amazon.casaaq.com Open in urlscan Pro
162.240.4.27 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://amazon.careoq.net/
Effective URL:
https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817
Submission: On September 26 via api (September 26th 2021, 9:49:22 pm UTC) from US — Scanned from DE

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 5 domains to perform 14 HTTP transactions. The main IP is 162.240.4.27, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is amazon.casaaq.com.
TLS certificate: Issued by R3 on September 26th 2021. Valid for: 3 months.

This is the only time amazon.casaaq.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
3 9	162.240.4.27 162.240.4.27	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	13.225.78.3 13.225.78.3	16509 (AMAZON-02) (AMAZON-02)
6	151.101.65.16 151.101.65.16	54113 (FASTLY) (FASTLY)
1	13.225.84.133 13.225.84.133	16509 (AMAZON-02) (AMAZON-02)
14	4

9 162.240.4.27 (United States) 3 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-6943159.artworkweb.com.br

amazon.careoq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
amazon.casaaq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-3.fra2.r.cloudfront.net

static.siege-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.65.16 (United States)

ASN54113 (FASTLY, US)

images-fe.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.84.133 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-84-133.fra2.r.cloudfront.net

d35uxhjf90umnp.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	casaaq.com 1 redirects amazon.casaaq.com	71 KB
6	ssl-images-amazon.com images-fe.ssl-images-amazon.com	285 KB
2	careoq.net 2 redirects amazon.careoq.net	332 B
1	cloudfront.net d35uxhjf90umnp.cloudfront.net	12 KB
1	siege-amazon.com static.siege-amazon.com	1 KB
14	5

	Domain	Requested by
7	amazon.casaaq.com	1 redirects amazon.casaaq.com
6	images-fe.ssl-images-amazon.com	amazon.casaaq.com
2	amazon.careoq.net	2 redirects
1	d35uxhjf90umnp.cloudfront.net	images-fe.ssl-images-amazon.com
1	static.siege-amazon.com	amazon.casaaq.com
14	5

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid
amazon.careoq.com R3	`2021-09-26` - `2021-12-25`	3 months	crt.sh
static.siege-amazon.com Amazon	`2021-04-22` - `2022-05-21`	a year	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817
Frame ID: C9216C49DCFC29EDBB1F1C163F3DD770
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazonサインイン

Page URL History Show full URLs

http://amazon.careoq.net/ HTTP 301
https://amazon.careoq.net/ HTTP 302
http://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 HTTP 301
https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Page URL

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

1
Countries

369 kB
Transfer

1260 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=1800&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&siteState=clientContext%3D358-8099168-1927245%2CsourceUrl%3Dhttps%253A%252F%252Fwww.amazon.co.jp%2Csignature%3DaPTU8l90tdRVm3iOS84RKH6zUzgj3D&marketPlaceId=A1VC38T7YXB528&pageId=amzn_abbott_portal_jp&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F&prevRID=2K83G2EH7B2B3WXTJTNF&openid.assoc_handle=amzn_abbott_portal_jp&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: パスワードを忘れた場合

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/register?showRememberMe=true&openid.pape.max_auth_age=1800&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&siteState=clientContext%3D358-8099168-1927245%2CsourceUrl%3Dhttps%253A%252F%252Fwww.amazon.co.jp%2Csignature%3DaPTU8l90tdRVm3iOS84RKH6zUzgj3D&marketPlaceId=A1VC38T7YXB528&pageId=amzn_abbott_portal_jp&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F&prevRID=2K83G2EH7B2B3WXTJTNF&openid.assoc_handle=amzn_abbott_portal_jp&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Amazonアカウントを作成する

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://amazon.careoq.net/ HTTP 301
https://amazon.careoq.net/ HTTP 302
http://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 HTTP 301
https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login Show response amazon.casaaq.com/index/index/ Redirect Chain http://amazon.careoq.net/ https://amazon.careoq.net/ http://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817	39 KB 10 KB	206ms 206ms	Document text/html	162.240.4.27 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.240.4.27 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS vps-6943159.artworkweb.com.br Software Apache / Resource Hash `56a649ef56acec1c285af3aa8de4b32765b39b7343d08ab7e5fb1b3b15863112` Request headers :method GET :authority amazon.casaaq.com :scheme https :path /index/index/login?login_key=6150eadd1b817 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Sun, 26 Sep 2021 21:49:17 GMT server Apache expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=p38ar632054ota56p3fo0aktki; path=/ vary Accept-Encoding content-encoding gzip content-length 10495 content-type text/html; charset=utf-8 Redirect headers Date Sun, 26 Sep 2021 21:49:17 GMT Server Apache Location https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Content-Length 342 Connection close Content-Type text/html; charset=iso-8859-1
GET H2	200	bd11e7e1780d43e799b3639e48965362.css amazon.casaaq.com/static/css/	129 KB 22 KB	176ms 176ms	Stylesheet text/css	162.240.4.27 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.240.4.27 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS vps-6943159.artworkweb.com.br Software Apache / Resource Hash `d447b1b5e5d8a7d5230c5c486665062dd8467240d0360e184e72e3aae85d6cf4` Request headers :path /static/css/bd11e7e1780d43e799b3639e48965362.css pragma no-cache cookie PHPSESSID=p38ar632054ota56p3fo0aktki accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.casaaq.com referer https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 07:06:50 GMT server Apache etag "20595-5cc90287a1680-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 21993
GET H2	200	85a90b4bdae741e0bac882a6c7f5cc24.css amazon.casaaq.com/static/css/	36 KB 7 KB	171ms 170ms	Stylesheet text/css	162.240.4.27 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://amazon.casaaq.com/static/css/85a90b4bdae741e0bac882a6c7f5cc24.css Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.240.4.27 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS vps-6943159.artworkweb.com.br Software Apache / Resource Hash `bc26ceee3e31c11e6f7a3770ded48f3c075a9202907030beb4beb51f887dfbbb` Request headers :path /static/css/85a90b4bdae741e0bac882a6c7f5cc24.css pragma no-cache cookie PHPSESSID=p38ar632054ota56p3fo0aktki accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.casaaq.com referer https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 06:47:32 GMT server Apache etag "8e85-5cc8fe3746900-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 6578
GET H2	200	11zuthihchl_1.css amazon.casaaq.com/static/css/	2 KB 971 B	170ms 170ms	Stylesheet text/css	162.240.4.27 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://amazon.casaaq.com/static/css/11zuthihchl_1.css Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.240.4.27 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS vps-6943159.artworkweb.com.br Software Apache / Resource Hash `622d8673eda33a71c418bfebdc10d50db4a75c6028fdae594e77e241284770d5` Request headers :path /static/css/11zuthihchl_1.css pragma no-cache cookie PHPSESSID=p38ar632054ota56p3fo0aktki accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.casaaq.com referer https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 07:06:50 GMT server Apache etag "942-5cc90287a1680-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 860
GET H2	200	AuthenticationPortalSigninFE.js Show response static.siege-amazon.com/prod/profiles/	2 KB 1 KB	50ms 8ms	Script text/plain	13.225.78.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.siege-amazon.com/prod/profiles/AuthenticationPortalSigninFE.js Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.78.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-3.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash `4ad0041d2796e95b541910ee8d455d82dcfa566b68a90c10b3fef2c680eaa89c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 01:32:05 GMT content-encoding gzip last-modified Mon, 08 Mar 2021 08:43:19 GMT server AmazonS3 age 73033 etag W/"c2b93f8502fc8d7641c3bf56cc0216cb" vary Accept-Encoding x-edge-origin-shield-skipped 0 content-type text/plain via 1.1 03d509e8374e9f42668961b5e0201349.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-pop FRA2-C2 x-amz-cf-id U8sreqNKuRMKb7Au-11BHfALAR_jb5KEcXj7Tl1_S3Z39aF_oYBRZQ==
GET H2	200	61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js Show response images-fe.ssl-images-amazon.com/images/I/	309 KB 96 KB	69ms 6ms	Script application/x-javascript	151.101.65.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js?AUIClients/AmazonUI Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4` Request headers Referer https://amazon.casaaq.com/ Origin https://amazon.casaaq.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip age 4221459 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT content-length 98087 x-served-by cache-dca17764-DCA, cache-hhn4081-HHN last-modified Thu, 12 Sep 2019 21:14:10 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 8f4e6d72-252a-4434-9646-4b52ecfc77c2 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Thu, 23 May 2041 21:18:16 GMT
GET H2	200	21G215oqvfL._RC%7C21OJDARBhQL.js,218GJg15I8L.js,31lucpmF4CL.js,2119M3Ks9rL.js,51QAvzqhMLL.js_.js Show response images-fe.ssl-images-amazon.com/images/I/	81 KB 23 KB	70ms 7ms	Script application/x-javascript	151.101.65.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/21G215oqvfL._RC%7C21OJDARBhQL.js,218GJg15I8L.js,31lucpmF4CL.js,2119M3Ks9rL.js,51QAvzqhMLL.js_.js?AUIClients/AuthenticationPortalAssets Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `9f40433e5c72287c59d8cb2117a44374b90e09908cf4b68feb87cd9d9a924687` Request headers Referer https://amazon.casaaq.com/ Origin https://amazon.casaaq.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip age 1572537 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS content-length 23478 x-served-by cache-dca17761-DCA, cache-hhn4081-HHN last-modified Tue, 24 Oct 2017 23:02:47 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id a280bd3b-d13b-4471-8eb7-ef6e112970a0 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Tue, 03 Sep 2041 17:00:21 GMT
GET H2	200	01wGDSlxwdL.js Show response images-fe.ssl-images-amazon.com/images/I/	521 B 501 B	70ms 7ms	Script application/x-javascript	151.101.65.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/01wGDSlxwdL.js?AUIClients/AuthenticationPortalInlineAssets Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `432dff2bd6f663c6151a5947fa318a46463085d4f6e40761450e8b38fd0fe938` Request headers Referer https://amazon.casaaq.com/ Origin https://amazon.casaaq.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip age 2131551 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT content-length 351 x-served-by cache-dca17760-DCA, cache-hhn4081-HHN last-modified Tue, 22 Dec 2020 19:40:30 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 8d6f2db9-f1f9-4a96-8217-f449f9f784bf accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Tue, 20 Aug 2041 13:15:23 GMT
GET H2	200	31LdPc9QDeL.js Show response images-fe.ssl-images-amazon.com/images/I/	15 KB 5 KB	81ms 18ms	Script application/x-javascript	151.101.65.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/31LdPc9QDeL.js?AUIClients/CVFAssets Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `4bea7372b51cb29d95ee70daf254792b7ec806259bc510b6f9ff176dda5a476b` Request headers Referer https://amazon.casaaq.com/ Origin https://amazon.casaaq.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip age 2129390 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT content-length 5098 x-served-by cache-dca17778-DCA, cache-hhn4081-HHN last-modified Wed, 01 Sep 2021 23:13:06 GMT vary Accept-Encoding content-type application/x-javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 75433256-7b2b-472a-a09e-d3cc165aef2c accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Wed, 28 Aug 2041 00:14:16 GMT
GET H2	200	81oDzXaLrLL.js Show response images-fe.ssl-images-amazon.com/images/I/	323 KB 94 KB	81ms 19ms	Script application/x-javascript	151.101.65.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/81oDzXaLrLL.js?AUIClients/SiegeClientSideEncryptionAUI Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `0de3356db62de62dc12d4024d65ec20c5f7577553b92384f0aecee28a05c8230` Request headers Referer https://amazon.casaaq.com/ Origin https://amazon.casaaq.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip age 3333150 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS content-length 96066 x-served-by cache-dca17724-DCA, cache-hhn4081-HHN last-modified Wed, 28 Apr 2021 15:07:36 GMT vary Accept-Encoding content-type application/x-javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id a5ab4d03-365f-4173-b35e-626193935791 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Wed, 14 Aug 2041 07:56:48 GMT
GET H2	200	71QA2qlWPdL.js Show response images-fe.ssl-images-amazon.com/images/I/	255 KB 66 KB	80ms 18ms	Script application/x-javascript	151.101.65.16 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-fe.ssl-images-amazon.com/images/I/71QA2qlWPdL.js?AUIClients/FWCIMAssets Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/index/index/login?login_key=6150eadd1b817 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.16 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `f77b52306a879207e8e96931f1cc7db37b06508b243da56c89152c894340ec8b` Request headers Referer https://amazon.casaaq.com/ Origin https://amazon.casaaq.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT content-encoding gzip age 3465639 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS content-length 67663 x-served-by cache-dca17736-DCA, cache-hhn4081-HHN last-modified Mon, 16 Aug 2021 19:13:49 GMT vary Accept-Encoding content-type application/x-javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id b485faac-9365-40cc-ada5-84ee26979c55 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Mon, 12 Aug 2041 19:08:39 GMT
GET H2	200	mpgmt0r6ietyiee_1.png amazon.casaaq.com/static/images/	27 KB 28 KB	169ms 169ms	Image image/png	162.240.4.27 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://amazon.casaaq.com/static/images/mpgmt0r6ietyiee_1.png Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.240.4.27 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS vps-6943159.artworkweb.com.br Software Apache / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers :path /static/images/mpgmt0r6ietyiee_1.png pragma no-cache cookie PHPSESSID=p38ar632054ota56p3fo0aktki accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority amazon.casaaq.com referer https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT last-modified Wed, 22 Sep 2021 07:06:50 GMT server Apache accept-ranges bytes etag "6d44-5cc90287a1680" content-length 27972 content-type image/png
GET H2	200	eyzhm86n6zcdpta_1.png amazon.casaaq.com/static/images/	4 KB 4 KB	169ms 169ms	Image image/png	162.240.4.27 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://amazon.casaaq.com/static/images/eyzhm86n6zcdpta_1.png Requested by Host: amazon.casaaq.com URL: https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.240.4.27 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS vps-6943159.artworkweb.com.br Software Apache / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers :path /static/images/eyzhm86n6zcdpta_1.png pragma no-cache cookie PHPSESSID=p38ar632054ota56p3fo0aktki accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority amazon.casaaq.com referer https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/static/css/bd11e7e1780d43e799b3639e48965362.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 21:49:18 GMT last-modified Wed, 22 Sep 2021 07:08:42 GMT server Apache accept-ranges bytes etag "e05-5cc902f271280" content-length 3589 content-type image/png
GET H2	200	index.js Show response d35uxhjf90umnp.cloudfront.net/	37 KB 12 KB	48ms 7ms	Script application/javascript	13.225.84.133 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d35uxhjf90umnp.cloudfront.net/index.js Requested by Host: images-fe.ssl-images-amazon.com URL: https://images-fe.ssl-images-amazon.com/images/I/71QA2qlWPdL.js?AUIClients/FWCIMAssets Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.133 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-133.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash `6267b22c78747f8db9476b502c900e874aebf89e1c658b5b3282f4c01f7a54c2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.casaaq.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id .WCB9yvxzufrsvypRZW5w_pUwNZ4.SCn content-encoding gzip etag W/"a216acbf4c266a507cb6c7de4d63d883" last-modified Tue, 27 Apr 2021 20:18:23 GMT server AmazonS3 age 59180 x-amz-server-side-encryption AES256 vary Accept-Encoding x-edge-origin-shield-skipped 0 content-type application/javascript via 1.1 882f747f39885162595630c95dd0012d.cloudfront.net (CloudFront) date Sun, 26 Sep 2021 06:05:23 GMT x-cache Hit from cloudfront x-amz-cf-pop FRA2-C2 x-amz-cf-id iOTTDCKiFBMDJgmOVbgoNxVwyRscbqW7o1tH8QD3LBqVjKLeTVHggg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon.casaaq.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: p38ar632054ota56p3fo0aktki

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.careoq.net
amazon.casaaq.com
d35uxhjf90umnp.cloudfront.net
images-fe.ssl-images-amazon.com
static.siege-amazon.com
13.225.78.3
13.225.84.133
151.101.65.16
162.240.4.27
0de3356db62de62dc12d4024d65ec20c5f7577553b92384f0aecee28a05c8230
432dff2bd6f663c6151a5947fa318a46463085d4f6e40761450e8b38fd0fe938
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
4ad0041d2796e95b541910ee8d455d82dcfa566b68a90c10b3fef2c680eaa89c
4bea7372b51cb29d95ee70daf254792b7ec806259bc510b6f9ff176dda5a476b
512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4
56a649ef56acec1c285af3aa8de4b32765b39b7343d08ab7e5fb1b3b15863112
622d8673eda33a71c418bfebdc10d50db4a75c6028fdae594e77e241284770d5
6267b22c78747f8db9476b502c900e874aebf89e1c658b5b3282f4c01f7a54c2
9f40433e5c72287c59d8cb2117a44374b90e09908cf4b68feb87cd9d9a924687
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
bc26ceee3e31c11e6f7a3770ded48f3c075a9202907030beb4beb51f887dfbbb
d447b1b5e5d8a7d5230c5c486665062dd8467240d0360e184e72e3aae85d6cf4
f77b52306a879207e8e96931f1cc7db37b06508b243da56c89152c894340ec8b

amazon.casaaq.com Open in urlscan Pro 162.240.4.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

4 IPs

1 Countries

369 kBTransfer

1260 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

1 Cookies

Indicators

amazon.casaaq.com Open in urlscan Pro
162.240.4.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

1
Countries

369 kB
Transfer

1260 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!