amazon.card-isq.net Open in urlscan Pro
104.21.79.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://amazon.oqls.net/
Effective URL:
https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e
Submission: On September 28 via automatic, source phishtank (September 28th 2021, 2:07:17 am UTC) — Scanned from DE

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 14 HTTP transactions. The main IP is 104.21.79.52, located in and belongs to CLOUDFLARENET, US. The main domain is amazon.card-isq.net.
TLS certificate: Issued by R3 on September 27th 2021. Valid for: 3 months.

This is the only time amazon.card-isq.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.21.1.15 104.21.1.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 7	104.21.79.52 104.21.79.52	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	151.101.129.16 151.101.129.16	54113 (FASTLY) (FASTLY)
1	13.225.78.55 13.225.78.55	16509 (AMAZON-02) (AMAZON-02)
1	13.225.84.133 13.225.84.133	16509 (AMAZON-02) (AMAZON-02)
14	4

1 104.21.1.15 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

amazon.oqls.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.21.79.52 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

amazon.card-isq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.129.16 (United States)

ASN54113 (FASTLY, US)

images-fe.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.55 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-55.fra2.r.cloudfront.net

static.siege-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.84.133 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-84-133.fra2.r.cloudfront.net

d35uxhjf90umnp.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	card-isq.net 1 redirects amazon.card-isq.net	74 KB
6	ssl-images-amazon.com images-fe.ssl-images-amazon.com	285 KB
1	cloudfront.net d35uxhjf90umnp.cloudfront.net	12 KB
1	siege-amazon.com static.siege-amazon.com	1 KB
1	oqls.net 1 redirects amazon.oqls.net	589 B
14	5

	Domain	Requested by
7	amazon.card-isq.net	1 redirects amazon.card-isq.net
6	images-fe.ssl-images-amazon.com	amazon.card-isq.net
1	d35uxhjf90umnp.cloudfront.net	images-fe.ssl-images-amazon.com
1	static.siege-amazon.com	amazon.card-isq.net
1	amazon.oqls.net	1 redirects
14	5

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid
*.card-isq.net R3	`2021-09-27` - `2021-12-26`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh
static.siege-amazon.com Amazon	`2021-04-22` - `2022-05-21`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e
Frame ID: C1F93F9CFC7D59618164AEF73A71E0AB
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazonサインイン

Page URL History Show full URLs

https://amazon.oqls.net/ HTTP 302
http://amazon.card-isq.net/index/index/login?login_key=615278cf6470e HTTP 301
https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Page URL

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

372 kB
Transfer

1260 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=1800&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&siteState=clientContext%3D358-8099168-1927245%2CsourceUrl%3Dhttps%253A%252F%252Fwww.amazon.co.jp%2Csignature%3DaPTU8l90tdRVm3iOS84RKH6zUzgj3D&marketPlaceId=A1VC38T7YXB528&pageId=amzn_abbott_portal_jp&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F&prevRID=2K83G2EH7B2B3WXTJTNF&openid.assoc_handle=amzn_abbott_portal_jp&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: パスワードを忘れた場合

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/register?showRememberMe=true&openid.pape.max_auth_age=1800&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&siteState=clientContext%3D358-8099168-1927245%2CsourceUrl%3Dhttps%253A%252F%252Fwww.amazon.co.jp%2Csignature%3DaPTU8l90tdRVm3iOS84RKH6zUzgj3D&marketPlaceId=A1VC38T7YXB528&pageId=amzn_abbott_portal_jp&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F&prevRID=2K83G2EH7B2B3WXTJTNF&openid.assoc_handle=amzn_abbott_portal_jp&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Amazonアカウントを作成する

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://amazon.oqls.net/ HTTP 302
http://amazon.card-isq.net/index/index/login?login_key=615278cf6470e HTTP 301
https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login Show response amazon.card-isq.net/index/index/ Redirect Chain https://amazon.oqls.net/ http://amazon.card-isq.net/index/index/login?login_key=615278cf6470e https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e	39 KB 11 KB	616ms 575ms	Document text/html	104.21.79.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.79.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56a649ef56acec1c285af3aa8de4b32765b39b7343d08ab7e5fb1b3b15863112` Request headers :method GET :authority amazon.card-isq.net :scheme https :path /index/index/login?login_key=615278cf6470e pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-type text/html; charset=utf-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=bhch5h3eg2sp6lc7ioqit6oc3r; path=/ vary Accept-Encoding cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JougsmJGYBO9yivqKweYgVpaCTdkTyuONe2bfmTeXZBM92I34YeWZts3y50GWjFyeRt%2B5QmEGvjKBm03Zj5EJ07z3YL8y8oZI%2BeFDZU%2F91w66KZoJlnZ39GyJLh%2BNV1PX%2Fz88Wbp"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 69596ab3a8a727a0-PRG content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Redirect headers Date Tue, 28 Sep 2021 02:07:11 GMT Content-Type text/html; charset=iso-8859-1 Transfer-Encoding chunked Connection keep-alive location https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e CF-Cache-Status DYNAMIC Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l6OvGWepfOAbfX8U%2FwfLugRvqGzvKmrk2HIARssQkYKVf8QmJ9YeVaA9tZh9%2FVGXFLwQPRX7S%2Fga7GLxYuGDoNJ8HMnif4TAmGj9SuZdEGSqgWGsE1XNsMAmL7NTcSd6tuB0rwiO"}],"group":"cf-nel","max_age":604800} NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare CF-RAY 69596ab1387a27b8-PRG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	bd11e7e1780d43e799b3639e48965362.css amazon.card-isq.net/static/css/	129 KB 22 KB	25ms 24ms	Stylesheet text/css	104.21.79.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.79.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d447b1b5e5d8a7d5230c5c486665062dd8467240d0360e184e72e3aae85d6cf4` Request headers :path /static/css/bd11e7e1780d43e799b3639e48965362.css pragma no-cache cookie PHPSESSID=bhch5h3eg2sp6lc7ioqit6oc3r accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.card-isq.net referer https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding br cf-cache-status HIT last-modified Wed, 22 Sep 2021 07:06:50 GMT server cloudflare age 2338 etag W/"20595-5cc90287a1680-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kgjQqP60A2W3MOl3tACKTzzwSTz1R3FBY7ylqmoh3l78eddABIlB9sYyYebQGPzflC3FyMPptYxil1ce0xBaMS8Z6nvog4oBtNXGjbcamDZYy1zArg9ktJopZl2qR1lcgxZ4oo62"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 69596ab7697327a0-PRG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	85a90b4bdae741e0bac882a6c7f5cc24.css amazon.card-isq.net/static/css/	36 KB 7 KB	24ms 23ms	Stylesheet text/css	104.21.79.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.card-isq.net/static/css/85a90b4bdae741e0bac882a6c7f5cc24.css Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.79.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bc26ceee3e31c11e6f7a3770ded48f3c075a9202907030beb4beb51f887dfbbb` Request headers :path /static/css/85a90b4bdae741e0bac882a6c7f5cc24.css pragma no-cache cookie PHPSESSID=bhch5h3eg2sp6lc7ioqit6oc3r accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.card-isq.net referer https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding br cf-cache-status HIT last-modified Wed, 22 Sep 2021 06:47:32 GMT server cloudflare age 2338 etag W/"8e85-5cc8fe3746900-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cGwIp5hDO1rVsJCQf%2FeHrMNtvtP3OMxMQo5LjIf%2FmY%2Fvu%2BBRVMpc4o3BneG7X4rsNCl%2FEqw3J2RppU10fQdJBzMSzhoPtvkKNtB1A3oIBp%2FkRC38xKDoO4jtVb0SllWp3Pco5QgI"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 69596ab7697427a0-PRG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	11zuthihchl_1.css amazon.card-isq.net/static/css/	2 KB 1 KB	23ms 22ms	Stylesheet text/css	104.21.79.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.card-isq.net/static/css/11zuthihchl_1.css Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.79.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `622d8673eda33a71c418bfebdc10d50db4a75c6028fdae594e77e241284770d5` Request headers :path /static/css/11zuthihchl_1.css pragma no-cache cookie PHPSESSID=bhch5h3eg2sp6lc7ioqit6oc3r accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.card-isq.net referer https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding br cf-cache-status HIT last-modified Wed, 22 Sep 2021 07:06:50 GMT server cloudflare age 2338 etag W/"942-5cc90287a1680-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ykHNTdBImTZitVlWRUABhmNDRNC5Xg4jQcvgnOJpNnxrNiP6k%2B9EumudXfwtmXBDHAQYJR%2FQXgU8O0S2rNhAlcXuQLscpg4bGssQmYD1izVPeLwkSTYujTV60hnJh9nzDesweTUL"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 69596ab7697527a0-PRG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js Show response images-fe.ssl-images-amazon.com/images/I/	309 KB 96 KB	22ms 6ms	Script application/x-javascript	151.101.129.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js?AUIClients/AmazonUI Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4` Request headers Referer https://amazon.card-isq.net/ Origin https://amazon.card-isq.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding gzip age 4323334 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT content-length 98087 x-served-by cache-dca17764-DCA, cache-hhn4061-HHN last-modified Thu, 12 Sep 2019 21:14:10 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 8f4e6d72-252a-4434-9646-4b52ecfc77c2 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Thu, 23 May 2041 21:18:16 GMT
GET H2	200	21G215oqvfL._RC%7C21OJDARBhQL.js,218GJg15I8L.js,31lucpmF4CL.js,2119M3Ks9rL.js,51QAvzqhMLL.js_.js Show response images-fe.ssl-images-amazon.com/images/I/	81 KB 23 KB	30ms 14ms	Script application/x-javascript	151.101.129.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/21G215oqvfL._RC%7C21OJDARBhQL.js,218GJg15I8L.js,31lucpmF4CL.js,2119M3Ks9rL.js,51QAvzqhMLL.js_.js?AUIClients/AuthenticationPortalAssets Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `9f40433e5c72287c59d8cb2117a44374b90e09908cf4b68feb87cd9d9a924687` Request headers Referer https://amazon.card-isq.net/ Origin https://amazon.card-isq.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding gzip age 1674411 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS content-length 23478 x-served-by cache-dca17732-DCA, cache-hhn4061-HHN last-modified Tue, 24 Oct 2017 23:02:47 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id a280bd3b-d13b-4471-8eb7-ef6e112970a0 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Tue, 03 Sep 2041 17:00:21 GMT
GET H2	200	01wGDSlxwdL.js Show response images-fe.ssl-images-amazon.com/images/I/	521 B 681 B	29ms 14ms	Script application/x-javascript	151.101.129.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/01wGDSlxwdL.js?AUIClients/AuthenticationPortalInlineAssets Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `432dff2bd6f663c6151a5947fa318a46463085d4f6e40761450e8b38fd0fe938` Request headers Referer https://amazon.card-isq.net/ Origin https://amazon.card-isq.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding gzip age 2233426 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT content-length 351 x-served-by cache-dca17760-DCA, cache-hhn4061-HHN last-modified Tue, 22 Dec 2020 19:40:30 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 8d6f2db9-f1f9-4a96-8217-f449f9f784bf accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Tue, 20 Aug 2041 13:15:23 GMT
GET H2	200	31LdPc9QDeL.js Show response images-fe.ssl-images-amazon.com/images/I/	15 KB 5 KB	29ms 14ms	Script application/x-javascript	151.101.129.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/31LdPc9QDeL.js?AUIClients/CVFAssets Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `4bea7372b51cb29d95ee70daf254792b7ec806259bc510b6f9ff176dda5a476b` Request headers Referer https://amazon.card-isq.net/ Origin https://amazon.card-isq.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding gzip age 2231263 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT content-length 5098 x-served-by cache-dca17778-DCA, cache-hhn4061-HHN last-modified Wed, 01 Sep 2021 23:13:06 GMT vary Accept-Encoding content-type application/x-javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 75433256-7b2b-472a-a09e-d3cc165aef2c accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Wed, 28 Aug 2041 00:14:16 GMT
GET H2	200	81oDzXaLrLL.js Show response images-fe.ssl-images-amazon.com/images/I/	323 KB 94 KB	29ms 13ms	Script application/x-javascript	151.101.129.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/81oDzXaLrLL.js?AUIClients/SiegeClientSideEncryptionAUI Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `0de3356db62de62dc12d4024d65ec20c5f7577553b92384f0aecee28a05c8230` Request headers Referer https://amazon.card-isq.net/ Origin https://amazon.card-isq.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding gzip age 3435024 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS content-length 96066 x-served-by cache-dca17724-DCA, cache-hhn4061-HHN last-modified Wed, 28 Apr 2021 15:07:36 GMT vary Accept-Encoding content-type application/x-javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id a5ab4d03-365f-4173-b35e-626193935791 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Wed, 14 Aug 2041 07:56:48 GMT
GET H2	200	71QA2qlWPdL.js Show response images-fe.ssl-images-amazon.com/images/I/	255 KB 66 KB	28ms 13ms	Script application/x-javascript	151.101.129.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/71QA2qlWPdL.js?AUIClients/FWCIMAssets Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `f77b52306a879207e8e96931f1cc7db37b06508b243da56c89152c894340ec8b` Request headers Referer https://amazon.card-isq.net/ Origin https://amazon.card-isq.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT content-encoding gzip age 3567513 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS content-length 67663 x-served-by cache-dca17736-DCA, cache-hhn4061-HHN last-modified Mon, 16 Aug 2021 19:13:49 GMT vary Accept-Encoding content-type application/x-javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id b485faac-9365-40cc-ada5-84ee26979c55 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Mon, 12 Aug 2041 19:08:39 GMT
GET H3	200	mpgmt0r6ietyiee_1.png amazon.card-isq.net/static/images/	27 KB 28 KB	24ms 23ms	Image image/png	104.21.79.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://amazon.card-isq.net/static/images/mpgmt0r6ietyiee_1.png Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.79.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers :path /static/images/mpgmt0r6ietyiee_1.png pragma no-cache cookie PHPSESSID=bhch5h3eg2sp6lc7ioqit6oc3r accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority amazon.card-isq.net referer https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 2338 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27972 last-modified Wed, 22 Sep 2021 07:06:50 GMT server cloudflare etag "6d44-5cc90287a1680" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zW5B1vt%2BPrDi9b%2FyiEf56%2BcJ6786YQLNfW4ZqscMoFVA0%2BZJtPHgS0rnal5sGIbPpqXWbMXyhVU7eCXFIU96IyP8%2F1cjgS132ZhhHYI3tjQcuQYep8qOVTVOqCD%2Fd2RjLFcIgXuG"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 69596ab7a8d627c0-PRG
GET H3	200	eyzhm86n6zcdpta_1.png amazon.card-isq.net/static/images/	4 KB 4 KB	23ms 23ms	Image image/png	104.21.79.52 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://amazon.card-isq.net/static/images/eyzhm86n6zcdpta_1.png Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.79.52 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers :path /static/images/eyzhm86n6zcdpta_1.png pragma no-cache cookie PHPSESSID=bhch5h3eg2sp6lc7ioqit6oc3r accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority amazon.card-isq.net referer https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/static/css/bd11e7e1780d43e799b3639e48965362.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 02:07:12 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 2338 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 3589 last-modified Wed, 22 Sep 2021 07:08:42 GMT server cloudflare etag "e05-5cc902f271280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=70kDIFuR4SMF77tsLcOeMpToPhRWDowyFgqoqr%2BuMzdo6CCts5HmszzXY5TuTUFclTCgGp16kcjRkOHdNSal%2BfW%2FkfimGZXsAQ25kuOiK4IpU17Ld31nqCnIFJMPzNFezHhvQbuD"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 69596ab7a8d727c0-PRG
GET H2	200	AuthenticationPortalSigninFE.js Show response static.siege-amazon.com/prod/profiles/	2 KB 1 KB	25ms 8ms	Script text/plain	13.225.78.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.siege-amazon.com/prod/profiles/AuthenticationPortalSigninFE.js Requested by Host: amazon.card-isq.net URL: https://amazon.card-isq.net/index/index/login?login_key=615278cf6470e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.78.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-55.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash `4ad0041d2796e95b541910ee8d455d82dcfa566b68a90c10b3fef2c680eaa89c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 01:33:11 GMT content-encoding gzip last-modified Mon, 08 Mar 2021 08:43:19 GMT server AmazonS3 age 2100 etag W/"c2b93f8502fc8d7641c3bf56cc0216cb" vary Accept-Encoding x-edge-origin-shield-skipped 0 content-type text/plain via 1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-pop FRA2-C2 x-amz-cf-id igEb9ljke-TQ4hT1YHJ7sfjj4WXIzD9lHmFRO8nrP-Eu-TocYZcPSA==
GET H2	200	index.js Show response d35uxhjf90umnp.cloudfront.net/	37 KB 12 KB	24ms 7ms	Script application/javascript	13.225.84.133 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d35uxhjf90umnp.cloudfront.net/index.js Requested by Host: images-fe.ssl-images-amazon.com URL: https://images-fe.ssl-images-amazon.com/images/I/71QA2qlWPdL.js?AUIClients/FWCIMAssets Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.133 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-133.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash `6267b22c78747f8db9476b502c900e874aebf89e1c658b5b3282f4c01f7a54c2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.card-isq.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id .WCB9yvxzufrsvypRZW5w_pUwNZ4.SCn content-encoding gzip etag W/"a216acbf4c266a507cb6c7de4d63d883" last-modified Tue, 27 Apr 2021 20:18:23 GMT server AmazonS3 age 74624 x-amz-server-side-encryption AES256 vary Accept-Encoding x-edge-origin-shield-skipped 0 content-type application/javascript via 1.1 edfd22ec6695cdc9d7ac634220af1315.cloudfront.net (CloudFront) date Mon, 27 Sep 2021 05:34:37 GMT x-cache Hit from cloudfront x-amz-cf-pop FRA2-C2 x-amz-cf-id 2vtUTje0bS_zJLKduTFRwhAgjpIz4aUO_ph3pKcB7B5rObql1y6h9w==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon.card-isq.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: bhch5h3eg2sp6lc7ioqit6oc3r

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.card-isq.net
amazon.oqls.net
d35uxhjf90umnp.cloudfront.net
images-fe.ssl-images-amazon.com
static.siege-amazon.com
104.21.1.15
104.21.79.52
13.225.78.55
13.225.84.133
151.101.129.16
0de3356db62de62dc12d4024d65ec20c5f7577553b92384f0aecee28a05c8230
432dff2bd6f663c6151a5947fa318a46463085d4f6e40761450e8b38fd0fe938
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
4ad0041d2796e95b541910ee8d455d82dcfa566b68a90c10b3fef2c680eaa89c
4bea7372b51cb29d95ee70daf254792b7ec806259bc510b6f9ff176dda5a476b
512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4
56a649ef56acec1c285af3aa8de4b32765b39b7343d08ab7e5fb1b3b15863112
622d8673eda33a71c418bfebdc10d50db4a75c6028fdae594e77e241284770d5
6267b22c78747f8db9476b502c900e874aebf89e1c658b5b3282f4c01f7a54c2
9f40433e5c72287c59d8cb2117a44374b90e09908cf4b68feb87cd9d9a924687
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
bc26ceee3e31c11e6f7a3770ded48f3c075a9202907030beb4beb51f887dfbbb
d447b1b5e5d8a7d5230c5c486665062dd8467240d0360e184e72e3aae85d6cf4
f77b52306a879207e8e96931f1cc7db37b06508b243da56c89152c894340ec8b

amazon.card-isq.net Open in urlscan Pro 104.21.79.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

372 kBTransfer

1260 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

1 Cookies

Indicators

amazon.card-isq.net Open in urlscan Pro
104.21.79.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

372 kB
Transfer

1260 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!