amazon.works.ga Open in urlscan Pro
35.186.245.55  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response amazon.works.ga/	6 KB 7 KB	547ms 312ms	Document text/html	35.186.245.55 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://amazon.works.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 55.245.186.35.bc.googleusercontent.com Software / Express Resource Hash 974cc85c8bfbf86af6a3208c56d63917e3548b25c85163dc41823cbc9590c289 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-length 6591 content-type text/html; charset=utf-8 date Wed, 04 May 2022 01:01:37 GMT etag W/"19bf-5yT+1yhmK7It92au3fNeFX0AC8I" expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" replit-cluster global x-powered-by Express
GET H2	200	AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	165 KB 23 KB	79ms 12ms	Stylesheet text/css	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Requested by Host: amazon.works.ga URL: https://amazon.works.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Wed, 19 Jan 2022 07:47:53 GMT content-encoding gzip age 9047624 edge-cache-tag x-cache-257,/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-257 /images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min last-modified Wed, 17 Jul 2013 22:49:32 GMT server Server content-type text/css via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id b19a335a-55dd-4eb3-aacf-064056f5ab07 x-amz-cf-pop FRA56-P7 timing-allow-origin https://www.amazon.com x-amz-cf-id wZuANVubar2tX9UFwMWp-EL3Btw9zjQMZxO14f9I06h6wdAs9UaAXA== expires Mon, 13 Jan 2042 15:51:19 GMT
GET H2	200	Captcha_jocbdxjepz.jpg images-na.ssl-images-amazon.com/captcha/ddwwidnf/	5 KB 6 KB	80ms 13ms	Image image/jpeg	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/captcha/ddwwidnf/Captcha_jocbdxjepz.jpg Requested by Host: amazon.works.ga URL: https://amazon.works.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash cbbe1b8fbb6766e4bd43ae9208be62642318b2409d7c0dd5b27e19e23eaa7569 Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Tue, 03 May 2022 09:40:17 GMT via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) age 55333 edge-cache-tag x-cache-329,/captcha/ddwwidnf/Captcha_jocbdxjepz x-nginx-cache-status HIT x-cache Hit from cloudfront content-length 5220 surrogate-key x-cache-329 /captcha/ddwwidnf/Captcha_jocbdxjepz last-modified Wed, 08 Feb 2012 17:14:53 GMT server Server content-type image/jpeg access-control-allow-origin * x-amz-ir-id 292a1adb-2439-45c7-9f09-39fc36bae984 x-amz-cf-pop FRA56-P7 accept-ranges bytes x-amz-cf-id v1-Pr_JxZh5k4n7Yu0oYyVWWvTKHkDR9Ljevzgu0UW0SBvZDlyT7og==
GET H2	200	requestId=6JX7B3KSCRN11PPS8RF9&js=1 fls-na.amazon.com/1/oc-csi/1/OP/	43 B 149 B	320ms 99ms	Image image/gif	34.226.72.32 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://fls-na.amazon.com/1/oc-csi/1/OP/requestId=6JX7B3KSCRN11PPS8RF9&js=1 Requested by Host: amazon.works.ga URL: https://amazon.works.ga/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.226.72.32 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-226-72-32.compute-1.amazonaws.com Software / Resource Hash a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Wed, 04 May 2022 01:01:38 GMT x-amzn-requestid a4403e2c-a3ab-4049-a471-22c25ab21d71 content-length 43 content-type image/gif
GET H2	200	csm-captcha-instrumentation.min.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	2 KB 2 KB	7ms 7ms	Script application/x-javascript	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js Requested by Host: amazon.works.ga URL: https://amazon.works.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Tue, 03 May 2022 15:11:32 GMT content-encoding gzip age 35405 edge-cache-tag x-cache-037,/images/G/01/csminstrumentation/csm-captcha-instrumentation.min x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-037 /images/G/01/csminstrumentation/csm-captcha-instrumentation.min last-modified Mon, 12 Oct 2015 09:22:39 GMT server Server content-type application/x-javascript via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) cache-control max-age=86400,public x-amz-ir-id 8811b86c-3f88-49ad-a48e-1a30683da749 x-amz-cf-pop FRA56-P7 timing-allow-origin https://www.amazon.com x-amz-cf-id H0L0EfHB_ADC81dkT74nZTsTw8sVNyAdJYppr44QTc1H4ph-9TGrHQ== expires Wed, 04 May 2022 09:16:11 GMT
GET H2	200	rd-script-6d68177fa6061598e9509dc4b5bdd08d.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	2 KB 1 KB	8ms 8ms	Script application/x-javascript	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d.js Requested by Host: amazon.works.ga URL: https://amazon.works.ga/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 0a7e3153f44d0e51c73dad9fa3034a14446bedbafc38e477915382dd02269123 Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Wed, 04 May 2022 00:44:49 GMT content-encoding gzip age 1008 edge-cache-tag x-cache-567,/images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-567 /images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d last-modified Fri, 20 Mar 2020 12:31:03 GMT server Server content-type application/x-javascript via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) cache-control max-age=86400,public x-amz-ir-id 8eab0781-fbb3-4135-84a3-dc4ed816afcd x-amz-cf-pop FRA56-P7 timing-allow-origin https://www.amazon.com x-amz-cf-id pulPF3ecDStgUAFzFebmi7EDdL553xlZ4sYB1oklLsFjxCqT2NNHeA== expires Wed, 04 May 2022 18:09:24 GMT
GET H2	200	aui_sprite_0007-1x._V383827579_.png images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/	17 KB 17 KB	8ms 8ms	Image image/png	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/aui_sprite_0007-1x._V383827579_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa Request headers accept-language de-DE,de;q=0.9 Referer https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 05 Feb 2022 18:57:14 GMT via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) age 7538663 edge-cache-tag x-cache-478,/images/G/01/amazonui/sprites/aui_sprite_0007-1x x-cache Hit from cloudfront content-length 16972 surrogate-key x-cache-478 /images/G/01/amazonui/sprites/aui_sprite_0007-1x last-modified Wed, 15 May 2013 01:55:34 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 12f57767-234b-41e5-88fb-3f96ea388957 x-amz-cf-pop FRA56-P7 timing-allow-origin https://www.amazon.com x-amz-cf-id 3TilOvgohVD7a8cQs7vTvYxYY9DM6Tr1uCgsuLq1ylTleAEfKf8Qsg== expires Fri, 31 Jan 2042 18:57:14 GMT
GET H2	200	ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	7 KB 4 KB	8ms 8ms	Script application/x-javascript	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37 Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 05 Feb 2022 09:10:30 GMT content-encoding gzip age 7573867 edge-cache-tag x-cache-298,/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 x-nginx-cache-status MISS x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-298 /images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 last-modified Wed, 26 Aug 2015 14:52:49 GMT server Server content-type application/x-javascript via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 37a8a3c8-fd27-401e-b2f6-2e8322a7f94e x-amz-cf-pop FRA56-P7 timing-allow-origin https://www.amazon.com x-amz-cf-id TeS2JvLRbyilWL2-2oqdFNbNU6jr6onP5gIPBOfJk6lUwWXWK9Qa8g== expires Fri, 31 Jan 2042 09:10:30 GMT
GET H2	200	ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	19 KB 8 KB	9ms 9ms	Script application/x-javascript	2600:9000:2491:3600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:3600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042 Request headers accept-language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 23 Apr 2022 16:42:12 GMT content-encoding gzip age 893969 edge-cache-tag x-cache-330,/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-330 /images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min last-modified Thu, 01 Oct 2015 10:17:43 GMT server Server content-type application/x-javascript via 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 2b2d830e-119a-4354-9503-43b8a3379a16 x-amz-cf-pop FRA56-P7 timing-allow-origin https://www.amazon.com x-amz-cf-id AoOKe3zs0ZOzl20FHe70FlNxn_ljrC-4-VuEDcsJ_81n5shK2Hs6Kg== expires Fri, 18 Apr 2042 16:42:08 GMT
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 166 B	196ms 195ms	Ping text/plain	34.226.72.32 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.226.72.32 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-226-72-32.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://amazon.works.ga/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 04 May 2022 01:01:39 GMT x-amzn-requestid 25ff39e6-947f-48db-897d-e38f7ccfdb2d access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails number| ue_t0 object| ue_csm object| ue string| ue_furl string| ue_mid string| ue_sid string| ue_sn string| ue_id object| head string| prefix object| elem object| ue_modules object| cel_widgets string| ue_cel_ns number| ue_skc object| ue_err number| ueinit function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop function| ueLogError object| ue_cel object| ue_pdm object| ue_vpm object| ue_fem object| ue_mcm object| ue_mmm object| ue_rpl object| ue_kpm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon.works.ga/	1970-01-20 03:26:32	Name: csm-sid Value: 663-1252685-3844296

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.works.ga
fls-na.amazon.com
images-na.ssl-images-amazon.com
2600:9000:2491:3600:1d:d7f6:39d0:c781
34.226.72.32
35.186.245.55
0a7e3153f44d0e51c73dad9fa3034a14446bedbafc38e477915382dd02269123
35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a
49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa
5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb
877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042
974cc85c8bfbf86af6a3208c56d63917e3548b25c85163dc41823cbc9590c289
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37
cbbe1b8fbb6766e4bd43ae9208be62642318b2409d7c0dd5b27e19e23eaa7569
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855