolean| state function| confirmExit function| get_browser boolean| InternetEx boolean| isIEedge object| browser undefined| msg_ff

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.d3n4e6gbgf49di.cloudfront.net/	1970-01-19 09:44:45	Name: _gat_gtag_UA_126764599_1 Value: 1
			.d3n4e6gbgf49di.cloudfront.net/	1970-01-19 09:46:11	Name: _gid Value: GA1.3.1784921901.1590285284
			.d3n4e6gbgf49di.cloudfront.net/	1970-01-20 03:15:57	Name: _ga Value: GA1.3.1977690755.1590285284

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d3n4e6gbgf49di.cloudfront.net
fonts.googleapis.com
www.google-analytics.com
13.224.89.31
2a00:1450:4001:800::200e
2a00:1450:4001:814::200a
143e1c0ed6cc6582749c9d73680356200d02b37fd0c66372cd2a1ea20a62b5fd
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
194e3cea1157a5cb62a34f76bcde3e02810f47aaa52495ffbf830cf21548c8a3
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
312c6606235f1ba63b2141b812fef5398536390a76c85f5ab8bcc35a7aa8737e
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9c39668fb6c7102f38bdd66aec1cc7000430d126cf8665f84fa81a40b619a2ff
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
d1d5ab92034a85150d0061a22f6821f236b09403c6ea78e5811a318efed089d0
dfc8c355a709de9239f10b162cbbe46b6862c0f6def9bfbfc2b5d2b815bd79a0
ea2cefd1f0e8aaac01aa58121d8e5e763b42965325b97f11ba504bf8e1ed8081
ed17a6e7532cc3065f9fbd8f607dfd30e09b4531ada9f7cb5732a2bf6cf6744c
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f82295b547363edb2e2b49609f3231db095b29c756c9069d37271b65e837d90a