104.131.69.126 - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 104.131.69.126, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is 104.131.69.126.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 15th 2021. Valid for: 3 months.

This is the only time 104.131.69.126 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	104.131.69.126 104.131.69.126	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	151.101.1.16 151.101.1.16	54113 (FASTLY) (FASTLY)
6	2

4 104.131.69.126 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

104.131.69.126	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.1.16 (United States)

ASN54113 (FASTLY, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	media-amazon.com m.media-amazon.com	31 KB
6	1

	Domain	Requested by
2	m.media-amazon.com	104.131.69.126
6	1

This site contains no links.

Subject Issuer	Validity	Valid
ca-amz.duckdns.org cPanel, Inc. Certification Authority	`2021-10-15` - `2022-01-13`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213
Frame ID: DFFC2F7C4006EF746977540325B12B25
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazonサインイン

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

33 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

218 kB
Transfer

216 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set signin.php Show response 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/	16 KB 17 KB	299ms 116ms	Document text/html	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `a86ce34d4c7adf07d92b845036e2211fe3106ebd0b6e5573f36e5b3eb59cb86b` Request headers Host 104.131.69.126 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Sat, 16 Oct 2021 03:41:56 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=5215e1862ec050e382b7d4fbbf104068; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	61givtVz9L.css 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/	131 KB 131 KB	156ms 90ms	Stylesheet text/css	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/61givtVz9L.css Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `7fb657d49094a6235f8ba8ff8f7c862dbedc8afd58a7e95c3aa0beb9e913a615` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 104.131.69.126 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Cookie PHPSESSID=5215e1862ec050e382b7d4fbbf104068 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:41:56 GMT Last-Modified Wed, 23 Jun 2021 21:57:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 133845
GET H/1.1	200 OK	01SdjaY0ZsL.css 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/	36 KB 36 KB	269ms 90ms	Stylesheet text/css	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/01SdjaY0ZsL.css Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 104.131.69.126 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Cookie PHPSESSID=5215e1862ec050e382b7d4fbbf104068 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:41:56 GMT Last-Modified Wed, 23 Jun 2021 21:57:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 36434
GET H/1.1	200 OK	11qeL1AgUGL.css 104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/	2 KB 3 KB	270ms 91ms	Stylesheet text/css	104.131.69.126 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/11qeL1AgUGL.css Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.131.69.126 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host 104.131.69.126 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 Cookie PHPSESSID=5215e1862ec050e382b7d4fbbf104068 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/signin.php?106.129.61.213 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sat, 16 Oct 2021 03:41:56 GMT Last-Modified Wed, 23 Jun 2021 21:57:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2460
GET H2	200	mPGmT0r6IeTyIee.png m.media-amazon.com/images/S/sash/	27 KB 28 KB	50ms 14ms	Image image/png	151.101.1.16 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/61givtVz9L.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin https://www.amazon.in, https://www.amazon.com date Sat, 16 Oct 2021 03:41:56 GMT last-modified Tue, 17 Nov 2020 23:31:33 GMT age 5607040 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT access-control-allow-origin * expires Sat, 25 May 2041 21:08:11 GMT cache-control max-age=630720000,public x-amz-ir-id 11644a82-494e-473e-9b04-47fb012f217a accept-ranges bytes content-type image/png content-length 27972 x-served-by cache-dca17772-DCA, cache-hhn4081-HHN
GET H2	200	EYzhM86N6ZcDPtA.png m.media-amazon.com/images/S/sash/	4 KB 4 KB	53ms 18ms	Image image/png	151.101.1.16 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/EYzhM86N6ZcDPtA.png Requested by Host: 104.131.69.126 URL: https://104.131.69.126/cpsess85741644/index.html/rontend/lemanage/paper_lantern/public_htm/amztiboot-text/files/61givtVz9L.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers Accept-Language de-DE,de;q=0.9 Referer https://104.131.69.126/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin https://www.amazon.in, https://www.amazon.com date Sat, 16 Oct 2021 03:41:56 GMT last-modified Tue, 17 Nov 2020 23:31:29 GMT age 838704 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT access-control-allow-origin * expires Mon, 23 Sep 2041 18:22:53 GMT cache-control max-age=630720000,public x-amz-ir-id 0f26868c-f8c9-4e49-8eac-4ea1c3d5e7ee accept-ranges bytes content-type image/png content-length 3589 x-served-by cache-dca17723-DCA, cache-hhn4081-HHN

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			104.131.69.126/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5215e1862ec050e382b7d4fbbf104068

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.media-amazon.com
104.131.69.126
151.101.1.16
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
7fb657d49094a6235f8ba8ff8f7c862dbedc8afd58a7e95c3aa0beb9e913a615
8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
a86ce34d4c7adf07d92b845036e2211fe3106ebd0b6e5573f36e5b3eb59cb86b
db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03

104.131.69.126 Open in urlscan Pro 104.131.69.126 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

33 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

218 kBTransfer

216 kBSize

1 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

104.131.69.126 Open in urlscan Pro
104.131.69.126 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

33 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

218 kB
Transfer

216 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!