![](/screenshots/f687548d-b2fc-465b-ad49-7349ee5fbf4e.png)
www.arnericanexpress.amghbui.cn
Open in
urlscan Pro
155.94.144.132
Malicious Activity!
Public Scan
Effective URL: https://www.arnericanexpress.amghbui.cn/login.php
Submission: On December 29 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on December 28th 2021. Valid for: 3 months.
This is the only time www.arnericanexpress.amghbui.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: American Express (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 22 | 155.94.144.132 155.94.144.132 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
2 | 23.193.30.56 23.193.30.56 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
23 | 3 |
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 155.94.144.132.static.quadranet.com
www.arnericanexpress.amghbui.cn |
ASN16625 (AKAMAI-AS, US)
PTR: a23-193-30-56.deploy.static.akamaitechnologies.com
www.aexp-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
amghbui.cn
1 redirects
www.arnericanexpress.amghbui.cn |
134 KB |
2 |
aexp-static.com
www.aexp-static.com |
45 KB |
23 | 2 |
Domain | Requested by | |
---|---|---|
22 | www.arnericanexpress.amghbui.cn |
1 redirects
www.arnericanexpress.amghbui.cn
|
2 | www.aexp-static.com |
www.arnericanexpress.amghbui.cn
|
23 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.arnericanexpress.amghbui.cn R3 |
2021-12-28 - 2022-03-28 |
3 months | crt.sh |
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA |
2021-06-08 - 2022-07-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.arnericanexpress.amghbui.cn/login.php
Frame ID: C9A999F0044D55EC15F382E62F03BBFA
Requests: 24 HTTP requests in this frame
Screenshot
![](/screenshots/f687548d-b2fc-465b-ad49-7349ee5fbf4e.png)
Page URL History Show full URLs
-
https://www.arnericanexpress.amghbui.cn/
HTTP 302
https://www.arnericanexpress.amghbui.cn/login.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/amex.png)
Detected patterns
- aexp-static\.com
![](/vendor/wappa/icons/React.png)
Detected patterns
- <[^>]+data-react
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.arnericanexpress.amghbui.cn/
HTTP 302
https://www.arnericanexpress.amghbui.cn/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
www.arnericanexpress.amghbui.cn/ Redirect Chain
|
334 KB 32 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.10.2.min.js
www.arnericanexpress.amghbui.cn/js/ |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls.min.css
www.arnericanexpress.amghbui.cn/css/ |
458 KB 54 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-logo-stack.svg
www.arnericanexpress.amghbui.cn/img/ |
2 KB 854 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-logo-stack-white.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.8.0/package/dist/img/logos/ |
2 KB 943 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-flag-jp.svg
www.arnericanexpress.amghbui.cn/img/ |
235 B 260 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone.webp
www.arnericanexpress.amghbui.cn/img/ |
12 KB 12 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-logo-line.svg
www.arnericanexpress.amghbui.cn/img/ |
2 KB 788 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
www.arnericanexpress.amghbui.cn/img/ |
644 B 700 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
www.arnericanexpress.amghbui.cn/img/ |
984 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-icons.woff
www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.2.0/package/dist/iconfont/ |
44 KB 44 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.arnericanexpress.amghbui.cn/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-icons.woff
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Medium.woff
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Regular.woff
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-flag-jp.svg
www.arnericanexpress.amghbui.cn/img/ |
235 B 260 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Light.woff
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-icons.ttf
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Medium.ttf
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Regular.ttf
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Light.ttf
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3be50273-0b2e-4aef-ae68-882eacd611f9-1.ttf
www.arnericanexpress.amghbui.cn/img/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: American Express (Financial)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| post1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.arnericanexpress.amghbui.cn/ | Name: PHPSESSID Value: lsbsi5fcn7blr0s4ej2snebua7 |
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.aexp-static.com
www.arnericanexpress.amghbui.cn
155.94.144.132
23.193.30.56
30ae66334096b72fb0ab8f7cdf46a6f2526a50b5917529c7db28e10df53e8eab
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
56b8e90244c34621e294d3357edfef9a1467e501773ed21b25dc6367ab3d7803
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
6c2307e5fa4f3725b00710176eeab8c23abbcd4acfd6f7c70389acc9d08d82f0
759b1da080b03f5104dc5bf2fc7cbe688fc10846ffdeb78c406db3df62b18f0d
ad07545842e63d005b0ade769403eb197cf762e0a7fb3484fdf14b2c2d996e62
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9
e4a94c917da05b3ce663535d9dd763383d649329643d4f96cfe41b5d31c01f41
e4e37395882770684d811919d658a61f587c2caa7f7984f01d4e6f1cceea1052
fc69234936c0df004440641a5df9ee1e3c3532df5780984f0f636e85e8788519