global36578-americanexpress.com
Open in
urlscan Pro
207.244.89.74
Malicious Activity!
Public Scan
Submitted URL: http://x.co/1Z2O36577
Effective URL: https://global36578-americanexpress.com/myca36578/cd28d/?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b99931b16f9&dispatch=...
Submission: On December 14 via manual from US
Effective URL: https://global36578-americanexpress.com/myca36578/cd28d/?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b99931b16f9&dispatch=...
Submission: On December 14 via manual from US
Summary
This website contacted 3 IPs
in 1 countries
across 3 domains to perform 17 HTTP transactions.
The main IP is 207.244.89.74, located in
Manassas, United States and
belongs to LEASEWEB-USA-WDC-01 - Leaseweb USA, Inc., US.
The main domain is global36578-americanexpress.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 14th 2017. Valid for: 3 months.
This is the only time global36578-americanexpress.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 14th 2017. Valid for: 3 months.
This is the only time global36578-americanexpress.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: American Express (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 184.168.131.241 184.168.131.241 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 1 | 2400:cb00:204... 2400:cb00:2048:1::6812:3bdd | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 3 18 | 207.244.89.74 207.244.89.74 | 30633 (LEASEWEB-...) (LEASEWEB-USA-WDC-01 - Leaseweb USA) | |
| 17 | 3 |
1
184.168.131.241
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net
| x.co |
1
2400:cb00:2048:1::6812:3bdd
(United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| short.id |
18
207.244.89.74
(Manassas, United States)
ASN30633 (LEASEWEB-USA-WDC-01 - Leaseweb USA, Inc., US)
ASN30633 (LEASEWEB-USA-WDC-01 - Leaseweb USA, Inc., US)
| global36578-americanexpress.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
global36578-americanexpress.com
3 redirects
global36578-americanexpress.com |
255 KB |
| 1 |
short.id
short.id |
|
| 1 |
x.co
1 redirects
x.co |
225 B |
| 17 | 3 |
| Domain | Requested by | |
|---|---|---|
| 18 | global36578-americanexpress.com |
3 redirects
global36578-americanexpress.com
|
| 1 | short.id | |
| 1 | x.co | 1 redirects |
| 17 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni146407.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2017-12-11 - 2018-06-19 |
6 months | crt.sh |
| global36578-americanexpress.com cPanel, Inc. Certification Authority |
2017-12-14 - 2018-03-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://global36578-americanexpress.com/myca36578/cd28d/?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b99931b16f9&dispatch=d5dc5e1f1307cc74067e8dc371b0e3dae405e211
Frame ID: (FC92B70D5332ACFB3F9AB94DDED30133)
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://x.co/1Z2O36577
HTTP 302
https://short.id/g9XQ Page URL
-
https://global36578-americanexpress.com/myca36578
HTTP 301
https://global36578-americanexpress.com/myca36578/ HTTP 302
https://global36578-americanexpress.com/myca36578/cd28d?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b9... HTTP 301
https://global36578-americanexpress.com/myca36578/cd28d/?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b... Page URL
Detected technologies
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
CloudFlare
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /cloudflare/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://x.co/1Z2O36577
HTTP 302
https://short.id/g9XQ Page URL
-
https://global36578-americanexpress.com/myca36578
HTTP 301
https://global36578-americanexpress.com/myca36578/ HTTP 302
https://global36578-americanexpress.com/myca36578/cd28d?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b99931b16f9&dispatch=d5dc5e1f1307cc74067e8dc371b0e3dae405e211 HTTP 301
https://global36578-americanexpress.com/myca36578/cd28d/?request_type=LogonHandler&Face=en_DE_2a7fd0b8df066fad301e3b99931b16f9&dispatch=d5dc5e1f1307cc74067e8dc371b0e3dae405e211 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://x.co/1Z2O36577 HTTP 302
- https://short.id/g9XQ
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
g9XQ
short.id/ Redirect Chain
|
491 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
global36578-americanexpress.com/myca36578/cd28d/ Redirect Chain
|
40 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ELILODefault.css
global36578-americanexpress.com/myca36578/form/css/ |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
RWDcmaxLogon_compress.css
global36578-americanexpress.com/myca36578/form/css/ |
851 B 851 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ELILOLarge.css
global36578-americanexpress.com/myca36578/form/css/ |
476 B 476 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
inav_responsive_intl.css
global36578-americanexpress.com/myca36578/file/ |
132 KB 132 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.gif
global36578-americanexpress.com/myca36578/action/ |
343 B 343 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_bluebox.gif
global36578-americanexpress.com/myca36578/form/img/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
DE.gif
global36578-americanexpress.com/myca36578/cd28d/myca/pics/flag/ |
354 B 354 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
img_orangearrow.gif
global36578-americanexpress.com/myca36578/form/img/ |
181 B 181 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ApplePayBenefitsMYCALoginALL300x250px.jpg
global36578-americanexpress.com/myca36578/form/img/ |
78 KB 78 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.gif
global36578-americanexpress.com/myca36578/form/img/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
commonFunctionsResponsive_Intl.js
global36578-americanexpress.com/myca36578/file/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
iNav_ngi_sprite_new.gif
global36578-americanexpress.com/myca36578/file/img/ |
23 KB 23 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
elilo-sprite.gif
global36578-americanexpress.com/myca36578/form/form/img/ |
357 B 357 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login_button_big.png
global36578-americanexpress.com/myca36578/form/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
iNav_ngi_sprite_footer.gif
global36578-americanexpress.com/myca36578/file/img/ |
934 B 934 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- global36578-americanexpress.com
- URL
- https://global36578-americanexpress.com/myca36578/file/commonFunctionsResponsive_Intl.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: American Express (Financial)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint string| browser object| isIpadIpod undefined| mt function| validation function| confirm_by_id0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubdomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
global36578-americanexpress.com
short.id
x.co
global36578-americanexpress.com
184.168.131.241
207.244.89.74
2400:cb00:2048:1::6812:3bdd
0d4e7d13d424c4569af233a3188ac42edaa093a12bced0dba6095c00047006e3
194b37addb793c71c33302afb3239216455121d66303067e15904eedd0a66b12
2b8b5ba85075c42d6c60e41a9e9c60e6de2ff16fd699e122915a8340e18a1cb4
352ff58f101fd04f532cefd9e4b762dfdb7d131f3126a88a78fae5c60c6e5bbb
3fdce13cb5b6f815026e05fd1564c2ba1e7f01de47d6b241fbe093326e2fba35
795c9e76297e35f8fbb8032f2715e8a3a4a383934315ff1410db802dae7213f4
7c3561cb6494af21aeb93bee7364f2914e578a6fb8208bd3c8812a071c2ca4bb
83a5f57735673ff8cca9d9364f44e96b0ad7c7c61a91624aaa41d022f74883d2
88e1f23c17e0d69700f6731467896887618e6677c70c3334ab2b309183876df5
9d333310ff20e35082fa9c34b86f752942d327b17cb9c76780c73d512651c0ff
a771965c6c6ce80d8a4aaa26d3db5b3b438bfe52d1127cb73b33e744ef283675
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e
ce966a9c8adf4ee062030feac8ba1a787bbaa31f53f119255f149972d2df0e17
f0f479c5b7bf6595a8469db9d6c7d9febb40e764b2bdaa0169b76886d3c06782
fd710334e8e9ea09c46bf37ad1167ccc073c1ab215c3d9ae7047b0448451a9c3