www.multserver.com.br
Open in
urlscan Pro
149.56.107.239
Malicious Activity!
Public Scan
Submission: On December 27 via manual from CA
Summary
This is the only time www.multserver.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 149.56.107.239 149.56.107.239 | 16276 (OVH) (OVH) | |
5 | 1 |
ASN16276 (OVH, FR)
PTR: akai.serversbr.com
www.multserver.com.br |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
multserver.com.br
www.multserver.com.br |
114 KB |
5 | 1 |
Domain | Requested by | |
---|---|---|
5 | www.multserver.com.br |
www.multserver.com.br
|
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://www.multserver.com.br/confirmation/87e075410b95e45965755c5be3ee346e/index/web/login.php?action=billing_login=true&_session;c77aea99d6790bf08156c81d81d6d244c77aea99d6790bf08156c81d81d6d244
Frame ID: 0135F568365B84220DFD885674AFB989
Requests: 5 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
www.multserver.com.br/confirmation/87e075410b95e45965755c5be3ee346e/index/web/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ap-flex-reduced-nav._3C8_.css
www.multserver.com.br/confirmation/87e075410b95e45965755c5be3ee346e/index/web/content/ |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sign-in-secure._V192194766_.gif
www.multserver.com.br/confirmation/87e075410b95e45965755c5be3ee346e/index/web/content/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amazon_logo_no-org_mid._V153387053_.png
www.multserver.com.br/confirmation/87e075410b95e45965755c5be3ee346e/index/web/content/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ap-flex-reduced-nav-2.0._V393733149_.js
www.multserver.com.br/confirmation/87e075410b95e45965755c5be3ee346e/index/web/content/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask undefined| popover_object function| close_popover function| toggle function| displayCapsWarning function| apValidateEmail function| isInteger function| apValidateTokenCode function| apMatchFields function| apCheckRequiredFields function| setElementAvailability function| enable function| disable function| matchFields function| amz_js_PopWin function| setCookie function| getCookie function| deleteCookie function| checkCookieEnabled function| updateCaptcha function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.multserver.com.br
149.56.107.239
605f462159b4e3b5352c949d60bf5c3bc109f79d3507f07e9e9b9275c53e2532
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
8840ebc746282c770bc8b34e86de42024097f9049fcb819e6046642fbd408b59
8d4a673dd9ea9b156cd7d580ee6f32b0e6d67c9ddcf9614af42ace679f507455
b3537151831be77817ed4bb332af56ddc840274b4e60473a398b046b2cecb92a