www.shiraraibillingupdateamazon.rscitysquare.ph Open in urlscan Pro
96.44.174.20 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Submission: On November 24 via api (November 24th 2023, 3:59:02 pm UTC) from US — Scanned from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 96.44.174.20, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is www.shiraraibillingupdateamazon.rscitysquare.ph.
TLS certificate: Issued by R3 on November 24th 2023. Valid for: 3 months.

This is the only time www.shiraraibillingupdateamazon.rscitysquare.ph was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	96.44.174.20 96.44.174.20	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
4	2606:4700:e6:... 2606:4700:e6::ac40:c010	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	159.89.102.253 159.89.102.253	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2606:4700:10:... 2606:4700:10::6814:3e7a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	5

3 96.44.174.20 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: sovs01.sysgenoutsource.com

www.shiraraibillingupdateamazon.rscitysquare.ph	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:e6::ac40:c010 (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.89.102.253 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

geolocation-db.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:3e7a (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipgeolocation.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 8545	247 KB
3	rscitysquare.ph www.shiraraibillingupdateamazon.rscitysquare.ph	320 KB
1	ipgeolocation.io api.ipgeolocation.io — Cisco Umbrella Rank: 36527	571 B
1	geolocation-db.com geolocation-db.com — Cisco Umbrella Rank: 19793	218 B
9	4

	Domain	Requested by
4	fonts.cdnfonts.com	www.shiraraibillingupdateamazon.rscitysquare.ph fonts.cdnfonts.com
3	www.shiraraibillingupdateamazon.rscitysquare.ph	www.shiraraibillingupdateamazon.rscitysquare.ph
1	api.ipgeolocation.io	www.shiraraibillingupdateamazon.rscitysquare.ph
1	geolocation-db.com	www.shiraraibillingupdateamazon.rscitysquare.ph
9	4

This site contains no links.

Subject Issuer	Validity	Valid
shiraraibillingupdateamazon.rscitysquare.ph R3	`2023-11-24` - `2024-02-22`	3 months	crt.sh
cdnfonts.com GTS CA 1P5	`2023-10-02` - `2023-12-31`	3 months	crt.sh
geolocation-db.com R3	`2023-10-13` - `2024-01-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-28` - `2024-04-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Frame ID: CE0D54B039BA8C445C8B04811E81C9D5
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign-In

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

568 kB
Transfer

945 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request signin Show response
www.shiraraibillingupdateamazon.rscitysquare.ph/ap/ 522 B
603 B 279ms
67ms Document
text/html 96.44.174.20
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 96.44.174.20 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: sovs01.sysgenoutsource.com
Software: Apache /
Resource Hash: 3882362b11d4d3a48201dc982094abb06abdfeaf3b6090d84faadec4dfa89620

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 303
Content-Type: text/html
Date: Fri, 24 Nov 2023 15:36:35 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Thu, 23 Nov 2023 08:45:22 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent

GET
H/1.1 200
OK index-GCTiKR2V.js Show response
www.shiraraibillingupdateamazon.rscitysquare.ph/assets/ 673 KB
315 KB 83ms
82ms Script
application/javascript 96.44.174.20
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/assets/index-GCTiKR2V.js
Requested by: Host: www.shiraraibillingupdateamazon.rscitysquare.ph
URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 96.44.174.20 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: sovs01.sysgenoutsource.com
Software: Apache /
Resource Hash: 4b8673f3252cfb13be62eebdf322acaa90f854bf48968839b32e0cf342a9de3c

Request headers

Referer: https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Origin: https://www.shiraraibillingupdateamazon.rscitysquare.ph
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Fri, 24 Nov 2023 15:36:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 23 Nov 2023 08:45:22 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK index-PeQXp9d3.css
www.shiraraibillingupdateamazon.rscitysquare.ph/assets/ 14 KB
4 KB 204ms
72ms Stylesheet
text/css 96.44.174.20
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/assets/index-PeQXp9d3.css
Requested by: Host: www.shiraraibillingupdateamazon.rscitysquare.ph
URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 96.44.174.20 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: sovs01.sysgenoutsource.com
Software: Apache /
Resource Hash: 2600a17f57dd75e4e937c1f7aa60fd1a6d4fa542598bc2d977abc11b80e00539

Request headers

Referer: https://www.shiraraibillingupdateamazon.rscitysquare.ph/ap/signin?applieIdKey?=U2FsdGVkX19cjogV12U64vv7qrxRdYFGGDeCDZljlPk=
Origin: https://www.shiraraibillingupdateamazon.rscitysquare.ph
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Fri, 24 Nov 2023 15:36:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 23 Nov 2023 08:45:22 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3973

GET
H2 200 amazon-ember
fonts.cdnfonts.com/css/ 6 KB
982 B 56ms
14ms Stylesheet
text/css 2606:4700:e6::ac40:c010
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/amazon-ember
Requested by: Host: www.shiraraibillingupdateamazon.rscitysquare.ph
URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/assets/index-PeQXp9d3.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c010 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6978c3f0ff346f8a6ae7e1276159fe5b6cae013317dfe4c648eae097b4586d61

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.shiraraibillingupdateamazon.rscitysquare.ph/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 15:58:55 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 986348
cf-polished: origSize=7548
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 13 Nov 2023 05:59:47 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xUMvcCdx3pHlfUBqaMrP0mXt87ZgszQBdvVeU2wkZsQprmNvJ83fNXkXbUhiSqvtYLBfNW6KVxBDVxee9kSoSjabKRPu9g0tUi2VVwHYwZ5gh%2BszNsFtMhTwud1Gnk1incV7qqvsOK4d%2BM9gf4fR0tQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 82b2db2d59b35e62-EWR

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f8fabd922eb64aa194f7ffa255bb8ffaadd5275cd1c276f6ac4d90c28d13d79b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 316 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 16d75a16ca13ac96c7c599c975d7b6403bc241fb92804f428710f14b72e95eab

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 / Show response
geolocation-db.com/json/ 181 B
218 B 820ms
625ms XHR
text/html 159.89.102.253
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://geolocation-db.com/json/
Requested by: Host: www.shiraraibillingupdateamazon.rscitysquare.ph
URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/assets/index-GCTiKR2V.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 159.89.102.253 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 35e560ee0ece3e78935b202db14e24c47a9d613f7fd6100eefeb27a70e3470ea

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.shiraraibillingupdateamazon.rscitysquare.ph/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 24 Nov 2023 15:58:56 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
content-type: text/html; charset=UTF-8

GET
H2 200 user-agent Show response
api.ipgeolocation.io/ 481 B
571 B 209ms
170ms XHR
application/json 2606:4700:10::6814:3e7a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.ipgeolocation.io/user-agent?apiKey=da57979de0254e79b72ba8f3116b5ad9

Requested by

Host: www.shiraraibillingupdateamazon.rscitysquare.ph
URL: https://www.shiraraibillingupdateamazon.rscitysquare.ph/assets/index-GCTiKR2V.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:3e7a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92d877f9f1e5e29019e152996619ec000883153834a7ef212a353b0597f1ef4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.shiraraibillingupdateamazon.rscitysquare.ph/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 15:58:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://www.shiraraibillingupdateamazon.rscitysquare.ph
access-control-allow-credentials: true
cf-ray: 82b2db2f7e088cbf-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 Amazon%20Ember.woff
fonts.cdnfonts.com/s/67521/ 102 KB
103 KB 405ms
391ms Font
font/woff 2606:4700:e6::ac40:c010
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/67521/Amazon%20Ember.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/amazon-ember
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:c010 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 550f18d7daf4106868e017e4d71b0e557de6dab5a99b247b5e4c50569354c3c1

Request headers

Referer: https://fonts.cdnfonts.com/css/amazon-ember
Origin: https://www.shiraraibillingupdateamazon.rscitysquare.ph
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 15:58:56 GMT
cf-cache-status: MISS
last-modified: Sat, 05 Feb 2022 02:00:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "198e0-5d73bbd026c38"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1kzsO0C8Bkv2%2Bz5Z%2BkuU5dW1md%2F6lDJvX0p4hSJQhjFlns1dTzWtmWgepgQhVmSxMxlgWyK88VHPzkjleC1Zof7x66Fqbomeiq9egP4slrrdyscVcJgsugijlSWIm%2FyUh7PG%2B4k0Dgw1%2Brlcv1Zdhow%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 82b2db2f5ce98c96-EWR
alt-svc: h3=":443"; ma=86400
content-length: 104672

GET
H3 200 Amazon%20Ember%20Heavy.woff
fonts.cdnfonts.com/s/67521/ 43 KB
43 KB 414ms
401ms Font
font/woff 2606:4700:e6::ac40:c010
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/67521/Amazon%20Ember%20Heavy.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/amazon-ember
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:c010 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c85f8431223a85c56c6313a861c2e9e0859b5f49b8000c978a8dfa0ad8aec90

Request headers

Referer: https://fonts.cdnfonts.com/css/amazon-ember
Origin: https://www.shiraraibillingupdateamazon.rscitysquare.ph
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 15:58:56 GMT
cf-cache-status: MISS
last-modified: Sat, 05 Feb 2022 02:00:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "ab78-5d73bbd026468"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GIY85PIESizwxnwuCBZnH7474EzPbKwYChNchSZ%2BD9MuExVQcnjzDMmSGeub98ZRomI%2FoA3avQyPkY9gjdwOHm8ufaI93B2d3qB4iAPgqyme7cDU1VQpKP0CzLHlwW3GcAAIdq%2B3XYchrINWiQOGaRE%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 82b2db2f5ce68c96-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43896

GET
H3 200 Amazon%20Ember%20Bold.woff
fonts.cdnfonts.com/s/67521/ 99 KB
100 KB 394ms
381ms Font
font/woff 2606:4700:e6::ac40:c010
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/67521/Amazon%20Ember%20Bold.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/amazon-ember
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:c010 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6d88e1853bf2bab51a6dcadf95bdea4c2fefebcc12e37d727921a284353a4d5

Request headers

Referer: https://fonts.cdnfonts.com/css/amazon-ember
Origin: https://www.shiraraibillingupdateamazon.rscitysquare.ph
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 15:58:56 GMT
cf-cache-status: MISS
last-modified: Sat, 05 Feb 2022 02:00:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "18cd0-5d73bbd025c98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BM24Rwo1atCtDmocoA9KJfc9R2bn0BcghulaV30DWRIsvymB29eOOaCpPNecSupL5mY7VLK5YwKD4IwqgCMgFZcOHYOVNkAl8dQaVuoXzsB8h37Y9dRws2cQZPpXhTPSjrED3iCw9lAg%2FxfrZ%2FaipoA%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 82b2db2f5cea8c96-EWR
alt-svc: h3=":443"; ma=86400
content-length: 101584

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipgeolocation.io
fonts.cdnfonts.com
geolocation-db.com
www.shiraraibillingupdateamazon.rscitysquare.ph
159.89.102.253
2606:4700:10::6814:3e7a
2606:4700:e6::ac40:c010
96.44.174.20
16d75a16ca13ac96c7c599c975d7b6403bc241fb92804f428710f14b72e95eab
1c85f8431223a85c56c6313a861c2e9e0859b5f49b8000c978a8dfa0ad8aec90
2600a17f57dd75e4e937c1f7aa60fd1a6d4fa542598bc2d977abc11b80e00539
35e560ee0ece3e78935b202db14e24c47a9d613f7fd6100eefeb27a70e3470ea
3882362b11d4d3a48201dc982094abb06abdfeaf3b6090d84faadec4dfa89620
4b8673f3252cfb13be62eebdf322acaa90f854bf48968839b32e0cf342a9de3c
550f18d7daf4106868e017e4d71b0e557de6dab5a99b247b5e4c50569354c3c1
6978c3f0ff346f8a6ae7e1276159fe5b6cae013317dfe4c648eae097b4586d61
92d877f9f1e5e29019e152996619ec000883153834a7ef212a353b0597f1ef4c
c6d88e1853bf2bab51a6dcadf95bdea4c2fefebcc12e37d727921a284353a4d5
f8fabd922eb64aa194f7ffa255bb8ffaadd5275cd1c276f6ac4d90c28d13d79b

www.shiraraibillingupdateamazon.rscitysquare.ph Open in urlscan Pro 96.44.174.20 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

568 kBTransfer

945 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

www.shiraraibillingupdateamazon.rscitysquare.ph Open in urlscan Pro
96.44.174.20 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

568 kB
Transfer

945 kB
Size

0
Cookies

9 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!