urlscan.io logo urlscan.io
SecurityTrails logo

smartfixtr.com Open in urlscan Pro
83.150.213.221  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://dik.si/EAGQS
Effective URL: https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_sub...
Submission: On March 15 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 83.150.213.221, located in Turkey and belongs to INTERNETBILISIM, TR. The main domain is smartfixtr.com.
TLS certificate: Issued by R3 on February 16th 2022. Valid for: 3 months.
This is the only time smartfixtr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 43.255.30.16 133199 (SONDERCLO...)
3 8 83.150.213.221 203576 (INTERNETB...)
6 2
Apex Domain
Subdomains		 Transfer
8 smartfixtr.com
smartfixtr.com
319 KB
1 hit-lac.org
hit-lac.org
485 B
1 dik.si
dik.si
1 KB
6 3
Domain Requested by
8 smartfixtr.com 3 redirects smartfixtr.com
1 hit-lac.org
1 dik.si 1 redirects
6 3

This site contains no links.

Subject Issuer Validity Valid
smartfixtr.com
R3		 2022-02-16 -
2022-05-17		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
Frame ID: 82FE5F10C854941FF6273482CB48D47F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

American Express : Online Services : Log in

Page URL History Show full URLs

  1. https://dik.si/EAGQS HTTP 301
    http://hit-lac.org/wp-admin/images/we.htm Page URL
  2. https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp HTTP 301
    https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/ HTTP 302
    https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home?cmd=www.ssaonline-account-ser... HTTP 301
    https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-se... Page URL

Page Statistics

6
Requests

83 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

319 kB
Transfer

319 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://dik.si/EAGQS HTTP 301
    http://hit-lac.org/wp-admin/images/we.htm Page URL
  2. https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp HTTP 301
    https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/ HTTP 302
    https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a HTTP 301
    https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://dik.si/EAGQS HTTP 301
  • http://hit-lac.org/wp-admin/images/we.htm

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
we.htm
hit-lac.org/wp-admin/images/
Redirect Chain
  • https://dik.si/EAGQS
  • http://hit-lac.org/wp-admin/images/we.htm
142 B
485 B 		Document
General
Check archive.org
Download Go to
Full URL
http://hit-lac.org/wp-admin/images/we.htm
Protocol
HTTP/1.1
Server
43.255.30.16 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
fe3b15ac55461d9bdfebf1fe5855432f84a8b206a2591ef18dddf42a250eff6a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Tue, 15 Mar 2022 21:21:18 GMT
Server
Apache/2.4.29 (Ubuntu)
Last-Modified
Tue, 15 Mar 2022 19:15:52 GMT
ETag
"8e-5da46a0174a00-gzip"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
149
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

date
Tue, 15 Mar 2022 21:21:17 GMT
content-type
text/html; charset=UTF-8
location
http://hit-lac.org/wp-admin/images/we.htm
cache-control
no-cache, no-store, private
expires
-1
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r06NscJ0uOvtz7W3zcAk3uvku%2Fy7cN%2Ffinu84Zo2pIgUo2K8%2B1n3IrytAtA9%2Fg8fyoMdpeyObegHBRQX6C8d2DiU3lMbIuAyQtOJgEcoSBVpDsH6i%2BWcNxlOIUpDGNQVvQ2%2BE14%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6ec84c4439075bfd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Primary Request /
smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/
Redirect Chain
  • https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp
  • https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/
  • https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session...
  • https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&sessio...
2 KB
754 B 		Document
General
Check archive.org
Download Go to
Full URL
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
83.150.213.221 , Turkey, ASN203576 (INTERNETBILISIM, TR),
Reverse DNS
ist11.internetbilisim.net
Software
LiteSpeed /
Resource Hash
604433e5e2477c774f81eb276f5ae87d55383a98550c38491929e92726552145

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://hit-lac.org/wp-admin/images/we.htm

Response headers

content-type
text/html; charset=UTF-8
content-length
707
content-encoding
br
vary
Accept-Encoding
date
Tue, 15 Mar 2022 21:21:18 GMT
server
LiteSpeed

Redirect headers

content-type
text/html
content-length
707
date
Tue, 15 Mar 2022 21:21:18 GMT
server
LiteSpeed
location
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
head.PNG
smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/head.PNG
Requested by
Host: smartfixtr.com
URL: https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
83.150.213.221 , Turkey, ASN203576 (INTERNETBILISIM, TR),
Reverse DNS
ist11.internetbilisim.net
Software
LiteSpeed /
Resource Hash
38d24ecdfeb3ccc75c799de1e034772a46e258c658a911e1fe029329eebe672e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 15 Mar 2022 21:21:18 GMT
last-modified
Tue, 15 Mar 2022 19:25:53 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
8182
expires
Tue, 22 Mar 2022 21:21:18 GMT
main.PNG
smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/ 		241 KB
242 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/main.PNG
Requested by
Host: smartfixtr.com
URL: https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
83.150.213.221 , Turkey, ASN203576 (INTERNETBILISIM, TR),
Reverse DNS
ist11.internetbilisim.net
Software
LiteSpeed /
Resource Hash
f3381d0d3c26b613f3bef7c554127a6c7043b81650b5bfb34203ad225356add9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 15 Mar 2022 21:21:18 GMT
last-modified
Tue, 15 Mar 2022 19:25:53 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
247287
expires
Tue, 22 Mar 2022 21:21:18 GMT
sign.PNG
smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/sign.PNG
Requested by
Host: smartfixtr.com
URL: https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
83.150.213.221 , Turkey, ASN203576 (INTERNETBILISIM, TR),
Reverse DNS
ist11.internetbilisim.net
Software
LiteSpeed /
Resource Hash
5feada6664eee041d84e1ee25ff66df39b1e9322730ac2e573e76aa8bad5269e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 15 Mar 2022 21:21:18 GMT
last-modified
Tue, 15 Mar 2022 19:25:53 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1363
expires
Tue, 22 Mar 2022 21:21:18 GMT
footer.PNG
smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/ 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/images/footer.PNG
Requested by
Host: smartfixtr.com
URL: https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
83.150.213.221 , Turkey, ASN203576 (INTERNETBILISIM, TR),
Reverse DNS
ist11.internetbilisim.net
Software
LiteSpeed /
Resource Hash
bd09c68a0c48de06d4bd56444551f4c536966eecc6d3219bb141da367960215e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://smartfixtr.com/wp-admin/includes/americanexpress.com.axp/home/?cmd=www.ssaonline-account-service.com-update_submit&id=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a&session=286663c57e2bc5115338e33b5f28905a286663c57e2bc5115338e33b5f28905a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 15 Mar 2022 21:21:18 GMT
last-modified
Tue, 15 Mar 2022 19:25:53 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
68010
expires
Tue, 22 Mar 2022 21:21:18 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| unhideBody

2 Cookies

Domain/Path Name / Value
dik.si/ Name: XSRF-TOKEN
Value: eyJpdiI6ImZna0RsSSsyRHBxQ2RjWThVNDhYbXc9PSIsInZhbHVlIjoiYUw0SjZNRHNSbXFUNkRrME1pUTVjYUM0R2lIREtjdGFSMkcrREhkejJYUmk5OVZBVTA1UUd5Q0VaWW53cFFmaFFrSE0vMlJBZ0dSbFV3bXNZYy9RWDZzMjNoZWl4VWJoMmRSaVNROE9iaUJjQXVyRHNSNGlSZWk0akRBSFByTEIiLCJtYWMiOiJjNjE2ZTBmMTUxNDRmZmZiYjkxZDk5MzY1MTJiMWM1YjBjNTRjNzk3NDNiYzcyNmFlOTliOGFiNzRhODMyYjZlIn0%3D
dik.si/ Name: diksi_session
Value: eyJpdiI6ImpEcmg3TFJNSHg0S1NZRWtRdkdSK0E9PSIsInZhbHVlIjoibWZjTlI1MEwzUTRUWjg3NlVvYlB3SXk4eURSeTc2bk5Ka013MUVhcy80c3lZYWRDN2pMdDR2KzUyTFYwTXA3VXpJU3hJbUVGbGFWVnJwM1cvNjJTMzI0eXUxbDBtUmhXZ3A2Zk9FeHFRQzl0MlRqQ2FFMEVUL0Z0WFdFTmVKVUwiLCJtYWMiOiJiYWEzYjU5MjVlZjgyYjNkNGU5NTNiYWIwYWNiMDkzNTk5NzZjNWNhMzRhMmY2MWZkN2Q0YTkyYzlhYjA3NWI1In0%3D