global.amecanexpress.com.nyrealestateeducation.com Open in urlscan Pro
92.205.1.14 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/allostd32notymo
Effective URL:
https://global.amecanexpress.com.nyrealestateeducation.com/
Submission: On November 08 via manual (November 8th 2021, 3:15:54 pm UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 92.205.1.14, located in Strasbourg, France and belongs to GODADDY-SXB, DE. The main domain is global.amecanexpress.com.nyrealestateeducation.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 4th 2021. Valid for: 3 months.

This is the only time global.amecanexpress.com.nyrealestateeducation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6814:8b41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
11	92.205.1.14 92.205.1.14	21499 (GODADDY-SXB) (GODADDY-SXB)
11	1

1 2606:4700:10::6814:8b41 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.168.131.241 (United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

92919117.reicolorado.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 92.205.1.14 (Strasbourg, France)

ASN21499 (GODADDY-SXB, DE)
PTR: ip-92-205-1-14.ip.secureserver.net

global.amecanexpress.com.nyrealestateeducation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	nyrealestateeducation.com global.amecanexpress.com.nyrealestateeducation.com	71 KB
1	reicolorado.com 1 redirects 92919117.reicolorado.com	250 B
1	tinyurl.com 1 redirects tinyurl.com	407 B
11	3

	Domain	Requested by
11	global.amecanexpress.com.nyrealestateeducation.com	global.amecanexpress.com.nyrealestateeducation.com
1	92919117.reicolorado.com	1 redirects
1	tinyurl.com	1 redirects
11	3

This site contains no links.

Subject Issuer	Validity	Valid
global.amecanexpress.com.nyrealestateeducation.com cPanel, Inc. Certification Authority	`2021-11-04` - `2022-02-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://global.amecanexpress.com.nyrealestateeducation.com/
Frame ID: B7A99464B2C60A2F348E02AB293EE399
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In to My Account | American Express US

Page URL History Show full URLs

https://tinyurl.com/allostd32notymo HTTP 301
http://92919117.reicolorado.com/ HTTP 301
https://global.amecanexpress.com.nyrealestateeducation.com/ Page URL

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

71 kB
Transfer

92 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/allostd32notymo HTTP 301
http://92919117.reicolorado.com/ HTTP 301
https://global.amecanexpress.com.nyrealestateeducation.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response global.amecanexpress.com.nyrealestateeducation.com/ Redirect Chain https://tinyurl.com/allostd32notymo http://92919117.reicolorado.com/ https://global.amecanexpress.com.nyrealestateeducation.com/	12 KB 3 KB	101ms 48ms	Document text/html	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / PHP/5.6.40 Resource Hash `10d2c285cd47b380f3a155f1832e4cbcafcb7f67b11be22c7e37cacf213a8028` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers x-powered-by PHP/5.6.40 vary Accept-Encoding content-encoding gzip content-length 2928 content-type text/html; charset=UTF-8 date Mon, 08 Nov 2021 15:15:50 GMT server Apache Redirect headers Server nginx/1.20.1 Date Mon, 08 Nov 2021 15:15:49 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection close Location https://global.amecanexpress.com.nyrealestateeducation.com
GET H2	200	ishmistb.css global.amecanexpress.com.nyrealestateeducation.com/isgonz/	6 KB 2 KB	12ms 11ms	Stylesheet text/css	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmistb.css Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `9d2b4f1f22c8789ca875c2d24c1681af4eecc4bed2407ceac8b0a143a9f2e46a` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT content-encoding gzip last-modified Thu, 28 Oct 2021 17:02:16 GMT server Apache etag "15e033e-1942-5cf6cac331600-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2065
GET H2	200	ishmistc.css global.amecanexpress.com.nyrealestateeducation.com/isgonz/	585 B 362 B	12ms 11ms	Stylesheet text/css	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmistc.css Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `7849cd37c9e0f6fb2c05d08990cf4e023fb01d27bbd728f1316539b466f67d59` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT content-encoding gzip last-modified Thu, 28 Oct 2021 17:02:16 GMT server Apache etag "15e033f-249-5cf6cac331600-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 303
GET H2	200	ishmista.css global.amecanexpress.com.nyrealestateeducation.com/isgonz/	11 KB 2 KB	12ms 12ms	Stylesheet text/css	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmista.css Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `24954caaea5171a4e31c6dd5d8a3722215a82e588969dc0ce8d6961f347df654` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT content-encoding gzip last-modified Thu, 28 Oct 2021 17:02:16 GMT server Apache etag "15e033d-2b1e-5cf6cac331600-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2049
GET H2	200	clear.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	43 B 95 B	11ms 10ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/clear.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Sun, 17 Nov 2019 06:38:26 GMT server Apache accept-ranges bytes etag "15e033c-2b-597851406fc80" content-length 43 content-type image/gif
GET H2	200	llafaic.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	4 KB 4 KB	11ms 11ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/llafaic.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Sun, 17 Nov 2019 06:38:26 GMT server Apache accept-ranges bytes etag "15e0345-1148-597851406fc80" content-length 4424 content-type image/gif
GET H2	200	llafaig.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	181 B 265 B	11ms 10ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/llafaig.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `184e5c3955026e19d8f1488b7103d1e55b5ebe2bb177ba35445e9c19b50b5570` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Sun, 17 Nov 2019 06:38:26 GMT server Apache accept-ranges bytes etag "15e0349-b5-597851406fc80" content-length 181 content-type image/gif
GET H2	200	llafaia.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	19 KB 19 KB	15ms 14ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/llafaia.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `b233901fcdfe0e98965aa037733641927c0fc548f055e84bb5ae11bec6420154` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Tue, 18 May 2021 01:01:26 GMT server Apache accept-ranges bytes etag "15e0343-4af1-5c2903fdbc580" content-length 19185 content-type image/gif
GET H2	200	llafaid.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	35 KB 36 KB	11ms 11ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/llafaid.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmista.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `62f15599210bcdfd0a7ed3a445ccef2514c403e323961d4c386000d5b716d7fa` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmista.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Sun, 17 Nov 2019 06:38:26 GMT server Apache accept-ranges bytes etag "15e0346-8dea-597851406fc80" content-length 36330 content-type image/gif
GET H2	200	llafaii.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	3 KB 3 KB	14ms 14ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/llafaii.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmistb.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `ac595759703754418524d900166983a09ad2a9126cc0d0d6dd77beafafbcba86` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmistb.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Sun, 17 Nov 2019 06:38:26 GMT server Apache accept-ranges bytes etag "15e034b-a31-597851406fc80" content-length 2609 content-type image/gif
GET H2	200	llafaif.gif global.amecanexpress.com.nyrealestateeducation.com/isgonz/	934 B 988 B	14ms 14ms	Image image/gif	92.205.1.14 GODADDY-SXB
General Check archive.org Show headers Download Go to Show image Full URL https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/llafaif.gif Requested by Host: global.amecanexpress.com.nyrealestateeducation.com URL: https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmista.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.205.1.14 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-1-14.ip.secureserver.net Software Apache / Resource Hash `194b37addb793c71c33302afb3239216455121d66303067e15904eedd0a66b12` Request headers Accept-Language de-DE,de;q=0.9 Referer https://global.amecanexpress.com.nyrealestateeducation.com/isgonz/ishmista.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 15:15:50 GMT last-modified Sun, 17 Nov 2019 06:38:26 GMT server Apache accept-ranges bytes etag "15e0348-3a6-597851406fc80" content-length 934 content-type image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

92919117.reicolorado.com
global.amecanexpress.com.nyrealestateeducation.com
tinyurl.com
184.168.131.241
2606:4700:10::6814:8b41
92.205.1.14
10d2c285cd47b380f3a155f1832e4cbcafcb7f67b11be22c7e37cacf213a8028
184e5c3955026e19d8f1488b7103d1e55b5ebe2bb177ba35445e9c19b50b5570
194b37addb793c71c33302afb3239216455121d66303067e15904eedd0a66b12
24954caaea5171a4e31c6dd5d8a3722215a82e588969dc0ce8d6961f347df654
62f15599210bcdfd0a7ed3a445ccef2514c403e323961d4c386000d5b716d7fa
7849cd37c9e0f6fb2c05d08990cf4e023fb01d27bbd728f1316539b466f67d59
9d2b4f1f22c8789ca875c2d24c1681af4eecc4bed2407ceac8b0a143a9f2e46a
ac595759703754418524d900166983a09ad2a9126cc0d0d6dd77beafafbcba86
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b233901fcdfe0e98965aa037733641927c0fc548f055e84bb5ae11bec6420154
b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e

global.amecanexpress.com.nyrealestateeducation.com Open in urlscan Pro 92.205.1.14 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

1 IPs

2 Countries

71 kBTransfer

92 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

global.amecanexpress.com.nyrealestateeducation.com Open in urlscan Pro
92.205.1.14 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

71 kB
Transfer

92 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!