wheatflourprim892.dns.navy

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 69.49.244.237, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is wheatflourprim892.dns.navy.
TLS certificate: Issued by R3 on April 2nd 2022. Valid for: 3 months.

This is the only time wheatflourprim892.dns.navy was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	176.58.127.162 176.58.127.162	63949 (LINODE-AP...) (LINODE-AP Linode)
1 1	2606:4700:303... 2606:4700:3038::6815:ead7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	69.49.244.237 69.49.244.237	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2600:9000:231... 2600:9000:2315:6000:1d:d7f6:39d0:c781	16509 (AMAZON-02) (AMAZON-02)
6	3

1 176.58.127.162 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: 176-58-127-162.ip.linodeusercontent.com

176.58.127.162	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3038::6815:ead7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

urlz.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.49.244.237 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-244-237.unifiedlayer.com

wheatflourprim892.dns.navy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2315:6000:1d:d7f6:39d0:c781 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	dns.navy wheatflourprim892.dns.navy	344 KB
1	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 597	28 KB
1	urlz.fr 1 redirects urlz.fr — Cisco Umbrella Rank: 416462	587 B
6	3

	Domain	Requested by
4	wheatflourprim892.dns.navy	176.58.127.162 wheatflourprim892.dns.navy
1	m.media-amazon.com	wheatflourprim892.dns.navy
1	urlz.fr	1 redirects
6	3

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
wheatflourprim892.dns.navy R3	`2022-04-02` - `2022-07-01`	3 months	crt.sh
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-02-01` - `2023-01-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924
Frame ID: DDB7359534E0A2CFB1D59A90DE196407
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Anmelden

Page URL History Show full URLs

http://176.58.127.162/8-46576879 Page URL
https://urlz.fr/hSKb HTTP 302
https://wheatflourprim892.dns.navy/?apps Page URL
https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

372 kB
Transfer

370 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=BRHA9NYG75BQK2E6TR1F&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=5E2S0M02YQK0KWXY6QRW&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Erstellen Sie Ihr Amazon-Konto

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://176.58.127.162/8-46576879 Page URL
https://urlz.fr/hSKb HTTP 302
https://wheatflourprim892.dns.navy/?apps Page URL
https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://urlz.fr/hSKb HTTP 302
https://wheatflourprim892.dns.navy/?apps

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	8-46576879 176.58.127.162/	66 B 270 B	70ms 54ms	Document text/html	176.58.127.162 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL http://176.58.127.162/8-46576879 Protocol HTTP/1.1 Server 176.58.127.162 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS 176-58-127-162.ip.linodeusercontent.com Software Apache/2.4.29 (Ubuntu) / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Connection Keep-Alive Content-Length 66 Content-Type text/html; charset=UTF-8 Date Mon, 04 Apr 2022 16:08:38 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.29 (Ubuntu)
GET H/1.1	200 OK	/ wheatflourprim892.dns.navy/ Redirect Chain https://urlz.fr/hSKb https://wheatflourprim892.dns.navy/?apps	121 B 502 B	1656ms 1352ms	Document text/html	69.49.244.237 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wheatflourprim892.dns.navy/?apps Requested by Host: 176.58.127.162 URL: http://176.58.127.162/8-46576879 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.244.237 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-244-237.unifiedlayer.com Software Apache / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://176.58.127.162/8-46576879 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 04 Apr 2022 16:08:38 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked Redirect headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=60 cf-cache-status DYNAMIC cf-ray 6f6b4dc9e82492a8-FRA content-type text/html; charset=UTF-8 date Mon, 04 Apr 2022 16:08:38 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" expires Mon, 04 Apr 2022 16:09:38 GMT location https://wheatflourprim892.dns.navy/?apps nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HqSNZhqI%2Bhj9o4devjFSitOvrDPSXxSR6QUoPbmmfBdcdS8TDmn1HmDa2MsVlXzK0y%2BM3x3NUKEwgqU1pfIqT1tOLsKKSZIaH2LsQkjb4Uf%2BTdcNeyvkydB5hXSEot6%2BIxjkppIH"}],"group":"cf-nel","max_age":604800} server cloudflare x-fastcgi-cache HIT
GET H/1.1	200 OK	Primary Request signin Show response wheatflourprim892.dns.navy/ap/	7 KB 8 KB	611ms 611ms	Document text/html	69.49.244.237 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 Requested by Host: wheatflourprim892.dns.navy URL: https://wheatflourprim892.dns.navy/?apps Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.244.237 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-244-237.unifiedlayer.com Software Apache / Resource Hash `88ade0f86cd3b2562be4fd6da360f8015f9041891207ec575d5ee6ad80a65b45` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wheatflourprim892.dns.navy/?apps Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 04 Apr 2022 16:08:39 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	jquery-1.9.1.js Show response wheatflourprim892.dns.navy/assets/js/	162 KB 162 KB	130ms 129ms	Script application/javascript	69.49.244.237 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wheatflourprim892.dns.navy/assets/js/jquery-1.9.1.js Requested by Host: wheatflourprim892.dns.navy URL: https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.244.237 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-244-237.unifiedlayer.com Software Apache / Resource Hash `3aaecdead9339facd5328cfb062003d1f740157a30daa5d45a40f588846d646b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Mon, 04 Apr 2022 16:08:40 GMT Last-Modified Sat, 08 Jan 2022 00:36:24 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 165637
GET H/1.1	200 OK	main.css wheatflourprim892.dns.navy/assets/css/	173 KB 174 KB	394ms 129ms	Stylesheet text/css	69.49.244.237 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://wheatflourprim892.dns.navy/assets/css/main.css Requested by Host: wheatflourprim892.dns.navy URL: https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.244.237 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-244-237.unifiedlayer.com Software Apache / Resource Hash `c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wheatflourprim892.dns.navy/ap/signin?session=8aa556f0c78e95cb444a0649ffc120354cec7924 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers Date Mon, 04 Apr 2022 16:08:40 GMT Last-Modified Sat, 08 Jan 2022 00:36:22 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 177536
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	113ms 19ms	Image image/png	2600:9000:2315:6000:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: wheatflourprim892.dns.navy URL: https://wheatflourprim892.dns.navy/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2315:6000:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers Accept-Language de-DE,de;q=0.9 Referer https://wheatflourprim892.dns.navy/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36 Response headers date Fri, 25 Feb 2022 05:54:08 GMT via 1.1 8080d8bfc581f6befaaa7736f6d0003e.cloudfront.net (CloudFront) age 3320073 edge-cache-tag x-cache-413,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 x-nginx-cache-status HIT x-cache Hit from cloudfront content-length 27972 surrogate-key x-cache-413 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 last-modified Fri, 22 Sep 2017 00:23:19 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 64f8f705-e930-42e1-8878-04e6ea13842a x-amz-cf-pop DUS51-P2 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id ov50vsZJrNbd44aty0kA3pBobue2KjRmSIeWSGp5COSivuy6iShh5w== expires Wed, 19 Feb 2042 13:35:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wheatflourprim892.dns.navy/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3e0d8a41345c8cec6aec720be236a31d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.media-amazon.com
urlz.fr
wheatflourprim892.dns.navy
176.58.127.162
2600:9000:2315:6000:1d:d7f6:39d0:c781
2606:4700:3038::6815:ead7
69.49.244.237
3aaecdead9339facd5328cfb062003d1f740157a30daa5d45a40f588846d646b
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
88ade0f86cd3b2562be4fd6da360f8015f9041891207ec575d5ee6ad80a65b45
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19

wheatflourprim892.dns.navy Open in urlscan Pro 69.49.244.237 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

372 kBTransfer

370 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

Indicators

wheatflourprim892.dns.navy Open in urlscan Pro
69.49.244.237 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

372 kB
Transfer

370 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!