cusmerseramasame.net Open in urlscan Pro
162.241.149.195  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://cusmerseramasame.net/?relaxed Page URL
2. https://cusmerseramasame.net/ap/signin?session=6cde3bab6e0facb6380a5ec0b55683dfacf7b499 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set / Show response cusmerseramasame.net/	121 B 502 B	2088ms 1592ms	Document text/html	162.241.149.195 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://cusmerseramasame.net/?relaxed Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.149.195 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-149-195.unifiedlayer.com Software Apache / Resource Hash 79e71b566186a4023444bfb06ab7113160a992b26a991208c96f0b6e87204e94 Request headers Host cusmerseramasame.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Dec 2020 02:54:34 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=3ff33a53710e0b43b68ae7a999aa69f2; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request signin Show response cusmerseramasame.net/ap/	7 KB 8 KB	1003ms 1002ms	Document text/html	162.241.149.195 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://cusmerseramasame.net/ap/signin?session=6cde3bab6e0facb6380a5ec0b55683dfacf7b499 Requested by Host: cusmerseramasame.net URL: https://cusmerseramasame.net/?relaxed Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.149.195 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-149-195.unifiedlayer.com Software Apache / Resource Hash b3c6b35b953a66c35abbd6261a988b2ce5370f53a2c6b9de4be9d07d0f5cf768 Request headers Host cusmerseramasame.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://cusmerseramasame.net/?relaxed Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie PHPSESSID=3ff33a53710e0b43b68ae7a999aa69f2 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cusmerseramasame.net/?relaxed Response headers Date Fri, 25 Dec 2020 02:54:36 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	main.css cusmerseramasame.net/assets/css/	173 KB 174 KB	160ms 160ms	Stylesheet text/css	162.241.149.195 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://cusmerseramasame.net/assets/css/main.css Requested by Host: cusmerseramasame.net URL: https://cusmerseramasame.net/ap/signin?session=6cde3bab6e0facb6380a5ec0b55683dfacf7b499 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.149.195 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-149-195.unifiedlayer.com Software Apache / Resource Hash c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://cusmerseramasame.net/ap/signin?session=6cde3bab6e0facb6380a5ec0b55683dfacf7b499 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 25 Dec 2020 02:54:37 GMT X-Content-Type-Options nosniff Last-Modified Fri, 22 Feb 2019 13:33:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 177536 X-XSS-Protection 1; mode=block
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	22ms 6ms	Image image/png	2a04:4e42:62::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: cusmerseramasame.net URL: https://cusmerseramasame.net/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:62::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5 Request headers Referer https://cusmerseramasame.net/assets/css/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Dec 2020 02:54:38 GMT last-modified Fri, 22 Sep 2017 00:23:19 GMT age 23838887 x-cache HIT from fastly, HIT from fastly content-type image/png access-control-allow-origin * expires Mon, 19 Mar 2040 04:59:49 GMT cache-control max-age=630720000,public x-amz-ir-id e4af3153-f914-4c55-9bfe-53fd16e4fbdd accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 27972 x-served-by cache-dca17749-DCA, cache-hhn11575-HHN

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated number| ue_t0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cusmerseramasame.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3ff33a53710e0b43b68ae7a999aa69f2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cusmerseramasame.net
m.media-amazon.com
162.241.149.195
2a04:4e42:62::272
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
79e71b566186a4023444bfb06ab7113160a992b26a991208c96f0b6e87204e94
b3c6b35b953a66c35abbd6261a988b2ce5370f53a2c6b9de4be9d07d0f5cf768
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19