mailcode.azurewebsites.net
Open in
urlscan Pro
52.173.245.249
Malicious Activity!
Public Scan
Submission: On July 06 via automatic, source openphish
Summary
This is the only time mailcode.azurewebsites.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 52.173.245.249 52.173.245.249 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
4 | 54.192.202.118 54.192.202.118 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
11 | 2 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
mailcode.azurewebsites.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-202-118.fra50.r.cloudfront.net
images-na.ssl-images-amazon.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
azurewebsites.net
mailcode.azurewebsites.net |
67 KB |
4 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
56 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
7 | mailcode.azurewebsites.net |
mailcode.azurewebsites.net
|
4 | images-na.ssl-images-amazon.com |
mailcode.azurewebsites.net
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
Images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2019-05-02 - 2020-04-23 |
a year | crt.sh |
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh |
This page contains 1 frames:
Primary Page:
http://mailcode.azurewebsites.net/mazon/deb5f/cirlo.php?cmd=login_submit&id=$praga$praga&session=$praga$praga
Frame ID: 4D8F53D9452086CC01BE4362A4B2FC60
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Windows Server (Operating Systems) Expand
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
cirlo.php
mailcode.azurewebsites.net/mazon/deb5f/ |
24 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ap-flex-reduced-nav-2.1._V360593186_.css
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amazon_logo_no-org_mid._V153387053_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screen.css
mailcode.azurewebsites.net/mazon/deb5f/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
mailcode.azurewebsites.net/mazon/deb5f/lib/ |
122 KB 45 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.js
mailcode.azurewebsites.net/mazon/deb5f/ |
37 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cmxforms.js
mailcode.azurewebsites.net/mazon/deb5f/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screen.css
mailcode.azurewebsites.net/mazon/deb5f/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-sprite.gif
images-na.ssl-images-amazon.com/images/G/01/x-locale/common/errors-alerts/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amznbtn-sprite03._V395592492_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
uedata
mailcode.azurewebsites.net/ap/ |
103 B 103 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| ue_t0 string| ue_id object| ue_csm string| ue_url string| ue_pr string| ue_md number| ue_navtiming string| ue_mid string| ue_sid string| ue_furl number| ue_hob number| ueinit object| ue function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop number| ue_hoe function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.mailcode.azurewebsites.net/ | Name: ARRAffinity Value: 67ca7f3007b0e3a36babb388d23237fb7b88cf51f4a925f888e9ea50edb58fd6 |
|
mailcode.azurewebsites.net/ | Name: PHPSESSID Value: i3jv00tuianop0njng30dob266 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
images-na.ssl-images-amazon.com
mailcode.azurewebsites.net
52.173.245.249
54.192.202.118
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
30b9903f22b92d34d170f4cc0aa95becb2e1465e65bd5e53e75c8379037fa2a2
65fb0d927462babb4af3693d6c9e26100ac43359692cb828af45cd8c9716bac6
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
88b426006b74ca81d9ced9a687a7b97690acf762b4658cccd72e7d5159a2134e
90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1
b33084766584f9745823b8686c6b655a5f908b5e8cbb5ae96d6dc9441cbf7872
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a