anazon.dnsrd.com Open in urlscan Pro
108.61.245.182 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://anazon.dnsrd.com/
Effective URL:
https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802
Submission Tags: @phishunt_io
Submission: On June 25 via api (June 25th 2024, 2:05:29 pm UTC) from DE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 108.61.245.182, located in Piscataway, United States and belongs to AS-CHOOPA, US. The main domain is anazon.dnsrd.com.
TLS certificate: Issued by E6 on June 25th 2024. Valid for: 3 months.

This is the only time anazon.dnsrd.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 9	108.61.245.182 108.61.245.182	20473 (AS-CHOOPA) (AS-CHOOPA)
2	2600:9000:223... 2600:9000:223e:e800:1d:d7f6:39d3:d9e1	16509 (AMAZON-02) (AMAZON-02)
10	2

9 108.61.245.182 (Piscataway, United States) 1 redirects

ASN20473 (AS-CHOOPA, US)
PTR: 108.61.245.182.vultrusercontent.com

anazon.dnsrd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223e:e800:1d:d7f6:39d3:d9e1 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dnsrd.com 1 redirects anazon.dnsrd.com	60 KB
2	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 439	34 KB
10	2

	Domain	Requested by
9	anazon.dnsrd.com	1 redirects anazon.dnsrd.com
2	m.media-amazon.com	anazon.dnsrd.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
anazon.dnsrd.com E6	`2024-06-25` - `2024-09-23`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2024-01-05` - `2024-12-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802
Frame ID: DE6CF88523F44E944EA99A12492BCD5E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign-In

Page URL History Show full URLs

https://anazon.dnsrd.com/279pnlfraycbuhd46wqj HTTP 301
https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/ Page URL
https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispa... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

93 kB
Transfer

251 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://anazon.dnsrd.com/279pnlfraycbuhd46wqj HTTP 301
https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/ Page URL
https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://anazon.dnsrd.com/279pnlfraycbuhd46wqj HTTP 301
https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ anazon.dnsrd.com/	0 340 B	700ms 298ms	Document text/html	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Tue, 25 Jun 2024 14:05:24 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache refresh 0; url=279pnlfraycbuhd46wqj server LiteSpeed
GET H2	200	/ anazon.dnsrd.com/279pnlfraycbuhd46wqj/ Redirect Chain https://anazon.dnsrd.com/279pnlfraycbuhd46wqj https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/	188 B 215 B	664ms 663ms	Document text/html	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://anazon.dnsrd.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 173 content-type text/html; charset=UTF-8 date Tue, 25 Jun 2024 14:05:25 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding gzip content-type text/html date Tue, 25 Jun 2024 14:05:25 GMT location https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/ server LiteSpeed vary Accept-Encoding
GET H2	404	favicon.ico anazon.dnsrd.com/	1 KB 778 B	172ms 113ms	Other text/html	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 25 Jun 2024 14:05:25 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding content-type text/html cache-control private, no-cache, max-age=0 alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H3	200	Primary Request Login.php Show response anazon.dnsrd.com/279pnlfraycbuhd46wqj/	6 KB 2 KB	115ms 114ms	Document text/html	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Requested by Host: anazon.dnsrd.com URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/ Protocol H3 Security QUIC, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash `ee5024b189bfd67c6189158f54d72ecc91e87f89484d5e4f834eda508754e67b` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding gzip content-length 1816 content-type text/html; charset=UTF-8 date Tue, 25 Jun 2024 14:05:26 GMT server LiteSpeed vary Accept-Encoding
GET H3	200	css-088.css anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/	135 KB 20 KB	133ms 132ms	Stylesheet text/css	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/css-088.css Requested by Host: anazon.dnsrd.com URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Protocol H3 Security QUIC, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash `2297b371bcff454816ac260b266fbfb9a867ce1fbfa9bbaf52502d4ebd306adc` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 25 Jun 2024 14:05:26 GMT content-encoding br last-modified Tue, 25 Jun 2024 14:05:24 GMT server LiteSpeed etag "21be5-667acea4-204490;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 20863 expires Tue, 02 Jul 2024 14:05:26 GMT
GET H3	200	css099.css anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/	46 KB 8 KB	139ms 138ms	Stylesheet text/css	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/css099.css Requested by Host: anazon.dnsrd.com URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Protocol H3 Security QUIC, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash `379abf5c20c39001941fa149c641d61154d10bfe6a2e009f9c25dc060919480e` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 25 Jun 2024 14:05:26 GMT content-encoding br last-modified Tue, 25 Jun 2024 14:05:24 GMT server LiteSpeed etag "b839-667acea4-204497;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 7776 expires Tue, 02 Jul 2024 14:05:26 GMT
GET H3	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/	27 KB 27 KB	114ms 113ms	Image image/png	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Show image Full URL https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: anazon.dnsrd.com URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/css-088.css Protocol H3 Security QUIC, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/css-088.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 25 Jun 2024 14:05:26 GMT last-modified Tue, 25 Jun 2024 14:05:24 GMT server LiteSpeed etag "6d44-667acea4-20449a;;;" content-type image/png cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 27972 expires Tue, 02 Jul 2024 14:05:26 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	296ms 77ms	Font application/font-woff2	2600:9000:223e:e800:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Requested by Host: anazon.dnsrd.com URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/css-088.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:223e:e800:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/ Origin https://anazon.dnsrd.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 18 Jul 2023 12:08:07 GMT via 1.1 3431ec594cac61983aae2d9ffaf23980.cloudfront.net (CloudFront) age 29642239 x-amz-cf-pop FRA56-P4 edge-cache-tag x-cache-688,/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa x-nginx-cache-status HIT x-cache Hit from cloudfront server-timing provider;desc="cf" alt-svc h3=":443"; ma=86400 content-length 16616 surrogate-key x-cache-688 /images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa last-modified Sat, 11 Jun 2016 01:31:21 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 7507c79f-13f4-4152-9162-cad34f6cf96c accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id gzzwMM9prrS_CdN5oa_dRHKOuF1h1E2O82RtHpo0xWyRQF9n_sOURQ== expires Wed, 08 Jul 2043 07:42:13 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	264ms 46ms	Font application/font-woff2	2600:9000:223e:e800:1d:d7f6:39d3:d9e1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 Requested by Host: anazon.dnsrd.com URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style/css-088.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:223e:e800:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/ Origin https://anazon.dnsrd.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 27 Jul 2023 14:09:13 GMT via 1.1 3431ec594cac61983aae2d9ffaf23980.cloudfront.net (CloudFront) age 28857373 x-amz-cf-pop FRA56-P4 edge-cache-tag x-cache-256,/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b x-nginx-cache-status HIT x-cache Hit from cloudfront server-timing provider;desc="cf" alt-svc h3=":443"; ma=86400 content-length 16460 surrogate-key x-cache-256 /images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b last-modified Sat, 11 Jun 2016 01:31:24 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id e9e1840c-e993-4835-8912-dbcb971eac04 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id CPB-vF5W-aUFLTVyT103304BUVSDMGMo8Ng6kn9gh_WxBkKzPqipdg== expires Sat, 18 Jul 2043 06:39:39 GMT
GET H3	200	amazon-icon-1.svg anazon.dnsrd.com/279pnlfraycbuhd46wqj/style//	3 KB 871 B	117ms 117ms	Other image/svg+xml	108.61.245.182 AS-CHOOPA
General Check archive.org Show headers Download Go to Full URL https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/style//amazon-icon-1.svg Protocol H3 Security QUIC, , AES_128_GCM Server 108.61.245.182 Piscataway, United States, ASN20473 (AS-CHOOPA, US), Reverse DNS 108.61.245.182.vultrusercontent.com Software LiteSpeed / Resource Hash `1d88dabb83080de94748c767e17b057546eca9cb33a552933cc0d191bc96ec81` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 25 Jun 2024 14:05:26 GMT content-encoding br last-modified Tue, 25 Jun 2024 14:05:24 GMT server LiteSpeed etag "b87-667acea4-20448a;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 814 expires Tue, 02 Jul 2024 14:05:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			anazon.dnsrd.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: qv1vqgjtqdach85pjs29a4sliq

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://anazon.dnsrd.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://anazon.dnsrd.com/279pnlfraycbuhd46wqj/Login.php?websrc=d41d8cd98f00b204e9800998ecf8427e&dispatched=65&id=3812899802 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anazon.dnsrd.com
m.media-amazon.com
108.61.245.182
2600:9000:223e:e800:1d:d7f6:39d3:d9e1
1d88dabb83080de94748c767e17b057546eca9cb33a552933cc0d191bc96ec81
2297b371bcff454816ac260b266fbfb9a867ce1fbfa9bbaf52502d4ebd306adc
379abf5c20c39001941fa149c641d61154d10bfe6a2e009f9c25dc060919480e
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
ee5024b189bfd67c6189158f54d72ecc91e87f89484d5e4f834eda508754e67b

anazon.dnsrd.com Open in urlscan Pro 108.61.245.182 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

93 kBTransfer

251 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

anazon.dnsrd.com Open in urlscan Pro
108.61.245.182 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

93 kB
Transfer

251 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!