uninna.com
Open in
urlscan Pro
2606:4700:3037::ac43:dcd4
Malicious Activity!
Public Scan
Effective URL: https://uninna.com/wp-includes/images/americanexpress.com.axp.lUrls/index.html
Submission: On May 24 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on April 12th 2023. Valid for: 3 months.
This is the only time uninna.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: American Express (Financial) Generic Email (Online)Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:310... 2606:4700:3108::ac42:2afb | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 161.97.78.118 161.97.78.118 | 51167 (CONTABO) (CONTABO) | |
1 | 2606:4700:303... 2606:4700:3037::ac43:dcd4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.102.52.74 104.102.52.74 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
7 | 7 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-52-74.deploy.static.akamaitechnologies.com
www.americanexpress.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 696 |
108 KB |
1 |
americanexpress.com
www.americanexpress.com — Cisco Umbrella Rank: 15773 |
9 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 199 |
7 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 320 |
30 KB |
1 |
uninna.com
uninna.com |
40 KB |
1 |
xollion.com
xollion.com |
498 B |
1 |
cli.co
1 redirects
cli.co |
180 B |
7 | 7 |
Domain | Requested by | |
---|---|---|
2 | code.jquery.com |
uninna.com
|
1 | www.americanexpress.com |
uninna.com
|
1 | cdnjs.cloudflare.com |
uninna.com
|
1 | ajax.googleapis.com |
uninna.com
|
1 | uninna.com | |
1 | xollion.com | |
1 | cli.co | 1 redirects |
7 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
xollion.com R3 |
2023-04-02 - 2023-07-01 |
3 months | crt.sh |
*.uninna.com GTS CA 1P5 |
2023-04-12 - 2023-07-11 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-08 - 2023-07-31 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
www.americanexpress.com DigiCert SHA2 Extended Validation Server CA |
2022-09-14 - 2023-09-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://uninna.com/wp-includes/images/americanexpress.com.axp.lUrls/index.html
Frame ID: 9E8F275D7554B89E3EA10DE3611E3E4E
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Log in to My Account | American Express USPage URL History Show full URLs
-
https://cli.co/ill9g-x
HTTP 302
https://xollion.com/wp-content/uploads/2023/05/css/rme.htm Page URL
- https://uninna.com/wp-includes/images/americanexpress.com.axp.lUrls/index.html Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Popper (Miscellaneous) Expand
Detected patterns
- <script [^>]*src="[^"]*/popper\.js/([0-9.]+)
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cli.co/ill9g-x
HTTP 302
https://xollion.com/wp-content/uploads/2023/05/css/rme.htm Page URL
- https://uninna.com/wp-includes/images/americanexpress.com.axp.lUrls/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://cli.co/ill9g-x HTTP 302
- https://xollion.com/wp-content/uploads/2023/05/css/rme.htm
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
rme.htm
xollion.com/wp-content/uploads/2023/05/css/ Redirect Chain
|
160 B 498 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
uninna.com/wp-includes/images/americanexpress.com.axp.lUrls/ |
99 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.js
code.jquery.com/ |
265 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
20-AMX-0046_Covid19Support-AmexBanner_300x250_m01_46.jpg
www.americanexpress.com/content/dam/amex/us/homepage/images/ |
9 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
693 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
644 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
764 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
984 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
task.url
Submitted on
May 24th 2023, 9:53:27 pm
UTC —
From United States
Threats:
Phishing
Brands:
American Express
US
Comment: This URL was collected from a phishing email pretending to be from AmEx.
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: American Express (Financial) Generic Email (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery function| Popper0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
cli.co
code.jquery.com
uninna.com
www.americanexpress.com
xollion.com
104.102.52.74
161.97.78.118
2001:4de0:ac18::1:a:3a
2606:4700:3037::ac43:dcd4
2606:4700:3108::ac42:2afb
2606:4700::6811:190e
2a00:1450:4001:831::200a
011871b672950332066994d18aaac9d923bc85df3ef22b296b3107df50261887
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0cd60fcc520da13e49b81375e1ebc9d8aad06f64b48e2cb420ac4eec5a5fdeeb
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
4fd6a6bcb34a7a7a6bd0ad4d90744025169fc85d05cc63d7ac8035f367fa6b02
50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9953abc4904c99318bb14a2e8f9abcc9ea8049c5d7e9f4e730c94a14b02a29b4
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542
d1dc4be2bb732742015d6ed477b2fc6fbde466a07a4cf57124a22c3a447a93b0
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad