9349.shemess.com Open in urlscan Pro
63.250.38.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/y2ca2bob
Effective URL:
https://9349.shemess.com/
Submission: On October 19 via api (October 19th 2020, 9:58:52 pm UTC) from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 63.250.38.9, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is 9349.shemess.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 17th 2020. Valid for: a year.

This is the only time 9349.shemess.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6814:8a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
12	63.250.38.9 63.250.38.9	22612 (NAMECHEAP...) (NAMECHEAP-NET)
12	1

1 2606:4700:10::6814:8a41 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.168.131.241 (Scottsdale, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

3541.southcapitolfunding.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 63.250.38.9 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium90-4.web-hosting.com

9349.shemess.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	shemess.com 9349.shemess.com	68 KB
1	southcapitolfunding.com 1 redirects 3541.southcapitolfunding.com	217 B
1	tinyurl.com 1 redirects tinyurl.com	845 B
12	3

	Domain	Requested by
12	9349.shemess.com	9349.shemess.com
1	3541.southcapitolfunding.com	1 redirects
1	tinyurl.com	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
9349.shemess.com Sectigo RSA Domain Validation Secure Server CA	`2020-10-17` - `2021-10-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://9349.shemess.com/
Frame ID: E5A3F3DB1A9CBE3F8C458D52DD7119F4
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://tinyurl.com/y2ca2bob HTTP 301
http://3541.southcapitolfunding.com/ HTTP 301
https://9349.shemess.com/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

1
Countries

68 kB
Transfer

133 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/y2ca2bob HTTP 301
http://3541.southcapitolfunding.com/ HTTP 301
https://9349.shemess.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 9349.shemess.com/ Redirect Chain https://tinyurl.com/y2ca2bob http://3541.southcapitolfunding.com/ https://9349.shemess.com/	16 KB 4 KB	872ms 482ms	Document text/html	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / PHP/7.4.11 Resource Hash `d1ae0678601ce7d566f25ebad017670b42182c3edab53c2bdebae7af47a4e652` Request headers :method GET :authority 9349.shemess.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:35 GMT server Apache x-powered-by PHP/7.4.11 vary Accept-Encoding content-encoding gzip content-length 3500 content-type text/html; charset=UTF-8 Redirect headers Server nginx/1.16.1 Date Mon, 19 Oct 2020 21:58:34 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection close Location https://9349.shemess.com/
GET H2	200	dwmeltb.css 9349.shemess.com/cemat/	9 KB 3 KB	370ms 369ms	Stylesheet text/css	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://9349.shemess.com/cemat/dwmeltb.css Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `2afe961a7edaef4dee69bf8d9f43d0b34f652e8b90522f8592360e5cda934f8a` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 19 Oct 2020 21:58:35 GMT content-encoding gzip last-modified Sat, 17 Oct 2020 14:04:58 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 2715
GET H2	200	dwmeltc.css 9349.shemess.com/cemat/	641 B 485 B	206ms 205ms	Stylesheet text/css	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://9349.shemess.com/cemat/dwmeltc.css Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `ef052c9ffc1b1cf9bc4dc94950c5c17a284ce14cd6a78a64668f407efd8d2944` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 19 Oct 2020 21:58:35 GMT content-encoding gzip last-modified Sat, 17 Oct 2020 14:04:58 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 329
GET H2	200	dwmelta.css 9349.shemess.com/cemat/	54 KB 7 KB	375ms 373ms	Stylesheet text/css	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://9349.shemess.com/cemat/dwmelta.css Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `3fcfcd8d5b9f7d78f7458abaa587a625c1cee9188e7638ffaeaef24558e48e14` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 19 Oct 2020 21:58:35 GMT content-encoding gzip last-modified Sat, 17 Oct 2020 14:04:58 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 6931
GET H2	200	clear.gif 9349.shemess.com/cemat/	43 B 154 B	202ms 201ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/clear.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:35 GMT last-modified Sun, 17 Nov 2019 01:38:26 GMT server Apache accept-ranges bytes content-length 43 content-type image/gif
GET H2	200	five.gif 9349.shemess.com/cemat/	4 KB 4 KB	370ms 369ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/five.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:35 GMT last-modified Sun, 17 Nov 2019 01:38:26 GMT server Apache accept-ranges bytes content-length 4424 content-type image/gif
GET H2	200	imgjorangearrow.gif 9349.shemess.com/cemat/	181 B 293 B	201ms 200ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/imgjorangearrow.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `184e5c3955026e19d8f1488b7103d1e55b5ebe2bb177ba35445e9c19b50b5570` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:35 GMT last-modified Sun, 17 Nov 2019 01:38:26 GMT server Apache accept-ranges bytes content-length 181 content-type image/gif
GET H2	200	conseteve.gif 9349.shemess.com/cemat/	10 KB 10 KB	205ms 205ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/conseteve.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `8520700a3b4774837d41056932e79832e1f83f318e967acfd3da089110a5c018` Request headers Referer https://9349.shemess.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:35 GMT last-modified Sat, 17 Oct 2020 13:52:28 GMT server Apache accept-ranges bytes content-length 10058 content-type image/gif
GET H2	200	tcjngijspritejnew.gif 9349.shemess.com/cemat/	35 KB 36 KB	215ms 214ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/tcjngijspritejnew.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/cemat/dwmelta.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `62f15599210bcdfd0a7ed3a445ccef2514c403e323961d4c386000d5b716d7fa` Request headers Referer https://9349.shemess.com/cemat/dwmelta.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:36 GMT last-modified Sun, 17 Nov 2019 01:38:26 GMT server Apache accept-ranges bytes content-length 36330 content-type image/gif
GET H2	404	imgjshdwjmaincematod.png 9349.shemess.com/cemat/	315 B 315 B	412ms 411ms	Image text/html	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/imgjshdwjmaincematod.png Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/cemat/dwmelta.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://9349.shemess.com/cemat/dwmelta.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Mon, 19 Oct 2020 21:58:36 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	vk-sprite.gif 9349.shemess.com/cemat/	3 KB 3 KB	411ms 410ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/vk-sprite.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/cemat/dwmeltb.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `ac595759703754418524d900166983a09ad2a9126cc0d0d6dd77beafafbcba86` Request headers Referer https://9349.shemess.com/cemat/dwmeltb.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:36 GMT last-modified Sun, 17 Nov 2019 01:38:26 GMT server Apache accept-ranges bytes content-length 2609 content-type image/gif
GET H2	200	pjngijspritejjadyfer.gif 9349.shemess.com/cemat/	934 B 1 KB	377ms 377ms	Image image/gif	63.250.38.9 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://9349.shemess.com/cemat/pjngijspritejjadyfer.gif Requested by Host: 9349.shemess.com URL: https://9349.shemess.com/cemat/dwmelta.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 63.250.38.9 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium90-4.web-hosting.com Software Apache / Resource Hash `194b37addb793c71c33302afb3239216455121d66303067e15904eedd0a66b12` Request headers Referer https://9349.shemess.com/cemat/dwmelta.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 19 Oct 2020 21:58:36 GMT last-modified Sun, 17 Nov 2019 01:38:26 GMT server Apache accept-ranges bytes content-length 934 content-type image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3541.southcapitolfunding.com
9349.shemess.com
tinyurl.com
184.168.131.241
2606:4700:10::6814:8a41
63.250.38.9
184e5c3955026e19d8f1488b7103d1e55b5ebe2bb177ba35445e9c19b50b5570
194b37addb793c71c33302afb3239216455121d66303067e15904eedd0a66b12
2afe961a7edaef4dee69bf8d9f43d0b34f652e8b90522f8592360e5cda934f8a
3fcfcd8d5b9f7d78f7458abaa587a625c1cee9188e7638ffaeaef24558e48e14
62f15599210bcdfd0a7ed3a445ccef2514c403e323961d4c386000d5b716d7fa
8520700a3b4774837d41056932e79832e1f83f318e967acfd3da089110a5c018
ac595759703754418524d900166983a09ad2a9126cc0d0d6dd77beafafbcba86
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e
d1ae0678601ce7d566f25ebad017670b42182c3edab53c2bdebae7af47a4e652
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
ef052c9ffc1b1cf9bc4dc94950c5c17a284ce14cd6a78a64668f407efd8d2944

9349.shemess.com Open in urlscan Pro 63.250.38.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

1 IPs

1 Countries

68 kBTransfer

133 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

9349.shemess.com Open in urlscan Pro
63.250.38.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

1
Countries

68 kB
Transfer

133 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!