www.amazon.com Open in urlscan Pro
2600:9000:2127:2c00:7:49a5:5fd2:8621  Public Scan

Submitted URL: https://rustictomato.mammothbuys.com/
Effective URL: https://www.amazon.com/errors/404.html
Submission Tags: phishingrod
Submission: On March 24 via api from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2600:9000:2127:2c00:7:49a5:5fd2:8621, located in United States and belongs to AMAZON-02, US. The main domain is www.amazon.com. The Cisco Umbrella rank of the primary domain is 558.
TLS certificate: Issued by DigiCert Global CA G2 on January 17th 2023. Valid for: a year.
This is the only time www.amazon.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 198.102.31.34 54839 (EMPIRE)
1 2 2600:9000:212... 16509 (AMAZON-02)
3 2a04:4e42:600... 54113 (FASTLY)
4 2
Apex Domain
Subdomains
Transfer
3 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 789
69 KB
2 amazon.com
www.amazon.com — Cisco Umbrella Rank: 558
2 KB
1 mammothbuys.com
rustictomato.mammothbuys.com
267 B
4 3
Domain Requested by
3 images-na.ssl-images-amazon.com www.amazon.com
2 www.amazon.com 1 redirects
1 rustictomato.mammothbuys.com 1 redirects
4 3

This site contains no links.

Subject Issuer Validity Valid
www.amazon.com
DigiCert Global CA G2
2023-01-17 -
2024-01-16
a year crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2
2022-10-19 -
2023-10-18
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.amazon.com/errors/404.html
Frame ID: 1FB84E4B0431E132B50B496C8023F292
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Amazon.com Page Not Found

Page URL History Show full URLs

  1. https://rustictomato.mammothbuys.com/ HTTP 301
    https://www.amazon.com/promocode/AYNI7OO9SWLO8 HTTP 302
    https://www.amazon.com/errors/404.html Page URL

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

70 kB
Transfer

69 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rustictomato.mammothbuys.com/ HTTP 301
    https://www.amazon.com/promocode/AYNI7OO9SWLO8 HTTP 302
    https://www.amazon.com/errors/404.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 404.html
www.amazon.com/errors/
Redirect Chain
  • https://rustictomato.mammothbuys.com/
  • https://www.amazon.com/promocode/AYNI7OO9SWLO8
  • https://www.amazon.com/errors/404.html
2 KB
1 KB
Document
General
Full URL
https://www.amazon.com/errors/404.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:2c00:7:49a5:5fd2:8621 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
de8dcb7b52689df5963255c61356ae055281040bd9753f02e7d302a16329cc84
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-type
text/html
date
Fri, 24 Mar 2023 09:50:06 GMT
etag
"687-5f6d6afd59e40-gzip"
last-modified
Tue, 14 Mar 2023 06:53:37 GMT
server
Server
strict-transport-security
max-age=47474747; includeSubDomains; preload
vary
Content-Type,Accept-Encoding,User-Agent
via
1.1 b5f551be30f63eca57ca04273cb75994.cloudfront.net (CloudFront)
x-amz-cf-id
mSrnPto28fBImV3prh8XGZDBge1-VRN89KZq4jZw3bbinjTmtYNLTQ==
x-amz-cf-pop
PRG50-C1
x-amz-rid
KN6HQJHPZTG5RCYAN1NZ
x-cache
Miss from cloudfront
x-frame-options
SAMEORIGIN

Redirect headers

accept-ch
ect,rtt,downlink,device-memory,sec-ch-device-memory,viewport-width,sec-ch-viewport-width,dpr,sec-ch-dpr
accept-ch-lifetime
86400
content-encoding
gzip
content-language
en-US
content-security-policy
upgrade-insecure-requests;report-uri https://metrics.media-amazon.com/
content-security-policy-report-only
default-src 'self' blob: https: data: mediastream: 'unsafe-eval' 'unsafe-inline';report-uri https://metrics.media-amazon.com/
date
Fri, 24 Mar 2023 09:50:06 GMT
location
/errors/404.html
server
Server
strict-transport-security
max-age=47474747; includeSubDomains; preload
vary
Content-Type,Accept-Encoding,User-Agent
via
1.1 b5f551be30f63eca57ca04273cb75994.cloudfront.net (CloudFront)
x-amz-cf-id
L8IcGdsfEzT3aG7S86LEM-NS6yhbUiZT9l75KPE9YKfzCz796sBqjw==
x-amz-cf-pop
PRG50-C1
x-amz-rid
MY4H0RKNC8N0DY6WDRNR
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1;
logo._TTD_.png
images-na.ssl-images-amazon.com/images/G/01/error/
1 KB
2 KB
Image
General
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/error/logo._TTD_.png
Requested by
Host: www.amazon.com
URL: https://www.amazon.com/errors/404.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b64f3905e6326c5ad45eb215de399169496f298f6aa5f51cdcfd303dc402e81d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.amazon.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

expires
Wed, 08 Feb 2023 06:15:16 GMT
date
Fri, 24 Mar 2023 09:50:06 GMT
last-modified
Wed, 09 Mar 2016 20:37:35 GMT
age
5861
x-cache
HIT from fastly, HIT from fastly
content-type
image/png
access-control-allow-origin
*
x-nginx-cache-status
HIT
cache-control
max-age=86400,public
x-amz-ir-id
5d41d151-e2ff-486f-b9ac-3ad07db54640
server-timing
provider;desc="fy"
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
content-length
1455
x-served-by
cache-iad-kjyo7100023-IAD, cache-fra-eddf8230121-FRA
title._TTD_.png
images-na.ssl-images-amazon.com/images/G/01/error/
31 KB
31 KB
Image
General
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/error/title._TTD_.png
Requested by
Host: www.amazon.com
URL: https://www.amazon.com/errors/404.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f0447f8a7a9a7c1209b4d4fbe6e43c4691cf9da27f728e3dfb048a4ba072398f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.amazon.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

expires
Wed, 25 Jan 2023 12:45:41 GMT
date
Fri, 24 Mar 2023 09:50:06 GMT
last-modified
Mon, 14 Mar 2016 17:16:58 GMT
age
82413
x-cache
HIT from fastly, HIT from fastly
content-type
image/png
access-control-allow-origin
*
x-nginx-cache-status
HIT
cache-control
max-age=86400,public
x-amz-ir-id
96e9cbf9-7554-4014-858c-56c00ad55d9f
server-timing
provider;desc="fy"
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
content-length
31854
x-served-by
cache-iad-kjyo7100102-IAD, cache-fra-eddf8230121-FRA
97._TTD_.jpg
images-na.ssl-images-amazon.com/images/G/01/error/
35 KB
35 KB
Image
General
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/error/97._TTD_.jpg
Requested by
Host: www.amazon.com
URL: https://www.amazon.com/errors/404.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::272 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0686e41fc4ea0a8ab3d9119f50e9a0c3f7363748d523bfe3e4897e9cc0fa0fd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.amazon.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

expires
Thu, 02 Mar 2023 11:30:43 GMT
date
Fri, 24 Mar 2023 09:50:06 GMT
last-modified
Fri, 23 Nov 2018 22:06:27 GMT
age
77444
x-cache
HIT from fastly, HIT from fastly
content-type
image/jpeg
access-control-allow-origin
*
x-nginx-cache-status
HIT
cache-control
max-age=86400,public
x-amz-ir-id
ccf1faa2-4c90-4539-a2f7-3d82de3047e2
server-timing
provider;desc="fy"
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
content-length
36153
x-served-by
cache-iad-kjyo7100104-IAD, cache-fra-eddf8230121-FRA

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

5 Cookies

Domain/Path Name / Value
.amazon.com/ Name: session-id
Value: 138-8008892-2727543
.amazon.com/ Name: session-id-time
Value: 2082787201l
.amazon.com/ Name: i18n-prefs
Value: USD
.amazon.com/ Name: lc-main
Value: de_DE
.amazon.com/ Name: sp-cdn
Value: "L5Z9:DE"

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload
X-Frame-Options SAMEORIGIN