www.scoalafiliasi.ro
Open in
urlscan Pro
188.214.39.132
Malicious Activity!
Public Scan
URL:
http://www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/welog.php
Submission: On June 18 via automatic, source openphish
Submission: On June 18 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 188.214.39.132, located in
Filiasi, Romania and
belongs to NETFIL-AS BULEVARDUL RACOTEANU NR. 163A, RO.
The main domain is www.scoalafiliasi.ro.
This is the only time www.scoalafiliasi.ro was scanned on urlscan.io!
This is the only time www.scoalafiliasi.ro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 188.214.39.132 188.214.39.132 | 50886 (NETFIL-AS...) (NETFIL-AS BULEVARDUL RACOTEANU NR. 163A) | |
| 4 | 13.32.223.84 13.32.223.84 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 11 | 2 |
7
188.214.39.132
(Filiasi, Romania)
ASN50886 (NETFIL-AS BULEVARDUL RACOTEANU NR. 163A, RO)
PTR: 132-39-214-188.netfil.ro
ASN50886 (NETFIL-AS BULEVARDUL RACOTEANU NR. 163A, RO)
PTR: 132-39-214-188.netfil.ro
| www.scoalafiliasi.ro |
4
13.32.223.84
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-223-84.fra56.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-223-84.fra56.r.cloudfront.net
| images-na.ssl-images-amazon.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
scoalafiliasi.ro
www.scoalafiliasi.ro |
51 KB |
| 4 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
56 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | www.scoalafiliasi.ro |
www.scoalafiliasi.ro
|
| 4 | images-na.ssl-images-amazon.com |
www.scoalafiliasi.ro
|
| 11 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/welog.php
Frame ID: 0A419FBA879D9845F7D5E19A26D7D141
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.amazon.com/ap/forgotpassword?openid.pape.max_auth_age=0&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&pageId=usflex&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.assoc_handle=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fgp%2Fcss%2Fhomepage.html%3Fie%3DUTF8%26ref_%3Dgno_yam_ya
Title: Forgot your password?
Title: Forgot your password?
Search URL Search Domain Scan URL
URL: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=0&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&pageId=usflex&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.assoc_handle=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fgp%2Fcss%2Fhomepage.html%3Fie%3DUTF8%26ref_%3Dgno_yam_ya&changeEmail=1
Title: Has your e-mail address changed since your last order?
Title: Has your e-mail address changed since your last order?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
welog.php
www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/ |
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
ap-flex-reduced-nav-2.1._V360593186_.css
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
amazon_logo_no-org_mid._V153387053_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
screen.css
www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/lib/ |
118 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.validate.js
www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cmxforms.js
www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
error-sprite.gif
images-na.ssl-images-amazon.com/images/G/01/x-locale/common/errors-alerts/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cmxforms.js
www.scoalafiliasi.ro/img/mm/943723512740e55044f7d08d72d0d5ef/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
amznbtn-sprite03._V395592492_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uedata
www.scoalafiliasi.ro/ap/ |
293 B 293 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| ue_t0 string| ue_id object| ue_csm string| ue_url string| ue_pr string| ue_md number| ue_navtiming string| ue_mid string| ue_sid string| ue_furl number| ue_hob number| ueinit object| ue function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop number| ue_hoe function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
images-na.ssl-images-amazon.com
www.scoalafiliasi.ro
13.32.223.84
188.214.39.132
12f44f7eae1ec755d69303c4c1a6dd1e289c85dbea4a27b4a4343f5f2e1def26
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
411b04207a66e16a007dfe18232aae387b8c0fe73791597786224a8688a82b9d
65fb0d927462babb4af3693d6c9e26100ac43359692cb828af45cd8c9716bac6
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
7c4d8a7bdde6345be8d95b72c60e6120316184c6693b2403c02ec04471037e2c
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a
d58928b9838bc1dda31a05dc44c2744975a4454b33977dfa9c4a3b465e002f9e