pageaexp.com
Open in
urlscan Pro
101.100.238.90
Malicious Activity!
Public Scan
Effective URL: http://pageaexp.com/b134567/?request_type=LogonHandler&Face=en_NL_fc764a063cb8945d741fee38f302c434frauds_89c63493fd4...
Submission: On August 22 via manual from US
Summary
This is the only time pageaexp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: American Express (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.189.202.206 54.189.202.206 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 2 | 45.40.140.1 45.40.140.1 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
2 21 | 101.100.238.90 101.100.238.90 | 58621 (VODIEN-AS...) (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd) | |
3 | 104.111.250.201 104.111.250.201 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
23 | 3 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-189-202-206.us-west-2.compute.amazonaws.com
dlvr.it |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-140-1.ip.secureserver.net
x.co |
ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG)
PTR: v238090.serveradd.com
pageaexp.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-250-201.deploy.static.akamaitechnologies.com
www.aexp-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
pageaexp.com
2 redirects
pageaexp.com |
2 MB |
3 |
aexp-static.com
www.aexp-static.com |
182 KB |
2 |
x.co
2 redirects
x.co |
299 B |
1 |
dlvr.it
1 redirects
dlvr.it |
283 B |
0 |
americanexpress.com
Failed
iwmap.americanexpress.com Failed |
|
23 | 5 |
Domain | Requested by | |
---|---|---|
21 | pageaexp.com |
2 redirects
pageaexp.com
|
3 | www.aexp-static.com |
pageaexp.com
|
2 | x.co | 2 redirects |
1 | dlvr.it | 1 redirects |
0 | iwmap.americanexpress.com Failed |
pageaexp.com
|
23 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
global.americanexpress.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA |
2018-08-08 - 2020-07-23 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://pageaexp.com/b134567/?request_type=LogonHandler&Face=en_NL_fc764a063cb8945d741fee38f302c434frauds_89c63493fd4a49037a8f47528c7af91d&dispatch=8d6dd1d2f090ddc8e5fe4e7e288821d8fdedbde1
Frame ID: EC24CD3B2623E4CC5603478A4717F3CF
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://dlvr.it/RBdVVD
HTTP 301
http://x.co/aexp010?346343453453 HTTP 301
https://x.co/aexp010?346343453453 HTTP 302
http://pageaexp.com/secure HTTP 302
http://pageaexp.com/b134567?request_type=LogonHandler&Face=en_NL_fc764a063cb8945d741fee38f302c43... HTTP 301
http://pageaexp.com/b134567/?request_type=LogonHandler&Face=en_NL_fc764a063cb8945d741fee38f302c4... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: HeK20478lp
Search URL Search Domain Scan URL
Title: LoT20317g In
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://dlvr.it/RBdVVD
HTTP 301
http://x.co/aexp010?346343453453 HTTP 301
https://x.co/aexp010?346343453453 HTTP 302
http://pageaexp.com/secure HTTP 302
http://pageaexp.com/b134567?request_type=LogonHandler&Face=en_NL_fc764a063cb8945d741fee38f302c434frauds_89c63493fd4a49037a8f47528c7af91d&dispatch=8d6dd1d2f090ddc8e5fe4e7e288821d8fdedbde1 HTTP 301
http://pageaexp.com/b134567/?request_type=LogonHandler&Face=en_NL_fc764a063cb8945d741fee38f302c434frauds_89c63493fd4a49037a8f47528c7af91d&dispatch=8d6dd1d2f090ddc8e5fe4e7e288821d8fdedbde1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
pageaexp.com/b134567/ Redirect Chain
|
97 KB 97 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dls.css
pageaexp.com/b134567/login_files/ |
332 KB 333 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jembut.css
pageaexp.com/b134567/login_files/ |
25 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jembutlagi.css
pageaexp.com/b134567/login_files/ |
14 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.css
pageaexp.com/b134567/login_files/ |
17 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
penting.css
pageaexp.com/b134567/login_files/ |
94 KB 94 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
penting2.css
pageaexp.com/b134567/login_files/ |
55 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
17.js
pageaexp.com/b134567/login_files/ |
32 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mmpackage-1.js
pageaexp.com/b134567/login_files/ |
60 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.js
pageaexp.com/b134567/login_files/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ali-metrics.js
pageaexp.com/b134567/login_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dls-logo-bluebox-solid.svg
pageaexp.com/b134567/login_files/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NL.gif
pageaexp.com/b134567/login_files/icon/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Amex-Mobile-App-web-banner.JPG
pageaexp.com/b134567/login_files/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dls-logo-line.svg
pageaexp.com/b134567/login_files/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors.js
pageaexp.com/b134567/login_files/ |
702 KB 702 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
axp-common.js
pageaexp.com/b134567/login_files/ |
708 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
axp-page-wrapper.js
pageaexp.com/b134567/login_files/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
axp-global-header.js
pageaexp.com/b134567/login_files/ |
216 KB 216 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Regular.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.0/package/dist/fonts/ |
75 KB 76 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-icons.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.0/package/dist/iconfont/ |
34 KB 34 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Medium.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.0/package/dist/fonts/ |
71 KB 72 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
info
iwmap.americanexpress.com/monitoring/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- iwmap.americanexpress.com
- URL
- https://iwmap.americanexpress.com/monitoring/info?preflight
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: American Express (Financial)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| validation function| confirm_by_id0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dlvr.it
iwmap.americanexpress.com
pageaexp.com
www.aexp-static.com
x.co
iwmap.americanexpress.com
101.100.238.90
104.111.250.201
45.40.140.1
54.189.202.206
0d53bb21f593a270be9786e8b8b4ce00c7c8db379036f7e61428834dc6932af4
22320420f855654ba3a8150026d72114ff9019a94671344c3edf457d9d44eddf
2332f8212e81c87c1728eab60a7226e443da1e2f05c71d001eb091af4e2ad88d
269e76492eee90453a140d6c95ca1c70d38fdc06d69a86453b2135aa16b9fdde
272282e1401c29c61c14b5478dd8d37c3e7a0a63ea5f34425c5faa813dfa41fb
2996ed3e0c89a7c50ae11dc3555d18491fe37cbd17e196bd2014d1368e167491
4702d2669cfe9a70b060230de5eed54403e62eb3d5b28ba4706e07783d24e3dc
689456042db63489ee5ffa4a6ae59f8e58db3659192b78bdb95608225e61d638
77c8765867314a40192a1e0365b013e2a16393c6b07f29d41d1ca69f824ee315
7ef974010abfe71fb92dc3f53e3948e1e544cf6821bf9802ea0bf35fa8fe5af6
831d4de8cc553942b94f2b2c7a39fb8d406ad97a349e71305996738642adba2d
ad9cb30d7f3e96ff82b394c2921eb6ec9e06447d6ff02066b4deaee5f10a875c
adce79a29b1d883b481a33a7322ce00f4a3ad9e76d0270cd85646bf9cbfc5597
b7aa917e54033ce796a8370220afc1a341e575fcfd1fa23360254d2037f9d45e
c25b292af1134a30c44e34d7ac70fb65bd76c57ab8ee95194e25de37c58ee4e8
c54acb431126b02f6f21433f327386a4cd637ef846267cc2cad712c47d3ce162
d5d7822393d3103ec421f72f09c7f7c78948c68da112031c0afd1c0b0da92c08
db0a0ce29e5122cadf979658627a665fa87dfe7dbe266b224e444787196af585
e1d7ba21683b4ad63d8e34d198d95a8641005f73a0c38768c648b3a42dce408a
e3843afba5f27163c11b2ec8c5488df6959edeb444ca3c13f2c7602c6d7aeeda