amkskmamck.com
Open in
urlscan Pro
104.21.13.254
Malicious Activity!
Public Scan
Effective URL: https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/login/
Submission: On November 27 via manual from PL — Scanned from PL
Summary
TLS certificate: Issued by WE1 on November 26th 2024. Valid for: 3 months.
This is the only time amkskmamck.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Santander (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 31.42.186.201 31.42.186.201 | 30860 (YURTEH-AS...) (YURTEH-AS Virtual Systems LLC) | |
2 30 | 104.21.13.254 104.21.13.254 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
29 | 2 |
ASN30860 (YURTEH-AS Virtual Systems LLC, UA)
PTR: groun-201-186-info.perfectkidsplaygrounds.info
ostrsicdibboran.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
30 |
amkskmamck.com
2 redirects
amkskmamck.com |
367 KB |
1 |
ostrsicdibboran.com
ostrsicdibboran.com |
343 B |
29 | 2 |
Domain | Requested by | |
---|---|---|
30 | amkskmamck.com |
2 redirects
amkskmamck.com
|
1 | ostrsicdibboran.com | |
29 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ostrsicdibboran.com R11 |
2024-11-26 - 2025-02-24 |
3 months | crt.sh |
amkskmamck.com WE1 |
2024-11-26 - 2025-02-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/login/
Frame ID: 2EB56DB833A02B5566C52DC1EB363A90
Requests: 29 HTTP requests in this frame
Screenshot
Page Title
Polska S.A.Page URL History Show full URLs
-
http://ostrsicdibboran.com/
HTTP 307
https://ostrsicdibboran.com/ Page URL
- https://amkskmamck.com/s/l/t/q.php Page URL
-
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c
HTTP 301
http://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/ HTTP 307
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/ HTTP 302
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/login/ Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ostrsicdibboran.com/
HTTP 307
https://ostrsicdibboran.com/ Page URL
- https://amkskmamck.com/s/l/t/q.php Page URL
-
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c
HTTP 301
http://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/ HTTP 307
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/ HTTP 302
https://amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://ostrsicdibboran.com/ HTTP 307
- https://ostrsicdibboran.com/
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
ostrsicdibboran.com/ Redirect Chain
|
80 B 343 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
q.php
amkskmamck.com/s/l/t/ |
728 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
amkskmamck.com/s/l/t/ztdw3m/43e5613a912f8585e3f5fb1b0f35594c/login/ Redirect Chain
|
38 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
amkskmamck.com/s/l/t/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ua-parser.min.js
amkskmamck.com/s/l/t/bower_components/ua-parser-js/dist/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
amkskmamck.com/s/l/t/bower_components/font-awesome/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_form.js
amkskmamck.com/s/l/t/core/form/ |
17 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_token.js
amkskmamck.com/s/l/t/core/token/ |
13 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
angular.min.js
amkskmamck.com/s/l/t/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_form.css
amkskmamck.com/s/l/t/core/form/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css.css
amkskmamck.com/s/l/t/login/form/ |
573 B 965 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
output.css
amkskmamck.com/s/l/t/login/ |
50 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
amkskmamck.com/s/l/t/login/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
safety-ilustration.svg
amkskmamck.com/s/l/t/login/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
left2.jpg
amkskmamck.com/s/l/t/login/ |
24 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tooltip-icon.svg
amkskmamck.com/s/l/t/login/ |
812 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_.webp
amkskmamck.com/s/l/t/login/ |
9 KB 10 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
right2.jpg
amkskmamck.com/s/l/t/login/ |
74 KB 74 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.js
amkskmamck.com/s/l/t/login/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
form.js
amkskmamck.com/s/l/t/login/form/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ng.js
amkskmamck.com/s/l/t/login/ng/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
token.js
amkskmamck.com/s/l/t/login/token/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
home.php
amkskmamck.com/s/l/t/ |
58 B 661 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
home.php
amkskmamck.com/s/l/t/ |
58 B 658 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SantanderMicroTextW05-Rg.woff2
amkskmamck.com/s/l/t/login/ |
35 KB 35 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SantanderMicroTextW05-Bold.woff2
amkskmamck.com/s/l/t/login/ |
35 KB 36 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SantanderMicroTextW05-SmBd.woff2
amkskmamck.com/s/l/t/login/ |
36 KB 37 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
amkskmamck.com/s/l/t/login/ |
2 KB 1 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
amkskmamck.com/s/l/t/login/ |
2 KB 0 |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Santander (Banking)43 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_login_proxy function| ask_password_proxy function| ask_call_proxy function| ask_email_proxy function| ask_sms_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj object| last_respond object| respond object| angular function| getFormattedDateTime string| bid object| php_js object| app string| el object| CORE__ object| REST_FN__ object| VTO object| VTOM object| sc_ number| bidder_timer3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
amkskmamck.com/s/l/t | Name: real Value: OK |
|
amkskmamck.com/ | Name: bid Value: 43e5613a912f8585e3f5fb1b0f35594c |
|
amkskmamck.com/ | Name: lng Value: pl |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amkskmamck.com
ostrsicdibboran.com
104.21.13.254
31.42.186.201
00d3cc1b3b7ce5de923a7afcc7e3c485765245561e925ae691efe582d3835844
06752324705409dc5e88ae5ab7865c7d8688276ec2a65c816727da8912419975
096829f4c5bdd254218c26aa4fcdd77a5e982e05704ed21c4e36f7e4c130fff1
0b2b7b3af50a2d8e0d0bbfab371f0a33c28c613b7e0882cffa454c87d4c81e43
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
103842494ebfa9ad23f7be3cb38987728160763765df1e357f8c1f4f486cdc4f
1385f70b8e59c0af58e0609c2d44e154d623475cc0627cb2fd31fe735fcb5168
15d8a431b2696fb0062931d013ec93c8292fa011b7e0dbd6195a8433f72fce98
20d0ce2b27cadceab8377f880acb3707bc062bfc6748ca7032fc45030c76f8be
2d14fb731c5324c4ac2b34b4b0dc458f29289e5ff07e6ec4f551a3deffff431b
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
3f82ad7e014efe968c76300cd8493f2b4bb9acf84bdae41988e18ecacffccc4b
53a93f6d7eedbbfbb4bd681f0ea09531e998139857437732a6c3894cb80f4b35
574e79693411c43405926ada4fe11a5d351967f8be9b959ce743340f003f3c07
5d31089ff8834b7ee8ca292cba3c453e55822abe665693cff59fe3030b7dd3a6
6876efde56c5ed85e78a75359ddfde3605d89b46979258bddd66e65b3ef88bcc
6d1fcbb829fad19d85ece061e1f6f4ab0b556daf7998be1cf089c36392f4dd81
6e8227889d0ac92968428f857e2328759701805a2aed23a8f89a286ed917e9dc
745434b7e618fe7b4c25dbf29a92a923ef79d7ea8180c38c8496bdaf54b5e19b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a2c936aa98332ba08d8699d44ae76a9011f287446252a977cca98d560a6f922
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8bd090480a7497b1cf0690275c147ae2184878d3ff5d48bbb31ae56ee217c649
8fa7e82dfaee00772362545fbfa01e580bb9e98677650730fceed697cc83b040
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
de17850455ba7164cb9716084aa15f704dd59b14b90804ff484be5d5cfd2a3e6
f2ff3738855b7f4c1794c85af30bc50c4dfa6590727cc2b2ad4d412e121b33d1
f87ee0f9a1cce9141d7091728510839d676fc6ef4cc95d0585897aac93e63bf3