ajmstech.com Open in urlscan Pro
209.222.99.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fi...
Submission: On July 05 via api (July 5th 2020, 3:09:58 am UTC) from TW

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 209.222.99.106, located in Philadelphia, United States and belongs to RELIABLESITE, US. The main domain is ajmstech.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 17th 2020. Valid for: 3 months.

This is the only time ajmstech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	209.222.99.106 209.222.99.106		23470 (RELIABLESITE) (RELIABLESITE)
10	1

10 209.222.99.106 (Philadelphia, United States)

ASN23470 (RELIABLESITE, US)
PTR: cherry.whitelabelwebserver.com

ajmstech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	ajmstech.com ajmstech.com	242 KB
10	1

	Domain	Requested by
10	ajmstech.com	ajmstech.com
10	1

This site contains no links.

Subject Issuer	Validity	Valid
ajmstech.com cPanel, Inc. Certification Authority	`2020-05-17` - `2020-08-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Frame ID: ADEFEDF4184064F4A6FE77044E1B733C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

242 kB
Transfer

245 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response ajmstech.com/Ex/Ex/	4 KB 2 KB	1408ms 130ms	Document text/html	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `2cf361c56c1d9998c849987a5c17741fd73d715b54ce93700b5c6b0559232cfd` Request headers :method GET :authority ajmstech.com :scheme https :path /Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 content-type text/html; charset=UTF-8 content-length 1417 content-encoding br vary Accept-Encoding date Sun, 05 Jul 2020 03:09:40 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	facebox.css ajmstech.com/Ex/Ex/files/	1 KB 473 B	96ms 95ms	Stylesheet text/css	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/facebox.css Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 03:09:40 GMT content-encoding br last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 365 expires Sun, 12 Jul 2020 03:09:40 GMT
GET H2	200	jquery-1.js.download Show response ajmstech.com/Ex/Ex/files/	89 KB 90 KB	97ms 95ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/jquery-1.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `220a01d3ddb14d07a6d0d15fe212ef9003e8b562d71dcda1c1b0342844d740bf` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 91557 content-type application/octet-stream
GET H2	200	facebox.js.download Show response ajmstech.com/Ex/Ex/files/	9 KB 9 KB	247ms 246ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/facebox.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `c42610390202a19758e4ac20c38b7486f9dd835983f9c9fd2f9b502bdc34f8f1` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 9532 content-type application/octet-stream
GET H2	200	jquery.js.download Show response ajmstech.com/Ex/Ex/files/	19 KB 19 KB	248ms 247ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/jquery.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `f30ebb1472bde171aa06b132012a19bcc2c1e9e7ad417f1e3c0e2831cf18cbb5` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 19227 content-type application/octet-stream
GET H2	200	javascript1.js.download Show response ajmstech.com/Ex/Ex/files/	3 KB 3 KB	252ms 251ms	Script application/octet-stream	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://ajmstech.com/Ex/Ex/files/javascript1.js.download Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `dc0b0453209bbdab5a6a2f5d32cf9b9330bba6ce1db2b103fea5a8053cb3f180` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 03:10:38 GMT server LiteSpeed accept-ranges bytes content-length 3319 content-type application/octet-stream
GET H2	200	pdf.png ajmstech.com/Ex/Ex/	73 KB 73 KB	95ms 94ms	Image image/png	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/pdf.png Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 05:52:22 GMT server LiteSpeed content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 74994 expires Sun, 12 Jul 2020 03:09:40 GMT
GET H2	200	pdf2013.png ajmstech.com/Ex/Ex/	12 KB 12 KB	112ms 111ms	Image image/png	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/pdf2013.png Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 05:51:18 GMT server LiteSpeed content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 12290 expires Sun, 12 Jul 2020 03:09:40 GMT
GET H2	404	294.gif ajmstech.com/Ex/Ex/	33 KB 33 KB	594ms 593ms	Image text/html	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/294.gif Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `194aa0360d442c911150f5fa9d79ced3961395232b810a999d17ef00f1723ca3` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 03:09:41 GMT content-encoding br server LiteSpeed vary Accept-Encoding content-type text/html; charset=UTF-8 status 404 cache-control no-cache, must-revalidate, max-age=0 link <https://ajmstech.com/wp-json/>; rel="https://api.w.org/" expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	pdf.gif ajmstech.com/Ex/Ex/	471 B 536 B	114ms 114ms	Image image/gif	209.222.99.106 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://ajmstech.com/Ex/Ex/pdf.gif Requested by Host: ajmstech.com URL: https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.222.99.106 Philadelphia, United States, ASN23470 (RELIABLESITE, US), Reverse DNS cherry.whitelabelwebserver.com Software LiteSpeed / Resource Hash `43ede7e97d30a62bd2b883edaa7d1cee07b6b55881049319cf512e938b434069` Request headers Referer https://ajmstech.com/Ex/Ex/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 03:09:40 GMT last-modified Tue, 25 Jul 2017 06:16:20 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 471 expires Sun, 12 Jul 2020 03:09:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ajmstech.com/	1970-01-19 10:46:01	Name: wp_ticket_com_wp_session Value: c138ee38e8df0e3244e222ab2cc127fe%7C%7C1593961781%7C%7C1593959981

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajmstech.com
209.222.99.106
194aa0360d442c911150f5fa9d79ced3961395232b810a999d17ef00f1723ca3
220a01d3ddb14d07a6d0d15fe212ef9003e8b562d71dcda1c1b0342844d740bf
2cf361c56c1d9998c849987a5c17741fd73d715b54ce93700b5c6b0559232cfd
43ede7e97d30a62bd2b883edaa7d1cee07b6b55881049319cf512e938b434069
7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798
9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf
c42610390202a19758e4ac20c38b7486f9dd835983f9c9fd2f9b502bdc34f8f1
dc0b0453209bbdab5a6a2f5d32cf9b9330bba6ce1db2b103fea5a8053cb3f180
f30ebb1472bde171aa06b132012a19bcc2c1e9e7ad417f1e3c0e2831cf18cbb5

ajmstech.com Open in urlscan Pro 209.222.99.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

242 kBTransfer

245 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

ajmstech.com Open in urlscan Pro
209.222.99.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

242 kB
Transfer

245 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!