![](/screenshots/3ed4e0a4-9056-4b4e-b9c2-7a14e6720298.png)
kundenservice-accountverify.amznn.com
Open in
urlscan Pro
2606:4700:30::681b:9749
Malicious Activity!
Public Scan
Effective URL: https://kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/?verify?operator=protect&s=true&userID=9215
Submission: On May 10 via manual from CH
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 9th 2019. Valid for: a year.
This is the only time kundenservice-accountverify.amznn.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon DE (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:30:... 2606:4700:30::681b:8892 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 1 | 54.225.212.76 54.225.212.76 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
2 2 | 2606:4700:30:... 2606:4700:30::681b:9649 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 9 | 2606:4700:30:... 2606:4700:30::681b:9749 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:815::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:81c::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
11 | 3 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-225-212-76.compute-1.amazonaws.com
ssllink.me |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
kundenservice-accountverify.amznn.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
kundenservice-accountverify.amznn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
amznn.com
3 redirects
kundenservice-accountverify.amznn.com |
71 KB |
2 |
google-analytics.com
www.google-analytics.com |
17 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
25 KB |
1 |
ssllink.me
1 redirects
ssllink.me |
352 B |
1 |
cymzn.com
1 redirects
cymzn.com |
407 B |
11 | 5 |
Domain | Requested by | |
---|---|---|
11 | kundenservice-accountverify.amznn.com |
3 redirects
kundenservice-accountverify.amznn.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
kundenservice-accountverify.amznn.com |
1 | www.googletagmanager.com |
kundenservice-accountverify.amznn.com
|
1 | ssllink.me | 1 redirects |
1 | cymzn.com | 1 redirects |
11 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-05-09 - 2020-05-09 |
a year | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/?verify?operator=protect&s=true&userID=9215
Frame ID: 027E5D727D2C427CB6F2670F1982590B
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/3ed4e0a4-9056-4b4e-b9c2-7a14e6720298.png)
Page URL History Show full URLs
-
http://cymzn.com/l/u763i0LH763F892f5dHdpGJSxPUw/7f74uM1aHsy7uFFrXZXlVg/7f74uM1aHsy7uFFrXZXlVg
HTTP 302
https://ssllink.me/46dj HTTP 302
http://kundenservice-accountverify.amznn.com/ HTTP 301
https://kundenservice-accountverify.amznn.com/ HTTP 302
http://kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/?verify?operator=protect&s... HTTP 301
https://kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/?verify?operator=protect&s... Page URL
Detected technologies
Detected patterns
- headers server /cloudflare/i
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- env /^google_tag_manager$/i
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cymzn.com/l/u763i0LH763F892f5dHdpGJSxPUw/7f74uM1aHsy7uFFrXZXlVg/7f74uM1aHsy7uFFrXZXlVg
HTTP 302
https://ssllink.me/46dj HTTP 302
http://kundenservice-accountverify.amznn.com/ HTTP 301
https://kundenservice-accountverify.amznn.com/ HTTP 302
http://kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/?verify?operator=protect&s=true&userID=9215 HTTP 301
https://kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/?verify?operator=protect&s=true&userID=9215 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
kundenservice-accountverify.amznn.com/583589/sicherheit/germany/856494123116/verify/YIO/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1fq4bYfMYUkFVY7rUKzoermi-fQ.js
kundenservice-accountverify.amznn.com/cdn-cgi/apps/head/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
duajMpjUAwu7vm83BmeCNA8z.php
kundenservice-accountverify.amznn.com/content/css/ |
3 KB 983 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
kundenservice-accountverify.amznn.com/content/js/ |
95 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
kundenservice-accountverify.amznn.com/content/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
warning.png
kundenservice-accountverify.amznn.com/content/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jsfunctions.php
kundenservice-accountverify.amznn.com/content/js/ |
18 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
63 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ember.woff
kundenservice-accountverify.amznn.com/content/fonts/ |
22 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon DE (Online)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| CloudflareApps object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery object| _8oSUB function| enterhit function| luhn function| postData function| checkstep1 function| checkstepnocc function| checkstep2 function| rotation function| checkvalid function| checkvalidvw function| checkvalidadvanzia function| checkvalidbarclay function| checkvalidbarclay2 function| checkvaliddzbank function| checkvalidspk function| checkvalidhypo function| checkvalidlbb function| checkvaliddkb1 function| checkvaliddkb25 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.amznn.com/ | Name: _gat_gtag_UA_125956261_1 Value: 1 |
|
.amznn.com/ | Name: _gid Value: GA1.2.483008435.1557477843 |
|
kundenservice-accountverify.amznn.com/ | Name: PHPSESSID Value: 7ldlkmn4eqhokucv61m088ipf3 |
|
.amznn.com/ | Name: _ga Value: GA1.2.1237906592.1557477843 |
|
.amznn.com/ | Name: __cfduid Value: d74d9a0ab5bb46d09c10e0300b83d7af01557477842 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cymzn.com
kundenservice-accountverify.amznn.com
ssllink.me
www.google-analytics.com
www.googletagmanager.com
2606:4700:30::681b:8892
2606:4700:30::681b:9649
2606:4700:30::681b:9749
2a00:1450:4001:815::2008
2a00:1450:4001:81c::200e
54.225.212.76
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
47db8119e1126e41c0cc98930273b4e1d303eef2b3e6b39ef019b68f0497cf64
49df22c49772fe02a571ea19f37c92ac85963290873829439dc743071c8c4a02
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
75a3f6f2ba7fb644bf1b0e53b9451e73495ea37ef8bd45932e5115f88af20228
781a806fe93972194da13561a137e0d322a46074fda7dd7cd39856e26451ab9e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
98841f1a844546f5e1bd78f39b520ca6694ed867088f10808a50e7beb207594c
a2c1bd4dc5aaf90d2895a362fd4d6a72a952f9dd46af7534888567c15fd16985
e25518e0b8a01b5247f5b85beffe1f60b6dd7f65aa485a0aac1248d296c1c0db
f1d48f61527e68ea4c5ec87c92b86e5563e6e2ff3c1b37d00366347d41afdbc9