urlscan.io logo urlscan.io
SecurityTrails logo

amazon-secure.com.mx Open in urlscan Pro
62.4.21.144  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://amazon-secure.com.mx/
Submission: On December 30 via automatic, source certstream-suspicious — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 62.4.21.144, located in France and belongs to Online SAS, FR. The main domain is amazon-secure.com.mx.
TLS certificate: Issued by R3 on December 30th 2022. Valid for: 3 months.
This is the only time amazon-secure.com.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
3 62.4.21.144 12876 (Online SAS)
4 2600:9000:20e... 16509 (AMAZON-02)
1 2001:4de0:ac1... 20446 (STACKPATH...)
8 3
Apex Domain
Subdomains		 Transfer
3 ssl-images-amazon.com
images-eu.ssl-images-amazon.com — Cisco Umbrella Rank: 3611
29 KB
3 amazon-secure.com.mx
amazon-secure.com.mx
6 KB
1 media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 417
28 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 943
31 KB
8 4
Domain Requested by
3 images-eu.ssl-images-amazon.com amazon-secure.com.mx
3 amazon-secure.com.mx amazon-secure.com.mx
1 m.media-amazon.com images-eu.ssl-images-amazon.com
1 code.jquery.com amazon-secure.com.mx
8 4

This site contains links to these domains. Also see Links.

Domain
www.amazon.fr
amazon.fr
Subject Issuer Validity Valid
amazon-secure.com.mx
R3		 2022-12-30 -
2023-03-30		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2022-10-26 -
2023-10-14		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://amazon-secure.com.mx/
Frame ID: 62FD9B9447C11546AA3B92A837BF27E4
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Connexion

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

94 kB
Transfer

304 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
amazon-secure.com.mx/ 		14 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.4.21.144 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PHP/8.0.26 PleskLin
Resource Hash
a7565cf1ad6985dd40f22cfac237a87ef409f610a6bad9a8424b0d675c3f0a7e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
3294
content-type
text/html; charset=UTF-8
date
Fri, 30 Dec 2022 02:38:15 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.26 PleskLin
61zcRmYWpgL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css
images-eu.ssl-images-amazon.com/images/I/ 		131 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-eu.ssl-images-amazon.com/images/I/61zcRmYWpgL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI
Requested by
Host: amazon-secure.com.mx
URL: https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:d200:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
52f683fa1a75a43e86a8265f72e13a81b43eedf5770560c943e61aac50fe3fe0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://amazon-secure.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 00:53:01 GMT
content-encoding
gzip
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
4585514
edge-cache-tag
x-cache-880,/images/I/61zcRmYWpgL
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
surrogate-key
x-cache-880 /images/I/61zcRmYWpgL
last-modified
Wed, 06 Jan 2021 02:50:18 GMT
server
Server
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
98dfece8-c5b1-4bae-87a9-0233c2395a38
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
YCMn0qxSgOvoeyIxBraRyh8H7_uUdnEPef8VT4IPczPh86jFCR3RiA==
expires
Sat, 01 Nov 2042 07:34:11 GMT
01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41DBI6BbFkL.css_.css
images-eu.ssl-images-amazon.com/images/I/ 		36 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-eu.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41DBI6BbFkL.css_.css?AUIClients/AuthenticationPortalAssets
Requested by
Host: amazon-secure.com.mx
URL: https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:d200:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://amazon-secure.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 09:51:26 GMT
content-encoding
br
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
2479609
edge-cache-tag
x-cache-520,/images/I/01SdjaY0ZsL
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
surrogate-key
x-cache-520 /images/I/01SdjaY0ZsL
last-modified
Sat, 30 May 2015 02:58:48 GMT
server
Server
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
c71dbe16-bc03-4b06-851b-75b5ac71b0bb
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
Ffhx7us_bdseHo1FSRgmXShmwVZ2N5ywVNdOMUxez-z-tjpzBz8NLg==
expires
Tue, 25 Nov 2042 00:17:53 GMT
11qeL1AgUGL.css
images-eu.ssl-images-amazon.com/images/I/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-eu.ssl-images-amazon.com/images/I/11qeL1AgUGL.css?AUIClients/CVFAssets
Requested by
Host: amazon-secure.com.mx
URL: https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:d200:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://amazon-secure.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 10:44:42 GMT
content-encoding
br
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
2044413
edge-cache-tag
x-cache-752,/images/I/11qeL1AgUGL
x-cache
Hit from cloudfront
x-nginx-cache-status
MISS
surrogate-key
x-cache-752 /images/I/11qeL1AgUGL
last-modified
Thu, 08 Apr 2021 22:47:22 GMT
server
Server
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
abce8d57-7088-4024-9e10-ced3c5367c40
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
R5VMyu7UOnTCTOdqamRu4UTgMa5T6IfLKzIHj6_OL1cJl5aaA_VV0g==
expires
Mon, 01 Dec 2042 10:44:42 GMT
anim.css
amazon-secure.com.mx/assets/css/ 		315 B
382 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amazon-secure.com.mx/assets/css/anim.css
Requested by
Host: amazon-secure.com.mx
URL: https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.4.21.144 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
8f3218ceab302b71593a1ffd742123877c48788382f63570b8a3285a6d9b64a0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://amazon-secure.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Fri, 30 Dec 2022 02:38:15 GMT
content-encoding
gzip
last-modified
Sun, 03 Oct 2021 13:12:32 GMT
server
nginx
x-accel-version
0.01
etag
"13b-5cd728c939000-gzip"
x-powered-by
PleskLin
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
175
jquery.js
amazon-secure.com.mx/assets/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://amazon-secure.com.mx/assets/js/jquery.js
Requested by
Host: amazon-secure.com.mx
URL: https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
62.4.21.144 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
a9f617f1f492d0a8515807432a326099143110cd39a71224ac73102f5e794427

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://amazon-secure.com.mx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Fri, 30 Dec 2022 02:38:15 GMT
content-encoding
br
last-modified
Thu, 14 Oct 2021 22:49:48 GMT
server
nginx
etag
W/"6168b40c-16a6"
x-powered-by
PleskLin
content-type
application/javascript
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: amazon-secure.com.mx
URL: https://amazon-secure.com.mx/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://amazon-secure.com.mx/
Origin
https://amazon-secure.com.mx
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Fri, 30 Dec 2022 02:38:15 GMT
content-encoding
gzip
x-sp-metadata
HS256.CKe6uZ0GEo4BCiRhMDczNWE2Mi1iMjk0LTRjYWQtODdiZS1iNzNhNGQ2Y2ZjNGQQ+OiCoKvU+wIaBgiXnrmdBiITMjAwMTo0MWQwOmQ6MzY0ZDo6NiisnAMwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDA0MDk2YjMzLWZjYjctNDcwMS04MmJmLTQwOWYxMWFhMWIwNBib8QEiGAgCEhRjZHMwNDcucGExLmh3Y2RuLm5ldA==.9pK2KozNgf9roVGh/9lzgFJrrfHHjwR9jqYv4ppuajI=
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15d9d"
vary
Accept-Encoding
x-hw
1672367895.dop026.pa1.t,1672367895.cds234.pa1.hn,1672367895.cds047.pa1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
mPGmT0r6IeTyIee.png
m.media-amazon.com/images/S/sash/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Requested by
Host: images-eu.ssl-images-amazon.com
URL: https://images-eu.ssl-images-amazon.com/images/I/61zcRmYWpgL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI#fr.not-trident
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:d200:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://images-eu.ssl-images-amazon.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 30 Nov 2022 08:04:13 GMT
via
1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
2572441
edge-cache-tag
x-cache-227,/images/S/sash/mPGmT0r6IeTyIee
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
27972
surrogate-key
x-cache-227 /images/S/sash/mPGmT0r6IeTyIee
last-modified
Tue, 17 Nov 2020 23:31:33 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
7712a426-a098-423a-965a-e74a633a24f0
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
Tv1zTCjcreap3jm5eEXrysSUjQCz_4_AhUmYcWto8ccXDyMM1581cA==
expires
Mon, 24 Nov 2042 21:02:30 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| vitos function| vitoK function| vitou function| vitod function| vitot function| vitoD function| vitoq function| vitoP function| vitoY function| vitoc function| viton function| vitoU function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
amazon-secure.com.mx/ Name: PHPSESSID
Value: 8ac41m9jhv8j7jftvmnjb790u0