ambcs.ae Open in urlscan Pro
209.99.16.57 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://36005-alternate.app.link/
Effective URL:
https://ambcs.ae/wp-content/themes/b2020r/
Submission: On April 20 via manual (April 20th 2020, 3:21:54 pm UTC) from US

Summary HTTP 3 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 209.99.16.57, located in Burlington, United States and belongs to PUBLIC-DOMAIN-REGISTRY, US. The main domain is ambcs.ae.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 23rd 2020. Valid for: 3 months.

This is the only time ambcs.ae was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 1	2600:9000:21f... 2600:9000:21f3:200:19:9934:6a80:93a1		16509 (AMAZON-02) (AMAZON-02)
3	209.99.16.57 209.99.16.57		394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY)
3	1

1 2600:9000:21f3:200:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

36005-alternate.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.99.16.57 (Burlington, United States)

ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: cp-42.webhostbox.net

ambcs.ae	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ambcs.ae ambcs.ae	74 KB
1	app.link 1 redirects 36005-alternate.app.link	628 B
3	2

	Domain	Requested by
3	ambcs.ae	ambcs.ae
1	36005-alternate.app.link	1 redirects
3	2

This site contains no links.

Subject Issuer	Validity	Valid
ambcs.ae Let's Encrypt Authority X3	`2020-03-23` - `2020-06-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ambcs.ae/wp-content/themes/b2020r/
Frame ID: 65175711A8E197EF9626EC9326716915
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://36005-alternate.app.link/ HTTP 307
https://ambcs.ae/wp-content/themes/b2020r/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

74 kB
Transfer

142 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://36005-alternate.app.link/ HTTP 307
https://ambcs.ae/wp-content/themes/b2020r/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ambcs.ae/wp-content/themes/b2020r/ Redirect Chain https://36005-alternate.app.link/ https://ambcs.ae/wp-content/themes/b2020r/	453 B 641 B	1322ms 791ms	Document text/html	209.99.16.57 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL https://ambcs.ae/wp-content/themes/b2020r/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 209.99.16.57 Burlington, United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS cp-42.webhostbox.net Software Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 / PHP/5.6.40 Resource Hash `e28b02098890839a34897238c1cb71144a9b2ad672d1c3d7df67d609e15e9aec` Request headers :method GET :authority ambcs.ae :scheme https :path /wp-content/themes/b2020r/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 20 Apr 2020 15:21:30 GMT server Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 x-powered-by PHP/5.6.40 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache set-cookie cazanova=m6h2ns0a2m0pouhspqulrtpbbuo41hng; expires=Mon, 20-Apr-2020 17:21:30 GMT; Max-Age=7200; path=/; HttpOnly vary Accept-Encoding content-encoding gzip content-length 300 content-type text/html; charset=UTF-8 Redirect headers Content-Length 0 Connection keep-alive Server openresty/1.13.6.2 Date Mon, 20 Apr 2020 15:21:29 GMT X-Powered-By Express Set-Cookie _s=nNzOjSa22WLHoJcjJuG3YL5P9HhvgYyphIugrabN0jSg22inY6bJ33wkGfbD6gg%2F; Max-Age=31536000; Domain=.app.link; Path=/; Expires=Tue, 20 Apr 2021 15:21:29 GMT Last-Modified Mon, 20 Apr 2020 15:21:29 GMT Location https://ambcs.ae/wp-content/themes/b2020r/ X-Cache Miss from cloudfront Via 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2 X-Amz-Cf-Id w-98onbBgfupDfEyWrHrSfkkPM7lA7f63g1hrTC0yayllUdl-sbqIg==
GET H2	200	captcha.js Show response ambcs.ae/wp-content/themes/b2020r//assets/js/	123 KB 54 KB	274ms 274ms	Script application/javascript	209.99.16.57 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Full URL https://ambcs.ae/wp-content/themes/b2020r//assets/js/captcha.js Requested by Host: ambcs.ae URL: https://ambcs.ae/wp-content/themes/b2020r/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 209.99.16.57 Burlington, United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS cp-42.webhostbox.net Software Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 / Resource Hash `abda937cf2741f8b08acc1fa946f155ee91073120f8de3dbcd26f70fc24f698b` Request headers Referer https://ambcs.ae/wp-content/themes/b2020r/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 20 Apr 2020 15:21:31 GMT content-encoding gzip last-modified Mon, 07 Oct 2019 17:02:48 GMT server Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 etag "49c2955-1ecbb-5945505715e00-gzip" vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes
GET H2	200	captcha.png ambcs.ae/wp-content/themes/b2020r//	18 KB 18 KB	654ms 654ms	Image image/png	209.99.16.57 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Show image Full URL https://ambcs.ae/wp-content/themes/b2020r//captcha.png?_1587396093534 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 209.99.16.57 Burlington, United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS cp-42.webhostbox.net Software Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 / PHP/5.6.40 Resource Hash `2f6f4945722570aa5766c53d88bec4e94dd92b149efe50dd9bbf0308946e83aa` Request headers Referer https://ambcs.ae/wp-content/themes/b2020r/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 20 Apr 2020 15:21:33 GMT content-encoding gzip server Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 x-powered-by PHP/5.6.40 vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ambcs.ae/	1970-01-19 08:56:43	Name: cazanova Value: m6h2ns0a2m0pouhspqulrtpbbuo41hng

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

36005-alternate.app.link
ambcs.ae
209.99.16.57
2600:9000:21f3:200:19:9934:6a80:93a1
2f6f4945722570aa5766c53d88bec4e94dd92b149efe50dd9bbf0308946e83aa
abda937cf2741f8b08acc1fa946f155ee91073120f8de3dbcd26f70fc24f698b
e28b02098890839a34897238c1cb71144a9b2ad672d1c3d7df67d609e15e9aec