urlscan.io logo urlscan.io
SecurityTrails logo

cosmicountry.com Open in urlscan Pro
169.62.177.170  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/
Effective URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php
Submission Tags: 7005838
Submission: On March 08 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 19 HTTP transactions. The main IP is 169.62.177.170, located in United States and belongs to SOFTLAYER, US. The main domain is cosmicountry.com.
This is the only time cosmicountry.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 6 103.86.130.98 133169 (UNIVERISI...)
1 11 169.62.177.170 36351 (SOFTLAYER)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
19 4
Apex Domain
Subdomains		 Transfer
11 cosmicountry.com
cosmicountry.com
1 MB
6 unimap.edu.my
isetech.unimap.edu.my
20 KB
3 gstatic.com
fonts.gstatic.com
44 KB
1 googleapis.com
fonts.googleapis.com
837 B
19 4
Domain Requested by
11 cosmicountry.com 1 redirects cosmicountry.com
6 isetech.unimap.edu.my 1 redirects isetech.unimap.edu.my
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com cosmicountry.com
19 4

This site contains no links.

Subject Issuer Validity Valid
*.unimap.edu.my
Go Daddy Secure Certificate Authority - G2		 2020-09-23 -
2021-10-25		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-02-17 -
2021-05-12		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2021-02-17 -
2021-05-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php
Frame ID: 2296F18226DF259CC8296A458F4ECA6D
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/ HTTP 302
    https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4N... Page URL
  2. http://cosmicountry.com/inc/.amz/ HTTP 302
    http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php Page URL

Page Statistics

19
Requests

47 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1482 kB
Transfer

1513 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/ HTTP 302
    https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA== Page URL
  2. http://cosmicountry.com/inc/.amz/ HTTP 302
    http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/ HTTP 302
  • https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
check.php
isetech.unimap.edu.my/wp-includes/css/dist/.Reset/
Redirect Chain
  • https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/
  • https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
743 B
857 B 		Document
General
Check archive.org
Download Go to
Full URL
https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.86.130.98 Arau, Malaysia, ASN133169 (UNIVERISITYMALAYSIAPERLIS-AS-AP University Malaysia Perlis, MY),
Reverse DNS
Software
Microsoft IIS / PHP/5.6.27
Resource Hash
62a50d1895db2b6ee3db04c4bc4cf8797e6eb139c51638bd2143bcb9b6efb5df

Request headers

Host
isetech.unimap.edu.my
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
noedit=true; PHPSESSID=d8hsi8ur1esf6mpjcrkfji6ot3; qstoken=KrsXBZlUYq1tM8ElJmvJ4Q
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:12 GMT
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Powered-By
PHP/5.6.27
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Server
Microsoft IIS
Content-Encoding
gzip

Redirect headers

Date
Mon, 08 Mar 2021 00:39:12 GMT
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.6.27
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
noedit=true; path=/ PHPSESSID=d8hsi8ur1esf6mpjcrkfji6ot3; path=/ qstoken=KrsXBZlUYq1tM8ElJmvJ4Q; expires=Wed, 11-Feb-2026 00:39:12 GMT; path=/; domain=.unimap.edu.my
Location
check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
Server
Microsoft IIS
41g6zWH.js
isetech.unimap.edu.my/ 		32 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://isetech.unimap.edu.my/41g6zWH.js
Requested by
Host: isetech.unimap.edu.my
URL: https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.86.130.98 Arau, Malaysia, ASN133169 (UNIVERISITYMALAYSIAPERLIS-AS-AP University Malaysia Perlis, MY),
Reverse DNS
Software
Microsoft IIS /
Resource Hash
89e9be37215928511cf5fb90c5b7de0d1924dce51718a81e4629fc4061132fe6

Request headers

Referer
https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Mar 2021 23:08:45 UTC
Server
Microsoft IIS
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=300, must-revalidate, proxy-revalidate, public
Transfer-Encoding
chunked
Connection
keep-alive
rgyyL1Y7bOKH8ILW2fwwoA.html
isetech.unimap.edu.my/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://isetech.unimap.edu.my/rgyyL1Y7bOKH8ILW2fwwoA.html
Requested by
Host: isetech.unimap.edu.my
URL: https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.86.130.98 Arau, Malaysia, ASN133169 (UNIVERISITYMALAYSIAPERLIS-AS-AP University Malaysia Perlis, MY),
Reverse DNS
Software
Microsoft IIS /
Resource Hash
c12ad130f65d3fa1b26ef2ad375e67b2d00162f10584d953474fcc3d0043554f

Request headers

Referer
https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Mar 2021 8:44:31 UTC
Server
Microsoft IIS
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=300, must-revalidate, proxy-revalidate, public
Transfer-Encoding
chunked
Connection
keep-alive
commonstyles.css
isetech.unimap.edu.my/ 		110 B
378 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://isetech.unimap.edu.my/commonstyles.css
Requested by
Host: isetech.unimap.edu.my
URL: https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.86.130.98 Arau, Malaysia, ASN133169 (UNIVERISITYMALAYSIAPERLIS-AS-AP University Malaysia Perlis, MY),
Reverse DNS
Software
Microsoft IIS /
Resource Hash
cd2b0ca9c6b1610529baa69195d9911d7caa4153ea3f83f71658acbf6c6a25f8

Request headers

Referer
https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:13 GMT
Content-Encoding
gzip
Server
Microsoft IIS
Vary
Accept-Encoding
Content-Type
text/css
Cache-control
private, max-age=180, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
cart1.2.js
isetech.unimap.edu.my/ 		417 B
616 B 		Script
General
Check archive.org
Download Go to
Full URL
https://isetech.unimap.edu.my/cart1.2.js
Requested by
Host: isetech.unimap.edu.my
URL: https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
103.86.130.98 Arau, Malaysia, ASN133169 (UNIVERISITYMALAYSIAPERLIS-AS-AP University Malaysia Perlis, MY),
Reverse DNS
Software
Microsoft IIS /
Resource Hash
7ab8a732ca70d690bcecc170ecf44a9a15bdea2d51064e09af894195b6674243

Request headers

Referer
https://isetech.unimap.edu.my/wp-includes/css/dist/.Reset/check.php?newtoken=MTYxNTE2NDU4NDQxYTU1ZmJhNzQ4NDZiMzdlZmUyNzNhMzNkN2RiODI1NjY0ZmJiMTE4ZTM4NmEzYmI3MjI1OTY3MmViOTJkMTU3M2UyODhlOA==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:13 GMT
Content-Encoding
gzip
Last-Modified
Fri, 05 Mar 2021 24:48:18 UTC
Server
Microsoft IIS
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=300, must-revalidate, proxy-revalidate, public
Transfer-Encoding
chunked
Connection
keep-alive
Primary Request login.php
cosmicountry.com/inc/.amz/3176cc5bb4ea90a/
Redirect Chain
  • http://cosmicountry.com/inc/.amz/?
  • http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
8da6ecbef2e0389a7e1c5f6d969ecc05668395f7f25cc5ed9296f53d579aa085

Request headers

Host
cosmicountry.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
PHPSESSID=6988113956fbeb5faee91e4ae4c76110
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Mon, 08 Mar 2021 00:39:45 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=6988113956fbeb5faee91e4ae4c76110; path=/
location
3176cc5bb4ea90a/login.php?#signin
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
bootstrap.min.css
cosmicountry.com/inc/.amz/assets/css/ 		152 KB
152 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/css/bootstrap.min.css
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 14 Feb 2019 04:01:40 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
155758
X-XSS-Protection
1; mode=block
helpers.css
cosmicountry.com/inc/.amz/assets/css/ 		41 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/css/helpers.css
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 27 Nov 2018 20:16:08 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
41752
X-XSS-Protection
1; mode=block
main.css
cosmicountry.com/inc/.amz/assets/css/ 		9 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/css/main.css
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
901f838d5b59ebe55df065fb021c4436b1170e2ece49af8d8b6a82359fef8333
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 26 Oct 2019 18:57:02 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
9064
X-XSS-Protection
1; mode=block
logo.png
cosmicountry.com/inc/.amz/assets/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cosmicountry.com/inc/.amz/assets/images/logo.png
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
184ad6c3c8381008e1a6a4a2d03e3e8937e162ad61d8a331159a09054b9afff1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:47 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 24 Oct 2019 12:42:06 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
8380
X-XSS-Protection
1; mode=block
jquery.min.js
cosmicountry.com/inc/.amz/assets/js/ 		86 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/js/jquery.min.js
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 12 Sep 2019 15:52:54 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
88145
X-XSS-Protection
1; mode=block
popper.min.js
cosmicountry.com/inc/.amz/assets/js/ 		20 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/js/popper.min.js
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 26 Nov 2018 16:02:46 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
20340
X-XSS-Protection
1; mode=block
bootstrap.min.js
cosmicountry.com/inc/.amz/assets/js/ 		59 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/js/bootstrap.min.js
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
ef7a91221d6cdcb18a99ce1a9093b0cfed274cbe47ea0e361d34ba748c45d882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:46 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 26 Oct 2019 18:32:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
60128
X-XSS-Protection
1; mode=block
fontawesome.min.js
cosmicountry.com/inc/.amz/assets/js/ 		1 MB
1 MB 		Script
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/js/fontawesome.min.js
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:47 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 26 Nov 2018 19:03:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1061198
X-XSS-Protection
1; mode=block
main.js
cosmicountry.com/inc/.amz/assets/js/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cosmicountry.com/inc/.amz/assets/js/main.js
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
Protocol
HTTP/1.1
Server
169.62.177.170 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
aa.b1.3ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
be3bbbd9f9e63f80510423a1c595ba446f91d3eedd09b8cf26306466fc06bc7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cosmicountry.com/inc/.amz/3176cc5bb4ea90a/login.php?
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 00:39:47 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 26 Oct 2019 18:51:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1414
X-XSS-Protection
1; mode=block
css
fonts.googleapis.com/ 		9 KB
837 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&display=swap
Requested by
Host: cosmicountry.com
URL: http://cosmicountry.com/inc/.amz/assets/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3ed154a0995f9a5597ccb3c567815c1222b7dd07843f761f700b9a9eb8cd3250
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://cosmicountry.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 07 Mar 2021 23:28:35 GMT
server
ESF
date
Mon, 08 Mar 2021 00:39:47 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 08 Mar 2021 00:39:47 GMT
mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://cosmicountry.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 04 Mar 2021 12:56:44 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:47 GMT
server
sffe
age
301383
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14880
x-xss-protection
0
expires
Fri, 04 Mar 2022 12:56:44 GMT
mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://cosmicountry.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 01 Mar 2021 18:15:32 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:11:00 GMT
server
sffe
age
541455
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15056
x-xss-protection
0
expires
Tue, 01 Mar 2022 18:15:32 GMT
mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://cosmicountry.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 04 Mar 2021 12:56:31 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:22 GMT
server
sffe
age
301396
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14380
x-xss-protection
0
expires
Fri, 04 Mar 2022 12:56:31 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator function| IsNumeric

1 Cookies

Domain/Path Name / Value
cosmicountry.com/ Name: PHPSESSID
Value: 6988113956fbeb5faee91e4ae4c76110

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cosmicountry.com
fonts.googleapis.com
fonts.gstatic.com
isetech.unimap.edu.my
103.86.130.98
169.62.177.170
2a00:1450:4001:800::2003
2a00:1450:4001:82a::200a
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
184ad6c3c8381008e1a6a4a2d03e3e8937e162ad61d8a331159a09054b9afff1
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
3ed154a0995f9a5597ccb3c567815c1222b7dd07843f761f700b9a9eb8cd3250
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
62a50d1895db2b6ee3db04c4bc4cf8797e6eb139c51638bd2143bcb9b6efb5df
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
7ab8a732ca70d690bcecc170ecf44a9a15bdea2d51064e09af894195b6674243
89e9be37215928511cf5fb90c5b7de0d1924dce51718a81e4629fc4061132fe6
8da6ecbef2e0389a7e1c5f6d969ecc05668395f7f25cc5ed9296f53d579aa085
901f838d5b59ebe55df065fb021c4436b1170e2ece49af8d8b6a82359fef8333
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
be3bbbd9f9e63f80510423a1c595ba446f91d3eedd09b8cf26306466fc06bc7a
c12ad130f65d3fa1b26ef2ad375e67b2d00162f10584d953474fcc3d0043554f
cd2b0ca9c6b1610529baa69195d9911d7caa4153ea3f83f71658acbf6c6a25f8
ef7a91221d6cdcb18a99ce1a9093b0cfed274cbe47ea0e361d34ba748c45d882
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765