djentel.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 52.8.3.109, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is djentel.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 17th 2020. Valid for: 3 months.

This is the only time djentel.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 5	52.8.3.109 52.8.3.109		16509 (AMAZON-02) (AMAZON-02)
4	1

5 52.8.3.109 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-8-3-109.us-west-1.compute.amazonaws.com

djentel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	djentel.com 1 redirects djentel.com	305 KB
4	1

	Domain	Requested by
5	djentel.com	1 redirects djentel.com
4	1

This site contains no links.

Subject Issuer	Validity	Valid
djentel.com Let's Encrypt Authority X3	`2020-05-17` - `2020-08-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://djentel.com/ssl/instant/
Frame ID: 5DCE9BDDACD95786515376BB931C6DFE
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://djentel.com/ssl/instant HTTP 301
https://djentel.com/ssl/instant/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

305 kB
Transfer

304 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://djentel.com/ssl/instant HTTP 301
https://djentel.com/ssl/instant/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response djentel.com/ssl/instant/ Redirect Chain https://djentel.com/ssl/instant https://djentel.com/ssl/instant/	2 KB 2 KB	578ms 195ms	Document text/html	52.8.3.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://djentel.com/ssl/instant/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.8.3.109 San Jose, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-8-3-109.us-west-1.compute.amazonaws.com Software Apache / Resource Hash `aa419014157e7a432644815a34e0e1fb6197606accb251d2842c3673dc4398f5` Request headers Host djentel.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 21 May 2020 20:48:02 GMT Server Apache Last-Modified Sun, 17 May 2020 07:22:46 GMT Accept-Ranges bytes Content-Length 1584 Connection close Content-Type text/html Redirect headers Date Thu, 21 May 2020 20:48:02 GMT Server Apache Location https://djentel.com/ssl/instant/ Content-Length 240 Connection close Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	s.png djentel.com/ssl/instant/Sign%20in_files/	34 KB 35 KB	553ms 177ms	Image image/png	52.8.3.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://djentel.com/ssl/instant/Sign%20in_files/s.png Requested by Host: djentel.com URL: https://djentel.com/ssl/instant/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.8.3.109 San Jose, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-8-3-109.us-west-1.compute.amazonaws.com Software Apache / Resource Hash `3aa2aaa09dbee23d060aa8d7374a487d364203282ea094313a03fe3ae94698ef` Request headers Referer https://djentel.com/ssl/instant/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 21 May 2020 20:48:03 GMT Last-Modified Sun, 17 May 2020 07:12:07 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 35248 Content-Type image/png
GET H/1.1	200 OK	bb.png djentel.com/ssl/instant/Sign%20in_files/	3 KB 4 KB	567ms 187ms	Image image/png	52.8.3.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://djentel.com/ssl/instant/Sign%20in_files/bb.png Requested by Host: djentel.com URL: https://djentel.com/ssl/instant/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.8.3.109 San Jose, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-8-3-109.us-west-1.compute.amazonaws.com Software Apache / Resource Hash `d680e90616fe9a7748c10a222d4fd38e25034db17a230267fde1d7c3b13e9ad9` Request headers Referer https://djentel.com/ssl/instant/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 21 May 2020 20:48:03 GMT Last-Modified Sun, 15 Dec 2019 20:54:50 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 3545 Content-Type image/png
GET H/1.1	200 OK	back.png djentel.com/ssl/instant/Sign%20in_files/	265 KB 265 KB	6549ms 177ms	Image image/png	52.8.3.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://djentel.com/ssl/instant/Sign%20in_files/back.png Requested by Host: djentel.com URL: https://djentel.com/ssl/instant/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.8.3.109 San Jose, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-8-3-109.us-west-1.compute.amazonaws.com Software Apache / Resource Hash `ddb6b5706f83f5a11d4de018b5b1d40164ee2703f95e4ed6ba93a656f6b17edd` Request headers Referer https://djentel.com/ssl/instant/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 21 May 2020 20:48:09 GMT Last-Modified Sun, 15 Dec 2019 22:09:32 GMT Server Apache Connection close Accept-Ranges bytes Content-Length 271219 Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

djentel.com
52.8.3.109
3aa2aaa09dbee23d060aa8d7374a487d364203282ea094313a03fe3ae94698ef
aa419014157e7a432644815a34e0e1fb6197606accb251d2842c3673dc4398f5
d680e90616fe9a7748c10a222d4fd38e25034db17a230267fde1d7c3b13e9ad9
ddb6b5706f83f5a11d4de018b5b1d40164ee2703f95e4ed6ba93a656f6b17edd

djentel.com Open in urlscan Pro 52.8.3.109 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

305 kBTransfer

304 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

djentel.com Open in urlscan Pro
52.8.3.109 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

305 kB
Transfer

304 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!