refund-order.com
Open in
urlscan Pro
185.248.86.142
Malicious Activity!
Public Scan
URL:
https://refund-order.com/
Submission: On August 08 via automatic, source certstream-suspicious — Scanned from GB
Submission: On August 08 via automatic, source certstream-suspicious — Scanned from GB
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 12 HTTP transactions.
The main IP is 185.248.86.142, located in
London, United Kingdom and
belongs to XTOM xTom GmbH, DE.
The main domain is refund-order.com.
TLS certificate: Issued by R3 on August 8th 2023. Valid for: 3 months.
This is the only time refund-order.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 8th 2023. Valid for: 3 months.
This is the only time refund-order.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 185.248.86.142 185.248.86.142 | 3214 (XTOM xTom...) (XTOM xTom GmbH) | |
| 1 | 157.119.103.161 157.119.103.161 | 9312 (XTOM xTom) (XTOM xTom) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 12 | 3 |
10
185.248.86.142
(London, United Kingdom)
ASN3214 (XTOM xTom GmbH, DE)
PTR: s19860.vps.hosting
ASN3214 (XTOM xTom GmbH, DE)
PTR: s19860.vps.hosting
| refund-order.com |
1
157.119.103.161
(Hong Kong)
ASN9312 (XTOM xTom, HK)
PTR: s19861.vps.hosting
ASN9312 (XTOM xTom, HK)
PTR: s19861.vps.hosting
| xiaopang.lion-admin-panel.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
refund-order.com
refund-order.com |
80 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 729 |
30 KB |
| 1 |
lion-admin-panel.com
xiaopang.lion-admin-panel.com |
345 B |
| 12 | 3 |
| Domain | Requested by | |
|---|---|---|
| 10 | refund-order.com |
refund-order.com
|
| 1 | code.jquery.com |
refund-order.com
|
| 1 | xiaopang.lion-admin-panel.com |
refund-order.com
|
| 12 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| refund-order.com R3 |
2023-08-08 - 2023-11-06 |
3 months | crt.sh |
| xiaopang.lion-admin-panel.com R3 |
2023-08-07 - 2023-11-05 |
3 months | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://refund-order.com/
Frame ID: 3AD73348D7AD1399F11004D51D2601D5
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Amazon Order Refund Request ConfirmationDetected technologies
Vue.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://www.amazon.com/gp/help/customer/display.html?nodeId=508088&ref_=navm_ftr_cou
Title: Conditions of Use
Title: Conditions of Use
Search URL Search Domain Scan URL
URL: https://www.amazon.com/gp/help/customer/display.html?ie=UTF8&nodeId=468496&ref_=footer_privacy
Title: Privacy Notice
Title: Privacy Notice
Search URL Search Domain Scan URL
URL: https://www.amazon.com/privacyprefs?ref_=footer_iba
Title: Your Ads Privacy Choices
Title: Your Ads Privacy Choices
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
refund-order.com/ |
852 B 1005 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loading.gif
refund-order.com/static/image/ |
29 KB 29 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
config.js
refund-order.com/static/js/ |
727 B 940 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
axios.js
refund-order.com/static/js/ |
42 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
data.js
refund-order.com/static/js/ |
1 KB 883 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
token
xiaopang.lion-admin-panel.com//api/v2/ |
78 B 345 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.2fcac2dc.css
refund-order.com/static/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
AuInfo.27a6e055.css
refund-order.com/static/css/ |
1 KB 720 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.978ab36a.css
refund-order.com/static/css/ |
536 B 739 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.7.0.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
axios.js
refund-order.com/static/js/ |
42 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
new-nav-sprite-global-2x_blueheaven-account._CB658093420_.3b48af91.png
refund-order.com/static/image/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| url function| axios function| $ function| jQuery function| next0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
refund-order.com
xiaopang.lion-admin-panel.com
157.119.103.161
185.248.86.142
2001:4de0:ac18::1:a:3a
08e15b8629275252f4223ac8f2f02e507bfba8c0de199038e020505ff4996515
245bbc018dac02f9f363670178dd44f3dac21f70db671aca9570a439e076bec5
27a6e055df2405e94d1b96cf9f7ab4caea48150c993dbeda1e996d636d3d52a9
3b48af9153e92423d79f2d3bdc3e0b15e482ceb87e5c3ce3af5bd6f593cead9d
96b65382c74cd6255d4628044c5394f2ef3f0662d7d72b10f1bceb50b6ee5455
978ab36a9e16990e2ea4facfc41a17b068323cc117291cd5b6a469b79e83ae42
a0de8a2079d7308c89e938a6dae2af95a1fc8b22d02d4a88c97dabeab6aef436
cc2614f8ca1174882e32462dfb568fe839dd8f577568b66bc1cc3d0b1f2efbb0
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
ed8c99acb5a2c94b3d50e309a629b6a796be1a824f4e802ceee420385ab8055b
fcad14a4b51c1b7825cf99338656d1a01e845a3531095251becb874cf6e101f9