kunden-contact-1187939747.icu Open in urlscan Pro
109.102.5.159  Malicious Activity! Public Scan

Submitted URL: https://fleetm.one/IGKVxf
Effective URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Submission: On April 15 via manual from DE

Summary

This website contacted 3 IPs in 5 countries across 3 domains to perform 7 HTTP transactions. The main IP is 109.102.5.159, located in Bucharest, Romania and belongs to RTD Bucharest, Romania, RO. The main domain is kunden-contact-1187939747.icu.
This is the only time kunden-contact-1187939747.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon DE (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 52.59.165.42 16509 (AMAZON-02)
1 1 2606:4700:30:... 13335 (CLOUDFLAR...)
1 1 2606:4700:30:... 13335 (CLOUDFLAR...)
1 1 31.5.167.149 6830 (LGI-UPC f...)
1 109.102.5.159 9050 (RTD Bucha...)
4 86.101.230.109 6830 (LGI-UPC f...)
2 151.251.23.210 13124 (IBGC)
7 3
Apex Domain
Subdomains
Transfer
8 kunden-contact-1187939747.icu
kunden-contact-1187939747.icu
70 KB
2 plevoyedelo.pw
plevoyedelo.pw
607 B
1 fleetm.one
fleetm.one
267 B
7 3
Domain Requested by
8 kunden-contact-1187939747.icu 1 redirects kunden-contact-1187939747.icu
2 plevoyedelo.pw 2 redirects
1 fleetm.one 1 redirects
7 3

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Frame ID: B74AB352E3A8E1255408D2849051A55F
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://fleetm.one/IGKVxf HTTP 302
    http://plevoyedelo.pw/?l=NHTp5i HTTP 301
    https://plevoyedelo.pw/?l=NHTp5i HTTP 302
    http://kunden-contact-1187939747.icu/ HTTP 302
    http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=prot... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

7
Requests

0 %
HTTPS

29 %
IPv6

3
Domains

3
Subdomains

3
IPs

5
Countries

70 kB
Transfer

148 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://fleetm.one/IGKVxf HTTP 302
    http://plevoyedelo.pw/?l=NHTp5i HTTP 301
    https://plevoyedelo.pw/?l=NHTp5i HTTP 302
    http://kunden-contact-1187939747.icu/ HTTP 302
    http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/
Redirect Chain
  • https://fleetm.one/IGKVxf
  • http://plevoyedelo.pw/?l=NHTp5i
  • https://plevoyedelo.pw/?l=NHTp5i
  • http://kunden-contact-1187939747.icu/
  • http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
3 KB
2 KB
Document
General
Full URL
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
109.102.5.159 Bucharest, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software
nginx /
Resource Hash
396cc2d9988726d391bbdcdf4a88c667d6c4f3bf4503748eca14e06fd47020a2

Request headers

Host
kunden-contact-1187939747.icu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Cookie
PHPSESSID=k0m4l4acjbm8dv2uvmv6uhoab3
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx
Date
Mon, 15 Apr 2019 13:03:52 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
1503
Connection
close
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Vary
Accept-Encoding
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Mon, 15 Apr 2019 13:03:51 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
0
Connection
close
Set-Cookie
PHPSESSID=k0m4l4acjbm8dv2uvmv6uhoab3; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Location
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Cookie set duajMpjUAwu7vm83BmeCNA8z.php
kunden-contact-1187939747.icu/content/css/
3 KB
1 KB
Stylesheet
General
Full URL
http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true
Requested by
Host: kunden-contact-1187939747.icu
URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
86.101.230.109 Budapest, Hungary, ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT),
Reverse DNS
business-86-101-230-109.business.broadband.hu
Software
nginx /
Resource Hash
49df22c49772fe02a571ea19f37c92ac85963290873829439dc743071c8c4a02

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
kunden-contact-1187939747.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Connection
keep-alive
Cache-Control
no-cache
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 15 Apr 2019 13:03:52 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css;charset=UTF-8
Set-Cookie
PHPSESSID=1k9e3m5p7tdtpkl7cokmc65sf1; path=/
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
close
Content-Length
953
Expires
Thu, 19 Nov 1981 08:52:00 GMT
jquery.min.js
kunden-contact-1187939747.icu/content/js/
95 KB
33 KB
Script
General
Full URL
http://kunden-contact-1187939747.icu/content/js/jquery.min.js
Requested by
Host: kunden-contact-1187939747.icu
URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
86.101.230.109 Budapest, Hungary, ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT),
Reverse DNS
business-86-101-230-109.business.broadband.hu
Software
nginx /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
kunden-contact-1187939747.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Connection
keep-alive
Cache-Control
no-cache
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 15 Apr 2019 13:03:52 GMT
Content-Encoding
gzip
Last-Modified
Thu, 09 Jun 2016 23:43:52 GMT
Server
nginx
ETag
"17b8b-534e0fe943e00-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
33760
logo.png
kunden-contact-1187939747.icu/content/img/
5 KB
5 KB
Image
General
Full URL
http://kunden-contact-1187939747.icu/content/img/logo.png
Requested by
Host: kunden-contact-1187939747.icu
URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
86.101.230.109 Budapest, Hungary, ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT),
Reverse DNS
business-86-101-230-109.business.broadband.hu
Software
nginx /
Resource Hash
75a3f6f2ba7fb644bf1b0e53b9451e73495ea37ef8bd45932e5115f88af20228

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
kunden-contact-1187939747.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Connection
keep-alive
Cache-Control
no-cache
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 15 Apr 2019 13:03:52 GMT
Last-Modified
Sun, 09 Jul 2017 19:58:54 GMT
Server
nginx
ETag
"146c-553e7e55a3b80"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
5228
warning.png
kunden-contact-1187939747.icu/content/img/
3 KB
3 KB
Image
General
Full URL
http://kunden-contact-1187939747.icu/content/img/warning.png
Requested by
Host: kunden-contact-1187939747.icu
URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
86.101.230.109 Budapest, Hungary, ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT),
Reverse DNS
business-86-101-230-109.business.broadband.hu
Software
nginx /
Resource Hash
47db8119e1126e41c0cc98930273b4e1d303eef2b3e6b39ef019b68f0497cf64

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
kunden-contact-1187939747.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Connection
keep-alive
Cache-Control
no-cache
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 15 Apr 2019 13:03:52 GMT
Last-Modified
Fri, 21 Jul 2017 23:56:58 GMT
Server
nginx
ETag
"c96-554dc9ed74680"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
3222
Cookie set jsfunctions.php
kunden-contact-1187939747.icu/content/js/
16 KB
3 KB
Script
General
Full URL
http://kunden-contact-1187939747.icu/content/js/jsfunctions.php?s=true
Requested by
Host: kunden-contact-1187939747.icu
URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
151.251.23.210 , Bulgaria, ASN13124 (IBGC, BG),
Reverse DNS
Software
nginx /
Resource Hash
028f05c18d21c71cd733e2e2dc991cb396716531df87c51f1e2ead3a34fe3e52

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
kunden-contact-1187939747.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Connection
keep-alive
Cache-Control
no-cache
Referer
http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 15 Apr 2019 13:03:53 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
application/javascript
Set-Cookie
PHPSESSID=pdhtpqhtt582465bd1dh0dg0j7; path=/
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
close
Content-Length
2587
Expires
Thu, 19 Nov 1981 08:52:00 GMT
ember.woff
kunden-contact-1187939747.icu/content/fonts/
22 KB
22 KB
Font
General
Full URL
http://kunden-contact-1187939747.icu/content/fonts/ember.woff
Requested by
Host: kunden-contact-1187939747.icu
URL: http://kunden-contact-1187939747.icu/990393/1253264542/3686354/267200994119/65321467/MRo5/?65321467?operator=protect&s=true&userID=5708
Protocol
HTTP/1.1
Server
151.251.23.210 , Bulgaria, ASN13124 (IBGC, BG),
Reverse DNS
Software
nginx /
Resource Hash
781a806fe93972194da13561a137e0d322a46074fda7dd7cd39856e26451ab9e

Request headers

Pragma
no-cache
Origin
http://kunden-contact-1187939747.icu
Accept-Encoding
gzip, deflate
Host
kunden-contact-1187939747.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true
Cookie
PHPSESSID=1k9e3m5p7tdtpkl7cokmc65sf1
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true
Origin
http://kunden-contact-1187939747.icu

Response headers

Date
Mon, 15 Apr 2019 13:03:53 GMT
Last-Modified
Sat, 15 Jul 2017 05:49:40 GMT
Server
nginx
ETag
"5684-55454bb4e2500"
Content-Type
application/font-woff
Connection
close
Accept-Ranges
bytes
Content-Length
22148

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon DE (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| _tUMPF function| enterhit function| luhn function| postData function| checkstep1 function| checkstep2 function| rotation function| checkvalid function| checkvalidadvanzia function| checkvalidbarclay function| checkvaliddzbank function| checkvalidspk function| checkvalidhypo function| checkvalidlbb function| checkvaliddkb1 function| checkvaliddkb2

1 Cookies

Domain/Path Name / Value
kunden-contact-1187939747.icu/ Name: PHPSESSID
Value: pdhtpqhtt582465bd1dh0dg0j7