store40107012.company.site
Open in
urlscan Pro
35.168.184.21
Malicious Activity!
Public Scan
Effective URL: https://store40107012.company.site/KfttLGLP38RDdnQd-p255552264
Submission: On November 10 via manual from GB
Summary
TLS certificate: Issued by Amazon on February 18th 2020. Valid for: a year.
This is the only time store40107012.company.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 3.22.78.243 3.22.78.243 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 35.168.184.21 35.168.184.21 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 54.230.228.146 54.230.228.146 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:20a... 2600:9000:20ae:a000:1f:58b3:eac0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
6 | 18.196.86.84 18.196.86.84 | 16509 (AMAZON-02) (AMAZON-02) | |
1 3 | 198.187.31.57 198.187.31.57 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
4 | 13.224.89.100 13.224.89.100 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 18.211.19.88 18.211.19.88 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2600:9000:219... 2600:9000:2190:6c00:19:4fd1:c1c0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:219... 2600:9000:2190:3e00:1c:b536:2c40:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700:20:... 2606:4700:20::ac43:46e9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 67.202.94.94 67.202.94.94 | 32748 (STEADFAST) (STEADFAST) | |
1 | 2606:4700:10:... 2606:4700:10::ac43:88d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 13 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-22-78-243.us-east-2.compute.amazonaws.com
lsh.re |
ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-184-21.compute-1.amazonaws.com
store40107012.company.site |
ASN16509 (AMAZON-02, US)
PTR: server-54-230-228-146.waw50.r.cloudfront.net
don16obqbay2c.cloudfront.net |
ASN16509 (AMAZON-02, US)
d34ikvsdm2rlij.cloudfront.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-86-84.eu-central-1.compute.amazonaws.com
app.ecwid.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: host8.registrar-servers.com
casanueva.store |
ASN16509 (AMAZON-02, US)
PTR: server-13-224-89-100.zrh50.r.cloudfront.net
d3hlm6p2n1wjk4.cloudfront.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-19-88.compute-1.amazonaws.com
ecomm.events |
ASN16509 (AMAZON-02, US)
d20ubqycd8ynev.cloudfront.net |
ASN16509 (AMAZON-02, US)
d1oxsl77a1kjht.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cloudfront.net
don16obqbay2c.cloudfront.net d34ikvsdm2rlij.cloudfront.net d3hlm6p2n1wjk4.cloudfront.net d20ubqycd8ynev.cloudfront.net d1oxsl77a1kjht.cloudfront.net |
1016 KB |
6 |
ecwid.com
app.ecwid.com |
47 KB |
3 |
amung.us
1 redirects
whos.amung.us widgets.amung.us |
2 KB |
3 |
casanueva.store
1 redirects
casanueva.store |
502 KB |
2 |
lsh.re
2 redirects
lsh.re |
741 B |
1 |
geojs.io
get.geojs.io |
971 B |
1 |
ecomm.events
ecomm.events |
2 KB |
1 |
company.site
store40107012.company.site |
90 KB |
22 | 8 |
Domain | Requested by | |
---|---|---|
6 | app.ecwid.com |
store40107012.company.site
app.ecwid.com d34ikvsdm2rlij.cloudfront.net |
4 | d3hlm6p2n1wjk4.cloudfront.net |
app.ecwid.com
|
3 | casanueva.store |
1 redirects
store40107012.company.site
|
2 | whos.amung.us | 1 redirects |
2 | don16obqbay2c.cloudfront.net |
store40107012.company.site
|
2 | lsh.re | 2 redirects |
1 | widgets.amung.us | |
1 | get.geojs.io |
store40107012.company.site
|
1 | d1oxsl77a1kjht.cloudfront.net |
app.ecwid.com
|
1 | d20ubqycd8ynev.cloudfront.net |
app.ecwid.com
|
1 | ecomm.events |
app.ecwid.com
|
1 | d34ikvsdm2rlij.cloudfront.net |
store40107012.company.site
|
1 | store40107012.company.site | |
22 | 13 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.company.site Amazon |
2020-02-18 - 2021-03-18 |
a year | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2020-05-26 - 2021-04-21 |
a year | crt.sh |
*.ecwid.com Sectigo RSA Organization Validation Secure Server CA |
2020-05-14 - 2022-08-16 |
2 years | crt.sh |
casanueva.store Sectigo RSA Domain Validation Secure Server CA |
2020-10-29 - 2021-10-29 |
a year | crt.sh |
ecomm.events Sectigo RSA Domain Validation Secure Server CA |
2019-02-11 - 2021-02-10 |
2 years | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://store40107012.company.site/KfttLGLP38RDdnQd-p255552264
Frame ID: B1D243177938FE71E9BBB3E955582BD5
Requests: 22 HTTP requests in this frame
Frame:
https://d3hlm6p2n1wjk4.cloudfront.net/static/br/2020-26947-gce52ecff4e9/A274DBBCC8AF98E0B02BA1BA007CBB71.cache.js
Frame ID: E0A025B18F6FF738B2518635A67A9127
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://lsh.re/892Zo1FYMp?fbclid=lwAR1Hv2RcHC1vp4EG6VOeNGxyGbmomqSxsJ6DPHYHA6i0-CHe0zkm-wd1...
HTTP 301
https://lsh.re/892Zo1FYMp?fbclid=lwAR1Hv2RcHC1vp4EG6VOeNGxyGbmomqSxsJ6DPHYHA6i0-CHe0zkm-wd1... HTTP 301
https://store40107012.company.site/KfttLGLP38RDdnQd-p255552264 Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://lsh.re/892Zo1FYMp?fbclid=lwAR1Hv2RcHC1vp4EG6VOeNGxyGbmomqSxsJ6DPHYHA6i0-CHe0zkm-wd1k04/
HTTP 301
https://lsh.re/892Zo1FYMp?fbclid=lwAR1Hv2RcHC1vp4EG6VOeNGxyGbmomqSxsJ6DPHYHA6i0-CHe0zkm-wd1k04/ HTTP 301
https://store40107012.company.site/KfttLGLP38RDdnQd-p255552264 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 17- https://casanueva.store/location HTTP 301
- https://casanueva.store/location/
- https://whos.amung.us/widget/vbirxj7lr8 HTTP 307
- https://widgets.amung.us/classic/06/641.png
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
KfttLGLP38RDdnQd-p255552264
store40107012.company.site/ Redirect Chain
|
398 KB 90 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
proximanova-regularit-webfont.woff2
don16obqbay2c.cloudfront.net/fonts/proximanova/ |
48 KB 48 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
store.bundle.js
d34ikvsdm2rlij.cloudfront.net/startersite/static/2020-26929-gda380219357/js/ |
118 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
app.ecwid.com/ |
72 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
casanueva.store/ |
717 KB 502 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
proximanova-bold-webfont.woff2
don16obqbay2c.cloudfront.net/fonts/proximanova/ |
46 KB 46 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new-frontend.es_MX.-1363788030.js
d3hlm6p2n1wjk4.cloudfront.net/rosetta/translations/new-frontend/files/ |
191 KB 54 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ecwid-storefront.5582713b95e944cdc4603062f5f3d324.min.js
d3hlm6p2n1wjk4.cloudfront.net/venera/static/ |
795 KB 183 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
states.js
app.ecwid.com/ |
67 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
data.js
app.ecwid.com/ |
14 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i.js
ecomm.events/ |
5 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
categories.js
app.ecwid.com/ |
15 B 182 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
A274DBBCC8AF98E0B02BA1BA007CBB71.cache.js
d3hlm6p2n1wjk4.cloudfront.net/static/br/2020-26947-gce52ecff4e9/ Frame E0A0 |
2 MB 415 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
storefront-app.js
d20ubqycd8ynev.cloudfront.net/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new
d1oxsl77a1kjht.cloudfront.net/css/ |
1023 KB 101 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
rpc
app.ecwid.com/ Frame |
0 0 |
Other
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
rpc
app.ecwid.com/ |
5 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ecwid-checkout.f3bbd76f1a2b994e96b602ef0240616c.min.js
d3hlm6p2n1wjk4.cloudfront.net/venera/static/ |
525 KB 126 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
casanueva.store/location/ Redirect Chain
|
1 KB 621 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geo.json
get.geojs.io/v1/ip/ |
304 B 971 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
641.png
widgets.amung.us/classic/06/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xxx
whos.amung.us/widget/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
51 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)194 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| bannedips string| ip object| handleips boolean| showStore boolean| hasStaticHtml boolean| isHomePage object| pb number| timeLimit number| waiter object| controller object| $jscomp function| Hero undefined| hero function| Cover object| cover function| jarallax function| VideoWorker object| style boolean| ecwid_no_body_height string| ecwidStoreURL string| ecwidStoreID string| ecwidStoreParams string| ecwidStoreName object| ecwidStoreSettings boolean| navigationEnabled function| animateScroll function| scrollToTile function| getQueryParams object| query function| getParams object| params object| Ecwid object| ec boolean| isOffline function| XMLHttpRequestConnection function| getContactusElements function| isSocialAppDeepLink function| isSocialWebLink function| useLinkForSocialContact function| isJustLink function| getNameFromPropertyPath function| getContactusDomainsByName function| getContactusAppDeepLinkPrefixesByName object| win number| winHeight number| winWidth object| body boolean| isTouchDevice object| passiveMode object| opts function| getClientX function| getClientY number| gtmWaitingDelayMs function| trackElementClickWithRedirect function| trackElementClick function| gtmSendEvent function| addClickEvent function| getSocialLogin function| setSocialLogin function| checkSlaveVisibility function| checkParentVisibility function| getUserLogin function| formatSocialIcons function| initEcwidCallback function| enableRPCLoader function| initFbWebView function| getPageUrl function| PageEvents function| FloatIcons function| Menu function| Cart function| Search function| StoreNavigation function| GoogleMap function| gwtPopups function| insertStore function| getTile function| checkStoreLastVisible function| externalLinks object| pageEvents object| map object| floatIcons object| menu object| cart object| search object| storeNavigation function| $ function| jQuery boolean| ecwid_script_defer object| _xnext_initialization_scripts boolean| _xnext_included function| isNewStorefront undefined| cartData undefined| item undefined| cartDataItem function| addExtension function| ep function| proxyChain object| chameleon string| colorPrefix string| key undefined| hash_position undefined| hash undefined| loc string| html_id object| html_tag string| body_id object| body_tag undefined| commonError undefined| bodyTagError undefined| isWindowsMobile2005 function| xInjectJs function| isElmNeed function| isOnIframe function| getHeadTag function| parseId function| parseStyle function| xAddWidget function| xProductBrowser function| ecwid_loader function| xAddToBag function| xProductThumbnail function| xLoginForm function| xMinicart function| xCategories function| xVCategories function| xCategoriesV2 function| xSearchPanel function| xSearch function| xGadget function| xSingleProduct function| xProduct function| xAffiliate undefined| xReportError object| lazySizes object| ecwidEvents function| ecwid_init_elm_config object| ecwid_elm_config object| ecwid_onBodyDoneTimerId boolean| ecwid_bodyDone function| ecwid_onBodyDone object| pathGroups boolean| needLoadEcwidAsync string| css_selectors_prefix string| ecwid_script_base string| ecwid_url number| ecwid_wait_for_interactive_seconds boolean| ecwid_use_new_loader string| ecwid_loader_logo_url string| amazon_image_domain number| xnext_ownerId object| ecwid_initial_data object| ecwid_states_data string| HeapAnalyticsObject function| eca boolean| __heap_inits__ function| ru_cdev_xnext_legacyfrontendstub_LegacyFrontendStub object| __gwt_activeModules function| __gwt_getMetaProperty function| __gwt_isKnownPropertyValue object| __gwt_stylesLoaded object| ChameleonIntegration string| ec_legacyCssUrl object| Venera string| rosettaLanguageCode object| rosettaMessages object| goog object| com object| java object| ru function| StackFrame object| ErrorStackParser object| EcwidCart function| GwtPotentialElementShim function| ecwid_incompatible_version object| testElm object| ProductBrowser function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.ecwid.com
casanueva.store
d1oxsl77a1kjht.cloudfront.net
d20ubqycd8ynev.cloudfront.net
d34ikvsdm2rlij.cloudfront.net
d3hlm6p2n1wjk4.cloudfront.net
don16obqbay2c.cloudfront.net
ecomm.events
get.geojs.io
lsh.re
store40107012.company.site
whos.amung.us
widgets.amung.us
13.224.89.100
18.196.86.84
18.211.19.88
198.187.31.57
2600:9000:20ae:a000:1f:58b3:eac0:21
2600:9000:2190:3e00:1c:b536:2c40:21
2600:9000:2190:6c00:19:4fd1:c1c0:21
2606:4700:10::ac43:88d
2606:4700:20::ac43:46e9
3.22.78.243
35.168.184.21
54.230.228.146
67.202.94.94
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
2c4314324f263725ac7b28bd76989eefaf415c4e2dc85185016016fcf5dfb7f9
30b0c0c203ef49c4d504532f52389522dcaeca5f0028a3e51b7d8792dbfa13f2
4bbe2fac4c556de87bc77980b5f9279bbc1e52712b7ef341b3114b50af19f1d6
5030ddf2cd7b49451b8eb3ffe83e8a6b00e44bf8838801db88ca4cca70d14799
50678ab87ff9ad496b9584604d32b69375374402c2d8a1dc28f3e3f24c7c7ba9
50c305a114a6bf618ed58db2dcf46d63007d459a52807c40741790b57c750e54
528d1dc4a8cab69f3f5b3feb5f5611f53cbde55917fcf324860678778dda9463
5e63c081216fb4cade51805de88ad62d0d0be42e3a70b723924c82b22820d4fc
662b49dbe195fa9dfa7b928766b6e252ba2ef1a324778f2bce2ae3b8e7d9c1c4
66ffe9b8ffb25cf52e29b35674f8431aa84ab7cb6dee27099a6aad9f47f2f141
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
7b640cfbb9a095ab1996af00d7bcf5421c79f30e94112e51c3aeb8dbd8f83dbc
83d25bd3e3e4d8b9a6d83ae07c45c3328c3c22436a37a6b9f89817947285f9e1
90cf02b3762ba56e66319497f44c6465e97402772fa21430e8b1028f149aa924
a6e01e8cf60ffc279a10b3a3d3eda6db8fdd76c692cbe0ffbb1ce6161249c8e0
c2ff910f890047aff1e2884260dc2db312f0f8c1131402be69cd960edcddbb91
cddd2f68d75962d7685fc9ce22823afe813a133d37399afb096ce2890d3dc0bb
ce0b3cc4048b5dd27f352533ac47cbdef8f4bb9a5170a7fa6d2a917428946599
d274d1a63fec16965e8b405f8089fb2613781e424fcdfcd15ecb5c1b8b6f74c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef608c27b8da4c32618875347c2fc043f1ebb3c105d46f48d2dab3f4171dbc19
f7291f6b9d457f0fc05157337c943296ec8eaeb48d421b23b5907f12155131c5