o8q8i38ur98dfi.cc
Open in
urlscan Pro
184.168.119.143
Malicious Activity!
Public Scan
Effective URL: http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Submission: On March 04 via automatic, source openphish — Scanned from DE
Summary
This is the only time o8q8i38ur98dfi.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 9 | 184.168.119.143 184.168.119.143 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
7 | 1 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-119-143.ip.secureserver.net
o8q8i38ur98dfi.cc |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
o8q8i38ur98dfi.cc
2 redirects
o8q8i38ur98dfi.cc |
111 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
9 | o8q8i38ur98dfi.cc |
2 redirects
o8q8i38ur98dfi.cc
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en
Frame ID: 6B6A3DBDF99D97D6CDDB0BB970109DA9
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Amazon ログインPage URL History Show full URLs
-
http://o8q8i38ur98dfi.cc/
HTTP 302
http://o8q8i38ur98dfi.cc/ap/index.php HTTP 302
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://o8q8i38ur98dfi.cc/
HTTP 302
http://o8q8i38ur98dfi.cc/ap/index.php HTTP 302
http://o8q8i38ur98dfi.cc/ap/signin.php?country=DE-Germany&lang=en Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
signin.php
o8q8i38ur98dfi.cc/ap/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.css
o8q8i38ur98dfi.cc/ap/library/bootstrap/css/ |
141 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.css
o8q8i38ur98dfi.cc/ap/sheets/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.js
o8q8i38ur98dfi.cc/ap/library/jquery/ |
148 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.js
o8q8i38ur98dfi.cc/ap/library/pooper/ |
28 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.min.js
o8q8i38ur98dfi.cc/ap/library/bootstrap/js/ |
67 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amazonui.png
o8q8i38ur98dfi.cc/ap/assets/img/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
o8q8i38ur98dfi.cc/ | Name: PHPSESSID Value: cc9660531e301310cad87ab90d9e0047 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
o8q8i38ur98dfi.cc
184.168.119.143
38ffe02b7083d0d0a7eb50ced86cf2f56f42066151078457e4d37e1139d76717
66e730aff72788bb008ddacd2fc467613011a49613e751a51594e5f549d836a2
6778e1c02adde018f442ea27a4542f75f10e56035ac315cac633d47fb640d704
6f5d47bd8e547a77f52cbac5e2bd8f44d0fcc2820295ca910129e9136e303ae6
c4b6ed2645519ec2c128badb2a2e7720052f8441ffa94c4f0bceca02311004da
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
fa25824ecd6e226af5f42b7fa1a377f11768d958acb5bbf8c38f21a4ae77edde