main.d31i5lu3nv68qn.amplifyapp.com Open in urlscan Pro
143.204.86.126 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://main.d31i5lu3nv68qn.amplifyapp.com/?bcda=%280101%29-50995-72334
Effective URL:
https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Submission: On January 20 via manual (January 20th 2024, 10:00:36 am UTC) from JP — Scanned from JP

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 143.204.86.126, located in United States and belongs to AMAZON-02, US. The main domain is main.d31i5lu3nv68qn.amplifyapp.com.
TLS certificate: Issued by Amazon RSA 2048 M03 on January 20th 2024. Valid for: a year.

This is the only time main.d31i5lu3nv68qn.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
13	143.204.86.126 143.204.86.126		16509 (AMAZON-02) (AMAZON-02)
13	1

13 143.204.86.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-86-126.nrt12.r.cloudfront.net

main.d31i5lu3nv68qn.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	amplifyapp.com main.d31i5lu3nv68qn.amplifyapp.com	242 KB
13	1

	Domain	Requested by
13	main.d31i5lu3nv68qn.amplifyapp.com	main.d31i5lu3nv68qn.amplifyapp.com
13	1

This site contains no links.

Subject Issuer	Validity	Valid
*.d31i5lu3nv68qn.amplifyapp.com Amazon RSA 2048 M03	`2024-01-20` - `2025-02-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Frame ID: 526423FDF7AA0022A51BEA9441B0DCC3
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

マイクロソフトのセキュリティ

Page URL History Show full URLs

https://main.d31i5lu3nv68qn.amplifyapp.com/?bcda=%280101%29-50995-72334 Page URL
https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

242 kB
Transfer

764 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://main.d31i5lu3nv68qn.amplifyapp.com/?bcda=%280101%29-50995-72334 Page URL
https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ main.d31i5lu3nv68qn.amplifyapp.com/	1 KB 921 B	518ms 196ms	Document text/html	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/?bcda=%280101%29-50995-72334 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Sat, 20 Jan 2024 10:00:31 GMT etag W/"667b0a22eae31539263aaa2ba9244300" last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 vary Accept-Encoding via 1.1 0962027405631ad0b2b25cd64e62ca38.cloudfront.net (CloudFront) x-amz-cf-id GtlwIHxiiBBpiu0Xd3WjHKk0-SOuvqurBEKcBbw-ljO8giqwJ0iafg== x-amz-cf-pop NRT12-C2 x-cache Miss from cloudfront
GET H2	200	Primary Request / Show response main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/	5 KB 3 KB	523ms 522ms	Document text/html	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/?bcda=%280101%29-50995-72334 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `a1c57f8b1348c33e17023b73fba4d56d31259abb296a3a5df5911d2ae77e6f17` Request headers Referer https://main.d31i5lu3nv68qn.amplifyapp.com/?bcda=%280101%29-50995-72334 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Sat, 20 Jan 2024 10:00:31 GMT etag W/"75449b812fd1f7f5f24b11d2aa51597b" last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 vary Accept-Encoding via 1.1 0962027405631ad0b2b25cd64e62ca38.cloudfront.net (CloudFront) x-amz-cf-id Op37mXaPKcOSOcZaX_Xt5M-lvIn70xxSvmnxQ12lDcKPmAvD25R-6Q== x-amz-cf-pop NRT12-C2 x-cache Miss from cloudfront
GET H3	200	bootstrap.min.css main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/css/	152 KB 22 KB	202ms 201ms	Stylesheet text/css	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/css/bootstrap.min.css Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT content-encoding gzip via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:05 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag W/"abe91756d18b7cd60871a2f47c1e8192" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id spuPm5-HhIIyz5gnD-XjNoLm_oJqivduR2GGD7XKI7UdSirZCviPog==
GET H3	200	jquery-3.7.1.min.js Show response main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/	85 KB 30 KB	12ms 11ms	Script application/javascript	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/jquery-3.7.1.min.js Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:30 GMT content-encoding gzip via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:05 GMT server AmazonS3 age 1 x-amz-cf-pop NRT12-C2 etag W/"2c872dbe60f4ba70fb85356113d8b35e" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id nrEJasp_jG06ogxTjTXk-IS-fmPbWtZTqmUShvU1xJgEHkXxjLOyMw==
GET H3	200	bootstrap.min.js Show response main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/	59 KB 16 KB	202ms 201ms	Script application/javascript	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/bootstrap.min.js Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `5c36e28c9a7bd864b673e223db7e1934923227536ffbdf871f58b6f09b9ac8c9` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT content-encoding gzip via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:05 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag W/"a08792f518b51f0f1422b5c96df9eb8a" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id OETc5o3xk5Ho5N8E7AXtSI3s1wITIq8LHz7pgr-STVQxQDLd2Uok0w==
GET H3	200	custom.js Show response main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/	1 KB 822 B	195ms 195ms	Script application/javascript	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/custom.js Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `e9cb4dfd7d26232f53cce9da021f3a7e4a20170f36008f862005146680f4b4b1` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT content-encoding gzip via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:05 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag W/"9210740eaf42291f9b3ad93fa07a0385" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id ahjjCx8fo2K_DVtarNcZ2FqzIMlW8AZijBm09rVfcvJhsG_ayqMpwA==
GET H3	200	custom.css main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/css/	4 KB 1 KB	190ms 190ms	Stylesheet text/css	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/css/custom.css Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `049edc6439119e468ba7766a337a58b3d96961699a2878e695510a2a7e728a27` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT content-encoding gzip via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag W/"69e4b99fc461d04ed98cb0e34b423772" vary Accept-Encoding x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 alt-svc h3=":443"; ma=86400 x-amz-cf-id oqJHcXi_iI3uNzEGNpBvwX-Uc9QawFuuJnsr3Qsgk90zNZVmf47QZQ==
GET H3	200	defend.png main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/	4 KB 4 KB	13ms 13ms	Image image/png	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/defend.png Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag "77a2ffc5545f87551d74781201de9b3b" x-cache Hit from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 3834 x-amz-cf-id 5UmkChUaBk7bUCVu8UvuTdslO10LcpovETEjF3vzwrk3v2_cb4PfvA==
GET H3	200	x.png main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/	43 KB 43 KB	11ms 11ms	Image image/png	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/x.png Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `3821ef20f5904fdb993e34d87ff8fb9c5786a382efb0eeee8b4f00c91428b701` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag "4487a588bf2a07e3d1936d705c5ceefd" x-cache Hit from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 44098 x-amz-cf-id RgU53lZbMmBvNaYBG2JRQAhLGJNW6f3u3DpvzM4aHvwB55xrx7GfZA==
GET H3	200	v.jpg main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/	8 KB 8 KB	8ms 7ms	Image image/jpeg	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/v.jpg Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `3b531d403dc8ce7cbb0efb1a0c307cfb2bbaaf21feaff9f3546f13bebda71887` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag "5fc559a242f0ea0a023f10830887d2af" x-cache Hit from cloudfront content-type image/jpeg cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 8196 x-amz-cf-id 1mZ9xMrp_AGFJMLEYn3dHrudHaR4F0qeuKzNIc3_eorssHgaljX_sA==
GET H3	200	ms.png main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/	1 KB 1 KB	14ms 14ms	Image image/png	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/ms.png Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:04 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag "bf2b460590fbb9d8e9611a6e9006b816" x-cache Hit from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 1045 x-amz-cf-id fBDTO9v0Zx8YvQifoMew3EewCqdC8OEFIBVVPL89ip8Lm3KYNSV_5w==
GET H3	200	back.jpg main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/	111 KB 111 KB	9ms 9ms	Image image/jpeg	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/images/back.jpg Requested by Host: main.d31i5lu3nv68qn.amplifyapp.com URL: https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/css/custom.css Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash `948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342` Request headers accept-language jp-JP,jp;q=0.9 Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/css/custom.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Sat, 20 Jan 2024 10:00:31 GMT via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:05 GMT server AmazonS3 age 1 x-amz-cf-pop NRT12-C2 etag "5e20d8c5bd6c7a06298a2663a1cc8403" x-cache Hit from cloudfront content-type image/jpeg cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 113635 x-amz-cf-id YUA86h9qMyVzpyilEKUiYeUQ-ARV4tUknVO_wtfn_mRgjpE8I8f_6Q==
GET H3	206	alert-en.wav main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/	289 KB 0	698ms 698ms	Media audio/wave	143.204.86.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/js/alert-en.wav Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.86.126 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-86-126.nrt12.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://main.d31i5lu3nv68qn.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Accept-Encoding identity;q=1, ;q=0 accept-language* jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Range bytes=0- Response headers date Sat, 20 Jan 2024 10:00:32 GMT via 1.1 2884f0fcb5b8a2bdfa5376dd5f29da92.cloudfront.net (CloudFront) last-modified Sat, 20 Jan 2024 08:10:05 GMT server AmazonS3 x-amz-cf-pop NRT12-C2 etag "bc750f522d327ce9eb63b695fde55114" x-cache Miss from cloudfront content-type audio/wave Content-Range bytes 0-1701581/1701582 cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id U5AbPpziq__48m_ObeKFw8-7A1TFbz7Ib14_0VNVY0JkIsqrroQsZw== Content-Length 1701582

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

main.d31i5lu3nv68qn.amplifyapp.com
143.204.86.126
049edc6439119e468ba7766a337a58b3d96961699a2878e695510a2a7e728a27
316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c
3821ef20f5904fdb993e34d87ff8fb9c5786a382efb0eeee8b4f00c91428b701
3b531d403dc8ce7cbb0efb1a0c307cfb2bbaaf21feaff9f3546f13bebda71887
5c36e28c9a7bd864b673e223db7e1934923227536ffbdf871f58b6f09b9ac8c9
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342
a1c57f8b1348c33e17023b73fba4d56d31259abb296a3a5df5911d2ae77e6f17
e9cb4dfd7d26232f53cce9da021f3a7e4a20170f36008f862005146680f4b4b1
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

main.d31i5lu3nv68qn.amplifyapp.com Open in urlscan Pro 143.204.86.126 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

242 kBTransfer

764 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

main.d31i5lu3nv68qn.amplifyapp.com Open in urlscan Pro
143.204.86.126 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

242 kB
Transfer

764 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!