che-mypaket01.me
Open in
urlscan Pro
95.143.196.248
Malicious Activity!
Public Scan
URL:
https://che-mypaket01.me/
Submission: On August 31 via automatic, source certstream-suspicious — Scanned from SE
Submission: On August 31 via automatic, source certstream-suspicious — Scanned from SE
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 11 HTTP transactions.
The main IP is 95.143.196.248, located in
Hudiksvall, Sweden and
belongs to INTERNETPORT-AS, SE.
The main domain is che-mypaket01.me.
TLS certificate: Issued by R3 on August 31st 2023. Valid for: 3 months.
This is the only time che-mypaket01.me was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 31st 2023. Valid for: 3 months.
This is the only time che-mypaket01.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 95.143.196.248 95.143.196.248 | 49770 (INTERNETP...) (INTERNETPORT-AS) | |
| 1 | 91.149.202.233 91.149.202.233 | 26383 (ASNET) (ASNET) | |
| 1 | 69.16.175.10 69.16.175.10 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 11 | 3 |
9
95.143.196.248
(Hudiksvall, Sweden)
ASN49770 (INTERNETPORT-AS, SE)
PTR: static-248-196-143-95.internetport.com
ASN49770 (INTERNETPORT-AS, SE)
PTR: static-248-196-143-95.internetport.com
| che-mypaket01.me |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
che-mypaket01.me
che-mypaket01.me |
67 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 733 |
30 KB |
| 1 |
api-service-panel.com
09877a321.api-service-panel.com |
343 B |
| 11 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | che-mypaket01.me |
che-mypaket01.me
|
| 1 | code.jquery.com |
che-mypaket01.me
|
| 1 | 09877a321.api-service-panel.com |
che-mypaket01.me
|
| 11 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| amazon-nl.com R3 |
2023-08-31 - 2023-11-29 |
3 months | crt.sh |
| 09877a321.api-service-panel.com R3 |
2023-08-29 - 2023-11-27 |
3 months | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://che-mypaket01.me/
Frame ID: 5785C234294565C91C738DD5CBA89809
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Amazon Order Refund Request ConfirmationDetected technologies
Vue.js
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://www.amazon.com/gp/help/customer/display.html?nodeId=508088&ref_=navm_ftr_cou
Title: Conditions of Use
Title: Conditions of Use
Search URL Search Domain Scan URL
URL: https://www.amazon.com/gp/help/customer/display.html?ie=UTF8&nodeId=468496&ref_=footer_privacy
Title: Privacy Notice
Title: Privacy Notice
Search URL Search Domain Scan URL
URL: https://www.amazon.com/privacyprefs?ref_=footer_iba
Title: Your Ads Privacy Choices
Title: Your Ads Privacy Choices
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
che-mypaket01.me/ |
826 B 979 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loading.gif
che-mypaket01.me/static/image/ |
29 KB 29 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
config.js
che-mypaket01.me/static/js/ |
728 B 941 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
axios.js
che-mypaket01.me/static/js/ |
42 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
data.js
che-mypaket01.me/static/js/ |
1 KB 883 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
token
09877a321.api-service-panel.com/api/v2/ |
78 B 343 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.2fcac2dc.css
che-mypaket01.me/static/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
AuInfo.27a6e055.css
che-mypaket01.me/static/css/ |
1 KB 720 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.978ab36a.css
che-mypaket01.me/static/css/ |
536 B 739 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.7.0.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
new-nav-sprite-global-2x_blueheaven-account._CB658093420_.3b48af91.png
che-mypaket01.me/static/image/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| url function| axios function| $ function| jQuery function| next0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
09877a321.api-service-panel.com
che-mypaket01.me
code.jquery.com
69.16.175.10
91.149.202.233
95.143.196.248
08e15b8629275252f4223ac8f2f02e507bfba8c0de199038e020505ff4996515
245bbc018dac02f9f363670178dd44f3dac21f70db671aca9570a439e076bec5
27a6e055df2405e94d1b96cf9f7ab4caea48150c993dbeda1e996d636d3d52a9
3b48af9153e92423d79f2d3bdc3e0b15e482ceb87e5c3ce3af5bd6f593cead9d
55e21407e59eec32b5e0f3a5d199051f768e17f265abbf1764249afce86433c7
96b65382c74cd6255d4628044c5394f2ef3f0662d7d72b10f1bceb50b6ee5455
978ab36a9e16990e2ea4facfc41a17b068323cc117291cd5b6a469b79e83ae42
b6e4559faf5fec4f605e1d46e98adb2b804b1b3d04744906f5d69dbf0531bc7a
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
ed8c99acb5a2c94b3d50e309a629b6a796be1a824f4e802ceee420385ab8055b
fcad14a4b51c1b7825cf99338656d1a01e845a3531095251becb874cf6e101f9