amazon.gejegames.com Open in urlscan Pro
2a05:d014:275:cb00:7dff:602c:d0e7:9c4  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response amazon.gejegames.com/	1 KB 934 B	202ms 25ms	Document text/html	2a05:d014:275:cb00:7dff:602c:d0e7:9c4 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://amazon.gejegames.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb00:7dff:602c:d0e7:9c4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 0a989ccb05a9ccb4eb77be89c3152b6fd1071173a0fb06d536e9cbc44d23970d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 30119 cache-control public, max-age=0, must-revalidate content-encoding gzip content-length 722 content-type text/html; charset=UTF-8 date Mon, 09 May 2022 06:43:42 GMT etag "d64bd8202e2bb892cde5debab393648b-ssl-df" server Netlify strict-transport-security max-age=31536000 vary Accept-Encoding x-nf-request-id 01G2MNNJP4C9KQJY72WEND8RFQ
GET H2	200	loading.gif 1.bp.blogspot.com/-RTK0ll2Vx0g/YJKC00ZeOPI/AAAAAAAABLk/VFG-YBkJOYIJTdPpS4SOEZV0XF2Q8HmcACLcBGAsYHQ/s0/	125 KB 126 KB	31ms 8ms	Image image/gif	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://1.bp.blogspot.com/-RTK0ll2Vx0g/YJKC00ZeOPI/AAAAAAAABLk/VFG-YBkJOYIJTdPpS4SOEZV0XF2Q8HmcACLcBGAsYHQ/s0/loading.gif Requested by Host: amazon.gejegames.com URL: https://amazon.gejegames.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 2a1e20235f63638e93ea2c61e69822ae63f5782fbceeb332ce23dbdd018f5d09 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.gejegames.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 09 May 2022 12:24:09 GMT x-content-type-options nosniff age 9692 content-disposition inline;filename="loading.gif" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128421 x-xss-protection 0 server fife etag "v4ba" vary Origin content-type image/gif access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Sat, 23 Apr 2022 12:49:37 GMT
GET H2	200	api.js Show response goadvertisers.com/amazon/	130 KB 40 KB	104ms 46ms	Script application/javascript	2a06:98c1:3121::a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://goadvertisers.com/amazon/api.js Requested by Host: amazon.gejegames.com URL: https://amazon.gejegames.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3862d37d58b86b77b5588bfedb7b9141b44981bc16f9304184b245231cc366fd Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.gejegames.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 09 May 2022 15:05:41 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 25181 cf-bgj minify alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-xss-protection 1; mode=block last-modified Wed, 20 Apr 2022 19:01:45 GMT server cloudflare x-frame-options SAMEORIGIN etag W/"62605899-2063f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BbijnmSgu3mJUgwbqAx6nu%2Bly19IGLfoZZtENm7ykPt90VSoFFFEVSNbiSwA2Un9Z5swcXMHJD1SV17Krrvt3xpntTmNotFcJYPSKKMuqJHON%2BvVBbahd%2FDBiWCkPUV1m0k%2B54g6jjeUGQrbzRBAiQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=2592000, public cf-ray 708b55b1eae73763-MXP expires Wed, 08 Jun 2022 08:06:00 GMT
GET H2	200	js15_as.js Show response s10.histats.com/	11 KB 4 KB	41ms 9ms	Script text/javascript	46.105.201.240 OVH
General Check archive.org Show headers Download Go to Full URL https://s10.histats.com/js15_as.js Requested by Host: amazon.gejegames.com URL: https://amazon.gejegames.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 46.105.201.240 , France, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.gejegames.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Mon, 09 May 2022 15:02:58 GMT content-encoding br last-modified Thu, 16 Apr 2020 10:44:16 GMT x-cdn-pop-ip 137.74.120.0/27 etag "-375139978" x-cacheable Matched cache content-type text/javascript x-cdn-pop sbg accept-ranges bytes content-length 4364 x-request-id 375555769
GET H/1.1	200 OK	0.php Show response s4.histats.com/stats/	49 B 183 B	304ms 99ms	Script text/html	192.99.13.63 OVH
General Check archive.org Show headers Download Go to Full URL https://s4.histats.com/stats/0.php?4658525&@f16&@g1&@h1&@i1&@j1652108741402&@k0&@l1&@mAmazon%20Geje%20Games&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-187026947&@b3:1652108741&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Famazon.gejegames.com%2F&@w Requested by Host: s10.histats.com URL: https://s10.histats.com/js15_as.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.99.13.63 , Canada, ASN16276 (OVH, FR), Reverse DNS ns504751.ip-192-99-13.net Software / Resource Hash ac22577d9e7380689bf66fd765a093be65fefed06a5503fdb870b65c5abbbde7 Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.gejegames.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers Date Mon, 09 May 2022 15:05:41 GMT Connection close Content-Length 49 Content-Type text/html;charset=UTF-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| _Hasync function| chfh function| chfh2 string| _HST_cntval object| Histats object| _0x5259 function| _0x4735 function| _0x4f3fd6 function| _0x52fd39 function| _0x3fd69e function| _0x1a8d2a function| _0x5a0707 function| _0x36ff76 function| _0x209e81 function| _0x21447e function| _0x62836e function| _0x161dba object| url_string object| url object| c function| write function| Redirect function| _0x4bcc1c object| _HistatsCounterGraphics_0_setValues

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstCfa4658525 Value: 1652108741402
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstCla4658525 Value: 1652108741402
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstCmu4658525 Value: 1652108741402
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstPn4658525 Value: 1
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstPt4658525 Value: 1
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstCnv4658525 Value: 1
			amazon.gejegames.com/	1970-01-20 11:40:44	Name: HstCns4658525 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
amazon.gejegames.com
goadvertisers.com
s10.histats.com
s4.histats.com
192.99.13.63
2a00:1450:4001:803::2001
2a05:d014:275:cb00:7dff:602c:d0e7:9c4
2a06:98c1:3121::a
46.105.201.240
0a989ccb05a9ccb4eb77be89c3152b6fd1071173a0fb06d536e9cbc44d23970d
2a1e20235f63638e93ea2c61e69822ae63f5782fbceeb332ce23dbdd018f5d09
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
3862d37d58b86b77b5588bfedb7b9141b44981bc16f9304184b245231cc366fd
ac22577d9e7380689bf66fd765a093be65fefed06a5503fdb870b65c5abbbde7