quintadeporrais.com
Open in
urlscan Pro
89.26.240.1
Malicious Activity!
Public Scan
URL:
http://quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/
Submission: On May 31 via automatic, source phishtank
Submission: On May 31 via automatic, source phishtank
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 89.26.240.1, located in
Portugal and
belongs to ONI Internet Service Provider, PT.
The main domain is quintadeporrais.com.
This is the only time quintadeporrais.com was scanned on urlscan.io!
This is the only time quintadeporrais.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 89.26.240.1 89.26.240.1 | 5626 (ONI Inter...) (ONI Internet Service Provider) | |
| 3 | 2.18.232.32 2.18.232.32 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 9 | 2 |
6
89.26.240.1
(Portugal)
ASN5626 (ONI Internet Service Provider, PT)
PTR: hosting3.serverhs.org
ASN5626 (ONI Internet Service Provider, PT)
PTR: hosting3.serverhs.org
| quintadeporrais.com |
3
2.18.232.32
(European Union)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-32.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-32.deploy.static.akamaitechnologies.com
| images-na.ssl-images-amazon.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
quintadeporrais.com
quintadeporrais.com |
176 KB |
| 3 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
53 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 6 | quintadeporrais.com |
quintadeporrais.com
|
| 3 | images-na.ssl-images-amazon.com |
quintadeporrais.com
|
| 9 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/
Frame ID: 5BCD55507447B4C95B3793821B1FB501
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.amazon.com/ap/forgotpassword?openid.pape.max_auth_age=0&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&pageId=usflex&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.assoc_handle=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fgp%2Fcss%2Fhomepage.html%3Fie%3DUTF8%26ref_%3Dgno_yam_ya
Title: Forgot your password?
Title: Forgot your password?
Search URL Search Domain Scan URL
URL: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=0&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&pageId=usflex&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.assoc_handle=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fgp%2Fcss%2Fhomepage.html%3Fie%3DUTF8%26ref_%3Dgno_yam_ya&changeEmail=1
Title: Has your e-mail address changed since your last order?
Title: Has your e-mail address changed since your last order?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/ |
20 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
ap-flex-reduced-nav-2.1._V360593186_.css
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
amazon_logo_no-org_mid._V153387053_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
screen.css
quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/lib/ |
118 KB 118 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.validate.js
quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/ |
36 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cmxforms.js
quintadeporrais.com/wp-content/mm/ff058aa23605a1577d77bbf6456e6385/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
amznbtn-sprite03._V395592492_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uedata
quintadeporrais.com/ap/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| ue_t0 string| ue_id object| ue_csm string| ue_url string| ue_pr string| ue_md number| ue_navtiming string| ue_mid string| ue_sid string| ue_furl number| ue_hob number| ueinit object| ue function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop number| ue_hoe function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
images-na.ssl-images-amazon.com
quintadeporrais.com
2.18.232.32
89.26.240.1
12f44f7eae1ec755d69303c4c1a6dd1e289c85dbea4a27b4a4343f5f2e1def26
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
411b04207a66e16a007dfe18232aae387b8c0fe73791597786224a8688a82b9d
67d7f215731cfc16758eae1b19f4dbd84d0a21729e85e0218741bb359a3ce790
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a
ea186fe16dbb82ad9ce91f3a6e45c4a83c880116ab567f1bdf533e391bc4fac1