Domain > cloudfunctions.demo.wlid.nl

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2021-05-19	13.225.230.116 (ClassC)
2024-08-29	3.163.158.81 (ClassC)
2025-04-10	3.163.24.9 (ClassC)
2025-07-18	3.163.24.84 (ClassC)

HTTP/1.1 200 OKContent-Type: text/htmlContent-Length: 2854Connection: keep-aliveDate: Thu, 29 Aug 2024 02:41:09 GMTLast-Modified: Tue, 18 May 2021 20:44:28 GMTETag: 3d986d9868b76823287fb04f67358341Cac

html>head>title>WLID CloudFront Functions Demo/title>link relstylesheet typetext/css href/css/bootstrap.min.css />link relstylesheet typetext/css href/css/wlid.css />script src/js/bootstrap.min.js typetext/javascript>/script>meta http-equivContent-Type contenttext/html; charsetiso-8859-1 />/head>body>div classcontainer>div classrow-fluid>div idheader>img src/img/headerbar_transparent.png />/div>/div>div classrow-fluid>div idmain>h4>CloudFront Functions Demo/h4>p>When you click on the links below, a picture of a secret aircraft will be retrieved from S3, cached in CloudFront, and shown in your browser./p>p>However, before downloading and forwarding the picture, CloudFront will run a CloudFront Function, which checks if your authorization is OK. This authorization is implemented (for demo purposes) in the query headers./p>p>Download the picture without authorization: a href/secret/secret_aircraft.jpeg>/secret/secret_aircraft.jpeg/a>/p>p>Download the picture with an incorrect authorization: a href/secret/secret_aircraft.jpeg?secretWrong>/secret/secret_aircraft.jpeg?secretWrong/a>/p>p>Download the picture with the correct authorization: a href/secret/secret_aircraft.jpeg?secretMySecret>/secret/secret_aircraft.jpeg?secretMySecret/a>/p>h4>Explanation/h4>p>The URL for this page (cloudfunctions.demo.wlid.nl) points to a CloudFront distribution. This distribution has an S3 bucket as its origin. Most of the distribution is pretty standard, however the distribution has a behaviour for /secret/*. If anybody tries to download anything from this /secret directory, a ViewerRequest CloudFront Function is automatically invoked. This function is as follows:/p>pre>function handler(event) {    var request  event.request;        if( request.querystring && request.querystring.secret && request.querystring.secret.value && request.querystring.secret.value  MySecret )    {        delete request.querystring.secret;        return( request );    }        var response401  {        statusCode: 401,        statusDescription: Unauthorized    };

Port 443

Subdomains

Date	Domain	IP
cf.demo.wlid.nl	2020-05-29	13.225.210.23
cloudfunctions.demo.wlid.nl	2024-08-29	3.163.158.81

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > cloudfunctions.demo.wlid.nl

Is this malicious?

DNS Resolutions

Port 80

Port 443

Subdomains