Domain > prod.rcaplus.dce.aws.dev

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2024-12-14	108.138.159.112 (ClassC)
2026-01-22	3.175.34.56 (ClassC)

HTTP/1.1 301 Moved PermanentlyServer: CloudFrontDate: Thu, 22 Jan 2026 13:45:41 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveLocation: https://prod.rcaplus.dce.aws.dev/X-Cache: Redirect from cloudfrontVia: 1.1 240505787baa09e4b0a287e248b4543a.cloudfront.net (CloudFront)X-Amz-Cf-Pop: HIO52-P3Alt-Svc: h3:443; ma86400X-Amz-Cf-Id: dGM9obHAKPgfrLnvoiVW2gxS7wKP51HGEuP4mr2QP5s390bSuNfmigX-Frame-Options: SAMEORIGINContent-Security-Policy: default-src self; script-src self sha256-FWC7PWgKxx1QRyYHa0r//Y9qlL30CWfq47G/gELAeBw; img-src self data: https://*.s3.us-west-2.amazonaws.com https://*.s3.amazonaws.com https://*.amazon.com; font-src self data: https://*.cloudfront.net; connect-src self https://*.amazoncognito.com https://*.amazonaws.com https://*.katal.metrics.core.nexus https://*.amazon.com; frame-src self https://app.smartsheet.com/X-Content-Type-Options: nosniffCache-Control: no-store, no-cachePragma: no-cache

html>head>title>301 Moved Permanently/title>/head>body>center>h1>301 Moved Permanently/h1>/center>hr>center>CloudFront/center>/body>/html>

Port 443

HTTP/1.1 403 ForbiddenContent-Type: text/html; charsetutf-8Content-Length: 8069Connection: keep-aliveDate: Thu, 22 Jan 2026 13:45:42 GMTLast-Modified: Wed, 21 Jan 2026 17:44:42 GMTETag: 30c77e721307c84c2fb20e27a563f017x-amz-server-side-encryption: AES256Cache-Control: no-store, no-cacheAccept-Ranges: bytesServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 0b56b2a6b0fdc99543294439c61ded5e.cloudfront.net (CloudFront)X-Amz-Cf-Pop: HIO52-P3Alt-Svc: h3:443; ma86400X-Amz-Cf-Id: uFjIiXC_pWL6H06bGi10lkWtBs5GtWnXTCl4PcXmrxuec9lweLSgDAX-Frame-Options: SAMEORIGINContent-Security-Policy: default-src self; script-src self sha256-FWC7PWgKxx1QRyYHa0r//Y9qlL30CWfq47G/gELAeBw; img-src self data: https://*.s3.us-west-2.amazonaws.com https://*.s3.amazonaws.com https://*.amazon.com; font-src self data: https://*.cloudfront.net; connect-src self https://*.amazoncognito.com https://*.amazonaws.com https://*.katal.metrics.core.nexus https://*.amazon.com; frame-src self https://app.smartsheet.com/X-Content-Type-Options: nosniffStrict-Transport-Security: max-age47304000; includeSubDomainsPragma: no-cache

!DOCTYPE html>html>    head>        script typetext/javascript>        function getParameterByName(name, url) {            if (!url) url  window.location.href;            name  name.replace(/\\/g, \\$&);            var regex  new RegExp(?& + name + ((^&#*)|&|#|$)),            results  regex.exec(url);            if (!results) return null;            if (!results2) return ;            return decodeURIComponent(results2.replace(/\+/g,  ));        }        function getValidURL(url) {            try {                return new URL(url);            } catch (e) {                return null;            }        }/*! * JavaScript Cookie v2.1.4 * https://github.com/js-cookie/js-cookie * * Copyright 2006, 2015 Klaus Hartl & Fagner Brack * Released under the MIT license */;(function (factory) {    var registeredInModuleLoader  false;    if (typeof define  function && define.amd) {        define(factory);        registeredInModuleLoader  true;    }    if (typeof exports  object) {        module.exports  factory();        registeredInModuleLoader  true;    }    if (!registeredInModuleLoader) {        var OldCookies  window.Cookies;        var api  window.Cookies  factory();        api.noConflict  function () {            window.Cookies  OldCookies;            return api;        };    }}(function () {    function extend () {        var i  0;        var result  {};        for (; i  arguments.length; i++) {            var attributes  arguments i ;            for (var key in attributes) {                resultkey  attributeskey;            }        }        return result;    }    function init (converter) {        function api (key, value, attributes) {            var result;            if (typeof document  undefined) {                return;            }            // Write            if (arguments.length > 1) {                attributes  extend({                    path: /                }, api.defaults, attributes);                if (typeof attributes.expires  number) {                    var expires  new Date();                    expires.setMilliseconds(expires.getMilliseconds() + attributes.expires * 864e+5);                    attributes.expires  expires;                }                // Were using expires because max-age is not supported by IE                attributes.expires  attributes.expires ? attributes.expires.toUTCString() : ;                try {                    result  JSON.stringify(value);                    if (/^\{\/.test(result)) {                        value  result;                    }                } catch (e) {}                if (!converter.write) {                    value  encodeURIComponent(String(value))                        .replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g, decodeURIComponent);                } else {                    value  converter.write(value, key);                }                key  encodeURIComponent(String(key));                key  key.replace(/%(23|24|26|2B|5E|60|7C)/g, decodeURIComponent);                key  key.replace(//g, escape);                var stringifiedAttributes  ;                for (var attributeName in attributes) {                    if (!attributesattributeName) {                        continue;                    }                    stringifiedAttributes + ;  + attributeName;                    if (attributesattributeName  true) {                        continue;                    }                    stringifiedAttributes +  + attributesattributeName;                }                return (document.cookie  key +  + value + stringifiedAttributes);            }            // Read            if (!key) {                result  {};            }            // To prevent the for loop in the first place assign an empty array            // in case there are no cookies at all. Also prevents odd result when            // calling get()            var cookies  document.cookie ? document.cookie.split(; ) : ;            var rdecode  /(%0-9A-Z{2})+/g;            var i  0;            for (; i  cookies.length; i++) {                var parts  cookiesi.split();                var cookie  parts.slice(1).join();                if (cookie.charAt(0)  ) {                    cookie  cookie.slice(1, -1);                }                try {                    var name  parts0.replace(rdecode, decodeURIComponent);                    cookie  converter.read ?                        converter.read(cookie, name) : converter(cookie, name) ||                        cookie.replace(rdecode, decodeURIComponent);                    if (this.json) {                        try {                            cookie  JSON.parse(cookie);                        } catch (e) {}                    }                    if (key  name) {                        result  cookie;                        break;                    }                    if (!key) {                        resultname  cookie;                    }                } catch (e) {}            }            return result;        }        api.set  api;        api.get  function (key) {            return api.call(api, key);        };        api.getJSON  function () {            return api.apply({                json: true            }, .slice.call(arguments));        };        api.defaults  {};        api.remove  function (key, attributes) {            api(key, , extend(attributes, {                expires: -1            }));        };        api.withConverter  init;        return api;    }    return init(function () {});}));        var policy  getParameterByName(policy);        var kpid  getParameterByName(kpid);        var exp  getParameterByName(exp);        var sig  getParameterByName(sig);        var encodedTargetUrl  getParameterByName(encodedTargetUrl);        var decodedTargetUrl  encodedTargetUrl && decodeURIComponent(encodedTargetUrl);        var validTargetURL  getValidURL(decodedTargetUrl);        var hash  window.location.hash;        if (policy && kpid && exp && sig) {            var curr_origin  window.location.origin;            Cookies.set(CloudFront-Policy, policy, { secure: true, sameSite: None, expires: 1 });            Cookies.set(CloudFront-Key-Pair-Id, kpid, { secure: true, sameSite: None, expires: 1 });            Cookies.set(CloudFront-Expiration, exp, { secure: true, sameSite: None, expires: 1 });            Cookies.set(CloudFront-Signature, sig, { secure: true, sameSite: None, expires: 1 });            // Preserve that hash through to the original caller.            if(validTargetURL && curr_origin  validTargetURL.origin) {                window.location.replace(decodedTargetUrl + hash);            } else {                window.location.replace(curr_origin + hash);            }        } else if (Cookies.get(CloudFront-Policy)){            //Nothing to do.        } else {            // Put the hash on the end of the cloudfront signer URL, not inside the encodedTargetUrl, so that it gets            // preserved through the authentication process and doesnt impact midway or CFSigners url limits.            var referrer  window.location.href.split(#)0;            var encodedUrl  encodeURIComponent(referrer);            window.location.replace(https://cloudfrontsigner.ninjas.security.a2z.com/sign?encodedTargetUrl + encodedUrl + hash);        }        /script>    /head>    body>        p>Redirecting you for Auth/p>        !-- This one should be a Bindle that doesnt exist, and triggers a 400 response from ECS. -->        div styledisplay:none idbindlediv>amzn1.bindle.resource.jktuzzeemzfbrcxzc7da/div>    /body>/html>

Subdomains

Date	Domain	IP
service.gamma.skyward.dce.aws.dev	2025-12-25	34.208.190.150
application-engineering.dce.aws.dev	2024-06-10	52.11.54.117
beta.rcaplus.dce.aws.dev	2025-07-16	204.246.191.52
prod.rcaplus.dce.aws.dev	2026-01-22	3.175.34.56

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > prod.rcaplus.dce.aws.dev

Is this malicious?

DNS Resolutions

Port 80

Port 443

Subdomains