www.updated-billi.com Open in urlscan Pro
192.64.117.70  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.updated-billi.com/	99 KB 12 KB	532ms 180ms	Document text/html	192.64.117.70 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.updated-billi.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.64.117.70 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business133-5.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash 7bee0ffb858a673be9b01fa6d7c294cb314d81546409d8a46aa6903af5077fb8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.updated-billi.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 12:38:48 GMT server Apache x-powered-by PHP/7.2.34 vary Accept-Encoding content-encoding gzip content-type text/html; charset=UTF-8 x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload; referrer-policy no-referrer-when-downgrade
GET H2	200	mobile_login.css www.updated-billi.com/assets/css/	210 KB 36 KB	283ms 283ms	Stylesheet text/css	192.64.117.70 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.updated-billi.com/assets/css/mobile_login.css Requested by Host: www.updated-billi.com URL: https://www.updated-billi.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.64.117.70 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business133-5.web-hosting.com Software Apache / Resource Hash 18fb397d2782484fe19e39551a0ae0ac31db7d80f7d5bb66740b3cab30a6a9a0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /assets/css/mobile_login.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority www.updated-billi.com referer https://www.updated-billi.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.updated-billi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 12:38:48 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Sat, 23 Feb 2019 11:05:58 GMT server Apache x-frame-options SAMEORIGIN content-type text/css x-xss-protection 1; mode=block strict-transport-security max-age=31536000; includeSubDomains; preload; accept-ranges bytes vary Accept-Encoding content-length 36623 x-content-type-options nosniff
GET H2	200	51tK4vb5u4L._RC%7C31zsNEvQFKL.css,01+72+wCC9L.css_.css images-na.ssl-images-amazon.com/images/I/	69 KB 12 KB	77ms 27ms	Stylesheet text/css	2600:9000:218f:6a00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/51tK4vb5u4L._RC%7C31zsNEvQFKL.css,01+72+wCC9L.css_.css?AUIClients/AmazonNavigationMobileMetaAsset Requested by Host: www.updated-billi.com URL: https://www.updated-billi.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:6a00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 533aa3146ba4a00a68d57ab5f5a3d2b0801596f2751cd528d456a354c62361c0 Request headers Referer https://www.updated-billi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 22 Apr 2021 06:34:50 GMT content-encoding gzip age 3806065 edge-cache-tag x-cache-918,/images/I/51tK4vb5u4L x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-918 /images/I/51tK4vb5u4L last-modified Tue, 08 Jan 2019 04:32:59 GMT server Server content-type text/css; charset=utf-8 via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id db013640-39f2-40bc-875f-b700b43a3182 x-amz-cf-pop CDG52-P2 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id avYE1lz0vjJbjr3H2wt6etymlvDob97uAb9ykioc5XbJ9jzvxdbq-Q== expires Sun, 14 Apr 2041 11:24:23 GMT
GET H2	200	new-nav-sm-smile-sprite-global-1x_blueheaven._CB496507362_.png images-na.ssl-images-amazon.com/images/G/01/gno/sprites/	11 KB 12 KB	36ms 35ms	Image image/png	2600:9000:218f:6a00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven._CB496507362_.png Requested by Host: www.updated-billi.com URL: https://www.updated-billi.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218f:6a00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d Request headers Referer https://www.updated-billi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 11:43:26 GMT via 1.1 ef16cf332760e013a5fd2d10ab2b11ec.cloudfront.net (CloudFront) age 3323 edge-cache-tag x-cache-942,/images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven x-cache Hit from cloudfront content-length 11329 surrogate-key x-cache-942 /images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven last-modified Wed, 02 May 2018 02:39:57 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=3600,public x-amz-ir-id 3c980001-54b2-4d30-84f8-21060cbf589a x-amz-cf-pop CDG52-P2 timing-allow-origin https://www.amazon.com x-amz-cf-id QKUYY-TE_JA5uqd-HcVOkPZHLXRZOunimcu-SikztetNTdzI3gBqtA== expires Wed, 02 Jun 2021 12:13:16 GMT
GET H2	200	AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1._V2_.png m.media-amazon.com/images/G/01/AUIClients/	60 KB 61 KB	22ms 7ms	Image image/png	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1._V2_.png Requested by Host: www.updated-billi.com URL: https://www.updated-billi.com/assets/css/mobile_login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a Request headers Referer https://www.updated-billi.com/assets/css/mobile_login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 12:38:49 GMT last-modified Fri, 22 Sep 2017 00:23:21 GMT age 2308397 x-cache HIT from fastly, HIT from fastly content-type image/png access-control-allow-origin * expires Wed, 01 May 2041 19:25:32 GMT cache-control max-age=630720000,public x-amz-ir-id b19aa02f-79c7-4549-b115-222a1185fa8a accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 61917 x-served-by cache-dca17782-DCA, cache-fra19169-FRA
GET H2	200	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	18ms 6ms	Font application/font-woff2	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Requested by Host: www.updated-billi.com URL: https://www.updated-billi.com/assets/css/mobile_login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7 Request headers Origin https://www.updated-billi.com Referer https://www.updated-billi.com/assets/css/mobile_login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 12:38:49 GMT last-modified Sat, 11 Jun 2016 01:31:21 GMT age 37587078 x-cache HIT from fastly, HIT from fastly content-type application/font-woff2; charset=utf-8 access-control-allow-origin * expires Mon, 19 Mar 2040 11:47:31 GMT cache-control max-age=630720000,public x-amz-ir-id c4938db2-267d-4756-b34a-9652d1c73e87 accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 16616 x-served-by cache-dca17725-DCA, cache-fra19178-FRA
GET H2	200	AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 16 KB	15ms 8ms	Font application/font-woff2	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 Requested by Host: www.updated-billi.com URL: https://www.updated-billi.com/assets/css/mobile_login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327 Request headers Origin https://www.updated-billi.com Referer https://www.updated-billi.com/assets/css/mobile_login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 02 Jun 2021 12:38:49 GMT last-modified Sat, 11 Jun 2016 01:31:24 GMT age 37627342 x-cache HIT from fastly, HIT from fastly content-type application/font-woff2; charset=utf-8 access-control-allow-origin * expires Mon, 19 Mar 2040 00:36:28 GMT cache-control max-age=630720000,public x-amz-ir-id 16827405-4151-4d26-b98a-f59d6eba6a1c accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 16460 x-served-by cache-dca17763-DCA, cache-fra19178-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-na.ssl-images-amazon.com
m.media-amazon.com
www.updated-billi.com
192.64.117.70
2600:9000:218f:6a00:1d:d7f6:39cf:a761
2a04:4e42:3::272
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327
18fb397d2782484fe19e39551a0ae0ac31db7d80f7d5bb66740b3cab30a6a9a0
533aa3146ba4a00a68d57ab5f5a3d2b0801596f2751cd528d456a354c62361c0
7bee0ffb858a673be9b01fa6d7c294cb314d81546409d8a46aa6903af5077fb8
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a