Submitted URL: http://o8q8i38ur98dfi.cc/
Effective URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Submission: On March 04 via automatic, source openphish — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 184.168.119.143, located in Singapore, Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is o8q8i38ur98dfi.cc.
This is the only time o8q8i38ur98dfi.cc was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
2 9 184.168.119.143 26496 (AS-26496-...)
7 1
Apex Domain
Subdomains
Transfer
9 o8q8i38ur98dfi.cc
o8q8i38ur98dfi.cc
111 KB
7 1
Domain Requested by
9 o8q8i38ur98dfi.cc 2 redirects o8q8i38ur98dfi.cc
7 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Frame ID: 6B6A3DBDF99D97D6CDDB0BB970109DA9
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://o8q8i38ur98dfi.cc/ HTTP 302
    http://o8q8i38ur98dfi.cc/ap/index.php HTTP 302
    http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

110 kB
Transfer

416 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://o8q8i38ur98dfi.cc/ HTTP 302
    http://o8q8i38ur98dfi.cc/ap/index.php HTTP 302
    http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request signin.php?country=DE-Germany&lang=en
o8q8i38ur98dfi.cc/ap/
Redirect Chain
  • http://o8q8i38ur98dfi.cc/
  • http://o8q8i38ur98dfi.cc/ap/index.php
  • http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
3 KB
1 KB
Document
General
Full URL
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache / PHP/7.4.26
Resource Hash
6f5d47bd8e547a77f52cbac5e2bd8f44d0fcc2820295ca910129e9136e303ae6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Server
Apache
X-Powered-By
PHP/7.4.26
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1128
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Fri, 04 Mar 2022 01:08:09 GMT
Server
Apache
X-Powered-By
PHP/7.4.26
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
location
signin.php?country=DE-Germany&lang=en
Content-Length
0
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
main.min.css
o8q8i38ur98dfi.cc/ap/library/bootstrap/css/
141 KB
20 KB
Stylesheet
General
Full URL
http://o8q8i38ur98dfi.cc/ap/library/bootstrap/css/main.min.css
Requested by
Host: o8q8i38ur98dfi.cc
URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
c4b6ed2645519ec2c128badb2a2e7720052f8441ffa94c4f0bceca02311004da

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 May 2018 21:25:54 GMT
Server
Apache
ETag
"4d81b2f-235f3-56bcc8c3f1c80-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
20565
index.css
o8q8i38ur98dfi.cc/ap/sheets/
4 KB
2 KB
Stylesheet
General
Full URL
http://o8q8i38ur98dfi.cc/ap/sheets/index.css
Requested by
Host: o8q8i38ur98dfi.cc
URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
66e730aff72788bb008ddacd2fc467613011a49613e751a51594e5f549d836a2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Jul 2020 20:06:20 GMT
Server
Apache
ETag
"4d81b39-1175-5a97af11f0700-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
1276
main.min.js
o8q8i38ur98dfi.cc/ap/library/jquery/
148 KB
38 KB
Script
General
Full URL
http://o8q8i38ur98dfi.cc/ap/library/jquery/main.min.js
Requested by
Host: o8q8i38ur98dfi.cc
URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
38ffe02b7083d0d0a7eb50ced86cf2f56f42066151078457e4d37e1139d76717

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 10:55:58 GMT
Server
Apache
ETag
"4d817c3-24e18-5add9c7f84b80-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
38962
main.min.js
o8q8i38ur98dfi.cc/ap/library/pooper/
28 KB
8 KB
Script
General
Full URL
http://o8q8i38ur98dfi.cc/ap/library/pooper/main.min.js
Requested by
Host: o8q8i38ur98dfi.cc
URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
fa25824ecd6e226af5f42b7fa1a377f11768d958acb5bbf8c38f21a4ae77edde

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 10:55:32 GMT
Server
Apache
ETag
"4d81869-6ebc-5add9c66b9100-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
7677
main.min.js
o8q8i38ur98dfi.cc/ap/library/bootstrap/js/
67 KB
15 KB
Script
General
Full URL
http://o8q8i38ur98dfi.cc/ap/library/bootstrap/js/main.min.js
Requested by
Host: o8q8i38ur98dfi.cc
URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
6778e1c02adde018f442ea27a4542f75f10e56035ac315cac633d47fb640d704

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 11:00:04 GMT
Server
Apache
ETag
"4d81b2d-10b4d-5add9d6a1f500-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
14498
amazonui.png
o8q8i38ur98dfi.cc/ap/assets/img/
26 KB
26 KB
Image
General
Full URL
http://o8q8i38ur98dfi.cc/ap/assets/img/amazonui.png
Requested by
Host: o8q8i38ur98dfi.cc
URL: http://o8q8i38ur98dfi.cc/ap/sheets/index.css
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://o8q8i38ur98dfi.cc/ap/sheets/index.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 04 Mar 2022 01:08:10 GMT
Last-Modified
Wed, 05 Aug 2020 20:01:36 GMT
Server
Apache
ETag
"4d81b5a-6607-5ac26d6cc4800"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
26119

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

1 Cookies

Domain/Path Name / Value
o8q8i38ur98dfi.cc/ Name: PHPSESSID
Value: cc9660531e301310cad87ab90d9e0047