onewayticketphil.com Open in urlscan Pro
185.199.109.153  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response onewayticketphil.com/targus-small-tripod/	6 KB 2 KB	33ms 9ms	Document text/html	185.199.109.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://onewayticketphil.com/targus-small-tripod/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.199.109.153 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS cdn-185-199-109-153.github.com Software GitHub.com / Resource Hash 2cd3c0114f4ac036248d20af4f3183f3f30fb60eb77cd72cc1bc2b1eb42f3821 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers accept-ranges bytes access-control-allow-origin * age 534 cache-control max-age=600 content-encoding gzip content-length 1912 content-type text/html; charset=utf-8 date Sun, 18 Aug 2024 01:07:42 GMT etag W/"5eac3d97-161c" expires Wed, 07 Aug 2024 07:09:35 GMT last-modified Fri, 01 May 2020 15:17:43 GMT server GitHub.com vary Accept-Encoding via 1.1 varnish x-cache HIT x-cache-hits 0 x-fastly-request-id 22570df4c81cc786a80d1fdff696b3e099d28da9 x-github-request-id 959D:1E534E:36E9540:385D3A5:66B31B57 x-proxy-cache MISS x-served-by cache-fra-eddf8230120-FRA x-timer S1723943263.504542,VS0,VE1
GET H2	200	AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	165 KB 21 KB	44ms 11ms	Stylesheet text/css	2a02:26f0:3500:12::1730:17bc AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Requested by Host: onewayticketphil.com URL: https://onewayticketphil.com/targus-small-tripod/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:12::1730:17bc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Server / Resource Hash 5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Sun, 18 Aug 2024 01:07:42 GMT content-encoding br akamai-cache-status Hit from child akamai-grn 0.bc163017.1723943262.b76f6e1 x-cache Hit from akamai x-nginx-cache-status HIT server-timing provider;desc="ak" alt-svc h3=":443"; ma=93600 content-length 21037 surrogate-key x-cache-957 /images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min last-modified Wed, 17 Jul 2013 22:49:32 GMT server Server vary Accept-Encoding content-type text/css access-control-allow-origin * peer-cache Hit cache-control public, max-age=630301806 x-amz-ir-id f55b4652-d436-470a-9cd3-fb4ad460411f timing-allow-origin https://onewayticketphil.com/ expires Mon, 08 Aug 2044 04:57:48 GMT
GET H2	200	Captcha_raaozlybcc.jpg images-na.ssl-images-amazon.com/captcha/dddfleoy/	6 KB 6 KB	47ms 13ms	Image image/jpeg	2a02:26f0:3500:12::1730:17bc AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/captcha/dddfleoy/Captcha_raaozlybcc.jpg Requested by Host: onewayticketphil.com URL: https://onewayticketphil.com/targus-small-tripod/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:12::1730:17bc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Server / Resource Hash 9613280ee3b6c3ed840b38cecb20a2c4cb216d45841635aa9ad9a56491b70d47 Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Sun, 18 Aug 2024 01:07:42 GMT akamai-cache-status Miss from child, Hit from parent akamai-grn 0.bc163017.1723943262.b76f6e3 x-cache Hit from akamai x-nginx-cache-status HIT server-timing provider;desc="ak" alt-svc h3=":443"; ma=93600 content-length 6022 surrogate-key x-cache-561 /captcha/dddfleoy/Captcha_raaozlybcc last-modified Wed, 08 Feb 2012 17:15:59 GMT server Server content-type image/jpeg access-control-allow-origin * peer-cache Hit x-amz-ir-id 7a89c2b0-0136-4355-8a84-924ef8eb0ccc accept-ranges bytes timing-allow-origin https://onewayticketphil.com/
GET H2	200	requestId=QQP2QJDQMYEA2R051HNZ&js=1 fls-na.amazon.com/1/oc-csi/1/OP/	43 B 150 B	295ms 92ms	Image image/gif	3.234.130.54 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://fls-na.amazon.com/1/oc-csi/1/OP/requestId=QQP2QJDQMYEA2R051HNZ&js=1 Requested by Host: onewayticketphil.com URL: https://onewayticketphil.com/targus-small-tripod/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.234.130.54 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-234-130-54.compute-1.amazonaws.com Software / Resource Hash a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Sun, 18 Aug 2024 01:07:42 GMT x-amzn-requestid d3687d9f-ee60-41cb-a9bc-23bfbb33ed82 content-length 43 content-type image/gif
GET H2	200	csm-captcha-instrumentation.min._V1723943262569_.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	2 KB 1 KB	206ms 205ms	Script application/x-javascript	2a02:26f0:3500:12::1730:17bc AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1723943262569_.js Requested by Host: onewayticketphil.com URL: https://onewayticketphil.com/targus-small-tripod/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:12::1730:17bc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Server / Resource Hash 35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Sun, 18 Aug 2024 01:07:42 GMT content-encoding br akamai-cache-status Miss from child, Miss from parent akamai-grn 0.bc163017.1723943262.b76f6fe x-cache Miss from akamai x-nginx-cache-status MISS server-timing provider;desc="ak" alt-svc h3=":443"; ma=93600 content-length 821 surrogate-key x-cache-214 /images/G/01/csminstrumentation/csm-captcha-instrumentation.min last-modified Mon, 12 Oct 2015 09:22:39 GMT server Server content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=630720000 x-amz-ir-id e30a8c10-cfcd-4bec-988a-f2e88a44fcd2 timing-allow-origin https://onewayticketphil.com/ expires Sat, 13 Aug 2044 01:07:42 GMT
GET H2	200	aui_sprite_0007-1x._V383827579_.png images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/	17 KB 17 KB	9ms 8ms	Image image/png	2a02:26f0:3500:12::1730:17bc AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/aui_sprite_0007-1x._V383827579_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:12::1730:17bc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Server / Resource Hash 49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa Request headers Referer https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Sun, 18 Aug 2024 01:07:42 GMT akamai-cache-status Hit from child akamai-grn 0.bc163017.1723943262.b76f702 x-cache Hit from akamai x-nginx-cache-status MISS server-timing provider;desc="ak" alt-svc h3=":443"; ma=93600 content-length 16972 surrogate-key x-cache-470 /images/G/01/amazonui/sprites/aui_sprite_0007-1x last-modified Wed, 15 May 2013 01:55:34 GMT server Server content-type image/png access-control-allow-origin * peer-cache Hit cache-control public, max-age=625421918 x-amz-ir-id 718d2011-f834-4f51-87de-16797a5ce213 accept-ranges bytes timing-allow-origin https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css expires Sun, 12 Jun 2044 17:26:20 GMT
GET H3	200	ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	7 KB 3 KB	10ms 9ms	Script application/x-javascript	2a02:26f0:3500:12::1730:17bc AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1723943262569_.js Protocol H3 Security QUIC, , AES_256_GCM Server 2a02:26f0:3500:12::1730:17bc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Server / Resource Hash a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37 Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers expires Sat, 23 Jul 2044 07:36:34 GMT date Sun, 18 Aug 2024 01:07:42 GMT content-encoding br akamai-cache-status Hit from child akamai-grn 0.bc163017.1723943262.b76f83d x-cache Hit from akamai x-nginx-cache-status HIT server-timing provider;desc="ak" alt-svc h3=":443"; ma=93600 content-length 3023 response-handler root surrogate-key x-cache-495 /images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 last-modified Wed, 26 Aug 2015 14:52:49 GMT server Server vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * peer-cache Hit cache-control public, max-age=628928932 x-amz-ir-id 93784284-960f-4365-896b-c9c65114e1bf timing-allow-origin https://onewayticketphil.com/ quic-version 0x00000001
GET H3	200	ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	19 KB 7 KB	15ms 14ms	Script application/x-javascript	2a02:26f0:3500:12::1730:17bc AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1723943262569_.js Protocol H3 Security QUIC, , AES_256_GCM Server 2a02:26f0:3500:12::1730:17bc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Server / Resource Hash 877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042 Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers expires Sun, 12 Jun 2044 17:26:27 GMT date Sun, 18 Aug 2024 01:07:42 GMT content-encoding br akamai-cache-status Hit from child akamai-grn 0.bc163017.1723943262.b76f854 x-cache Hit from akamai x-nginx-cache-status HIT server-timing provider;desc="ak" alt-svc h3=":443"; ma=93600 content-length 7642 surrogate-key x-cache-012 /images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-s last-modified Thu, 01 Oct 2015 10:17:43 GMT server Server vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * peer-cache Hit cache-control public, max-age=625421925 x-amz-ir-id 13c87f43-e1e1-41d5-9f1f-89901aea496a timing-allow-origin https://onewayticketphil.com/ quic-version 0x00000001
GET H2	200	favicon.ico onewayticketphil.com/	318 B 358 B	112ms 112ms	Other image/vnd.microsoft.icon	185.199.109.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://onewayticketphil.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.199.109.153 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS cdn-185-199-109-153.github.com Software GitHub.com / Resource Hash 759af58365d04477d98f00e10b1f51603cc75d15f5e51d3f6dd57cbea0a667e5 Request headers Referer https://onewayticketphil.com/targus-small-tripod/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers expires Sun, 18 Aug 2024 00:17:40 GMT x-fastly-request-id 44a3256e0d96279d98b9199db5bd43a58d50cf27 date Sun, 18 Aug 2024 01:07:42 GMT content-encoding gzip via 1.1 varnish x-cache-hits 0 age 0 x-cache HIT content-length 171 x-served-by cache-fra-eddf8230120-FRA last-modified Fri, 01 May 2020 15:17:43 GMT server GitHub.com x-github-request-id A37E:B734A:130EFE1:13929E3:66C13B4C x-timer S1723943263.871657,VS0,VE104 etag W/"5eac3d97-13e" vary Accept-Encoding content-type image/vnd.microsoft.icon access-control-allow-origin * cache-control max-age=600 accept-ranges bytes x-proxy-cache MISS
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 165 B	190ms 186ms	Ping text/plain	3.234.130.54 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.234.130.54 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-234-130-54.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://onewayticketphil.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sun, 18 Aug 2024 01:07:43 GMT access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date x-amzn-requestid df3a99ad-f86b-4536-bcc5-ae3ea16973a9

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| ue_t0 object| ue_csm object| ue string| ue_furl string| ue_mid string| ue_sid string| ue_sn string| ue_id object| elem object| ue_modules object| cel_widgets string| ue_cel_ns object| ue_err number| ueinit function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop function| ueLogError object| ue_cel object| ue_pdm object| ue_vpm object| ue_fem object| ue_mcm object| ue_mmm object| ue_rpl object| ue_kpm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			onewayticketphil.com/	1970-01-20 23:31:50	Name: csm-sid Value: 273-9619628-5791405

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fls-na.amazon.com
images-na.ssl-images-amazon.com
onewayticketphil.com
185.199.109.153
2a02:26f0:3500:12::1730:17bc
3.234.130.54
2cd3c0114f4ac036248d20af4f3183f3f30fb60eb77cd72cc1bc2b1eb42f3821
35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a
49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa
5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb
759af58365d04477d98f00e10b1f51603cc75d15f5e51d3f6dd57cbea0a667e5
877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042
9613280ee3b6c3ed840b38cecb20a2c4cb216d45841635aa9ad9a56491b70d47
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855