alexmarine-eg.com Open in urlscan Pro
192.185.112.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://alexmarine-eg.com/po.htm
Submission: On March 31 via manual (March 31st 2019, 6:21:44 am UTC) from SG

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 192.185.112.224, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is alexmarine-eg.com.

This is the only time alexmarine-eg.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	192.185.112.224 192.185.112.224	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
1	107.180.40.14 107.180.40.14	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
4	104.111.236.50 104.111.236.50	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
9	104.111.250.201 104.111.250.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	106.247.251.66 106.247.251.66	3786 (LGDACOM L...) (LGDACOM LG DACOM Corporation)
1 2	2a01:7c8:ec:0... 2a01:7c8:ec:0:149:210:196:91	20857 (TRANSIP-A...) (TRANSIP-AS Amsterdam)
17	6

1 192.185.112.224 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: ns810.websitewelcome.com

alexmarine-eg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.180.40.14 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-40-14.ip.secureserver.net

comnac.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.236.50 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-236-50.deploy.static.akamaitechnologies.com

online.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.111.250.201 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-250-201.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 106.247.251.66 (Seoul, Korea, Republic Of)

ASN3786 (LGDACOM LG DACOM Corporation, KR)

106.247.251.66	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a01:7c8:ec:0:149:210:196:91 (Netherlands) 1 redirects

ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL)

www.s2.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	aexp-static.com www.aexp-static.com	124 KB
4	americanexpress.com online.americanexpress.com	74 KB
2	s2.be 1 redirects www.s2.be	674 B
1	comnac.com comnac.com	205 KB
1	alexmarine-eg.com alexmarine-eg.com	687 B
17	5

	Domain	Requested by
9	www.aexp-static.com	alexmarine-eg.com
4	online.americanexpress.com	alexmarine-eg.com
2	www.s2.be	1 redirects alexmarine-eg.com
1	comnac.com	alexmarine-eg.com
1	alexmarine-eg.com
17	5

This site contains no links.

Subject Issuer	Validity	Valid
online.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2018-08-08` - `2020-07-23`	2 years	crt.sh
www.s2.be Let's Encrypt Authority X3	`2019-02-06` - `2019-05-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://alexmarine-eg.com/po.htm
Frame ID: 6729E48786E510F597B939A3368FAD94
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

17
Requests

82 %
HTTPS

17 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

405 kB
Transfer

1133 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://www.s2.be/aexp-static/spacer.png HTTP 301
https://www.s2.be/aexp-static/spacer.png

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request po.htm Show response
alexmarine-eg.com/ 651 B
687 B 385ms
129ms Document
text/html 192.185.112.224
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Server: 192.185.112.224 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: ns810.websitewelcome.com
Software: nginx/1.14.1 /
Resource Hash: bfb0d792ca6786bcb5b76540d9c31bbc5b752cb763f0819c962e0f2e8a6a0716

Request headers

Host: alexmarine-eg.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx/1.14.1
Date: Sun, 31 Mar 2019 06:21:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sat, 30 Mar 2019 13:58:02 GMT
Content-Encoding: gzip

GET
H/1.1 200
OK bpk.js Show response
comnac.com/ 842 KB
205 KB 261ms
130ms Script
application/javascript 107.180.40.14
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://comnac.com/bpk.js
Requested by: Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Server: 107.180.40.14 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-107-180-40-14.ip.secureserver.net
Software: Apache /
Resource Hash: d7cb08a2f847c00ab7482aaebabb30ec8c678fe1fc2480a8e52ba6eefde8aaa0

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sun, 31 Mar 2019 06:21:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Mar 2019 14:47:52 GMT
Server: Apache
ETag: "8fcc25a-d2611-5851485ab7600-gzip"
Vary: Accept-Encoding,User-Agent
Upgrade: h2,h2c
Transfer-Encoding: chunked
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5

GET
H2 200 fuidFypDefault.css
online.americanexpress.com/myca/fuidfyp/us/resources/css/ 19 KB
7 KB 90ms
14ms Stylesheet
text/css 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.americanexpress.com/myca/fuidfyp/us/resources/css/fuidFypDefault.css

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

e599503c3bdee1fef6065e575091caef7a56b463e751886b298304379eab47b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Nov 2016 09:17:19 GMT
date: Sun, 31 Mar 2019 06:21:28 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 6707

GET
H2 200 inav_responsive.css
www.aexp-static.com/nav/ngn/css/ 93 KB
12 KB 82ms
14ms Stylesheet
text/css 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/css/inav_responsive.css

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

7f1b85f13e643de7a8dd568b6073849d777a677a7d699229b8eb2fdb787ff2b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
content-encoding: gzip
last-modified: Wed, 11 Apr 2018 19:54:17 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=86400
accept-ranges: bytes
timing-allow-origin: *
content-length: 11740

GET
H/1.1 200
OK footer.php
106.247.251.66/tr/ 1 KB
1 KB 872ms
569ms Image
image/gif 106.247.251.66
LGDACOM LG DACOM ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://106.247.251.66/tr/footer.php?image=att.gif
Requested by: Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Server: 106.247.251.66 Seoul, Korea, Republic Of, ASN3786 (LGDACOM LG DACOM Corporation, KR),
Reverse DNS
Software: Apache/2.4.23 (Win64) PHP/5.6.25 / PHP/5.6.25
Resource Hash: 8a1afe334fda16d81d21995b656b62f3d746e46826a1927ca3e81d7a723b094e

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 31 Mar 2019 02:45:39 GMT
Server: Apache/2.4.23 (Win64) PHP/5.6.25
Connection: Keep-Alive
X-Powered-By: PHP/5.6.25
Content-Length: 1101
Keep-Alive: timeout=5, max=100
Content-Type: image/gif

GET
H/1.1

404
Not Found

spacer.png
www.s2.be/aexp-static/
Redirect Chain

http://www.s2.be/aexp-static/spacer.png
https://www.s2.be/aexp-static/spacer.png

0
417 B

66ms
24ms

Image
text/html

2a01:7c8:ec:0:149:210:196:91
TRANSIP-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.s2.be/aexp-static/spacer.png
Requested by: Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a01:7c8:ec:0:149:210:196:91 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

Location: https://www.s2.be/aexp-static/spacer.png
Date: Sun, 31 Mar 2019 06:21:28 GMT
X-TransIP-Balancer: lb1
X-TransIP-Backend: web246
Server: Apache
Content-Length: 248
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 OCA_body-background.gif
online.americanexpress.com/myca/oce/us/oce/images/actreg/ 16 KB
16 KB 10ms
9ms Image
image/gif 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.americanexpress.com/myca/oce/us/oce/images/actreg/OCA_body-background.gif

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

c05cee2eb8aacab52bba3b3dd940b68055fc11a088302418c776efa459f63884

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
last-modified: Thu, 15 Nov 2018 20:11:11 GMT
date: Sun, 31 Mar 2019 06:21:28 GMT
content-type: image/gif
status: 200
cache-control: private, must-revalidate, max-age=176520
accept-ranges: bytes
content-length: 16020

GET
H2 200 clear.gif
www.aexp-static.com/nav/ngn/img/ 43 B
214 B 13ms
12ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/clear.gif

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:23:00 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 43

GET
H2 200 logo_bluebox_1x.gif
www.aexp-static.com/nav/ngn/img/ 4 KB
4 KB 29ms
28ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/logo_bluebox_1x.gif

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:26:41 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 4424

GET
H2 200 spacer.png
online.americanexpress.com/myca/fuidfyp/us/resources/images/ 922 B
1 KB 11ms
11ms Image
image/png 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.americanexpress.com/myca/fuidfyp/us/resources/images/spacer.png

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

e989c2542a6af77569f5b65286bf132dd113c75810c71866dacba5d025d68bc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 08 Nov 2016 09:17:19 GMT
date: Sun, 31 Mar 2019 06:21:28 GMT
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE,TRACE
content-type: image/png
status: 200
access-control-expose-headers: Date
cache-control: private, must-revalidate, max-age=405808
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: account_token,account_tokens,locale,,correlation_id,security_token
content-length: 922

GET
H2 200 iNav_ngi_sprite_new.gif
www.aexp-static.com/nav/ngn/img/ 23 KB
23 KB 22ms
22ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/iNav_ngi_sprite_new.gif?ver=0916_01

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

0d4e7d13d424c4569af233a3188ac42edaa093a12bced0dba6095c00047006e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:26:29 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 23367

GET
H2 200 img_shdw_mainNav.png
www.aexp-static.com/nav/ngn/img/ 143 B
338 B 27ms
26ms Image
image/png 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/img_shdw_mainNav.png

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

d3c6dbfeb63c1155df3a80a04d72d9c0c95ed561d54c9694019c28eac1920c1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://alexmarine-eg.com/po.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:24:34 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 143

GET
H2 200 3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.aexp-static.com/nav/ngn/fonts/ 36 KB
37 KB 57ms
10ms Font
application/x-font-woff 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
Origin: http://alexmarine-eg.com

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:12:19 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
access-control-max-age: 15778463
access-control-allow-methods: GET
content-type: application/x-font-woff
status: 200
cache-control: max-age=29030400
accept-ranges: bytes
timing-allow-origin: *
content-length: 37153

GET
H2 200 amex-fuid-sprite.png
online.americanexpress.com/myca/fuidfyp/us/resources/images/ 49 KB
50 KB 14ms
12ms Image
image/png 104.111.236.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.americanexpress.com/myca/fuidfyp/us/resources/images/amex-fuid-sprite.png

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.236.50 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-236-50.deploy.static.akamaitechnologies.com

Software

Resource Hash

9a12464e4b2e913955e124313a5ab47e63b771a41bdba9390d008212a1b52052

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.americanexpress.com/myca/fuidfyp/us/resources/css/fuidFypDefault.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 08 Nov 2016 09:17:19 GMT
date: Sun, 31 Mar 2019 06:21:28 GMT
access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE,TRACE
content-type: image/png
status: 200
access-control-expose-headers: Date
cache-control: private, must-revalidate, max-age=166666
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: account_token,account_tokens,locale,,correlation_id,security_token
content-length: 50415

GET
H2 200 iNav_sprite_footer.gif
www.aexp-static.com/nav/ngn/img/ 5 KB
5 KB 23ms
22ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/iNav_sprite_footer.gif?ver=0916_02

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

c5728ebd8f225043ec8b85f79c9964f133136f91b9bb260eb69437ce9af4573a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:26:31 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 5012

GET
H2 200 iNav_sprite_footer1.gif
www.aexp-static.com/nav/ngn/img/ 5 KB
6 KB 27ms
26ms Image
image/gif 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/iNav_sprite_footer1.gif?ver=0917_11

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b3be0c1dca2d9a00d8da591e1c209fced4d3ee588efb495eed4191aa2558e658

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Mon, 11 Sep 2017 19:23:42 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 5603

GET
H2 200 0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
www.aexp-static.com/nav/ngn/fonts/ 37 KB
37 KB 61ms
19ms Font
application/x-font-woff 104.111.250.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff

Requested by

Host: alexmarine-eg.com
URL: http://alexmarine-eg.com/po.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.250.201 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-250-201.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://www.aexp-static.com/nav/ngn/css/inav_responsive.css
Origin: http://alexmarine-eg.com

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:12:14 GMT
server: IBM_HTTP_Server
access-control-allow-origin: *
date: Sun, 31 Mar 2019 06:21:28 GMT
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff
status: 200
cache-control: max-age=29030400
accept-ranges: bytes
timing-allow-origin: *
content-length: 37949

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alexmarine-eg.com
comnac.com
online.americanexpress.com
www.aexp-static.com
www.s2.be
104.111.236.50
104.111.250.201
106.247.251.66
107.180.40.14
192.185.112.224
2a01:7c8:ec:0:149:210:196:91
0d4e7d13d424c4569af233a3188ac42edaa093a12bced0dba6095c00047006e3
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c
7f1b85f13e643de7a8dd568b6073849d777a677a7d699229b8eb2fdb787ff2b9
8a1afe334fda16d81d21995b656b62f3d746e46826a1927ca3e81d7a723b094e
9a12464e4b2e913955e124313a5ab47e63b771a41bdba9390d008212a1b52052
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3be0c1dca2d9a00d8da591e1c209fced4d3ee588efb495eed4191aa2558e658
b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e
bfb0d792ca6786bcb5b76540d9c31bbc5b752cb763f0819c962e0f2e8a6a0716
c05cee2eb8aacab52bba3b3dd940b68055fc11a088302418c776efa459f63884
c5728ebd8f225043ec8b85f79c9964f133136f91b9bb260eb69437ce9af4573a
d3c6dbfeb63c1155df3a80a04d72d9c0c95ed561d54c9694019c28eac1920c1b
d7cb08a2f847c00ab7482aaebabb30ec8c678fe1fc2480a8e52ba6eefde8aaa0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e599503c3bdee1fef6065e575091caef7a56b463e751886b298304379eab47b8
e989c2542a6af77569f5b65286bf132dd113c75810c71866dacba5d025d68bc5

alexmarine-eg.com Open in urlscan Pro 192.185.112.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

82 %HTTPS

17 %IPv6

5 Domains

5 Subdomains

6 IPs

3 Countries

405 kBTransfer

1133 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

alexmarine-eg.com Open in urlscan Pro
192.185.112.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

82 %
HTTPS

17 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

405 kB
Transfer

1133 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!