amsnxeoncoerd.rrwtcdz.cn Open in urlscan Pro
204.44.109.51 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://amsnxeoncoerd.rrwtcdz.cn/
Effective URL:
https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Submission Tags: phishing amex Search All
Submission: On August 27 via api (August 27th 2023, 6:08:47 pm UTC) from JP — Scanned from JP

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 26 HTTP transactions. The main IP is 204.44.109.51, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is amsnxeoncoerd.rrwtcdz.cn.
TLS certificate: Issued by R3 on August 27th 2023. Valid for: 3 months.

This is the only time amsnxeoncoerd.rrwtcdz.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
8	204.44.109.51 204.44.109.51	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
1	119.188.86.194 119.188.86.194	() ()
9	23.2.131.101 23.2.131.101	() ()
26	4

8 204.44.109.51 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.109.51.static.quadranet.com

amsnxeoncoerd.rrwtcdz.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.188.86.194 (None, )

ASN- ()

cdn.bootcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.2.131.101 (None, )

ASN- ()

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	aexp-static.com www.aexp-static.com icm.aexp-static.com Failed	124 KB
8	rrwtcdz.cn amsnxeoncoerd.rrwtcdz.cn	164 KB
1	bootcdn.net cdn.bootcdn.net	3 KB
0	adobedtm.com Failed assets.adobedtm.com Failed
26	4

	Domain	Requested by
9	www.aexp-static.com	amsnxeoncoerd.rrwtcdz.cn www.aexp-static.com
8	amsnxeoncoerd.rrwtcdz.cn	amsnxeoncoerd.rrwtcdz.cn
1	cdn.bootcdn.net	amsnxeoncoerd.rrwtcdz.cn
0	icm.aexp-static.com Failed	amsnxeoncoerd.rrwtcdz.cn
0	assets.adobedtm.com Failed	amsnxeoncoerd.rrwtcdz.cn
26	5

This site contains no links.

Subject Issuer	Validity	Valid
amsnxeoncoerd.rrwtcdz.cn R3	`2023-08-27` - `2023-11-25`	3 months	crt.sh
*.bootcdn.net Sectigo RSA Domain Validation Secure Server CA	`2023-08-17` - `2024-08-17`	a year	crt.sh
m.americanexpress.com DigiCert EV RSA CA G2	`2023-04-05` - `2024-04-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Frame ID: F026149318B1399014C1ABAA7E30AD78
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Amex Express Checkout (Payment processors) Expand

Overall confidence: 100%
Detected patterns

aexp-static\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

26
Requests

69 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

291 kB
Transfer

1245 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
amsnxeoncoerd.rrwtcdz.cn/ 0
209 B 1833ms
261ms Document
text/html 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 27 Aug 2023 18:08:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
refresh: 3; url=logn.php?token=45d96a29b32d5afcd5e9d360d58
server: Apache

GET
H2 200 Primary Request logn.php Show response
amsnxeoncoerd.rrwtcdz.cn/ 264 KB
40 KB 1070ms
1069ms Document
text/html 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash: d25f7a7b843105e4808b46445b701746ef4d5e9760485e6dda9c4c8e4c121267

Request headers

Referer: https://amsnxeoncoerd.rrwtcdz.cn/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: *
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 40513
content-type: text/html;charset=utf-8
date: Sun, 27 Aug 2023 18:08:42 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding

GET
H2 200 layui.js Show response
amsnxeoncoerd.rrwtcdz.cn/admin/im/ 284 KB
92 KB 306ms
305ms Script
application/javascript 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/layui.js
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash: bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:43 GMT
content-encoding: gzip
last-modified: Tue, 06 Jul 2021 04:01:50 GMT
server: Apache
etag: "471da-5c66c7b3e4780-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 site-jquery.min.js Show response
amsnxeoncoerd.rrwtcdz.cn/admin/im/ 91 KB
32 KB 307ms
306ms Script
application/javascript 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/site-jquery.min.js
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash: 5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:43 GMT
content-encoding: gzip
last-modified: Mon, 23 Aug 2021 08:34:16 GMT
server: Apache
etag: "16b60-5ca35e1ec7200-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 32817

GET
H2 200 layer.min.css
cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/ 13 KB
3 KB 3354ms
867ms Stylesheet
text/css 119.188.86.194

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/layer.min.css

Requested by

Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

119.188.86.194 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-cache-lookup: Cache Miss, Cache Miss
age: 2761242
strict-transport-security: max-age=63072000;
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2288
last-modified: Thu, 22 Jun 2023 11:06:31 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b37-8f0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=swTqi%2F29YKL8qHW9N5a9jXvKwbn5NT7tO%2BboKaKoCNX1%2FQWkLmknk2sn1umT%2BkErnMm%2B5LEcEjE2dD92swthhcUR7iXBnb6FjV%2BJ0SbNONJJStHf%2FgyU159PrH%2FFn6%2BOswv4jbUh"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
x-nws-log-uuid: 10690625736352246424
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7fd643059ef8faca-SJC
expires: Fri, 16 Aug 2024 18:08:46 GMT

GET
H2 200 dls.min.css
www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/styles/ 345 KB
50 KB 2168ms
606ms Stylesheet
text/css 23.2.131.101

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/styles/dls.min.css
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3488e209e7ecf29039fda4dfc5a98bfabb7a682c79bdb0d3e848dc5509fdc776

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:45 GMT
content-encoding: gzip
last-modified: Thu, 10 Oct 2019 22:16:00 GMT
etag: W/"5d9fada0-5655a"
vary: Origin, Accept-Encoding
content-type: text/css
cache-control: max-age=15552000
timing-allow-origin: *
content-length: 51294
expires: Sun, 10 Jan 2021 04:18:16 GMT

GET
H2 200 axp-marketing-placement.client.js Show response
www.aexp-static.com/cdaas/axp-app/modules/axp-marketing-placement/4.1.2/ 96 KB
31 KB 54ms
54ms Script
application/javascript 23.2.131.101

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/axp-app/modules/axp-marketing-placement/4.1.2/axp-marketing-placement.client.js
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de845e24b2467bd23331c59a3b0873b47122cbec7a0bcef8414da29937ea3461

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:46 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 17:16:27 GMT
etag: W/"606de8eb-18018"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 31811

GET
H2 200 axp-voice-of-customer.client.js Show response
www.aexp-static.com/cdaas/axp-app/modules/axp-voice-of-customer/1.4.1/ 98 KB
32 KB 51ms
51ms Script
application/javascript 23.2.131.101

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/axp-app/modules/axp-voice-of-customer/1.4.1/axp-voice-of-customer.client.js
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85bbd9fec0b60035ccefc6088a04660609ee27f12af3efcb2f2d650354b4b6d6

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:46 GMT
content-encoding: gzip
last-modified: Thu, 14 Nov 2019 17:59:02 GMT
etag: W/"5dcd95e6-188dc"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 32745

GET EX29b48e242ee64e7eb05073d267244e6a-libraryCode_source.min.js
assets.adobedtm.com/dcb19cbd6cbf/b4385da1798a/04055ca6ea92/ 0
0

GET
H2 200 14.7c9330169f395c4c3a22.chunk.js Show response
www.aexp-static.com/cdaas/one/qualtrics/1.48.0/ 2 KB
1 KB 2473ms
924ms Script
application/javascript 23.2.131.101

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/qualtrics/1.48.0/14.7c9330169f395c4c3a22.chunk.js?Q_CLIENTVERSION=1.48.0&Q_CLIENTTYPE=hostedjs
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f81c0917f4fa2a35faa6b8c33644f463cebf118239b18aaffdede8e12a33ee54

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:45 GMT
content-encoding: gzip
last-modified: Tue, 04 May 2021 20:22:51 GMT
etag: W/"6091ad1b-9ef"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 1233

GET
H2 200 1.05db7c20a5a8e5ea5c34.chunk.js Show response
www.aexp-static.com/cdaas/one/qualtrics/1.48.0/ 27 KB
6 KB 2473ms
924ms Script
application/javascript 23.2.131.101

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/qualtrics/1.48.0/1.05db7c20a5a8e5ea5c34.chunk.js?Q_CLIENTVERSION=1.48.0&Q_CLIENTTYPE=hostedjs
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad554a1d1de34a9edfa65f5956fbaaa76f62f5bf424716dfaa75fd28f99cb469

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:45 GMT
content-encoding: gzip
last-modified: Tue, 04 May 2021 20:22:51 GMT
etag: W/"6091ad1b-6a49"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 6389

GET
H2 200 dls-logo-bluebox-solid.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.8.0/package/dist/img/logos/ 2 KB
1 KB 37ms
37ms Image
image/svg+xml 23.2.131.101

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.8.0/package/dist/img/logos/dls-logo-bluebox-solid.svg
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:47 GMT
content-encoding: gzip
last-modified: Thu, 31 Oct 2019 17:37:19 GMT
etag: W/"5dbb1bcf-962"
vary: Origin, Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 989

GET
H2 200 dls-flag-jp.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.14.2/package/dist/img/flags/ 235 B
391 B 69ms
68ms Image
image/svg+xml 23.2.131.101

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.14.2/package/dist/img/flags/dls-flag-jp.svg
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4e37395882770684d811919d658a61f587c2caa7f7984f01d4e6f1cceea1052

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:47 GMT
content-encoding: gzip
last-modified: Fri, 04 Sep 2020 17:15:25 GMT
etag: "5f52762d-eb"
vary: Origin, Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 208

GET JP%20Default%20image_mobile%20app.jpg
icm.aexp-static.com/content/dam/PZN/Default/JP/ 0
0

GET
H2 200 dls-logo-line.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.7.1/package/dist/img/logos/ 2 KB
903 B 67ms
67ms Image
image/svg+xml 23.2.131.101

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.7.1/package/dist/img/logos/dls-logo-line.svg
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:47 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 2019 19:50:49 GMT
etag: W/"5daa1799-693"
vary: Origin, Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=15552000
timing-allow-origin: *
content-length: 712
expires: Mon, 21 Dec 2020 02:49:51 GMT

GET
H2 404 laydate.css
amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/laydate/default/ 0
0 1803ms
1802ms Stylesheet
text/html 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/layui.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:45 GMT
server: Apache
content-length: 271
content-type: text/html; charset=iso-8859-1

GET
H2 404 layer.css
amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/layer/default/ 0
0 1777ms
1777ms Stylesheet
text/html 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/layer/default/layer.css?v=3.5.1
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/layui.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:45 GMT
server: Apache
content-length: 271
content-type: text/html; charset=iso-8859-1

GET
H2 404 code.css
amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/ 0
0 1769ms
1769ms Stylesheet
text/html 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/code.css?v=2
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/layui.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:45 GMT
server: Apache
content-length: 271
content-type: text/html; charset=iso-8859-1

GET dls-flag-jp.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.14.2/package/dist/img/flags/ 0
0

GET
DATA 200
OK truncated
/ 644 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd

Request headers

accept-language: jp-jp,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 984 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d

Request headers

accept-language: jp-jp,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da

Request headers

accept-language: jp-jp,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 api.php Show response
amsnxeoncoerd.rrwtcdz.cn/ 13 B
88 B 308ms
308ms XHR
text/html 204.44.109.51
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://amsnxeoncoerd.rrwtcdz.cn/api.php?act=ip_save&_r=0.6014449314571335
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/site-jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.109.51 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.109.51.static.quadranet.com
Software: Apache /
Resource Hash: aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794

Request headers

Accept: */*
Referer: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
X-Requested-With: XMLHttpRequest
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 18:08:47 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
content-length: 33
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET dls-icons.woff
www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.2.0/package/dist/iconfont/ 0
0

GET
H2 200 3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.aexp-static.com/nav/ngn/fonts/ 16 KB
0 346ms
288ms Font
font/woff 23.2.131.101

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
Requested by: Host: amsnxeoncoerd.rrwtcdz.cn
URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.131.101 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://amsnxeoncoerd.rrwtcdz.cn/
Origin: https://amsnxeoncoerd.rrwtcdz.cn
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 18:08:47 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-9121"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37153
expires: Fri, 08 Jan 2021 21:09:55 GMT

GET dls-icons.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/iconfont/ 0
0

GET Roboto-Medium.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/fonts/ 0
0

GET Roboto-Regular.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/fonts/ 0
0

GET Roboto-Light.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: assets.adobedtm.com
URL: https://assets.adobedtm.com/dcb19cbd6cbf/b4385da1798a/04055ca6ea92/EX29b48e242ee64e7eb05073d267244e6a-libraryCode_source.min.js

Domain: icm.aexp-static.com
URL: https://icm.aexp-static.com/content/dam/PZN/Default/JP/JP%20Default%20image_mobile%20app.jpg

Domain: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.14.2/package/dist/img/flags/dls-flag-jp.svg

Domain: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.2.0/package/dist/iconfont/dls-icons.woff?v=2.1.0

Domain: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/iconfont/dls-icons.woff

Domain: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/fonts/Roboto-Medium.woff

Domain: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/fonts/Roboto-Regular.woff

Domain: www.aexp-static.com
URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.11.2/package/dist/fonts/Roboto-Light.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amsnxeoncoerd.rrwtcdz.cn/	1969-12-31 23:59:59	Name: PHPSESSID Value: udcjed0prf7f4oetm0qni837rh

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://amsnxeoncoerd.rrwtcdz.cn/admin/im/css/modules/code.css?v=2 Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://amsnxeoncoerd.rrwtcdz.cn/logn.php?token=45d96a29b32d5afcd5e9d360d58 Message: Access to image at 'https://www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.14.2/package/dist/img/flags/dls-flag-jp.svg' from origin 'https://amsnxeoncoerd.rrwtcdz.cn' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amsnxeoncoerd.rrwtcdz.cn
assets.adobedtm.com
cdn.bootcdn.net
icm.aexp-static.com
www.aexp-static.com
assets.adobedtm.com
icm.aexp-static.com
www.aexp-static.com
119.188.86.194
204.44.109.51
23.2.131.101
028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab
3488e209e7ecf29039fda4dfc5a98bfabb7a682c79bdb0d3e848dc5509fdc776
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
85bbd9fec0b60035ccefc6088a04660609ee27f12af3efcb2f2d650354b4b6d6
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
ad554a1d1de34a9edfa65f5956fbaaa76f62f5bf424716dfaa75fd28f99cb469
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9
d25f7a7b843105e4808b46445b701746ef4d5e9760485e6dda9c4c8e4c121267
de845e24b2467bd23331c59a3b0873b47122cbec7a0bcef8414da29937ea3461
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e37395882770684d811919d658a61f587c2caa7f7984f01d4e6f1cceea1052
f81c0917f4fa2a35faa6b8c33644f463cebf118239b18aaffdede8e12a33ee54
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e

amsnxeoncoerd.rrwtcdz.cn Open in urlscan Pro 204.44.109.51 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

26 Requests

69 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

4 IPs

1 Countries

291 kBTransfer

1245 kBSize

1 Cookies

0 Outgoing links

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

amsnxeoncoerd.rrwtcdz.cn Open in urlscan Pro
204.44.109.51 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

69 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

291 kB
Transfer

1245 kB
Size

1
Cookies

26 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!