projects.nerdster.com.au
Open in
urlscan Pro
103.14.203.63
Malicious Activity!
Public Scan
URL:
http://projects.nerdster.com.au/xvc0080Ioo/jUegoscst.php
Submission: On July 05 via automatic, source openphish
Submission: On July 05 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 103.14.203.63, located in
Australia and
belongs to AS45671-NET-AU Wholesale Services Provider, AU.
The main domain is projects.nerdster.com.au.
This is the only time projects.nerdster.com.au was scanned on urlscan.io!
This is the only time projects.nerdster.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon Japan (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 103.14.203.63 103.14.203.63 | 45671 (AS45671-N...) (AS45671-NET-AU Wholesale Services Provider) | |
| 1 | 54.192.202.118 54.192.202.118 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 9 | 2 |
8
103.14.203.63
(Australia)
ASN45671 (AS45671-NET-AU Wholesale Services Provider, AU)
PTR: devops.nerdster.com.au
ASN45671 (AS45671-NET-AU Wholesale Services Provider, AU)
PTR: devops.nerdster.com.au
| projects.nerdster.com.au |
1
54.192.202.118
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-202-118.fra50.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-202-118.fra50.r.cloudfront.net
| m.media-amazon.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
nerdster.com.au
projects.nerdster.com.au |
964 KB |
| 1 |
media-amazon.com
m.media-amazon.com |
26 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | projects.nerdster.com.au |
projects.nerdster.com.au
|
| 1 | m.media-amazon.com |
projects.nerdster.com.au
|
| 9 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
| Images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2019-05-02 - 2020-04-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://projects.nerdster.com.au/xvc0080Ioo/jUegoscst.php
Frame ID: ED622C8DDF921AB69D0815F95818E515
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
UNIX
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Unix/i
OpenSSL
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
jUegoscst.php
projects.nerdster.com.au/xvc0080Ioo/ |
20 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
5.css
projects.nerdster.com.au/xvc0080Ioo/img/ |
134 KB 135 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
6.css
projects.nerdster.com.au/xvc0080Ioo/img/ |
31 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
7.css
projects.nerdster.com.au/xvc0080Ioo/img/ |
950 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fwcim._CB509002374_.js
projects.nerdster.com.au/xvc0080Ioo/img/ |
383 KB 383 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
3.js
projects.nerdster.com.au/xvc0080Ioo/img/ |
314 KB 314 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v2.js
projects.nerdster.com.au/xvc0080Ioo/img/ |
74 KB 74 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v21.js
projects.nerdster.com.au/xvc0080Ioo/img/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
AmazonUIBaseCSS-sprite_1x_weblab_AUI_100106_T1-08d1bf2f96db8cd72c14d8d205cb94b2af51d2a2._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon Japan (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| ue_t0 number| aPageStart object| amzn object| jQuery16409739583504347857 boolean| __fwcimLoaded object| fwcim function| Zepto function| $0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
m.media-amazon.com
projects.nerdster.com.au
103.14.203.63
54.192.202.118
07dd83c1b0c7b5977cec1f1fcad4f95cc3ff3ec00546af21232181cea472c0e3
7f2b422b2fe6c70185a090ca6e14de9e396e1a33c9f7d7746b82b78db41703a9
a257c36ecf60a5ae63d4155f6d9eba596ef6cb9662ef695cc38e5c5a8b3608e2
a666e2fe7f1713ba2d6bf2ebab888b709cf1ada6b18b7c0b141dfee28d1aee9b
b6a0ba657ebd0f6b36ed1cee78a251d4323f24f2d72ac9800a1346915d26fc04
c854c61bda66041aa3f86a791e9606bddcd87ad170a6476c25207f27b966d8e9
e4837c049b80d1b7da5474cc986147553adfaef41f49dc85fbe8087caddab96e
e66c2f5abffb537836789a8cad7d2fe66c7a4935b1e45ca5d8028c126a180853
f55def887e4c9c29609f96234386fb7711827e685b3853c045c24b2f8b3ac593