ajmstech.com Open in urlscan Pro
209.222.99.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289...
Submission: On July 17 via api (July 17th 2020, 7:03:42 am UTC) from TW

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 209.222.99.106, located in Philadelphia, United States and belongs to RELIABLESITE, US. The main domain is ajmstech.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 17th 2020. Valid for: 3 months.

This is the only time ajmstech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	209.222.99.106 209.222.99.106		23470 (RELIABLESITE) (RELIABLESITE)
10	1

10 209.222.99.106 (Philadelphia, United States)

ASN23470 (RELIABLESITE, US)

ajmstech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	ajmstech.com ajmstech.com	242 KB
10	1

	Domain	Requested by
10	ajmstech.com	ajmstech.com
10	1

This site contains no links.

Subject Issuer	Validity	Valid
ajmstech.com cPanel, Inc. Certification Authority	`2020-05-17` - `2020-08-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Frame ID: EC22EDC554FE8D049FC82B5E33D76EB6
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

242 kB
Transfer

245 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response ajmstech.com/Ex/Ex/	4 KB 2 KB	512ms 139ms	Document text/html	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `2cf361c56c1d9998c849987a5c17741fd73d715b54ce93700b5c6b0559232cfd` Request headers :method GET :authority ajmstech.com :scheme https :path /Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 content-type text/html; charset=UTF-8 content-length 1417 content-encoding br vary Accept-Encoding date Fri, 17 Jul 2020 07:03:23 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	facebox.css ajmstech.com/Ex/Ex/files/	1 KB 473 B	109ms 107ms	Stylesheet text/css	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/facebox.css Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 17 Jul 2020 07:03:23 GMT content-encoding br last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 365 expires Fri, 24 Jul 2020 07:03:23 GMT
GET H2	200	jquery-1.js.download Show response ajmstech.com/Ex/Ex/files/	89 KB 90 KB	109ms 108ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/jquery-1.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `220a01d3ddb14d07a6d0d15fe212ef9003e8b562d71dcda1c1b0342844d740bf` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 17 Jul 2020 07:03:23 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 91557 content-type application/octet-stream
GET H2	200	facebox.js.download Show response ajmstech.com/Ex/Ex/files/	9 KB 9 KB	298ms 296ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/facebox.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `c42610390202a19758e4ac20c38b7486f9dd835983f9c9fd2f9b502bdc34f8f1` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 17 Jul 2020 07:03:23 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 9532 content-type application/octet-stream
GET H2	200	jquery.js.download Show response ajmstech.com/Ex/Ex/files/	19 KB 19 KB	298ms 297ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/jquery.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `f30ebb1472bde171aa06b132012a19bcc2c1e9e7ad417f1e3c0e2831cf18cbb5` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 17 Jul 2020 07:03:23 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 19227 content-type application/octet-stream
GET H2	200	javascript1.js.download Show response ajmstech.com/Ex/Ex/files/	3 KB 3 KB	301ms 300ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/javascript1.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `dc0b0453209bbdab5a6a2f5d32cf9b9330bba6ce1db2b103fea5a8053cb3f180` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Fri, 17 Jul 2020 07:03:23 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 3319 content-type application/octet-stream
GET H2	200	pdf.png ajmstech.com/Ex/Ex/	73 KB 73 KB	107ms 105ms	Image image/png	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/pdf.png Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 17 Jul 2020 07:03:24 GMT last-modified Tue, 25 Jul 2017 05:52:22 GMT server LiteSpeed content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 74994 expires Fri, 24 Jul 2020 07:03:24 GMT
GET H2	200	pdf2013.png ajmstech.com/Ex/Ex/	12 KB 12 KB	116ms 115ms	Image image/png	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/pdf2013.png Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 17 Jul 2020 07:03:24 GMT last-modified Tue, 25 Jul 2017 05:51:18 GMT server LiteSpeed content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 12290 expires Fri, 24 Jul 2020 07:03:24 GMT
GET H2	404	294.gif ajmstech.com/Ex/Ex/	33 KB 33 KB	586ms 585ms	Image text/html	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/294.gif Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `194aa0360d442c911150f5fa9d79ced3961395232b810a999d17ef00f1723ca3` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 17 Jul 2020 07:03:24 GMT content-encoding br server LiteSpeed vary Accept-Encoding content-type text/html; charset=UTF-8 status 404 cache-control no-cache, must-revalidate, max-age=0 link <https://ajmstech.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	pdf.gif ajmstech.com/Ex/Ex/	471 B 536 B	118ms 117ms	Image image/gif	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/pdf.gif Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software LiteSpeed / Resource Hash `43ede7e97d30a62bd2b883edaa7d1cee07b6b55881049319cf512e938b434069` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 17 Jul 2020 07:03:24 GMT last-modified Tue, 25 Jul 2017 06:16:20 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 471 expires Fri, 24 Jul 2020 07:03:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ajmstech.com/	1970-01-19 11:03:32	Name: wp_ticket_com_wp_session Value: e902965419a790d9c8740718798055f9%7C%7C1595012604%7C%7C1595010804

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajmstech.com
209.222.99.106
194aa0360d442c911150f5fa9d79ced3961395232b810a999d17ef00f1723ca3
220a01d3ddb14d07a6d0d15fe212ef9003e8b562d71dcda1c1b0342844d740bf
2cf361c56c1d9998c849987a5c17741fd73d715b54ce93700b5c6b0559232cfd
43ede7e97d30a62bd2b883edaa7d1cee07b6b55881049319cf512e938b434069
7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798
9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf
c42610390202a19758e4ac20c38b7486f9dd835983f9c9fd2f9b502bdc34f8f1
dc0b0453209bbdab5a6a2f5d32cf9b9330bba6ce1db2b103fea5a8053cb3f180
f30ebb1472bde171aa06b132012a19bcc2c1e9e7ad417f1e3c0e2831cf18cbb5

ajmstech.com Open in urlscan Pro 209.222.99.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

242 kBTransfer

245 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

ajmstech.com Open in urlscan Pro
209.222.99.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

242 kB
Transfer

245 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!