urlscan.io logo urlscan.io
SecurityTrails logo

amh.ro Open in urlscan Pro
195.88.81.226  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://amh.ro/index.htm
Submission: On December 15 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 20 HTTP transactions. The main IP is 195.88.81.226, located in Romania and belongs to SPACE-AS, RO. The main domain is amh.ro.
This is the only time amh.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alibaba (Online)

Domain & IP information

IP Address AS Autonomous System
1 195.88.81.226 50939 (SPACE-AS)
19 198.11.132.198 45102 (CNNIC-ALI...)
20 2
Apex Domain
Subdomains		 Transfer
19 alibaba.com
login.alibaba.com
15 KB
1 amh.ro
amh.ro
4 KB
20 2
Domain Requested by
19 login.alibaba.com amh.ro
1 amh.ro
20 2
Subject Issuer Validity Valid
*.alibaba.com
GlobalSign Organization Validation CA - SHA256 - G2		 2019-08-15 -
2020-08-15		 a year crt.sh

This page contains 1 frames:

Primary Page: http://amh.ro/index.htm
Frame ID: 8BDD64028740E4079C8839071CD505D3
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

20
Requests

95 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

19 kB
Transfer

38 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.htm
amh.ro/ 		11 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://amh.ro/index.htm
Protocol
HTTP/1.1
Server
195.88.81.226 , Romania, ASN50939 (SPACE-AS, RO),
Reverse DNS
core2.hostingspace.ro
Software
LiteSpeed /
Resource Hash
697824ae2fad5014b925945d1a3c12931ba532512fc5643446a2fb21eddae41d

Request headers

Host
amh.ro
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Last-Modified
Sat, 31 May 2014 16:08:36 GMT
Content-Type
text/html
Content-Length
4082
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Sun, 15 Dec 2019 03:32:04 GMT
Accept-Ranges
bytes
Server
LiteSpeed
Connection
close
layout.css
login.alibaba.com/css/4v/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/css/4v/layout.css
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
common.css
login.alibaba.com/css/4v/ 		13 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/css/4v/common.css
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
4279f72abed7e2209625f76cedad468177a685ea177b90cec8907509bb1eacb0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 15 Dec 2019 03:32:06 GMT
content-encoding
gzip
last-modified
Wed, 04 Dec 2019 02:53:48 GMT
vary
Accept-Encoding
content-type
text/css
status
200
ufe-result
A6
strict-transport-security
max-age=31536000
timing-allow-origin
*
eagleid
0be3752c15763807260848729ec121
ae_login.js
login.alibaba.com/js/library/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/js/library/ae_login.js
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
beacon_en.js
login.alibaba.com/js/library/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/js/library/beacon_en.js
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
sorcing-signin-20110212.css
login.alibaba.com/css/4v/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/css/4v/sorcing-signin-20110212.css
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
da053296855e4e4f95057f4da441debc7183c5134841f048483b40017d683b89
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 15 Dec 2019 03:32:06 GMT
content-encoding
gzip
last-modified
Wed, 04 Dec 2019 02:53:48 GMT
vary
Accept-Encoding
content-type
text/css
status
200
ufe-result
A6
strict-transport-security
max-age=31536000
timing-allow-origin
*
eagleid
0be3752c15763807260848730ec121
email_suggestion.js
login.alibaba.com/js/library/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/js/library/email_suggestion.js
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
xman.css
login.alibaba.com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/css/xman.css?version=20110104
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
blank.html
login.alibaba.com/js/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/js/blank.html
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
beacon_en.js
login.alibaba.com/js/library/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/js/library/beacon_en.js
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
headCap.gif
login.alibaba.com/images/eng/style/css_images/navigation/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/css_images/navigation/headCap.gif
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://login.alibaba.com/css/4v/common.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
logo_alibaba_sprite.gif
login.alibaba.com/images/xman/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/xman/logo_alibaba_sprite.gif
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://login.alibaba.com/css/4v/common.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
email_suggestion.js
login.alibaba.com/js/library/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/js/library/email_suggestion.js
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
signin_head_bg.png
login.alibaba.com/images/eng/style/css_images/ 		630 B
845 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/css_images/signin_head_bg.png
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
c503a04975b22bed74b1fcca57e22de46147170280df9c321803ba4f2482dc58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin-20110212.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 15 Dec 2019 03:32:06 GMT
last-modified
Wed, 04 Dec 2019 02:53:48 GMT
etag
"5de71fbc-276"
strict-transport-security
max-age=31536000
content-type
image/png
status
200
ufe-result
A6
accept-ranges
bytes
timing-allow-origin
*
content-length
630
eagleid
0be3752c15763807265758759ec121
alibaba_logo.png
login.alibaba.com/images/eng/style/logo/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/logo/alibaba_logo.png
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
0219efe34cf993a3703ef8d47a913b8532b7015ea4ce1689c93712253a31af6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin-20110212.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 15 Dec 2019 03:32:06 GMT
last-modified
Wed, 04 Dec 2019 02:53:48 GMT
etag
"5de71fbc-2055"
strict-transport-security
max-age=31536000
content-type
image/png
status
200
ufe-result
A6
accept-ranges
bytes
timing-allow-origin
*
content-length
8277
eagleid
0be3752c15763807265758760ec121
xman.css
login.alibaba.com/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/css/xman.css?version=20110104
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://amh.ro/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
signin_feild_bg.gif
login.alibaba.com/images/eng/style/css_images/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/css_images/signin_feild_bg.gif
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin-20110212.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
icon_error_bc.gif
login.alibaba.com/images/eng/style/css_images/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/css_images/icon_error_bc.gif
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://login.alibaba.com/css/4v/common.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
sorcing_signin_bg.gif
login.alibaba.com/images/signin/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/signin/sorcing_signin_bg.gif
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin-20110212.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
list_dot.gif
login.alibaba.com/images/eng/style/icon/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/icon/list_dot.gif
Requested by
Host: amh.ro
URL: http://amh.ro/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin-20110212.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alibaba (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| dmtrack_c string| dmtrack_pageid function| trackFavorite

0 Cookies