12tribesacademy.com Open in urlscan Pro
184.154.206.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://irbis.pushkinlibrary.kz:8087/openmiilting
Effective URL:
http://12tribesacademy.com/nodules/swo/gps/file/
Submission: On September 08 via api (September 8th 2020, 1:43:00 am UTC) from QA

Summary HTTP 10 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 10 HTTP transactions. The main IP is 184.154.206.2, located in Chicago, United States and belongs to SINGLEHOP-LLC, US. The main domain is 12tribesacademy.com.

This is the only time 12tribesacademy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 2	95.59.207.66 95.59.207.66		9198 (KAZTELECO...) (KAZTELECOM-AS)
8	184.154.206.2 184.154.206.2		32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	2a00:1450:400... 2a00:1450:4001:825::2001		15169 (GOOGLE) (GOOGLE)
10	3

2 95.59.207.66 (Kazakhstan) 1 redirects

ASN9198 (KAZTELECOM-AS, KZ)
PTR: 95.59.207.66.static.telecom.kz

irbis.pushkinlibrary.kz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 184.154.206.2 (Chicago, United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: s940.tmd.cloud

12tribesacademy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

amazon-scama.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	12tribesacademy.com 12tribesacademy.com	108 KB
2	pushkinlibrary.kz 1 redirects irbis.pushkinlibrary.kz	1 KB
1	blogspot.com amazon-scama.blogspot.com
10	3

	Domain	Requested by
8	12tribesacademy.com	12tribesacademy.com
2	irbis.pushkinlibrary.kz	1 redirects
1	amazon-scama.blogspot.com	12tribesacademy.com
10	3

This site contains no links.

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://12tribesacademy.com/nodules/swo/gps/file/
Frame ID: CE617E5E0A276F09D861B47F325DF08D
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://irbis.pushkinlibrary.kz:8087/openmiilting HTTP 301
http://irbis.pushkinlibrary.kz:8087/openmiilting/ Page URL
http://12tribesacademy.com/nodules/swo/gps/file/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_dav (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

10 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

108 kB
Transfer

438 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://irbis.pushkinlibrary.kz:8087/openmiilting HTTP 301
http://irbis.pushkinlibrary.kz:8087/openmiilting/ Page URL
http://12tribesacademy.com/nodules/swo/gps/file/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://irbis.pushkinlibrary.kz:8087/openmiilting HTTP 301
http://irbis.pushkinlibrary.kz:8087/openmiilting/

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response irbis.pushkinlibrary.kz/openmiilting/ Redirect Chain http://irbis.pushkinlibrary.kz:8087/openmiilting http://irbis.pushkinlibrary.kz:8087/openmiilting/	316 B 679 B	140ms 140ms	Document text/html	95.59.207.66 KAZTELECOM-AS
General Check archive.org Show headers Download Go to Full URL http://irbis.pushkinlibrary.kz:8087/openmiilting/ Protocol HTTP/1.1 Server 95.59.207.66 , Kazakhstan, ASN9198 (KAZTELECOM-AS, KZ), Reverse DNS 95.59.207.66.static.telecom.kz Software Apache/2.2.9 (Win32) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8h mod_autoindex_color PHP/5.2.6 / Resource Hash `a74611cd1f2166bd8bf923c1bf3eca66e1a4142e5114ce37cc2fea47fca01fa2` Request headers Host irbis.pushkinlibrary.kz:8087 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:33 GMT Server Apache/2.2.9 (Win32) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8h mod_autoindex_color PHP/5.2.6 Last-Modified Sun, 06 Sep 2020 17:00:12 GMT ETag "28300000002acb3-13c-5aea809049b23" Accept-Ranges bytes Content-Length 316 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html Redirect headers Date Tue, 08 Sep 2020 01:42:33 GMT Server Apache/2.2.9 (Win32) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8h mod_autoindex_color PHP/5.2.6 Location http://irbis.pushkinlibrary.kz:8087/openmiilting/ Content-Length 411 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	Primary Request Cookie set / Show response 12tribesacademy.com/nodules/swo/gps/file/	8 KB 2 KB	319ms 295ms	Document text/html	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / PHP/5.6.40 Resource Hash `4342a4a4ac7a8c5f0bf938040777a373516da8395a347c1494489a00e76fd7ed` Request headers Host 12tribesacademy.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://irbis.pushkinlibrary.kz:8087/openmiilting/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://irbis.pushkinlibrary.kz:8087/openmiilting/ Response headers Connection close X-Powered-By PHP/5.6.40 Set-Cookie PHPSESSID=keandhd5o61263hullp5js40t4; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Content-Encoding gzip Vary Accept-Encoding Date Tue, 08 Sep 2020 01:42:40 GMT Server LiteSpeed
GET H/1.1	200 OK	style3.css 12tribesacademy.com/nodules/swo/gps/file/style/	168 KB 24 KB	259ms 237ms	Stylesheet text/css	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/style/style3.css Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash `bcf1b6c1393473201b637b3d9738fc0ad599a52c7a998379d07ba01d6b75f4a9` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Content-Encoding gzip Last-Modified Tue, 16 Apr 2019 07:47:56 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 24026 Expires Tue, 15 Sep 2020 01:42:40 GMT
GET H/1.1	200 OK	style2.css 12tribesacademy.com/nodules/swo/gps/file/style/	39 KB 7 KB	262ms 239ms	Stylesheet text/css	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/style/style2.css Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash `f395d4f7e16a56f78b3ebb62ce61a099e8c6f909bfae191927a20a36b5f6256c` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Content-Encoding gzip Last-Modified Tue, 16 Apr 2019 07:47:56 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 6464 Expires Tue, 15 Sep 2020 01:42:40 GMT
GET H/1.1	404 Not Found	style1.css 12tribesacademy.com/nodules/swo/gps/file/styel/	0 0	261ms 239ms	Stylesheet text/html	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/styel/style1.css Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 351 Vary Accept-Encoding Content-Type text/html
GET H/1.1	200 OK	jquery.min.js Show response 12tribesacademy.com/nodules/swo/gps/file/js/	156 KB 39 KB	259ms 237ms	Script application/javascript	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/js/jquery.min.js Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash `89db88fadaf63fd4e91d869fed81834918debd6eacbe6e47b5ad54e061996aed` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Content-Encoding gzip Last-Modified Tue, 16 Apr 2019 07:47:56 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 40041 Expires Tue, 15 Sep 2020 01:42:40 GMT
GET H/1.1	200 OK	jquery.validate.min.js Show response 12tribesacademy.com/nodules/swo/gps/file/js/	34 KB 8 KB	259ms 237ms	Script application/javascript	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/js/jquery.validate.min.js Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash `f59dc66c08474ec52a21ab66cd6ba46a4e4ace29b0b82e2306add18741ae9c2a` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Content-Encoding gzip Last-Modified Tue, 16 Apr 2019 07:47:56 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 8058 Expires Tue, 15 Sep 2020 01:42:40 GMT
GET H/1.1	200 OK	sire.form.js Show response 12tribesacademy.com/nodules/swo/gps/file/js/	8 KB 1 KB	262ms 240ms	Script application/javascript	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://12tribesacademy.com/nodules/swo/gps/file/js/sire.form.js Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/ Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash `5770aab99e33b0e18f73c3a6937e7e02a0858ea03e410e5d36905a13fc0a7537` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Content-Encoding gzip Last-Modified Tue, 16 Apr 2019 07:47:56 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 925 Expires Tue, 15 Sep 2020 01:42:40 GMT
GET H2	200	/ amazon-scama.blogspot.com/	0 0	164ms 144ms	Image text/html	2a00:1450:4001:825::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://amazon-scama.blogspot.com/ Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/style/style3.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/style/style3.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png 12tribesacademy.com/nodules/swo/gps/file/style/img/	26 KB 26 KB	129ms 129ms	Image image/png	184.154.206.2 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Show image Full URL http://12tribesacademy.com/nodules/swo/gps/file/style/img/AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png Requested by Host: 12tribesacademy.com URL: http://12tribesacademy.com/nodules/swo/gps/file/style/style3.css Protocol HTTP/1.1 Server 184.154.206.2 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS s940.tmd.cloud Software LiteSpeed / Resource Hash `e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d` Request headers Referer http://12tribesacademy.com/nodules/swo/gps/file/style/style3.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Sep 2020 01:42:40 GMT Last-Modified Tue, 16 Apr 2019 07:47:56 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 26119 Expires Tue, 15 Sep 2020 01:42:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			12tribesacademy.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: keandhd5o61263hullp5js40t4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12tribesacademy.com
amazon-scama.blogspot.com
irbis.pushkinlibrary.kz
184.154.206.2
2a00:1450:4001:825::2001
95.59.207.66
4342a4a4ac7a8c5f0bf938040777a373516da8395a347c1494489a00e76fd7ed
5770aab99e33b0e18f73c3a6937e7e02a0858ea03e410e5d36905a13fc0a7537
89db88fadaf63fd4e91d869fed81834918debd6eacbe6e47b5ad54e061996aed
a74611cd1f2166bd8bf923c1bf3eca66e1a4142e5114ce37cc2fea47fca01fa2
bcf1b6c1393473201b637b3d9738fc0ad599a52c7a998379d07ba01d6b75f4a9
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f395d4f7e16a56f78b3ebb62ce61a099e8c6f909bfae191927a20a36b5f6256c
f59dc66c08474ec52a21ab66cd6ba46a4e4ace29b0b82e2306add18741ae9c2a