www.primuslife.in Open in urlscan Pro
192.185.139.36  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cirlo.php Show response www.primuslife.in/logo/Billing/update/amazon/mm/serv/	21 KB 7 KB	798ms 227ms	Document text/html	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash 15b4690410b7a48307ccaf2e9691f104d107b4702f83f1d4b810cb0d7327746d Request headers :method GET :authority www.primuslife.in :scheme https :path /logo/Billing/update/amazon/mm/serv/cirlo.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 date Sun, 27 Oct 2019 12:14:07 GMT server Apache vary Accept-Encoding content-encoding gzip content-length 7459 content-type text/html
GET H2	200	ap-flex-reduced-nav-2.1._V360593186_.css images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/	51 KB 8 KB	27ms 10ms	Stylesheet text/css	13.224.199.33 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ap-flex-reduced-nav-2.1._V360593186_.css Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.33 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-199-33.fra2.r.cloudfront.net Software Server / Resource Hash 233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 16 Oct 2019 17:03:22 GMT content-encoding gzip x-amz-cf-pop FRA2-C1 edge-cache-tag x-cache-301,/images/G/01/authportal/flex/reduced-nav/ap-flex-reduced-nav-2.1 status 200 x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-301 /images/G/01/authportal/flex/reduced-nav/ap-flex-reduced-nav-2.1 last-modified Tue, 25 Feb 2014 20:00:55 GMT server Server content-type text/css via 1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id f2c5f0cc-d808-40d2-9743-5b9721cc67a8 timing-allow-origin https://www.amazon.com x-amz-cf-id 3_hC3xkf2CU2jQSg-kskU4aObG3kfO_ZIlzXXLoNbQlqx66EErgzHw== expires Mon, 10 Oct 2039 18:17:45 GMT
GET H2	200	amazon_logo_no-org_mid._V153387053_.png images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/	1 KB 2 KB	23ms 7ms	Image image/png	13.224.199.33 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/amazon_logo_no-org_mid._V153387053_.png Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.33 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-199-33.fra2.r.cloudfront.net Software Server / Resource Hash 765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80 Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 17 Sep 2019 19:05:45 GMT via 1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront) age 220206 x-cache Hit from cloudfront status 200 content-length 1491 last-modified Thu, 25 Aug 2011 23:05:36 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 65c2d3c9-87f6-4241-a7b6-03359012ee95 x-amz-cf-pop FRA2-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id K_2lQM5Sav5rht0tyH8o3jFl_DrzaKP0C1z7Ptae0uieCZqIkBLm6Q== expires Fri, 22 Oct 2038 05:08:10 GMT
GET H2	404	screen.css www.primuslife.in/logo/Billing/update/amazon/mm/serv/css/	0 0	118ms 117ms	Stylesheet text/html	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/css/screen.css Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 12:14:07 GMT content-encoding gzip last-modified Tue, 23 Jul 2019 13:35:48 GMT server Apache vary Accept-Encoding content-type text/html status 404 accept-ranges bytes content-length 4677
GET H2	200	jquery.js Show response www.primuslife.in/logo/Billing/update/amazon/mm/serv/lib/	114 KB 43 KB	123ms 123ms	Script application/javascript	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/lib/jquery.js Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash 5c44ebfc4b86e80fad397c5fb99fc35a0a97bbf6793dd295b224e46ea9bf2393 Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 12:14:07 GMT content-encoding gzip last-modified Sat, 26 Oct 2019 12:08:12 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes
GET H2	200	jquery.validate.js Show response www.primuslife.in/logo/Billing/update/amazon/mm/serv/	36 KB 12 KB	228ms 228ms	Script application/javascript	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/jquery.validate.js Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash 12f44f7eae1ec755d69303c4c1a6dd1e289c85dbea4a27b4a4343f5f2e1def26 Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 12:14:07 GMT content-encoding gzip last-modified Sat, 26 Oct 2019 12:08:09 GMT server Apache vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes content-length 12148
GET H2	404	cmxforms.js www.primuslife.in/logo/Billing/update/amazon/mm/serv/js/	0 0	228ms 227ms	Script text/html	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/js/cmxforms.js Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 12:14:07 GMT content-encoding gzip last-modified Tue, 23 Jul 2019 13:35:48 GMT server Apache vary Accept-Encoding content-type text/html status 404 accept-ranges bytes content-length 4677
GET H2	200	error-sprite.gif images-na.ssl-images-amazon.com/images/G/01/x-locale/common/errors-alerts/	2 KB 3 KB	6ms 6ms	Image image/gif	13.224.199.33 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/x-locale/common/errors-alerts/error-sprite.gif Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.33 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-199-33.fra2.r.cloudfront.net Software Server / Resource Hash 65fb0d927462babb4af3693d6c9e26100ac43359692cb828af45cd8c9716bac6 Request headers Sec-Fetch-Mode no-cors Referer https://images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ap-flex-reduced-nav-2.1._V360593186_.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 09:37:59 GMT via 1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront) last-modified Thu, 03 Jun 2010 01:49:58 GMT server Server age 46246 status 200 x-cache Hit from cloudfront content-type image/gif access-control-allow-origin * cache-control max-age=86400,public x-amz-ir-id 3305d26e-79c7-431e-9d62-6ed8b01a7d54 x-amz-cf-pop FRA2-C1 content-length 2352 x-amz-cf-id dCNS8ZPbhyjynnmWMZa3yZExiRr06HRgHSrj8eA9stuD6KDmWAJG-Q== expires Wed, 16 Oct 2019 22:26:33 GMT
GET H2	404	cmxforms.js www.primuslife.in/logo/Billing/update/amazon/mm/serv/js/	0 0	116ms 116ms	Script text/html	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/js/cmxforms.js Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 12:14:08 GMT content-encoding gzip last-modified Tue, 23 Jul 2019 13:35:48 GMT server Apache vary Accept-Encoding content-type text/html status 404 accept-ranges bytes content-length 4677
GET H2	200	amznbtn-sprite03._V395592492_.png images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/	42 KB 43 KB	9ms 8ms	Image image/png	13.224.199.33 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/amznbtn-sprite03._V395592492_.png Requested by Host: www.primuslife.in URL: https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.33 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-199-33.fra2.r.cloudfront.net Software Server / Resource Hash c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a Request headers Sec-Fetch-Mode no-cors Referer https://images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ap-flex-reduced-nav-2.1._V360593186_.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 21 Oct 2019 22:54:20 GMT via 1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront) age 211234 edge-cache-tag x-cache-239,/images/G/01/authportal/common/images/amznbtn-sprite03 status 200 x-cache Hit from cloudfront content-length 43438 surrogate-key x-cache-239 /images/G/01/authportal/common/images/amznbtn-sprite03 last-modified Thu, 27 Sep 2012 21:16:59 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 0bfea249-fcb8-4344-9cb3-b396fd0343e8 x-amz-cf-pop FRA2-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id L_5uARShPeTqw3FKnZsx7h1Xiw2nwsmFD9NEAnhFlo8nvt3EUUmwYA== expires Thu, 13 Oct 2039 05:21:28 GMT
GET H2	404	uedata www.primuslife.in/ap/	12 KB 12 KB	123ms 123ms	Image text/html	192.185.139.36 Unified Layer
General Check archive.org Show headers Download Go to Show image Full URL https://www.primuslife.in/ap/uedata?ld&v=28&id=1RSWXCRPY9818YC3TWGS&m=1&sc=1RSWXCRPY9818YC3TWGS&ue=1&bb=27&cf=464&af=464&pc=471&tc=-818&na_=-818&fe_=-818&lk_=-817&_lk=-469&co_=-469&_co=-247&sc_=-360&rq_=-247&rs_=-20&_rs=-19&dl_=-3&di_=464&de_=464&_de=470&_dc=470&ld_=470&ty=0&rc=0&hob=0&hoe=1&ld=471&t=1572178448324&ctb=1&csmtags=nonredirect|noAmznJQ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.185.139.36 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS 192-185-139-36.unifiedlayer.com Software Apache / Resource Hash bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482 Request headers Sec-Fetch-Mode no-cors Referer https://www.primuslife.in/logo/Billing/update/amazon/mm/serv/cirlo.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 27 Oct 2019 12:14:08 GMT content-encoding gzip last-modified Tue, 23 Jul 2019 13:35:48 GMT server Apache vary Accept-Encoding content-type text/html status 404 accept-ranges bytes content-length 4677

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate number| ue_t0 string| ue_id object| ue_csm string| ue_url string| ue_pr string| ue_md number| ue_navtiming string| ue_mid string| ue_sid string| ue_furl number| ue_hob number| ueinit object| ue function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop number| ue_hoe function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-na.ssl-images-amazon.com
www.primuslife.in
13.224.199.33
192.185.139.36
12f44f7eae1ec755d69303c4c1a6dd1e289c85dbea4a27b4a4343f5f2e1def26
15b4690410b7a48307ccaf2e9691f104d107b4702f83f1d4b810cb0d7327746d
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
5c44ebfc4b86e80fad397c5fb99fc35a0a97bbf6793dd295b224e46ea9bf2393
65fb0d927462babb4af3693d6c9e26100ac43359692cb828af45cd8c9716bac6
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a