alexmarine-eg.com Open in urlscan Pro
192.185.112.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://alexmarine-eg.com/po.htm
Submission: On April 14 via manual (April 14th 2019, 4:39:50 pm UTC) from GB

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 192.185.112.224, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is alexmarine-eg.com.

This is the only time alexmarine-eg.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	192.185.112.224 192.185.112.224	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
4	104.111.236.50 104.111.236.50	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	106.247.251.66 106.247.251.66	3786 (LGDACOM L...) (LGDACOM LG DACOM Corporation)
2 4	2a01:7c8:ec:0... 2a01:7c8:ec:0:149:210:196:91	20857 (TRANSIP-A...) (TRANSIP-AS Amsterdam)
9	104.111.250.201 104.111.250.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
17	5

1 192.185.112.224 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: ns810.websitewelcome.com

alexmarine-eg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.236.50 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-236-50.deploy.static.akamaitechnologies.com

online.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 106.247.251.66 (Seoul, Korea, Republic Of)

ASN3786 (LGDACOM LG DACOM Corporation, KR)

106.247.251.66	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a01:7c8:ec:0:149:210:196:91 (Netherlands) 2 redirects

ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL)

www.s2.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.111.250.201 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-250-201.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	aexp-static.com www.aexp-static.com	124 KB
4	s2.be 2 redirects www.s2.be	1 KB
4	americanexpress.com online.americanexpress.com	74 KB
1	alexmarine-eg.com alexmarine-eg.com	9 KB
17	4

	Domain	Requested by
9	www.aexp-static.com	alexmarine-eg.com
4	www.s2.be	2 redirects alexmarine-eg.com
4	online.americanexpress.com	alexmarine-eg.com
1	alexmarine-eg.com
17	4

This site contains no links.

Subject Issuer	Validity	Valid
online.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
www.s2.be Let's Encrypt Authority X3	`2019-02-06` - `2019-05-07`	3 months	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2018-08-08` - `2020-07-23`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://alexmarine-eg.com/po.htm
Frame ID: E2ACF9D5CC9A7CB6C97CD4BAE1D9347D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

17
Requests

88 %
HTTPS

20 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

209 kB
Transfer

338 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://www.s2.be/aexp-static/spacer.png HTTP 301
https://www.s2.be/aexp-static/spacer.png

Request Chain 7

http://www.s2.be/aexp-static/spacer.png HTTP 301
https://www.s2.be/aexp-static/spacer.png

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request po.htm Show response
alexmarine-eg.com/ 47 KB
9 KB 291ms
143ms Document
text/html 192.185.112.224
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Server: 192.185.112.224 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns810.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: de560025c5a1ec9e8b2b1be79456c32da00a9f1b9dea876494392655794d7e2b

Request headers

Host: alexmarine-eg.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx/1.14.1
Date: Sun, 14 Apr 2019 16:39:34 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 31 Mar 2019 11:55:29 GMT
Content-Encoding: gzip

GET
H2 200 fuidFypDefault.css
online.americanexpress.com/myca/fuidfyp/us/resources/css/ 19 KB
7 KB 226ms
47ms Stylesheet
text/css 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.americanexpress.com/myca/fuidfyp/us/resources/css/fuidFypDefault.css

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

e599503c3bdee1fef6065e575091caef7a56b463e751886b298304379eab47b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Nov 2016 09:17:19 GMT
date: Sun, 14 Apr 2019 16:39:35 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 6707

GET
H/1.1 200
OK footer.php
106.247.251.66/tr/ 1 KB
1 KB 877ms
578ms Image
image/gif 106.247.251.66
LGDACOM LG DACOM ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://106.247.251.66/tr/footer.php?image=att.gif
Requested by: Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Server: 106.247.251.66 Seoul, Korea, Republic Of, ASN3786 (LGDACOM LG DACOM Corporation, KR),
Reverse DNS
Software: Apache/2.4.23 (Win64) PHP/5.6.25 / PHP/5.6.25
Resource Hash: 8a1afe334fda16d81d21995b656b62f3d746e46826a1927ca3e81d7a723b094e

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 14 Apr 2019 13:04:23 GMT
Server: Apache/2.4.23 (Win64) PHP/5.6.25
Connection: Keep-Alive
X-Powered-By: PHP/5.6.25
Content-Length: 1101
Keep-Alive: timeout=5, max=100
Content-Type: image/gif

GET
H/1.1

404
Not Found

spacer.png
www.s2.be/aexp-static/
Redirect Chain

http://www.s2.be/aexp-static/spacer.png
https://www.s2.be/aexp-static/spacer.png

0
417 B

58ms
21ms

Image
text/html

2a01:7c8:ec:0:149:210:196:91
TRANSIP-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.s2.be/aexp-static/spacer.png
Requested by: Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a01:7c8:ec:0:149:210:196:91 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

Location: https://www.s2.be/aexp-static/spacer.png
Date: Sun, 14 Apr 2019 16:39:34 GMT
X-TransIP-Balancer: lb1
X-TransIP-Backend: web246
Server: Apache
Content-Length: 248
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 inav_responsive.css
www.aexp-static.com/nav/ngn/css/ 93 KB
12 KB 217ms
54ms Stylesheet
text/css 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/css/inav_responsive.css

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

7f1b85f13e643de7a8dd568b6073849d777a677a7d699229b8eb2fdb787ff2b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
content-encoding: gzip
last-modified: Wed, 11 Apr 2018 19:54:17 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=86400
accept-ranges: bytes
timing-allow-origin: *
content-length: 11740

GET
H2 200 OCA_body-background.gif
online.americanexpress.com/myca/oce/us/oce/images/actreg/ 16 KB
16 KB 47ms
46ms Image
image/gif 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.americanexpress.com/myca/oce/us/oce/images/actreg/OCA_body-background.gif

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

c05cee2eb8aacab52bba3b3dd940b68055fc11a088302418c776efa459f63884

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 15 Nov 2018 20:11:11 GMT
date: Sun, 14 Apr 2019 16:39:35 GMT
content-type: image/gif
status: 200
cache-control: private, must-revalidate, max-age=126113
accept-ranges: bytes
content-length: 16020

GET
H2 200 clear.gif
www.aexp-static.com/nav/ngn/img/ 43 B
215 B 56ms
56ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/clear.gif

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:23:00 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 43

GET
H2 200 logo_bluebox_1x.gif
www.aexp-static.com/nav/ngn/img/ 4 KB
4 KB 67ms
67ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/logo_bluebox_1x.gif

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:26:41 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 4424

GET
H/1.1

404
Not Found

spacer.png
www.s2.be/aexp-static/
Redirect Chain

http://www.s2.be/aexp-static/spacer.png
https://www.s2.be/aexp-static/spacer.png

0
417 B

15ms
14ms

Image
text/html

2a01:7c8:ec:0:149:210:196:91
TRANSIP-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.s2.be/aexp-static/spacer.png
Requested by: Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a01:7c8:ec:0:149:210:196:91 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

Location: https://www.s2.be/aexp-static/spacer.png
Date: Sun, 14 Apr 2019 16:39:35 GMT
X-TransIP-Balancer: lb1
X-TransIP-Backend: web246
Server: Apache
Content-Length: 248
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 iNav_ngi_sprite_new.gif
www.aexp-static.com/nav/ngn/img/ 23 KB
23 KB 61ms
61ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/iNav_ngi_sprite_new.gif?ver=0916_01

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

0d4e7d13d424c4569af233a3188ac42edaa093a12bced0dba6095c00047006e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:26:29 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 23367

GET
H2 200 img_shdw_mainNav.png
www.aexp-static.com/nav/ngn/img/ 143 B
339 B 63ms
63ms Image
image/png 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/img_shdw_mainNav.png

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

d3c6dbfeb63c1155df3a80a04d72d9c0c95ed561d54c9694019c28eac1920c1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:24:34 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 143

GET
H2 200 3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.aexp-static.com/nav/ngn/fonts/ 36 KB
37 KB 197ms
47ms Font
application/x-font-woff 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
Origin: http://alexmarine-eg.com

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:12:19 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
access-control-max-age: 15778463
access-control-allow-methods: GET
content-type: application/x-font-woff
status: 200
cache-control: max-age=29030400
accept-ranges: bytes
timing-allow-origin: *
content-length: 37153

GET
H2 200 amex-fuid-sprite.png
online.americanexpress.com/myca/fuidfyp/us/resources/images/ 49 KB
50 KB 48ms
48ms Image
image/png 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.americanexpress.com/myca/fuidfyp/us/resources/images/amex-fuid-sprite.png

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

9a12464e4b2e913955e124313a5ab47e63b771a41bdba9390d008212a1b52052

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.americanexpress.com/myca/fuidfyp/us/resources/css/fuidFypDefault.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 08 Nov 2016 09:17:19 GMT
date: Sun, 14 Apr 2019 16:39:35 GMT
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE,TRACE
content-type: image/png
status: 200
access-control-expose-headers: Date
cache-control: private, must-revalidate, max-age=190389
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: account_token,account_tokens,locale,,correlation_id,security_token
content-length: 50415

GET
H2 200 0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
www.aexp-static.com/nav/ngn/fonts/ 37 KB
37 KB 237ms
88ms Font
application/x-font-woff 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
Origin: http://alexmarine-eg.com

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:12:14 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff
status: 200
cache-control: max-age=29030400
accept-ranges: bytes
timing-allow-origin: *
content-length: 37949

GET
H2 200 spacer.png
online.americanexpress.com/myca/fuidfyp/us/resources/images/ 922 B
1 KB 76ms
75ms Image
image/png 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.americanexpress.com/myca/fuidfyp/us/resources/images/spacer.png

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

e989c2542a6af77569f5b65286bf132dd113c75810c71866dacba5d025d68bc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 08 Nov 2016 09:17:19 GMT
date: Sun, 14 Apr 2019 16:39:35 GMT
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE,TRACE
content-type: image/png
status: 200
access-control-expose-headers: Date
cache-control: private, must-revalidate, max-age=250024
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: account_token,account_tokens,locale,,correlation_id,security_token
content-length: 922

GET
H2 200 iNav_sprite_footer.gif
www.aexp-static.com/nav/ngn/img/ 5 KB
5 KB 81ms
80ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/iNav_sprite_footer.gif?ver=0916_02

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

c5728ebd8f225043ec8b85f79c9964f133136f91b9bb260eb69437ce9af4573a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:26:31 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 5012

GET
H2 200 iNav_sprite_footer1.gif
www.aexp-static.com/nav/ngn/img/ 5 KB
6 KB 83ms
82ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/iNav_sprite_footer1.gif?ver=0917_11

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b3be0c1dca2d9a00d8da591e1c209fced4d3ee588efb495eed4191aa2558e658

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Mon, 11 Sep 2017 19:23:42 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 14 Apr 2019 16:39:35 GMT
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 5603

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| validate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alexmarine-eg.com
online.americanexpress.com
www.aexp-static.com
www.s2.be
104.111.236.50
104.111.250.201
106.247.251.66
192.185.112.224
2a01:7c8:ec:0:149:210:196:91
0d4e7d13d424c4569af233a3188ac42edaa093a12bced0dba6095c00047006e3
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c
7f1b85f13e643de7a8dd568b6073849d777a677a7d699229b8eb2fdb787ff2b9
8a1afe334fda16d81d21995b656b62f3d746e46826a1927ca3e81d7a723b094e
9a12464e4b2e913955e124313a5ab47e63b771a41bdba9390d008212a1b52052
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3be0c1dca2d9a00d8da591e1c209fced4d3ee588efb495eed4191aa2558e658
b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e
c05cee2eb8aacab52bba3b3dd940b68055fc11a088302418c776efa459f63884
c5728ebd8f225043ec8b85f79c9964f133136f91b9bb260eb69437ce9af4573a
d3c6dbfeb63c1155df3a80a04d72d9c0c95ed561d54c9694019c28eac1920c1b
de560025c5a1ec9e8b2b1be79456c32da00a9f1b9dea876494392655794d7e2b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e599503c3bdee1fef6065e575091caef7a56b463e751886b298304379eab47b8
e989c2542a6af77569f5b65286bf132dd113c75810c71866dacba5d025d68bc5

alexmarine-eg.com Open in urlscan Pro 192.185.112.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

88 %HTTPS

20 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

209 kBTransfer

338 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

alexmarine-eg.com Open in urlscan Pro
192.185.112.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

88 %
HTTPS

20 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

209 kB
Transfer

338 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!