amacongsecurezxlq.com
Open in
urlscan Pro
34.72.144.253
Malicious Activity!
Public Scan
Effective URL: https://amacongsecurezxlq.com/ap/signin??wF3bBchverifywF3bBch
Submission: On May 05 via manual from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 4th 2021. Valid for: 3 months.
This is the only time amacongsecurezxlq.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.131.99.102 104.131.99.102 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 1 | 208.91.198.178 208.91.198.178 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
8 | 34.72.144.253 34.72.144.253 | 15169 (GOOGLE) (GOOGLE) | |
8 | 1 |
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: 208.91.198-178.publicdomainregistry.com
vssct.com |
ASN15169 (GOOGLE, US)
PTR: 253.144.72.34.bc.googleusercontent.com
amacongsecurezxlq.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
amacongsecurezxlq.com
amacongsecurezxlq.com |
224 KB |
1 |
vssct.com
1 redirects
vssct.com |
102 B |
1 |
abre.ai
1 redirects
abre.ai |
668 B |
8 | 3 |
Domain | Requested by | |
---|---|---|
8 | amacongsecurezxlq.com |
amacongsecurezxlq.com
|
1 | vssct.com | 1 redirects |
1 | abre.ai | 1 redirects |
8 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
amacongsecurezxlq.com cPanel, Inc. Certification Authority |
2021-05-04 - 2021-08-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://amacongsecurezxlq.com/ap/signin??wF3bBchverifywF3bBch
Frame ID: 438FC32A5A8E4EF8E42018587C360E6B
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://abre.ai/cEXZ
HTTP 302
https://vssct.com/aaa.php HTTP 302
https://amacongsecurezxlq.com/?verify Page URL
- https://amacongsecurezxlq.com/ap/signin??wF3bBchverifywF3bBch Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://abre.ai/cEXZ
HTTP 302
https://vssct.com/aaa.php HTTP 302
https://amacongsecurezxlq.com/?verify Page URL
- https://amacongsecurezxlq.com/ap/signin??wF3bBchverifywF3bBch Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://abre.ai/cEXZ HTTP 302
- https://vssct.com/aaa.php HTTP 302
- https://amacongsecurezxlq.com/?verify
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
amacongsecurezxlq.com/ Redirect Chain
|
717 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
is-private-mode.js
amacongsecurezxlq.com/assets/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
signin
amacongsecurezxlq.com/ap/ |
20 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AmazonUI2.css
amacongsecurezxlq.com/assets/css/ |
160 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AuthenticationPortalAssets.css
amacongsecurezxlq.com/assets/css/ |
56 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AmazonUI2.js
amacongsecurezxlq.com/assets/js/ |
435 KB 112 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AuthenticationPortalAssets.js
amacongsecurezxlq.com/assets/js/ |
111 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
amacongsecurezxlq.com/assets/img/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated number| aPageStart function| mapJSCallback object| jQuery16407441193484036539 boolean| loginWithOTPState1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
amacongsecurezxlq.com/ | Name: PHPSESSID Value: 9f1f84b7769cb8f1417155236ad97cfc |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
abre.ai
amacongsecurezxlq.com
vssct.com
104.131.99.102
208.91.198.178
34.72.144.253
07ca25675885c4d6e1b375972be73ec19771ca9fee1f96b3aea2dd98e03530b2
0da05f1e570873ca449c8b9b534af58f74f93d9808ec080c0423c2e8d70bddd2
402224e8708f5cade4e1d55b70d0b802fb1ee86125cc3d9540b515850c44eb8a
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
9b182e9935f659c66ca5679d1e3825e95bf9033f1b9f166347b6669250fbbcc0
e53ab2f1016c64acb6db8ed8bc7b6d0f776fe649f5604bd7fa37c2b98b7cf7bf
ec5d9bc61241e06a745521e52d25a1e3414c959624b8e5ee7ad8e3475dccbfb8
fa8ea86c289d62d7ca1a5b601383ddbf89d257543489e21dcc38ec8221059030