aaammazonm.temp.swtest.ru Open in urlscan Pro
77.222.57.10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://aaammazonm.temp.swtest.ru/Amazon/Billing.php
Submission: On February 03 via manual (February 3rd 2018, 10:50:54 am UTC) from US

Summary HTTP 18 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 77.222.57.10, located in Russian Federation and belongs to SWEB-AS, RU. The main domain is aaammazonm.temp.swtest.ru.

This is the only time aaammazonm.temp.swtest.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address		AS Autonomous System
18	77.222.57.10 77.222.57.10		44112 (SWEB-AS) (SWEB-AS)
18	1

18 77.222.57.10 (Russian Federation)

ASN44112 (SWEB-AS, RU)
PTR: vh252.sweb.ru

aaammazonm.temp.swtest.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	swtest.ru aaammazonm.temp.swtest.ru	221 KB
18	1

	Domain	Requested by
18	aaammazonm.temp.swtest.ru	aaammazonm.temp.swtest.ru
18	1

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php
Frame ID: (46D610C46302D1044932FC6B56F76122)
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

18
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

221 kB
Transfer

411 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.amazon.com/gp/feature.html/ref=nav_sap_clddrive_1a?ie=UTF8&docId=1000796931

Search URL Search Domain Scan URL

URL: http://www.amazon.com/b/ref=nav_sap_audible_a?ie=UTF8&node=2402172011

Search URL Search Domain Scan URL

URL: http://www.amazon.com/New-Future-Releases/b/ref=nav_sap_vg_sony?ie=UTF8&node=496994

Search URL Search Domain Scan URL

URL: http://www.amazon.com/Women-Clothing/b/ref=nav_sap_clothing_image?ie=UTF8&node=1040660

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Billing.php Show response aaammazonm.temp.swtest.ru/Amazon/	124 KB 26 KB	159ms 97ms	Document text/html	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / PHP/5.6.30-pl0-gentoo Resource Hash `2e2a22a3cf6b4da3a209f49719b994257a7359a31ec5558ac9123ce0acfb38ba` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Server nginx/1.9.12 X-Powered-By PHP/5.6.30-pl0-gentoo Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	site-wide-a04329._V1_.css aaammazonm.temp.swtest.ru/Amazon/content/	31 KB 7 KB	118ms 65ms	Stylesheet text/css	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/content/site-wide-a04329._V1_.css Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `10765b5e83a4ccbc5edbfcc4f3ada63b02c76cc1d29c21f1202fc54bd018710c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Last-Modified Tue, 10 Jul 2012 07:44:36 GMT Server nginx/1.9.12 ETag W/"ff5c42-7dec-4c474e6e72100" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	BeaconSprite-US-01._V141013396_.png aaammazonm.temp.swtest.ru/Amazon/content/	6 KB 6 KB	133ms 73ms	Image image/png	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://aaammazonm.temp.swtest.ru/Amazon/content/BeaconSprite-US-01._V141013396_.png Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `4514d4d04b4644de38864be5ac0c945f94eec540dcef27061330658e46d848a9` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Last-Modified Tue, 10 Jul 2012 07:54:14 GMT Server nginx/1.9.12 ETag "ff5c02-1804-4c475095ab580" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 6148
GET H/1.1	200 OK	transparent-pixel._V192234675_.gif aaammazonm.temp.swtest.ru/Amazon/content/	43 B 315 B	67ms 67ms	Image image/gif	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://aaammazonm.temp.swtest.ru/Amazon/content/transparent-pixel._V192234675_.gif Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Last-Modified Tue, 10 Jul 2012 07:54:22 GMT Server nginx/1.9.12 ETag "ff5c54-2b-4c47509d4c780" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 43
GET H/1.1	404 Not Found	jquery.min.js aaammazonm.temp.swtest.ru/js/	0 0	104ms 100ms	Script text/html	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/js/jquery.min.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Server nginx/1.9.12 Vary Accept-Encoding accept-language,accept-charset Content-Language en Transfer-Encoding chunked Connection keep-alive Content-Type text/html; charset=iso-8859-1 Keep-Alive timeout=10
GET H/1.1	404 Not Found	jquery.payment.js aaammazonm.temp.swtest.ru/js/	0 0	87ms 82ms	Script text/html	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/js/jquery.payment.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Server nginx/1.9.12 Vary Accept-Encoding accept-language,accept-charset Content-Language en Transfer-Encoding chunked Connection keep-alive Content-Type text/html; charset=iso-8859-1 Keep-Alive timeout=10
GET H/1.1	404 Not Found	app.css aaammazonm.temp.swtest.ru/css/	0 0	107ms 94ms	Stylesheet text/html	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/css/app.css Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Server nginx/1.9.12 Vary Accept-Encoding accept-language,accept-charset Content-Language en Transfer-Encoding chunked Connection keep-alive Content-Type text/html; charset=iso-8859-1 Keep-Alive timeout=10
GET H/1.1	200 OK	check.css aaammazonm.temp.swtest.ru/Amazon/files_billing2/css/	2 KB 845 B	119ms 60ms	Stylesheet text/css	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/css/check.css Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `225976876db56a2d0a97954d4c2afeec6e88458a7645a418d1cebcc264bf6e34` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Last-Modified Tue, 07 Feb 2017 14:40:04 GMT Server nginx/1.9.12 ETag W/"ff5c5d-766-547f1b93c9900" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	jquery.min.js Show response aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/	82 KB 29 KB	103ms 87ms	Script application/x-javascript	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/jquery.min.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Last-Modified Sun, 11 Sep 2016 05:50:58 GMT Server nginx/1.9.12 ETag W/"ff5c84-14960-53c34f6ac3480" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	jquery.maskedinput.js Show response aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/	10 KB 3 KB	114ms 81ms	Script application/x-javascript	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/jquery.maskedinput.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Last-Modified Sat, 10 Sep 2016 12:50:06 GMT Server nginx/1.9.12 ETag W/"ff5c83-284d-53c26b3c4db80" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	ccFormat.js Show response aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/	3 KB 1 KB	73ms 61ms	Script application/x-javascript	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/ccFormat.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `5faf5783b8c3c6171e1727fd32976ccd629925c5e978278b18e49d090067d4d1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Last-Modified Sun, 11 Sep 2016 07:46:36 GMT Server nginx/1.9.12 ETag W/"ff5c7f-dbc-53c369435af00" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	jquery.creditCardValidator.js Show response aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/	8 KB 3 KB	74ms 71ms	Script application/x-javascript	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/js/jquery.creditCardValidator.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Last-Modified Sat, 08 Oct 2016 09:00:42 GMT Server nginx/1.9.12 ETag W/"ff5c82-21b1-53e56c2ed6280" Vary Accept-Encoding Content-Type application/x-javascript Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=10
GET H/1.1	200 OK	cc-lRj.png aaammazonm.temp.swtest.ru/Amazon/	119 KB 119 KB	67ms 67ms	Image image/png	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://aaammazonm.temp.swtest.ru/Amazon/cc-lRj.png Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `1593def2db87b53e2a57e58ceb6a45be663861602ff57704f7e0c343bc64511e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Last-Modified Fri, 27 Jan 2017 14:49:28 GMT Server nginx/1.9.12 ETag "ff5bf4-1da81-5471492996e00" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 121473
GET H/1.1	200 OK	confirm-card._V17236_.png aaammazonm.temp.swtest.ru/Amazon/content/	2 KB 2 KB	58ms 58ms	Image image/png	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://aaammazonm.temp.swtest.ru/Amazon/content/confirm-card._V17236_.png Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `b924ce130dc972a751e5bd741fb35cd7cb8d7a94894916d941f48e35abddf5dc` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Last-Modified Wed, 11 Jul 2012 11:32:38 GMT Server nginx/1.9.12 ETag "ff5c0b-877-4c48c34414180" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 2167
GET H/1.1	200 OK	navAmazonLogoFooter._V169459313_.gif aaammazonm.temp.swtest.ru/Amazon/content/	1 KB 1 KB	82ms 82ms	Image image/gif	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://aaammazonm.temp.swtest.ru/Amazon/content/navAmazonLogoFooter._V169459313_.gif Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `bde31848f3c02d44b188927f63b8724262cf12a30a2bef988f81698ecbbf5790` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Last-Modified Tue, 10 Jul 2012 08:48:30 GMT Server nginx/1.9.12 ETag "ff5c23-4c0-4c475cb6d5380" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 1216
GET H/1.1	404 Not Found	jquery.payment.js aaammazonm.temp.swtest.ru/js/	0 0	86ms 83ms	Script text/html	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/js/jquery.payment.js Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Server nginx/1.9.12 Vary Accept-Encoding accept-language,accept-charset Content-Language en Transfer-Encoding chunked Connection keep-alive Content-Type text/html; charset=iso-8859-1 Keep-Alive timeout=10
GET H/1.1	404 Not Found	app.css aaammazonm.temp.swtest.ru/css/	0 0	86ms 86ms	Stylesheet text/html	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Full URL http://aaammazonm.temp.swtest.ru/css/app.css Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/Billing.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Content-Encoding gzip Server nginx/1.9.12 Vary Accept-Encoding accept-language,accept-charset Content-Language en Transfer-Encoding chunked Connection keep-alive Content-Type text/html; charset=iso-8859-1 Keep-Alive timeout=10
GET H/1.1	200 OK	images.png aaammazonm.temp.swtest.ru/Amazon/files_billing2/css/	22 KB 22 KB	71ms 71ms	Image image/png	77.222.57.10 SWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/css/images.png Requested by Host: aaammazonm.temp.swtest.ru URL: http://aaammazonm.temp.swtest.ru/Amazon/Billing.php Protocol HTTP/1.1 Server 77.222.57.10 , Russian Federation, ASN44112 (SWEB-AS, RU), Reverse DNS vh252.sweb.ru Software nginx/1.9.12 / Resource Hash `1a5946139fa91b58210d45b2e89ea7cba00f9b89b79cddf5faf95055033baeb8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host aaammazonm.temp.swtest.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/css/check.css Connection keep-alive Cache-Control no-cache Referer http://aaammazonm.temp.swtest.ru/Amazon/files_billing2/css/check.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sat, 03 Feb 2018 10:50:43 GMT Last-Modified Sun, 11 Sep 2016 06:41:44 GMT Server nginx/1.9.12 ETag "ff5c5f-5795-53c35ac3a7a00" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 22421

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aaammazonm.temp.swtest.ru
77.222.57.10
10765b5e83a4ccbc5edbfcc4f3ada63b02c76cc1d29c21f1202fc54bd018710c
1593def2db87b53e2a57e58ceb6a45be663861602ff57704f7e0c343bc64511e
1a5946139fa91b58210d45b2e89ea7cba00f9b89b79cddf5faf95055033baeb8
225976876db56a2d0a97954d4c2afeec6e88458a7645a418d1cebcc264bf6e34
2e2a22a3cf6b4da3a209f49719b994257a7359a31ec5558ac9123ce0acfb38ba
4514d4d04b4644de38864be5ac0c945f94eec540dcef27061330658e46d848a9
5faf5783b8c3c6171e1727fd32976ccd629925c5e978278b18e49d090067d4d1
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
b924ce130dc972a751e5bd741fb35cd7cb8d7a94894916d941f48e35abddf5dc
bde31848f3c02d44b188927f63b8724262cf12a30a2bef988f81698ecbbf5790
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079

aaammazonm.temp.swtest.ru Open in urlscan Pro 77.222.57.10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

18 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

221 kBTransfer

411 kBSize

0 Cookies

4 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

Indicators

aaammazonm.temp.swtest.ru Open in urlscan Pro
77.222.57.10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

221 kB
Transfer

411 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!