gift.amazonws.it
Open in
urlscan Pro
54.246.37.32
Malicious Activity!
Public Scan
URL:
http://gift.amazonws.it/?rid=72oV67c
Submission: On June 16 via manual from IN — Scanned from IT
Submission: On June 16 via manual from IN — Scanned from IT
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 4 HTTP transactions.
The main IP is 54.246.37.32, located in
Dublin, Ireland and
belongs to AMAZON-02, US.
The main domain is gift.amazonws.it.
This is the only time gift.amazonws.it was scanned on urlscan.io!
This is the only time gift.amazonws.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Eni (Energy)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 54.246.37.32 54.246.37.32 | 16509 (AMAZON-02) (AMAZON-02) | |
| 3 | 151.96.0.241 151.96.0.241 | 8217 (ASN-ENI) (ASN-ENI) | |
| 4 | 2 |
1
54.246.37.32
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-37-32.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-37-32.eu-west-1.compute.amazonaws.com
| gift.amazonws.it |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
eni.it
basic.eni.it |
12 KB |
| 1 |
amazonws.it
gift.amazonws.it |
4 KB |
| 4 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | basic.eni.it |
gift.amazonws.it
|
| 1 | gift.amazonws.it | |
| 4 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| basic.eni.it DigiCert TLS RSA SHA256 2020 CA1 |
2022-10-17 - 2023-10-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://gift.amazonws.it/?rid=72oV67c
Frame ID: C8BC1227FAE8BAFE32EB6745CC69E1E2
Requests: 4 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
gift.amazonws.it/ |
33 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
back_gradient.jpg
basic.eni.it/up-password/portali/uapstyle/mslight/resources/images/ |
8 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
myeni_tooltop_background.gif
basic.eni.it/up-password/portali/uapstyle/mslight/resources/images/ |
58 B 771 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
myeni_tooltop_logo.gif
basic.eni.it/up-password/portali/uapstyle/mslight/resources/images/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Eni (Energy)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
basic.eni.it
gift.amazonws.it
151.96.0.241
54.246.37.32
023172366a3b3b92c43993cda22a70ded5a0b8a4aaf2782530f09100a57c880a
118c8bc4beaf9065d3b45caf79ae5c11265e1eb0104d0d78ca11938673045162
9260fcda652a42908f87f140f359a891ad1818f51671a3cc00fe89d47b3b1984
a3b46098a25ff5c4716a5ad5b89ead975b8d6c22fd40a734baabc582fe0c24b3