urlscan.io logo urlscan.io
SecurityTrails logo

dhbfb.ml Open in urlscan Pro
212.237.61.226  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://dhbfb.ml/1.html
Submission: On June 26 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 212.237.61.226, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is dhbfb.ml.
This is the only time dhbfb.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 212.237.61.226 31034 (ARUBA-ASN)
5 54.192.202.49 16509 (AMAZON-02)
6 2
Domain Requested by
4 images-na.ssl-images-amazon.com dhbfb.ml
1 m.media-amazon.com dhbfb.ml
1 dhbfb.ml
6 3

This site contains links to these domains. Also see Links.

Domain
www.amazon.de
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://dhbfb.ml/1.html
Frame ID: 2E693082B54445C1E64CFF421B664F98
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • env /^Zepto$/i

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

216 kB
Transfer

630 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1.html
dhbfb.ml/ 		20 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://dhbfb.ml/1.html
Protocol
HTTP/1.1
Server
212.237.61.226 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
host226-61-237-212.serverdedicati.aruba.it
Software
Apache /
Resource Hash
48b537a3390a095c8f1a42e9225018f2d0d1388cf541cd7acfac4755e8c7c293

Request headers

Host
dhbfb.ml
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
2E693082B54445C1E64CFF421B664F98

Response headers

Date
Tue, 26 Jun 2018 03:46:08 GMT
Server
Apache
Last-Modified
Sun, 24 Jun 2018 08:10:20 GMT
Accept-Ranges
bytes
Content-Length
20737
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css
images-na.ssl-images-amazon.com/images/I/ 		136 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css
Requested by
Host: dhbfb.ml
URL: http://dhbfb.ml/1.html
Protocol
SPDY
Server
54.192.202.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-202-49.fra50.r.cloudfront.net
Software
Server /
Resource Hash
b06058dda50252e2ff430d60f9d799d44e0dbbad47006ea169aa9abd90146459

Request headers

Referer
http://dhbfb.ml/1.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sat, 19 Aug 2017 00:25:26 GMT
content-encoding
gzip
last-modified
Thu, 16 Mar 2017 06:31:45 GMT
server
Server
age
26920907
status
200
x-cache
Hit from cloudfront
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
3638cbfe-a9d7-40fb-a7d5-19288d75274e
x-amz-cf-id
AjEswnA8Y17Pa5UsrzM7FBcNs6Gg4VlzOFpm2bzkRFw4a1gdEqGM7A==
via
1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
expires
Wed, 18 May 2033 03:33:20 GMT
AuthenticationPortalAssets-92bdcb014495140f8aca9d91e6f2d7091fe1850f._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		32 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-92bdcb014495140f8aca9d91e6f2d7091fe1850f._V2_.css
Requested by
Host: dhbfb.ml
URL: http://dhbfb.ml/1.html
Protocol
SPDY
Server
54.192.202.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-202-49.fra50.r.cloudfront.net
Software
Server /
Resource Hash
a35ce523d97474b43694a6e33939edeaa7fda55c4626c1fa0af4321e533cd98d

Request headers

Referer
http://dhbfb.ml/1.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 01 Dec 2017 02:20:33 GMT
content-encoding
gzip
last-modified
Tue, 28 Nov 2017 18:36:17 GMT
server
Server
age
17958020
status
200
x-cache
Hit from cloudfront
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
1e624475-c562-43f7-9fa1-0219e9c12baf
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
c9TIGRO2iwSaxNQPlOireF5tRDkJPH0EcX1wwHRmHL7Sz68IovDxxw==
via
1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
expires
Mon, 23 Nov 2037 22:50:39 GMT
CVFAssets-e91ba5c6e67c58c7f9c4c413fa67697feade389e._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/CVFAssets-e91ba5c6e67c58c7f9c4c413fa67697feade389e._V2_.css
Requested by
Host: dhbfb.ml
URL: http://dhbfb.ml/1.html
Protocol
SPDY
Server
54.192.202.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-202-49.fra50.r.cloudfront.net
Software
Server /
Resource Hash
ac6c8a640f5b8fea68c8aeaaad4e145c8261be36ba09df844e4121fb69e90cc7

Request headers

Referer
http://dhbfb.ml/1.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Feb 2018 05:56:45 GMT
content-encoding
gzip
last-modified
Mon, 16 Oct 2017 21:31:50 GMT
server
Server
age
11361562
status
200
x-cache
Hit from cloudfront
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
32614ec4-ed8d-4170-a86a-99bd38c3b627
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
FjN7JSmNzq3XOozm0EYMIWgsbUgp5_MlDBGnCdIcOhfxj1XLdNl7dg==
via
1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
expires
Sun, 29 Nov 2037 03:05:38 GMT
fwcim._CB513229088_.js
images-na.ssl-images-amazon.com/images/G/03/x-locale/common/login/ 		383 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/03/x-locale/common/login/fwcim._CB513229088_.js
Requested by
Host: dhbfb.ml
URL: http://dhbfb.ml/1.html
Protocol
SPDY
Server
54.192.202.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-202-49.fra50.r.cloudfront.net
Software
Server /
Resource Hash
c854c61bda66041aa3f86a791e9606bddcd87ad170a6476c25207f27b966d8e9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://dhbfb.ml/1.html
Origin
http://dhbfb.ml

Response headers

date
Mon, 16 Oct 2017 20:19:30 GMT
content-encoding
gzip
last-modified
Mon, 16 Oct 2017 16:18:16 GMT
server
Server
age
21799599
status
200
x-cache
Hit from cloudfront
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
74c85784-a151-42a7-b240-953a9b7f1761
x-amz-cf-id
l-uQx2AxxBDnO1XhpDZV6Cyi5qd7x5nkhSeC7Kl6HCF0PTDWmYNxRQ==
via
1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
expires
Sun, 11 Oct 2037 20:19:30 GMT
AmazonUIBaseCSS-sprite_2x-8852bac7bd07ba976a42828c3641f6a896197566._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ 		56 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_2x-8852bac7bd07ba976a42828c3641f6a896197566._V2_.png
Requested by
Host: dhbfb.ml
URL: http://dhbfb.ml/1.html
Protocol
SPDY
Server
54.192.202.49 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-192-202-49.fra50.r.cloudfront.net
Software
Server /
Resource Hash
0d467a598012edc9929f7e1b9e44208ec07a7621d12ea7b92b1fea093c1d0812

Request headers

Referer
https://images-na.ssl-images-amazon.com/images/I/61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 28 May 2017 10:20:13 GMT
via
1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
last-modified
Thu, 15 Sep 2016 00:27:30 GMT
server
Server
age
11268210
status
200
x-cache
Hit from cloudfront
content-type
image/png; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
63029423-3856-4996-9356-8cde7fd7dce7
timing-allow-origin
https://www.amazon.com
content-length
57657
x-amz-cf-id
10Qpi1LPAxL_Yg_B-UIYrc1D2CVHTDHtbHmEa0vUX9eAVIYS5MQXag==
expires
Wed, 18 May 2033 03:33:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| cf boolean| __fwcimLoaded object| fwcim boolean| __fwcimShimProfileReady undefined| ue_mbl undefined| ue_pty undefined| ue_spty undefined| ue_adb function| Zepto function| $

0 Cookies