adexposure.com
Open in
urlscan Pro
107.180.114.51
Malicious Activity!
Public Scan
Submission: On December 12 via automatic, source phishtank
Summary
This is the only time adexposure.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 107.180.114.51 107.180.114.51 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
8 | 52.222.166.63 52.222.166.63 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 104.111.214.19 104.111.214.19 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
7 | 54.88.218.242 54.88.218.242 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 45.40.130.22 45.40.130.22 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
19 | 5 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-114-51.ip.secureserver.net
adexposure.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-166-63.fra54.r.cloudfront.net
images-na.ssl-images-amazon.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a104-111-214-19.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-88-218-242.compute-1.amazonaws.com
fls-na.amazon.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
img.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
189 KB |
7 |
amazon.com
fls-na.amazon.com |
215 B |
2 |
adexposure.com
adexposure.com |
947 B |
1 |
secureserver.net
img.secureserver.net |
43 B |
1 |
wsimg.com
img1.wsimg.com |
4 KB |
19 | 5 |
Domain | Requested by | |
---|---|---|
8 | images-na.ssl-images-amazon.com |
adexposure.com
|
7 | fls-na.amazon.com |
images-na.ssl-images-amazon.com
|
2 | adexposure.com | |
1 | img.secureserver.net | |
1 | img1.wsimg.com |
adexposure.com
|
19 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.amazon.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
Images-na.ssl-images-amazon.com Symantec Class 3 Secure Server CA - G4 |
2017-10-19 - 2018-07-19 |
9 months | crt.sh |
*.wsimg.com Starfield Secure Certificate Authority - G2 |
2015-11-13 - 2018-11-13 |
3 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://adexposure.com/wp-content/plugins/underconstruction/languages/amazon/SignIn.html?client_id=tb5SFf3cRxEyspDN&response_type=code
Frame ID: (E0694307CC5E02C36D92D7AFA77B1BBC)
Requests: 19 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Forgot your password?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
SignIn.html
adexposure.com/wp-content/plugins/underconstruction/languages/amazon/ |
31 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ap-flex-reduced-nav-2.1._CB343920894_.css
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amazon_logo_no-org_mid._CB153387053_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ap-flex-reduced-nav-2.0._CB309092102_.js
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
84 KB 24 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fwcim._CB342128453_.js
images-na.ssl-images-amazon.com/images/G/01/x-locale/common/login/ |
376 KB 106 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amznbtn-sprite03._V395592492_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
42 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
uedata
adexposure.com/ap/ |
16 KB 947 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATVPDKIKX0DER:190-4435259-9959100:ZTTNG3EVF41PW730QX18$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.832.1%26id%3DZTTNG3EVF41PW730QX18%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3DZTTNG3EV...
fls-na.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
forester-client-min-758617388.js
images-na.ssl-images-amazon.com/images/G/01/browser-scripts/forester-client/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jserrors-min-3018617914.js
images-na.ssl-images-amazon.com/images/G/01/browser-scripts/jserrors/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csmCELLS-min-413530770.js
images-na.ssl-images-amazon.com/images/G/01/browser-scripts/csmCELLS/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATVPDKIKX0DER:190-4435259-9959100:ZTTNG3EVF41PW730QX18$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.832.1%26id%3DZTTNG3EVF41PW730QX18%26ctb%3D1%26sc0%3DcsmCELLSframework%26bb0%3D152%26pc0%3D152%26ld0%3D152...
fls-na.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATVPDKIKX0DER:190-4435259-9959100:ZTTNG3EVF41PW730QX18$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.832.1%26id%3DZTTNG3EVF41PW730QX18%26ctb%3D1%26sc0%3DcsmCELLSpdm%26bb0%3D153%26pc0%3D153%26ld0%3D153%26t0%...
fls-na.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATVPDKIKX0DER:190-4435259-9959100:ZTTNG3EVF41PW730QX18$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.832.1%26id%3DZTTNG3EVF41PW730QX18%26ctb%3D1%26sc0%3DcsmCELLSvpm%26bb0%3D153%26pc0%3D153%26ld0%3D153%26t0%...
fls-na.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATVPDKIKX0DER:190-4435259-9959100:ZTTNG3EVF41PW730QX18$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.832.1%26id%3DZTTNG3EVF41PW730QX18%26ctb%3D1%26sc0%3DcsmCELLSfem%26bb0%3D153%26pc0%3D153%26ld0%3D153%26t0%...
fls-na.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
fls-na.amazon.com/1/batch/1/OE/ |
0 0 |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
fls-na.amazon.com/1/batch/1/OE/ |
0 0 |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)81 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint number| ue_t0 object| ue_csm number| ue_hob string| ue_err_chan string| ue_id string| ue_url number| ue_navtiming string| ue_mid string| ue_sid string| ue_sn string| ue_furl number| ue_fcsn string| ue_fpf number| ue_swi function| ue_viz object| ue function| ueLogError object| ue_err number| ueinit function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onUl function| onstop object| cel_widgets number| ue_tbno number| ue_tble number| ue_hoe number| useCel number| useCelFF object| amzn function| cf undefined| popover_object function| close_popover function| toggle function| displayCapsWarning function| apValidateEmail function| isInteger function| apValidateTokenCode function| apMatchFields function| apCheckRequiredFields function| setElementAvailability function| enable function| disable function| matchFields function| amz_js_PopWin function| setCookie function| getCookie function| deleteCookie function| checkCookieEnabled function| updateCaptcha function| $ function| jQuery boolean| __fwcimLoaded object| fwcim boolean| __fwcimShimProfileReady number| c_start number| c_end string| ue_pty string| ue_spty object| ue_pti function| _uess function| _uec object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true function| Zepto object| ue_cel object| ue_pdm object| ue_vpm object| ue_fem0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adexposure.com
fls-na.amazon.com
images-na.ssl-images-amazon.com
img.secureserver.net
img1.wsimg.com
104.111.214.19
107.180.114.51
45.40.130.22
52.222.166.63
54.88.218.242
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
50a23012f387cba8cf4821be76bfcb688fc929580494499a3c79683032753084
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
a4b1507176705848bc5b15271539a7f2bc3d1f49f2a1322579aa849923578cea
a62722637e9bef85ce46292269b9775d5dc42de722f4f6301f1180fabe8f8b17
a8ce80566ecf0e7bf8d0824f2c515a21533a89731b76e08b43444a5b8b618f98
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
c5c390bb2dc2768028fe80f208eb8d531621139eb8c0117071bc41e9667f9da6
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a
c97197d3ade2125e98fa97832817347132495756fc2c2f9eb9dd679ad3940857
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcfc9b92b833358277d2100ab1ea98e8a036c8b564be471873f40e353e74d03c