mail.rusmm.org Open in urlscan Pro
142.4.3.149 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mail.rusmm.org/index.html
Submission: On January 06 via manual (January 6th 2025, 3:24:25 pm UTC) from IN — Scanned from FR

Summary HTTP 19 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 19 HTTP transactions. The main IP is 142.4.3.149, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is mail.rusmm.org.
TLS certificate: Issued by R11 on November 24th 2024. Valid for: 3 months.

This is the only time mail.rusmm.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
8	142.4.3.149 142.4.3.149	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
5	2a04:4e42:200... 2a04:4e42:200::272	54113 (FASTLY) (FASTLY)
6	34.206.14.79 34.206.14.79	14618 (AMAZON-AES) (AMAZON-AES)
19	3

8 142.4.3.149 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: sv2.hostingta.com

mail.rusmm.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:4e42:200::272 (United States)

ASN54113 (FASTLY, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.206.14.79 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-14-79.compute-1.amazonaws.com

fls-na.amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	rusmm.org mail.rusmm.org	575 KB
6	amazon.com fls-na.amazon.com — Cisco Umbrella Rank: 1288	1 KB
5	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 856	131 KB
19	3

	Domain	Requested by
8	mail.rusmm.org	mail.rusmm.org
6	fls-na.amazon.com	mail.rusmm.org
5	images-na.ssl-images-amazon.com	mail.rusmm.org
19	3

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
*.rusmm.org R11	`2024-11-24` - `2025-02-22`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2024-12-04` - `2025-11-18`	a year	crt.sh
fls-na.amazon.com Amazon RSA 2048 M02	`2024-10-03` - `2025-11-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mail.rusmm.org/index.html
Frame ID: FAC2D7437E075185700380A022BFD1C6
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign In

Page Statistics

19
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

706 kB
Transfer

974 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ref=ap_frn_logo
Title: Amazon

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_cookie_error_help

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/forgotpassword?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=JGMWMV41Q6S17XXQV2AC&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/?nodeId=200957780&pop-up=1
Title: Details

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/register?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=JGMWMV41Q6S17XXQV2AC&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Create your Amazon account

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=508088
Title: Conditions of Use

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.com/help
Title: Help

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response mail.rusmm.org/	78 KB 78 KB	1921ms 141ms	Document text/html	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `c9a1b03639a2f3945cb072d6b9c2847003ee15cb95f8d831607412a1d2c58267` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 79813 Content-Type text/html Date Mon, 06 Jan 2025 15:24:20 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 08 Oct 2024 16:23:21 GMT Server Apache
GET H/1.1	200 OK	ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js.download Show response mail.rusmm.org/Amazon%20Sign%20In_files/	9 KB 9 KB	424ms 142ms	Script application/javascript	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/Amazon%20Sign%20In_files/ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js.download Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `2b18f88b67c4c9c469277d5231aace18fd273679c43f4077e925c6179669dec8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/index.html Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 9012 Keep-Alive timeout=5, max=100 Date Mon, 06 Jan 2025 15:24:21 GMT Last-Modified Tue, 08 Oct 2024 16:17:56 GMT Content-Type application/javascript Server Apache
GET H/1.1	200 OK	AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css mail.rusmm.org/Amazon%20Sign%20In_files/	117 KB 118 KB	287ms 142ms	Stylesheet text/css	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/Amazon%20Sign%20In_files/AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `8b1da396d990146a5c58465e5edd9a4b3153e7b0dba150937b639704b581bb3d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/index.html Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 120165 Keep-Alive timeout=5, max=99 Date Mon, 06 Jan 2025 15:24:21 GMT Last-Modified Tue, 08 Oct 2024 16:17:56 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	AmazonUI-fbe29e7e7feb1ee355f37cef9938c823338ae404._V2_.js.download Show response mail.rusmm.org/Amazon%20Sign%20In_files/	272 KB 273 KB	142ms 142ms	Script application/javascript	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/Amazon%20Sign%20In_files/AmazonUI-fbe29e7e7feb1ee355f37cef9938c823338ae404._V2_.js.download Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `e17e55cb4f739811e449055053e853ce5ce1603313a61e8306f3c6f29b4734cd` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://mail.rusmm.org Referer https://mail.rusmm.org/index.html Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 278883 Keep-Alive timeout=5, max=99 Date Mon, 06 Jan 2025 15:24:21 GMT Last-Modified Tue, 08 Oct 2024 16:17:57 GMT Content-Type application/javascript Server Apache
GET H/1.1	200 OK	AuthenticationPortalAssets-232052515ce620836dbb308fe54ea4362a88afeb._V2_.js.download Show response mail.rusmm.org/Amazon%20Sign%20In_files/	72 KB 73 KB	142ms 142ms	Script application/javascript	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/Amazon%20Sign%20In_files/AuthenticationPortalAssets-232052515ce620836dbb308fe54ea4362a88afeb._V2_.js.download Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `9da41ee270ff05a1c8f8051a1bb4bd62b2bf0febb38ca16b2e0f41c806e7253f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://mail.rusmm.org Referer https://mail.rusmm.org/index.html Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 74034 Keep-Alive timeout=5, max=98 Date Mon, 06 Jan 2025 15:24:21 GMT Last-Modified Tue, 08 Oct 2024 16:17:56 GMT Content-Type application/javascript Server Apache
GET H/1.1	200 OK	FWCIMAssets-7603d4e9252c2ebc1fa39056feba9efc5448e149._V2_.js.download Show response mail.rusmm.org/Amazon%20Sign%20In_files/	24 KB 24 KB	142ms 141ms	Script application/javascript	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/Amazon%20Sign%20In_files/FWCIMAssets-7603d4e9252c2ebc1fa39056feba9efc5448e149._V2_.js.download Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `30fe70b2c076430b912d206fbac52a7f97b506999bd006196e427af982c41bcd` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://mail.rusmm.org Referer https://mail.rusmm.org/index.html Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 24229 Keep-Alive timeout=5, max=100 Date Mon, 06 Jan 2025 15:24:21 GMT Last-Modified Tue, 08 Oct 2024 16:17:56 GMT Content-Type application/javascript Server Apache
GET H2	200	AmazonUI-fbe29e7e7feb1ee355f37cef9938c823338ae404._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	272 KB 74 KB	426ms 112ms	Script application/x-javascript	2a04:4e42:200::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-fbe29e7e7feb1ee355f37cef9938c823338ae404._V2_.js Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `ad5052cfcd4bc6b262fae85507eea061c33bad087c67296846337a1935ff5b8d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://mail.rusmm.org Referer https://mail.rusmm.org/ Response headers x-amz-ir-id 87f5f293-9eba-4bdc-99d5-4358e94f57a3 content-encoding br age 2342810 expires Thu, 13 Oct 2044 16:58:05 GMT server-timing provider;desc="fy" x-cache HIT from fastly, MISS from fastly alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 date Mon, 06 Jan 2025 15:24:21 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding x-nginx-cache-status HIT last-modified Thu, 16 Jun 2016 03:52:41 GMT x-served-by cache-iad-kjyo7100171-IAD, cache-man4135-MAN cache-control max-age=630720000,public timing-allow-origin https://www.amazon.com accept-ranges bytes access-control-allow-origin * content-length 75714
GET H2	200	AuthenticationPortalAssets-232052515ce620836dbb308fe54ea4362a88afeb._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	72 KB 19 KB	460ms 146ms	Script application/x-javascript	2a04:4e42:200::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-232052515ce620836dbb308fe54ea4362a88afeb._V2_.js Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `10f5a050e2131debd8075d5d488a628f9964d7da2f03291ea6948864788431cf` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://mail.rusmm.org Referer https://mail.rusmm.org/ Response headers x-amz-ir-id b2b83ee3-a016-4012-ad0a-2582c6e86c05 content-encoding br age 0 expires Sat, 19 Nov 2044 17:04:57 GMT server-timing provider;desc="fy" x-cache HIT from fastly, MISS from fastly alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 date Mon, 06 Jan 2025 15:24:21 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding x-nginx-cache-status HIT last-modified Wed, 25 Jan 2017 03:04:20 GMT x-served-by cache-iad-kcgs7200167-IAD, cache-man4135-MAN cache-control max-age=630720000,public timing-allow-origin https://www.amazon.com accept-ranges bytes access-control-allow-origin * content-length 19233
GET H2	200	FWCIMAssets-7603d4e9252c2ebc1fa39056feba9efc5448e149._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	24 KB 9 KB	422ms 108ms	Script application/x-javascript	2a04:4e42:200::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/FWCIMAssets-7603d4e9252c2ebc1fa39056feba9efc5448e149._V2_.js Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `2a6b7506143f786dbb06d8087b72e552732a685450618b15c8c2a4b988a33a52` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://mail.rusmm.org Referer https://mail.rusmm.org/ Response headers x-amz-ir-id 00e72d8d-beec-4c0f-bc43-1e8b45e8ad8c content-encoding br age 570773 expires Mon, 26 Dec 2044 00:51:28 GMT server-timing provider;desc="fy" x-cache HIT from fastly, MISS from fastly alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 date Mon, 06 Jan 2025 15:24:21 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding x-nginx-cache-status MISS last-modified Mon, 03 Oct 2016 22:43:45 GMT x-served-by cache-iad-kcgs7200107-IAD, cache-man4135-MAN cache-control max-age=630720000,public timing-allow-origin https://www.amazon.com accept-ranges bytes access-control-allow-origin * content-length 8346
POST H2	200	csm-features:impression-tracking fls-na.amazon.com/1/action-impressions/1/OP/csm/action/	43 B 252 B	407ms 94ms	Ping image/gif	34.206.14.79 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/action-impressions/1/OP/csm/action/csm-features:impression-tracking?requestId=JGMWMV41Q6S17XXQV2AC&marketplaceId=ATVPDKIKX0DER&session=152-8992188-7172864&csm=1 Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.14.79 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-14-79.compute-1.amazonaws.com Software / Resource Hash `a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/ Response headers x-amzn-requestid 7d765d8c-94f5-479b-a75e-d4238b826aa1 access-control-allow-origin * access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol content-length 43 date Mon, 06 Jan 2025 15:24:21 GMT content-type image/gif
GET H2	200	AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	25 KB 25 KB	339ms 27ms	Image image/png	2a04:4e42:200::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/Amazon%20Sign%20In_files/AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/ Response headers x-amz-ir-id d7a2cade-cc27-47ae-b2c5-7a32555dd369 age 1139182 expires Tue, 24 May 2044 21:46:50 GMT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT from fastly, HIT from fastly server-timing provider;desc="fy" date Mon, 06 Jan 2025 15:24:21 GMT content-type image/png last-modified Sat, 13 Feb 2016 23:21:21 GMT x-nginx-cache-status HIT x-served-by cache-iad-kjyo7100165-IAD, cache-man4161-MAN cache-control max-age=630720000,public timing-allow-origin https://www.amazon.com accept-ranges bytes access-control-allow-origin * content-length 25262
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 177 B	95ms 94ms	Ping text/plain	34.206.14.79 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/Amazon%20Sign%20In_files/ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js.download Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.14.79 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-14-79.compute-1.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://mail.rusmm.org/ Response headers x-amzn-requestid 9f6bf6cd-d50c-4cbd-9c44-e079b2fd0e31 access-control-allow-origin * access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol date Mon, 06 Jan 2025 15:24:21 GMT
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 177 B	99ms 92ms	Ping text/plain	34.206.14.79 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/Amazon%20Sign%20In_files/ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js.download Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.14.79 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-14-79.compute-1.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://mail.rusmm.org/ Response headers x-amzn-requestid d60d848a-ba22-4287-9edb-009f40a00e24 access-control-allow-origin * access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol date Mon, 06 Jan 2025 15:24:21 GMT
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 177 B	95ms 93ms	Ping text/plain	34.206.14.79 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/Amazon%20Sign%20In_files/ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js.download Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.14.79 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-14-79.compute-1.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://mail.rusmm.org/ Response headers x-amzn-requestid bd9761ae-1e38-4ca6-9455-2a15d0b18d0f access-control-allow-origin * access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol date Mon, 06 Jan 2025 15:24:21 GMT
GET H/1.1	404 Not Found	uedata mail.rusmm.org/ap/	315 B 315 B	143ms 143ms	Image text/html	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://mail.rusmm.org/ap/uedata?ld&v=0.417.186&id=JGMWMV41Q6S17XXQV2AC&sw=1600&sh=1200&vw=1600&vh=1200&m=1&sc=JGMWMV41Q6S17XXQV2AC&ue=125&bb=561&cf=561&be=562&pc=1098&tc=-1937&na_=-1937&ul_=-1736177060747&_ul=-1736177060747&rd_=-1736177060747&_rd=-1736177060747&fe_=-1937&lk_=-1936&_lk=-879&co_=-879&_co=-157&sc_=-738&rq_=-157&rs_=-16&_rs=270&dl_=-13&di_=568&de_=568&_de=568&_dc=1098&ld_=1098&_ld=-1736177060747&ntd=0&ty=0&rc=0&hob=125&hoe=125&ld=1098&t=1736177061845&ctb=1&bfform=1&nrbf=1&rt=cf:2-1-1-0-1-0-1__ld:11-7-1-0-3-0-1&ec=3&ecf=3&csmtags=aui\|aui:aui_build_date:3.16.7.7-2016-07-27\|fls-na&viz=visible:125&pty=AuthenticationPortal&spty=SignInApplication&pti=undefined&tid=JGMWMV41Q6S17XXQV2AC&aftb=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/index.html Response headers Keep-Alive timeout=5, max=98 Content-Length 315 Date Mon, 06 Jan 2025 15:24:21 GMT Content-Type text/html; charset=iso-8859-1 Server Apache Connection Keep-Alive
GET H2	200	ATVPDKIKX0DER:152-8992188-7172864:JGMWMV41Q6S17XXQV2AC$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.417.186%26id%3DJGMWMV41Q6S17XXQV2AC%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3DJGMWMV... fls-na.amazon.com/1/batch/1/OP/	43 B 149 B	95ms 95ms	Image image/gif	34.206.14.79 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://fls-na.amazon.com/1/batch/1/OP/ATVPDKIKX0DER:152-8992188-7172864:JGMWMV41Q6S17XXQV2AC$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.417.186%26id%3DJGMWMV41Q6S17XXQV2AC%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3DJGMWMV41Q6S17XXQV2AC%26ue%3D125%26bb%3D561%26cf%3D561%26be%3D562%26pc%3D1098%26tc%3D-1937%26na_%3D-1937%26ul_%3D-1736177060747%26_ul%3D-1736177060747%26rd_%3D-1736177060747%26_rd%3D-1736177060747%26fe_%3D-1937%26lk_%3D-1936%26_lk%3D-879%26co_%3D-879%26_co%3D-157%26sc_%3D-738%26rq_%3D-157%26rs_%3D-16%26_rs%3D270%26dl_%3D-13%26di_%3D568%26de_%3D568%26_de%3D568%26_dc%3D1098%26ld_%3D1098%26_ld%3D-1736177060747%26ntd%3D0%26ty%3D0%26rc%3D0%26hob%3D125%26hoe%3D125%26ld%3D1098%26t%3D1736177061845%26ctb%3D1%26bfform%3D1%26nrbf%3D1%26rt%3Dcf%3A2-1-1-0-1-0-1__ld%3A11-7-1-0-3-0-1%26ec%3D3%26ecf%3D3%26csmtags%3Daui%7Caui%3Aaui_build_date%3A3.16.7.7-2016-07-27%7Cfls-na%26viz%3Dvisible%3A125%26pty%3DAuthenticationPortal%26spty%3DSignInApplication%26pti%3Dundefined%26tid%3DJGMWMV41Q6S17XXQV2AC%26aftb%3D1:1099 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.14.79 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-14-79.compute-1.amazonaws.com Software / Resource Hash `a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/ Response headers x-amzn-requestid 1e105d97-ebb2-4700-9d90-10c75bd577d7 content-length 43 date Mon, 06 Jan 2025 15:24:21 GMT content-type image/gif
GET H2	200	ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	9 KB 4 KB	110ms 110ms	Script application/x-javascript	2a04:4e42:200::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `96bd12ece30b7875eb0a2f93d90ee22fff82eb5f70b89a0bb44315f6ffb78d88` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/ Response headers x-amz-ir-id d60180dc-968b-4054-9ea8-15a9293d8572 content-encoding br age 1146622 expires Wed, 02 Nov 2044 16:23:30 GMT server-timing provider;desc="fy" x-cache HIT from fastly, MISS from fastly alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 date Mon, 06 Jan 2025 15:24:21 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding x-nginx-cache-status HIT last-modified Wed, 30 Nov 2016 22:01:43 GMT x-served-by cache-iad-kcgs7200109-IAD, cache-man4161-MAN cache-control max-age=630720000,public timing-allow-origin https://www.amazon.com accept-ranges bytes access-control-allow-origin * content-length 3713
GET H/1.1	404 Not Found	favicon.ico mail.rusmm.org/	315 B 515 B	142ms 142ms	Other text/html	142.4.3.149 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://mail.rusmm.org/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 142.4.3.149 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sv2.hostingta.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://mail.rusmm.org/index.html Response headers Keep-Alive timeout=5, max=99 Content-Length 315 Date Mon, 06 Jan 2025 15:24:21 GMT Content-Type text/html; charset=iso-8859-1 Server Apache Connection Keep-Alive
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 177 B	95ms 94ms	Ping text/plain	34.206.14.79 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: mail.rusmm.org URL: https://mail.rusmm.org/Amazon%20Sign%20In_files/ClientSideMetricsAUIJavascript-53a09034467dafd68e3b50809a38a53c170e472c._V2_.js.download Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.14.79 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-14-79.compute-1.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://mail.rusmm.org/ Response headers x-amzn-requestid 309d9871-68a3-4678-8e5d-5ae05de44c5e access-control-allow-origin * access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date,smithy-protocol date Mon, 06 Jan 2025 15:24:22 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mail.rusmm.org/	1970-01-21 02:26:21	Name: csm-hit Value: s-JGMWMV41Q6S17XXQV2AC\|1736177061307

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://mail.rusmm.org/index.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://mail.rusmm.org/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://mail.rusmm.org/ap/uedata?ld&v=0.417.186&id=JGMWMV41Q6S17XXQV2AC&sw=1600&sh=1200&vw=1600&vh=1200&m=1&sc=JGMWMV41Q6S17XXQV2AC&ue=125&bb=561&cf=561&be=562&pc=1098&tc=-1937&na_=-1937&ul_=-1736177060747&_ul=-1736177060747&rd_=-1736177060747&_rd=-1736177060747&fe_=-1937&lk_=-1936&_lk=-879&co_=-879&_co=-157&sc_=-738&rq_=-157&rs_=-16&_rs=270&dl_=-13&di_=568&de_=568&_de=568&_dc=1098&ld_=1098&_ld=-1736177060747&ntd=0&ty=0&rc=0&hob=125&hoe=125&ld=1098&t=1736177061845&ctb=1&bfform=1&nrbf=1&rt=cf:2-1-1-0-1-0-1__ld:11-7-1-0-3-0-1&ec=3&ecf=3&csmtags=aui\|aui:aui_build_date:3.16.7.7-2016-07-27\|fls-na&viz=visible:125&pty=AuthenticationPortal&spty=SignInApplication&pti=undefined&tid=JGMWMV41Q6S17XXQV2AC&aftb=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fls-na.amazon.com
images-na.ssl-images-amazon.com
mail.rusmm.org
142.4.3.149
2a04:4e42:200::272
34.206.14.79
10f5a050e2131debd8075d5d488a628f9964d7da2f03291ea6948864788431cf
2a6b7506143f786dbb06d8087b72e552732a685450618b15c8c2a4b988a33a52
2b18f88b67c4c9c469277d5231aace18fd273679c43f4077e925c6179669dec8
30fe70b2c076430b912d206fbac52a7f97b506999bd006196e427af982c41bcd
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
8b1da396d990146a5c58465e5edd9a4b3153e7b0dba150937b639704b581bb3d
96bd12ece30b7875eb0a2f93d90ee22fff82eb5f70b89a0bb44315f6ffb78d88
9da41ee270ff05a1c8f8051a1bb4bd62b2bf0febb38ca16b2e0f41c806e7253f
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
ad5052cfcd4bc6b262fae85507eea061c33bad087c67296846337a1935ff5b8d
c9a1b03639a2f3945cb072d6b9c2847003ee15cb95f8d831607412a1d2c58267
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e17e55cb4f739811e449055053e853ce5ce1603313a61e8306f3c6f29b4734cd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

mail.rusmm.org Open in urlscan Pro 142.4.3.149 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

19 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

706 kBTransfer

974 kBSize

1 Cookies

8 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

40 JavaScript Global Variables

1 Cookies

3 Console Messages

Indicators

mail.rusmm.org Open in urlscan Pro
142.4.3.149 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

706 kB
Transfer

974 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!