alamosagco.top Open in urlscan Pro
2606:4700:3037::6815:1dbb  Malicious Activity! Public Scan

URL: https://alamosagco.top/r/JPM/
Submission: On August 13 via automatic, source phishtank

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3037::6815:1dbb, located in United States and belongs to CLOUDFLARENET, US. The main domain is alamosagco.top.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 11th 2021. Valid for: a year.
This is the only time alamosagco.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:303... 13335 (CLOUDFLAR...)
4 1
Apex Domain
Subdomains
Transfer
4 alamosagco.top
alamosagco.top
88 KB
4 1
Domain Requested by
4 alamosagco.top alamosagco.top
4 1

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-08-11 -
2022-08-10
a year crt.sh

This page contains 1 frames:

Primary Page: https://alamosagco.top/r/JPM/
Frame ID: 4777C6C1FB39A588F102BE2C7C6C29A4
Requests: 4 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

88 kB
Transfer

86 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
alamosagco.top/r/JPM/
1 KB
961 B
Document
General
Full URL
https://alamosagco.top/r/JPM/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1dbb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71559156af53b41631ab68c0e2ea7f406a2e717b701229b2a6bae4197b918520

Request headers

:method
GET
:authority
alamosagco.top
:scheme
https
:path
/r/JPM/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 03:06:41 GMT
content-type
text/html
last-modified
Tue, 23 Aug 2016 05:56:48 GMT
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rDXEn8ysP%2FNAq8OWuu8xrxlA7zvo%2BEo6V0HWtzglcvv7PUOVHqzY7Aw1c1i9msb8vkfuirR6EJhuHy1WQv8%2FN27FaQy7nt5a%2FrpBzayS%2FYdGvOaliW0t82rdkeR%2BzAMVymishPmakS5m6D4lug%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
67deba9a2bd34a91-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
logon.png
alamosagco.top/r/JPM/
2 KB
3 KB
Image
General
Full URL
https://alamosagco.top/r/JPM/logon.png
Requested by
Host: alamosagco.top
URL: https://alamosagco.top/r/JPM/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1dbb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c2c8857135fc632f8ce73b25fc6a56d67f18d173c07ad2cbc5b9f4298d8db4d

Request headers

:path
/r/JPM/logon.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
alamosagco.top
referer
https://alamosagco.top/r/JPM/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://alamosagco.top/r/JPM/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 03:06:41 GMT
cf-cache-status
HIT
last-modified
Thu, 18 Aug 2016 09:50:56 GMT
server
cloudflare
age
395
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z1Esnpjy1zzlud9jQj%2FJfP2Sqcy1AsXt%2BqpOE9eqTAkY4Of0AbrH3BL%2B8HbvuI1FPX%2FNrA9YmgfmtL%2Fg1UXhDWN%2FoezubyWLFWDRj%2F4%2FHdbXtAAMFgppS6SMbkY4WEK8C04gU8jc%2FRx7yYhnmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
67deba9b8f900605-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
2160
w.png
alamosagco.top/r/JPM/
121 B
730 B
Image
General
Full URL
https://alamosagco.top/r/JPM/w.png
Requested by
Host: alamosagco.top
URL: https://alamosagco.top/r/JPM/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1dbb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21acf758a3ee2eb84b46ca8c51be22a92fd84086f04c00d3f12b33c3bb5876bf

Request headers

:path
/r/JPM/w.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
alamosagco.top
referer
https://alamosagco.top/r/JPM/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://alamosagco.top/r/JPM/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 03:06:41 GMT
cf-cache-status
HIT
last-modified
Wed, 09 Sep 2015 22:01:38 GMT
server
cloudflare
age
395
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QahbJGFPJJu4pfgNU6SSmp1pbj9qlYHm6K1%2FBnKKUiF1eu4nr1HmFZ69qMWJ3RdFreIqUmvLTIomzzuvjCT3rmCpNAtC8n0VIz5N3YlJlytlw9KAr8vv%2B3HXR87r78X18PBk1LGFN7cv%2Fi70cg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
67deba9b8f8e0605-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
121
bg.png
alamosagco.top/r/JPM/
83 KB
84 KB
Image
General
Full URL
https://alamosagco.top/r/JPM/bg.png
Requested by
Host: alamosagco.top
URL: https://alamosagco.top/r/JPM/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1dbb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89264065a318def64942cc72e735f0f8a8d713bd64040303b00db06c241e78ab

Request headers

:path
/r/JPM/bg.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
alamosagco.top
referer
https://alamosagco.top/r/JPM/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://alamosagco.top/r/JPM/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 03:06:41 GMT
cf-cache-status
HIT
last-modified
Thu, 18 Aug 2016 11:49:32 GMT
server
cloudflare
age
395
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7B%2Fr6kF7Ekt5IYb%2FDWpaPfucyPolikbNBMp73%2FHH6Jp1GCQb2FcdGB4srIHBuMTW%2BuExxaRv6vtoyfByJ0Xke%2Fm%2FgM1NTNUf4zFd5JTrdrZkdye3hqp%2F5%2BUd5MTCDtDdMBgpk%2FfiPl%2F4cTwBYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
67deba9b8f910605-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
84926

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies