urlscan.io logo urlscan.io
SecurityTrails logo

forchallenge.ro Open in urlscan Pro
89.42.218.231  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Submission: On December 01 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 89.42.218.231, located in Romania and belongs to ROMARG HOSTING, RO. The main domain is forchallenge.ro.
TLS certificate: Issued by R3 on October 7th 2022. Valid for: 3 months.
This is the only time forchallenge.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
9 89.42.218.231 205275 (ROMARG HO...)
9 1
Apex Domain
Subdomains		 Transfer
9 forchallenge.ro
forchallenge.ro
122 KB
9 1
Domain Requested by
9 forchallenge.ro forchallenge.ro
9 1

This site contains no links.

Subject Issuer Validity Valid
prodgsm.eu
R3		 2022-10-07 -
2023-01-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Frame ID: EECD0E3DE8007B601B4AC9D4BE7C14B1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon Sign-In

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

122 kB
Transfer

372 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request authentication.php
forchallenge.ro/us_gate/ 		17 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
3466e15062aa006066bd113f5e06d213efef47afdc5f0f5638966066945ca5b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 01 Dec 2022 13:12:58 GMT
server
LiteSpeed
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block
main.css
forchallenge.ro/us_gate/css/ 		3 KB
934 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/css/main.css
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
955015eaa8deba2d6a3652482092163edf3180da9f83c881d682ae8d9fa1b747
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://forchallenge.ro/us_gate/authentication.php?token=912hz7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sat, 25 Jun 2022 06:26:20 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
900
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
amazonUI.css
forchallenge.ro/us_gate/css/ 		162 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/css/amazonUI.css
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
f88e9f6145e11b66fdf699cb8c4eb58f3a329acd800f7297f9c9324c2f5ef4ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://forchallenge.ro/us_gate/authentication.php?token=912hz7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 27 Jun 2022 12:14:32 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
22181
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
onPortalAssets.css
forchallenge.ro/us_gate/css/ 		45 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/css/onPortalAssets.css
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
8b880d1a1fa08d71593330353b236bd8acb1a8837d9a72bdf1551931fed4f5d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://forchallenge.ro/us_gate/authentication.php?token=912hz7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sat, 25 Jun 2022 06:26:20 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
6006
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
jquery-3.3.1.min.js
forchallenge.ro/us_gate/js/ 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/js/jquery-3.3.1.min.js
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://forchallenge.ro/us_gate/authentication.php?token=912hz7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Sat, 25 Jun 2022 06:26:20 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29664
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
main.js
forchallenge.ro/us_gate/js/ 		967 B
354 B 		Script
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/js/main.js
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/authentication.php?token=912hz7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
9d76fadd246f9de1b9512378f7fac117657df42a7b7a6d3b3c9ce36305be50a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://forchallenge.ro/us_gate/authentication.php?token=912hz7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 01 Dec 2022 00:48:04 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
280
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
mPGmT0r6IeTyIee.png
forchallenge.ro/us_gate/images/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forchallenge.ro/us_gate/images/mPGmT0r6IeTyIee.png
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/css/amazonUI.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://forchallenge.ro/us_gate/css/amazonUI.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Jun 2022 12:06:42 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
27972
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
pDxWAF1pBB0dzGB.woff2
forchallenge.ro/us_gate/fonts/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/fonts/pDxWAF1pBB0dzGB.woff2
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/css/amazonUI.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forchallenge.ro/us_gate/css/amazonUI.css
Origin
https://forchallenge.ro
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Jun 2022 12:09:54 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
16616
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT
KFPk-9IF4FqAqY-.woff2
forchallenge.ro/us_gate/fonts/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forchallenge.ro/us_gate/fonts/KFPk-9IF4FqAqY-.woff2
Requested by
Host: forchallenge.ro
URL: https://forchallenge.ro/us_gate/css/amazonUI.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
89.42.218.231 , Romania, ASN205275 (ROMARG HOSTING, RO),
Reverse DNS
server-0337.whmpanels.com
Software
LiteSpeed /
Resource Hash
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forchallenge.ro/us_gate/css/amazonUI.css
Origin
https://forchallenge.ro
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:12:58 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Jun 2022 12:10:32 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
16460
x-xss-protection
1; mode=block
expires
Thu, 08 Dec 2022 13:12:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| onlyLettersAndNumbers

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block