hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com Open in urlscan Pro
52.95.171.44  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://qtsqs.com//RK=0/RS=CxmcfWBj9USV5Ex6tVoFdDAM498- Page URL
2. https://hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com/index.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	RS=CxmcfWBj9USV5Ex6tVoFdDAM498- qtsqs.com//RK=0/	7 KB 3 KB	654ms 628ms	Document text/html	85.187.128.14 A2HOSTING
General Check archive.org Show headers Download Go to Full URL http://qtsqs.com//RK=0/RS=CxmcfWBj9USV5Ex6tVoFdDAM498- Protocol HTTP/1.1 Server 85.187.128.14 Singapore, Singapore, ASN55293 (A2HOSTING, US), Reverse DNS sg1-ss8.a2hosting.com Software Apache / PHP/7.0.33 Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Host qtsqs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 26 Apr 2021 10:04:37 GMT Server Apache X-Powered-By PHP/7.0.33 Strict-Transport-Security max-age=63072000; includeSubDomains X-Frame-Options SAMEORIGIN X-Content-Type-Options nosniff Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip Content-Length 3072 Keep-Alive timeout=3, max=500 Content-Type text/html; charset=UTF-8
GET		install.css qtsqs.com//RK=0/wp-admin/css/	0 0
GET		wordpress-logo.png qtsqs.com//RK=0/wp-admin/images/	0 0
GET H/1.1	200 OK	Primary Request index.html Show response hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com/	597 KB 597 KB	181ms 59ms	Document text/html	52.95.171.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com/index.html Requested by Host: qtsqs.com URL: http://qtsqs.com//RK=0/RS=CxmcfWBj9USV5Ex6tVoFdDAM498- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.95.171.44 Stockholm, Sweden, ASN16509 (AMAZON-02, US), Reverse DNS s3-r-w.eu-north-1.amazonaws.com Software AmazonS3 / Resource Hash cfaa704322deda32e4e119ffd434b63ddcdefa966be4bd30bf0541464c5af91d Request headers Host hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer http://qtsqs.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://qtsqs.com/ Response headers x-amz-id-2 NHCNyQhFiQOBrNqGtTY3LdH9n9+xzVqR8qPNeqZys8DyOykPwAZ+Z2v9u58da346DpweL6vrvsY= x-amz-request-id PQ4F5TPW6XTAHWQ2 Date Mon, 26 Apr 2021 10:04:39 GMT Last-Modified Mon, 26 Apr 2021 08:22:07 GMT ETag "1c9a798874472042559e4b7fe1d846c5" Accept-Ranges bytes Content-Type text/html Content-Length 611043 Server AmazonS3
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	14ms 13ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com URL: https://hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin https://hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com Referer https://hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 26 Apr 2021 10:04:38 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 267552 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27938 cf-request-id 09af3c6bf60000dfd33613c000000001 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=E15%2BWZg0rx%2BWpPnl2lre5wL%2F5S4ZS8R2dIJIQrx0ydZhB9nWI9ORQ7ZxwsIUhfztWIOyh5e1xuG%2F17E6CvPtNfGCIJdCqKso%2FZOHKPVoBlsWmlitk5a8lR8uBGxJu1iAsg%3D%3D"}],"max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 645efcf32db9dfd3-FRA expires Sat, 16 Apr 2022 10:04:38 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	277 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET H/1.1	200 OK	call.php Show response scotlandyouthleague.com/	579 B 887 B	683ms 350ms	XHR application/json	69.49.229.85 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://scotlandyouthleague.com/call.php?u=null Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 69.49.229.85 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 1.bharatyojana.org Software Apache / Resource Hash b1996ab0a5e1e1d28c798dce30827591d936996a87e266817452d5788b005585 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Mon, 26 Apr 2021 10:04:38 GMT Server Apache Transfer-Encoding chunked Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-cache Connection Keep-Alive Access-Control-Allow-Headers * Keep-Alive timeout=5, max=100

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

qtsqs.com

URL

http://qtsqs.com//RK=0/wp-admin/css/install.css?ver=20100228

Domain

qtsqs.com

URL

http://qtsqs.com//RK=0/wp-admin/images/wordpress-logo.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| lc function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
hashi-044820-aldjhywnk-pk2y62h.s3.eu-north-1.amazonaws.com
qtsqs.com
scotlandyouthleague.com
qtsqs.com
2606:4700::6810:125e
52.95.171.44
69.49.229.85
85.187.128.14
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
b1996ab0a5e1e1d28c798dce30827591d936996a87e266817452d5788b005585
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
cfaa704322deda32e4e119ffd434b63ddcdefa966be4bd30bf0541464c5af91d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e