amazon.nov.su
Open in
urlscan Pro
103.245.208.40
Malicious Activity!
Public Scan
Effective URL: https://amazon.nov.su/ap/signin?openid.pape.max_auth_age=12ef2cfe48c3ce8d6fda5602f84b058e5df48e8c&locale=nl_NL
Submission: On July 08 via api from US
Summary
TLS certificate: Issued by TrustAsia TLS RSA CA on July 7th 2020. Valid for: a year.
This is the only time amazon.nov.su was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 103.245.208.40 103.245.208.40 | 133115 (HKKFGL-AS...) (HKKFGL-AS-AP HK Kwaifong Group Limited) | |
10 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
nov.su
amazon.nov.su |
68 KB |
10 | 1 |
Domain | Requested by | |
---|---|---|
8 | amazon.nov.su |
amazon.nov.su
|
10 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
amazon.nov.su TrustAsia TLS RSA CA |
2020-07-07 - 2021-07-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://amazon.nov.su/ap/signin?openid.pape.max_auth_age=12ef2cfe48c3ce8d6fda5602f84b058e5df48e8c&locale=nl_NL
Frame ID: B1CA29F0969436C4CE18B4B668E36FC9
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://amazon.nov.su/?iyh_re Page URL
- https://amazon.nov.su/ap/signin?openid.pape.max_auth_age=12ef2cfe48c3ce8d6fda5602f84b058e5df48e8c&... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://amazon.nov.su/?iyh_re Page URL
- https://amazon.nov.su/ap/signin?openid.pape.max_auth_age=12ef2cfe48c3ce8d6fda5602f84b058e5df48e8c&locale=nl_NL Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
amazon.nov.su/ |
133 B 346 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
signin
amazon.nov.su/ap/ |
27 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
amazon.nov.su/aws/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.maskedinput.min.js
amazon.nov.su/aws/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.payment.min.js
amazon.nov.su/aws/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.js
amazon.nov.su/aws/js/ |
3 KB 988 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v.css
amazon.nov.su/aws/css/ |
188 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amazon1.png
amazon.nov.su/aws/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
1.js
amazon.nov.su/ap/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
2.js
amazon.nov.su/ap/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- amazon.nov.su
- URL
- https://amazon.nov.su/ap/js/1.js
- Domain
- amazon.nov.su
- URL
- https://amazon.nov.su/ap/js/2.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| AmazonUIPageJS object| P0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amazon.nov.su
amazon.nov.su
103.245.208.40
0d94cc0b172effdf344ad2a73a78a48641dfd06ead68d831aba2cee14aa1d89f
5c12dda8f3d2ca52f05cb1426d4d47876a1a202321258d7707908f73bb461eb0
5cebe6cfbf7548af9e59411157b341f260c2f365f794bfbaf2751fa79e1c2491
8923a7d20eb1e3d7a42c4c029f0ed1a87deefee4c33b2c927270a0c2aa33ef97
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
b51437c45c2be6ce00a55faa767e3773c0b93cc04394fb8ffe57ce59e3d8009e
fb82877818fa23c8c028053cc5744c5d7947faca82bd50a82b918016499bfb62