actiongmasterr.org Open in urlscan Pro
23.95.217.2  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response actiongmasterr.org/	50 KB 15 KB	343ms 193ms	Document text/html	23.95.217.2 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL http://actiongmasterr.org/ Protocol HTTP/1.1 Server 23.95.217.2 Buffalo, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS ny1.vpshared.com Software LiteSpeed / Resource Hash 1ffe1a6fbe911e0ee3a389dbb244c6537db6b31a5d28345988c867d7fd0bf584 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host actiongmasterr.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 15219 Content-Encoding gzip Vary Accept-Encoding Date Thu, 12 Nov 2020 13:59:03 GMT Server LiteSpeed Strict-Transport-Security max-age=300; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-XSS-Protection 1; mode=block X-Content-Type-Options nosniff
GET H2	200	AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	117 KB 20 KB	22ms 7ms	Stylesheet text/css	2a04:4e42:1b::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css Requested by Host: actiongmasterr.org URL: http://actiongmasterr.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8b1da396d990146a5c58465e5edd9a4b3153e7b0dba150937b639704b581bb3d Request headers Referer http://actiongmasterr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 12 Nov 2020 13:59:03 GMT content-encoding gzip age 1033119 x-cache HIT from fastly, HIT from fastly status 200 content-length 19728 x-served-by cache-dca17773-DCA, cache-hhn4042-HHN last-modified Fri, 27 May 2016 04:47:06 GMT vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id bdc4788c-3398-4bcb-aee9-59ec5f0a9018 accept-ranges bytes timing-allow-origin https://www.amazon.com expires Fri, 26 Oct 2040 15:00:24 GMT
GET H2	200	AmazonUI-fbe29e7e7feb1ee355f37cef9938c823338ae404._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	272 KB 85 KB	20ms 7ms	Script application/x-javascript	2a04:4e42:1b::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-fbe29e7e7feb1ee355f37cef9938c823338ae404._V2_.js Requested by Host: actiongmasterr.org URL: http://actiongmasterr.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ad5052cfcd4bc6b262fae85507eea061c33bad087c67296846337a1935ff5b8d Request headers Origin http://actiongmasterr.org Referer http://actiongmasterr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 12 Nov 2020 13:59:03 GMT content-encoding gzip age 1462996 x-cache HIT from fastly, HIT from fastly status 200 content-length 86503 x-served-by cache-dca17728-DCA, cache-hhn4067-HHN last-modified Thu, 16 Jun 2016 03:52:41 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 49e46829-9b55-42c5-851c-3d71d00b9c1a accept-ranges bytes timing-allow-origin https://www.amazon.com expires Sun, 21 Oct 2040 15:35:47 GMT
GET H2	200	AuthenticationPortalAssets-232052515ce620836dbb308fe54ea4362a88afeb._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	72 KB 21 KB	28ms 15ms	Script application/x-javascript	2a04:4e42:1b::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-232052515ce620836dbb308fe54ea4362a88afeb._V2_.js Requested by Host: actiongmasterr.org URL: http://actiongmasterr.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 10f5a050e2131debd8075d5d488a628f9964d7da2f03291ea6948864788431cf Request headers Origin http://actiongmasterr.org Referer http://actiongmasterr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 12 Nov 2020 13:59:03 GMT content-encoding gzip age 558742 x-cache HIT from fastly, HIT from fastly status 200 content-length 21192 x-served-by cache-dca17774-DCA, cache-hhn4067-HHN last-modified Wed, 25 Jan 2017 03:04:20 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 25fb31b7-2dfb-499a-89f0-fac4136c4497 accept-ranges bytes timing-allow-origin https://www.amazon.com expires Thu, 01 Nov 2040 02:46:40 GMT
GET H2	200	FWCIMAssets-6cd9b9548d51ff660b6128f579a62611fae659cb._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	24 KB 9 KB	30ms 18ms	Script application/x-javascript	2a04:4e42:1b::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/FWCIMAssets-6cd9b9548d51ff660b6128f579a62611fae659cb._V2_.js Requested by Host: actiongmasterr.org URL: http://actiongmasterr.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ef9336661b4f33b1160cab9443d244681a448858818424fa075c8e42efa58b65 Request headers Origin http://actiongmasterr.org Referer http://actiongmasterr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 12 Nov 2020 13:59:03 GMT content-encoding gzip age 20525278 x-cache HIT from fastly, HIT from fastly status 200 content-length 9430 x-served-by cache-dca17783-DCA, cache-hhn4067-HHN last-modified Tue, 27 Sep 2016 23:02:10 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id e5e41190-3bcd-48ea-875c-87eb42b5c0cb accept-ranges bytes timing-allow-origin https://www.amazon.com expires Thu, 15 Mar 2040 00:31:06 GMT
GET H2	200	AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	25 KB 25 KB	7ms 6ms	Image image/png	2a04:4e42:1b::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a Request headers Referer https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-de8acf3eb250580d6759e6f8f5aa7179debc59d2._V2_.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 12 Nov 2020 13:59:03 GMT last-modified Sat, 13 Feb 2016 23:21:21 GMT age 20120863 status 200 x-cache HIT from fastly, HIT from fastly content-type image/png access-control-allow-origin * expires Mon, 19 Mar 2040 16:51:21 GMT cache-control max-age=630720000,public x-amz-ir-id 8891aa6d-a4b5-47d1-b74c-13490c985ef4 accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 25262 x-served-by cache-dca17758-DCA, cache-hhn4042-HHN

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes number| aPageStart object| jQuery164025104920368649686 function| cf

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=300; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

actiongmasterr.org
images-na.ssl-images-amazon.com
23.95.217.2
2a04:4e42:1b::272
10f5a050e2131debd8075d5d488a628f9964d7da2f03291ea6948864788431cf
1ffe1a6fbe911e0ee3a389dbb244c6537db6b31a5d28345988c867d7fd0bf584
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
8b1da396d990146a5c58465e5edd9a4b3153e7b0dba150937b639704b581bb3d
ad5052cfcd4bc6b262fae85507eea061c33bad087c67296846337a1935ff5b8d
ef9336661b4f33b1160cab9443d244681a448858818424fa075c8e42efa58b65