onewayticketphil.com Open in urlscan Pro
185.199.109.153  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response onewayticketphil.com/exofficio-boxer-brief/	6 KB 3 KB	135ms 74ms	Document text/html	185.199.109.153 FASTLY
General Check archive.org Show headers Download Go to Full URL http://onewayticketphil.com/exofficio-boxer-brief/ Protocol HTTP/1.1 Server 185.199.109.153 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS cdn-185-199-109-153.github.com Software GitHub.com / Resource Hash d06e3264eda1de6aa585a3d9ec249a7b2c6b14edab803babce4d1675a04dd97e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Accept-Ranges bytes Access-Control-Allow-Origin * Age 0 Cache-Control max-age=600 Connection keep-alive Content-Encoding gzip Content-Length 1979 Content-Type text/html; charset=utf-8 Date Fri, 08 Mar 2024 22:16:13 GMT ETag W/"5eac3d97-1665" Last-Modified Fri, 01 May 2020 15:17:43 GMT Server GitHub.com Vary Accept-Encoding Via 1.1 varnish X-Cache MISS X-Cache-Hits 0 X-Fastly-Request-ID 5e28e7e24f9f5cc8f0a021aaad189d6fb919f09f X-GitHub-Request-Id 2AB2:8C4D:13306B9:16FE031:65EB8E2C X-Served-By cache-mia-kmia1760084-MIA X-Timer S1709936174.912529,VS0,VE41 expires Fri, 08 Mar 2024 22:26:13 GMT x-proxy-cache MISS
GET H2	200	AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	165 KB 19 KB	309ms 76ms	Stylesheet text/css	2600:9000:266a:400:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Requested by Host: onewayticketphil.com URL: http://onewayticketphil.com/exofficio-boxer-brief/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:266a:400:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb Request headers accept-language en-US,en;q=0.9 Referer http://onewayticketphil.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Fri, 01 Dec 2023 12:53:45 GMT content-encoding br via 1.1 f80d7132f63b09d3c980a7f84c3ec4a4.cloudfront.net (CloudFront) age 6128367 x-amz-cf-pop JFK52-P5 edge-cache-tag x-cache-957,/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min x-nginx-cache-status HIT x-cache Hit from cloudfront server-timing cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="jBzt6UGvDdxecDccKvwodaKeEA4tExYZCgH6F8KFjTmvaMOcyOpYPg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=2,provider;desc="cf" alt-svc h3=":443"; ma=86400 surrogate-key x-cache-957 /images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min last-modified Wed, 17 Jul 2013 22:49:32 GMT server Server content-type text/css access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id f55b4652-d436-470a-9cd3-fb4ad460411f timing-allow-origin https://www.amazon.com x-amz-cf-id jBzt6UGvDdxecDccKvwodaKeEA4tExYZCgH6F8KFjTmvaMOcyOpYPg== expires Thu, 26 Nov 2043 12:53:45 GMT
GET H2	200	Captcha_kljpltwnqu.jpg images-na.ssl-images-amazon.com/captcha/huyzhwry/	5 KB 5 KB	316ms 83ms	Image image/jpeg	2600:9000:266a:400:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/captcha/huyzhwry/Captcha_kljpltwnqu.jpg Requested by Host: onewayticketphil.com URL: http://onewayticketphil.com/exofficio-boxer-brief/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:266a:400:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash ba47461949efda833d9eea27b9ac905f8c48b297c76fc74b2e453f938e80da7b Request headers accept-language en-US,en;q=0.9 Referer http://onewayticketphil.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Fri, 08 Mar 2024 10:45:25 GMT via 1.1 f80d7132f63b09d3c980a7f84c3ec4a4.cloudfront.net (CloudFront) age 35795 x-amz-cf-pop JFK52-P5 edge-cache-tag x-cache-001,/captcha/huyzhwry/Captcha_kljpltwnqu x-cache Hit from cloudfront x-nginx-cache-status HIT server-timing provider;desc="cf" alt-svc h3=":443"; ma=86400 content-length 5046 surrogate-key x-cache-001 /captcha/huyzhwry/Captcha_kljpltwnqu last-modified Wed, 08 Feb 2012 17:14:34 GMT server Server content-type image/jpeg access-control-allow-origin * x-amz-ir-id 0eef6475-fc77-4e55-9835-fa9fafe4434e accept-ranges bytes x-amz-cf-id mX4nKKIJ0mBK0VKmFw_p3_1MUuXmcDPGFhp0higk3qF5_o8mI7MFlw==
GET H2	200	requestId=HKH3012MPZP2BFMDPBJR&js=1 fls-na.amazon.com/1/oc-csi/1/OP/	43 B 150 B	190ms 59ms	Image image/gif	44.194.136.132 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://fls-na.amazon.com/1/oc-csi/1/OP/requestId=HKH3012MPZP2BFMDPBJR&js=1 Requested by Host: onewayticketphil.com URL: http://onewayticketphil.com/exofficio-boxer-brief/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.194.136.132 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-194-136-132.compute-1.amazonaws.com Software / Resource Hash a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce Request headers accept-language en-US,en;q=0.9 Referer http://onewayticketphil.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Fri, 08 Mar 2024 22:16:14 GMT x-amzn-requestid cc993235-0fb1-4e19-b32f-8d79aa6247fa content-length 43 content-type image/gif
GET H2	200	csm-captcha-instrumentation.min._V1709936174297_.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	2 KB 1 KB	106ms 105ms	Script application/x-javascript	2600:9000:266a:400:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1709936174297_.js Requested by Host: onewayticketphil.com URL: http://onewayticketphil.com/exofficio-boxer-brief/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:266a:400:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a Request headers accept-language en-US,en;q=0.9 Referer http://onewayticketphil.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Fri, 08 Mar 2024 22:16:14 GMT content-encoding br via 1.1 f80d7132f63b09d3c980a7f84c3ec4a4.cloudfront.net (CloudFront) x-amz-cf-pop JFK52-P5 edge-cache-tag x-cache-850,/images/G/01/csminstrumentation/csm-captcha-instrumentation.min x-nginx-cache-status MISS x-cache Miss from cloudfront server-timing provider;desc="cf" alt-svc h3=":443"; ma=86400 surrogate-key x-cache-850 /images/G/01/csminstrumentation/csm-captcha-instrumentation.min last-modified Mon, 12 Oct 2015 09:22:39 GMT server Server content-type application/x-javascript access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id faf6bc2e-ac41-4bf1-8911-93be56e2e4e8 timing-allow-origin https://www.amazon.com x-amz-cf-id 8xjl7LadYloN0xnmkggm-fhU_L7q1PNAbf9NFczZb0olPAXvjVSmtg== expires Thu, 03 Mar 2044 22:16:14 GMT
GET H2	200	aui_sprite_0007-1x._V383827579_.png images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/	17 KB 17 KB	76ms 75ms	Image image/png	2600:9000:266a:400:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/aui_sprite_0007-1x._V383827579_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:266a:400:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa Request headers accept-language en-US,en;q=0.9 Referer https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Fri, 21 Jul 2023 15:11:09 GMT via 1.1 f80d7132f63b09d3c980a7f84c3ec4a4.cloudfront.net (CloudFront) age 19983905 x-amz-cf-pop JFK52-P5 edge-cache-tag x-cache-846,/images/G/01/amazonui/sprites/aui_sprite_0007-1x x-nginx-cache-status HIT x-cache Hit from cloudfront server-timing provider;desc="cf" alt-svc h3=":443"; ma=86400 content-length 16972 surrogate-key x-cache-846 /images/G/01/amazonui/sprites/aui_sprite_0007-1x last-modified Wed, 15 May 2013 01:55:34 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 6eef3435-ceab-4342-9443-c088d5a6e681 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id 0N-H0w_zj_xS5RGvUF2evc7IA2KI4kVBQBNtryVw7VcNzCTPu6MzwA== expires Sat, 04 Jul 2043 01:09:17 GMT
GET H3	200	ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	7 KB 3 KB	68ms 67ms	Script application/x-javascript	2600:9000:266a:400:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1709936174297_.js Protocol H3 Security QUIC, , AES_128_GCM Server 2600:9000:266a:400:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37 Request headers accept-language en-US,en;q=0.9 Referer http://onewayticketphil.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Thu, 19 Oct 2023 05:19:11 GMT content-encoding br via 1.1 08c43f80b07f0023f38f7f0e417359b4.cloudfront.net (CloudFront) x-amz-cf-pop JFK52-P5 age 6898812 x-cache Hit from cloudfront edge-cache-tag x-cache-495,/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 x-nginx-cache-status HIT server-timing provider;desc="cf",cdn-rid;desc="rzW4PYlED9rbt54Bny-82kKHwS8Qi3T850FrxUDJmXR2TNSFeacn6w==",cdn-downstream-fbl;dur=2 alt-svc h3=":443"; ma=86400 surrogate-key x-cache-495 /images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 last-modified Wed, 26 Aug 2015 14:52:49 GMT server Server content-type application/x-javascript access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 93784284-960f-4365-896b-c9c65114e1bf timing-allow-origin https://www.amazon.com x-amz-cf-id rzW4PYlED9rbt54Bny-82kKHwS8Qi3T850FrxUDJmXR2TNSFeacn6w== expires Wed, 14 Oct 2043 05:19:11 GMT
GET H3	200	ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	19 KB 8 KB	71ms 71ms	Script application/x-javascript	2600:9000:266a:400:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1709936174297_.js Protocol H3 Security QUIC, , AES_128_GCM Server 2600:9000:266a:400:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042 Request headers accept-language en-US,en;q=0.9 Referer http://onewayticketphil.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 30 Sep 2023 00:21:17 GMT content-encoding br via 1.1 08c43f80b07f0023f38f7f0e417359b4.cloudfront.net (CloudFront) x-amz-cf-pop JFK52-P5 age 13902897 x-cache Hit from cloudfront edge-cache-tag x-cache-512,/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-s x-nginx-cache-status HIT server-timing provider;desc="cf",cdn-rid;desc="tCNNd-ujgTYDPZ2Zf1hJWsYKqQOYLsWf1EfnQisQxSVStM6U0kBI0g==",cdn-downstream-fbl;dur=5 alt-svc h3=":443"; ma=86400 surrogate-key x-cache-512 /images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-s last-modified Thu, 01 Oct 2015 10:17:43 GMT server Server content-type application/x-javascript access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id d6f55b63-8437-46cd-895d-3623a35aeb3b timing-allow-origin https://www.amazon.com x-amz-cf-id tCNNd-ujgTYDPZ2Zf1hJWsYKqQOYLsWf1EfnQisQxSVStM6U0kBI0g== expires Mon, 07 Sep 2043 01:00:28 GMT
POST H/1.1	204 No Content	/ fls-na.amazon.com/1/batch/1/OE/	0 293 B	174ms 116ms	Ping text/plain	50.19.125.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Protocol HTTP/1.1 Server 50.19.125.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-50-19-125-90.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://onewayticketphil.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin * Date Fri, 08 Mar 2024 22:16:15 GMT Access-Control-Expose-Headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date Connection keep-alive x-amzn-RequestId a2fd4d45-b9a9-4dea-b159-b2a6519e3b91 Content-Type text/plain

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| ue_t0 object| ue_csm object| ue string| ue_furl string| ue_mid string| ue_sid string| ue_sn string| ue_id object| elem object| ue_modules object| cel_widgets string| ue_cel_ns number| ue_skc object| ue_err number| ueinit function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop function| ueLogError object| ue_cel object| ue_pdm object| ue_vpm object| ue_fem object| ue_mcm object| ue_mmm object| ue_rpl object| ue_kpm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			onewayticketphil.com/	1970-01-20 19:38:22	Name: csm-sid Value: 582-8782389-1149366

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fls-na.amazon.com
images-na.ssl-images-amazon.com
onewayticketphil.com
185.199.109.153
2600:9000:266a:400:1d:d7f6:39d3:d9e1
44.194.136.132
50.19.125.90
35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a
49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa
5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb
877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37
ba47461949efda833d9eea27b9ac905f8c48b297c76fc74b2e453f938e80da7b
d06e3264eda1de6aa585a3d9ec249a7b2c6b14edab803babce4d1675a04dd97e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855