104.131.69.126 - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 104.131.69.126, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is 104.131.69.126.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 15th 2021. Valid for: 3 months.

This is the only time 104.131.69.126 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	104.131.69.126 104.131.69.126	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	2600:9000:206... 2600:9000:206f:9800:1d:d7f6:39cf:a761	16509 (AMAZON-02) (AMAZON-02)
6	2

4 104.131.69.126 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

104.131.69.126	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:206f:9800:1d:d7f6:39cf:a761 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	media-amazon.com m.media-amazon.com	32 KB
6	1

	Domain	Requested by
2	m.media-amazon.com	104.131.69.126
6	1

This site contains no links.

Subject Issuer	Validity	Valid
ca-amz.duckdns.org cPanel, Inc. Certification Authority	`2021-10-15` - `2022-01-13`	3 months	crt.sh
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-03-23` - `2022-03-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196
Frame ID: 4DF068068F6CA49EC0CBF4FA9C0BF077
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazonサインイン

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

33 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

218 kB
Transfer

216 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set signin.php Show response 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/	16 KB 17 KB	488ms 279ms	Document text/html	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `a86ce34d4c7adf07d92b845036e2211fe3106ebd0b6e5573f36e5b3eb59cb86b` Request headers Host 104.131.69.126 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Sat, 16 Oct 2021 10:03:17 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=09690228d023f7c538209cb067d73aee; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	61givtVz9L.css 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/	131 KB 131 KB	171ms 99ms	Stylesheet text/css	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/61givtVz9L.css Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `7fb657d49094a6235f8ba8ff8f7c862dbedc8afd58a7e95c3aa0beb9e913a615` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 104.131.69.126 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Cookie PHPSESSID=09690228d023f7c538209cb067d73aee Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 10:03:18 GMT Last-Modified Wed, 23 Jun 2021 21:57:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 133845
GET H/1.1	200 OK	01SdjaY0ZsL.css 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/	36 KB 36 KB	296ms 99ms	Stylesheet text/css	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/01SdjaY0ZsL.css Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 104.131.69.126 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Cookie PHPSESSID=09690228d023f7c538209cb067d73aee Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 10:03:18 GMT Last-Modified Wed, 23 Jun 2021 21:57:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 36434
GET H/1.1	200 OK	11qeL1AgUGL.css 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/	2 KB 3 KB	295ms 98ms	Stylesheet text/css	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/11qeL1AgUGL.css Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 104.131.69.126 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 Cookie PHPSESSID=09690228d023f7c538209cb067d73aee Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.128.37.196 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 10:03:18 GMT Last-Modified Wed, 23 Jun 2021 21:57:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2460
GET H2	200	mPGmT0r6IeTyIee.png m.media-amazon.com/images/S/sash/	27 KB 28 KB	37ms 9ms	Image image/png	2600:9000:206f:9800:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/61givtVz9L.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206f:9800:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 17 Mar 2021 21:56:39 GMT via 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront) age 18360601 edge-cache-tag x-cache-317,/images/S/sash/mPGmT0r6IeTyIee x-cache Hit from cloudfront content-length 27972 surrogate-key x-cache-317 /images/S/sash/mPGmT0r6IeTyIee last-modified Tue, 17 Nov 2020 23:31:33 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 34cc475b-0460-47f7-9a2b-4c73f91fd08a x-amz-cf-pop FRA56-C1 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id 0rJOC_ru10pi9AEyfA9ovBscbgYTx_7w2DlKd3MrxzMlfo7ZOYGFSA== expires Tue, 12 Mar 2041 21:53:17 GMT
GET H2	200	EYzhM86N6ZcDPtA.png m.media-amazon.com/images/S/sash/	4 KB 4 KB	42ms 14ms	Image image/png	2600:9000:206f:9800:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/EYzhM86N6ZcDPtA.png Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/61givtVz9L.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206f:9800:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Jan 2021 21:56:36 GMT via 1.1 b8fb5d47d5536b63dd25111404e6e2e4.cloudfront.net (CloudFront) age 22745658 edge-cache-tag x-cache-047,/images/S/sash/EYzhM86N6ZcDPtA x-cache Hit from cloudfront content-length 3589 surrogate-key x-cache-047 /images/S/sash/EYzhM86N6ZcDPtA last-modified Tue, 17 Nov 2020 23:31:29 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 6677471f-3ec4-437f-aa80-c752ae566c8c x-amz-cf-pop FRA56-C1 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id qokY97O2EN6XbESH5V5Xxa0oHIZAXrVPXuFeyE89YAx9M-Vqct2www== expires Mon, 21 Jan 2041 03:49:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			104.131.69.126/	1969-12-31 23:59:59	Name: PHPSESSID Value: 09690228d023f7c538209cb067d73aee

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.media-amazon.com
104.131.69.126
2600:9000:206f:9800:1d:d7f6:39cf:a761
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
7fb657d49094a6235f8ba8ff8f7c862dbedc8afd58a7e95c3aa0beb9e913a615
8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
a86ce34d4c7adf07d92b845036e2211fe3106ebd0b6e5573f36e5b3eb59cb86b
db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03

104.131.69.126 Open in urlscan Pro 104.131.69.126 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

33 %HTTPS

50 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

218 kBTransfer

216 kBSize

1 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

104.131.69.126 Open in urlscan Pro
104.131.69.126 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

33 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

218 kB
Transfer

216 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!