![](/screenshots/459254d6-3d80-4888-8773-318df389a850.png)
nestorli.d2ukqkfzpwwt88.amplifyapp.com
Open in
urlscan Pro
18.172.52.99
Malicious Activity!
Public Scan
Submission: On February 07 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by Amazon RSA 2048 M03 on February 6th 2024. Valid for: a year.
This is the only time nestorli.d2ukqkfzpwwt88.amplifyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
13 | 18.172.52.99 18.172.52.99 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2620:1ec:48:1... 2620:1ec:48:1::46 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 103.126.138.87 103.126.138.87 | 40676 (AS40676) (AS40676) | |
1 2 | 20.205.115.81 20.205.115.81 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 2620:1ec:c11:... 2620:1ec:c11::200 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 20.10.16.51 20.10.16.51 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
23 | 8 |
ASN16509 (AMAZON-02, US)
PTR: server-18-172-52-99.nrt20.r.cloudfront.net
nestorli.d2ukqkfzpwwt88.amplifyapp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
amplifyapp.com
nestorli.d2ukqkfzpwwt88.amplifyapp.com |
932 KB |
6 |
clarity.ms
1 redirects
www.clarity.ms — Cisco Umbrella Rank: 747 c.clarity.ms — Cisco Umbrella Rank: 1351 z.clarity.ms — Cisco Umbrella Rank: 10209 |
23 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1019 |
72 KB |
1 |
bing.com
1 redirects
c.bing.com — Cisco Umbrella Rank: 247 |
763 B |
1 |
ipwho.is
ipwho.is — Cisco Umbrella Rank: 68028 |
952 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
27 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 324 |
26 KB |
23 | 7 |
Domain | Requested by | |
---|---|---|
13 | nestorli.d2ukqkfzpwwt88.amplifyapp.com |
nestorli.d2ukqkfzpwwt88.amplifyapp.com
|
2 | z.clarity.ms |
www.clarity.ms
|
2 | c.clarity.ms | 1 redirects |
2 | www.clarity.ms |
nestorli.d2ukqkfzpwwt88.amplifyapp.com
www.clarity.ms |
2 | maxcdn.bootstrapcdn.com |
nestorli.d2ukqkfzpwwt88.amplifyapp.com
maxcdn.bootstrapcdn.com |
1 | c.bing.com | 1 redirects |
1 | ipwho.is |
nestorli.d2ukqkfzpwwt88.amplifyapp.com
|
1 | cdnjs.cloudflare.com |
nestorli.d2ukqkfzpwwt88.amplifyapp.com
|
1 | cdn.jsdelivr.net |
nestorli.d2ukqkfzpwwt88.amplifyapp.com
|
23 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.d2ukqkfzpwwt88.amplifyapp.com Amazon RSA 2048 M03 |
2024-02-06 - 2025-03-06 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-01-28 - 2024-04-27 |
3 months | crt.sh |
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1 |
2023-12-07 - 2024-12-07 |
a year | crt.sh |
ipwho.is GoGetSSL ECC DV CA |
2023-04-05 - 2024-04-05 |
a year | crt.sh |
a.clarity.ms Microsoft Azure TLS Issuing CA 01 |
2024-01-14 - 2024-06-27 |
5 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://nestorli.d2ukqkfzpwwt88.amplifyapp.com/
Frame ID: 1DC213F763DC21621B24A3896D105934
Requests: 23 HTTP requests in this frame
Screenshot
![](/screenshots/459254d6-3d80-4888-8773-318df389a850.png)
Page Title
オンライン Windows Defender ヘルプ センターDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 18- https://c.clarity.ms/c.gif HTTP 302
- https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=5113A2C64FFA42E99A7ACA372261FD27&RedC=c.clarity.ms&MXFR=28DD2E9524B96BA93CEC3A8B20B965EB HTTP 302
- https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=5113A2C64FFA42E99A7ACA372261FD27&MUID=0CEF126A4F916D633DCD06744E7B6CFB
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
18 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scripts.js
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
925 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
esc.js
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
87 B 470 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/ |
158 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ |
82 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
noir.js
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
82 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7a-bg.png
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
479 KB 480 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
def.png
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cs.png
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
websw.png
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cross.png
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
377 KB 378 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bell.png
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kom5v48ljl
www.clarity.ms/tag/ |
650 B 1017 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
ipwho.is/ |
680 B 952 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
safehub.mp3
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
70 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webs.mp4
nestorli.d2ukqkfzpwwt88.amplifyapp.com/ |
8 KB 9 KB |
Media
video/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clarity.js
www.clarity.ms/s/0.7.20/ |
60 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c.gif
c.clarity.ms/ Redirect Chain
|
42 B 442 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
collect
z.clarity.ms/ |
0 318 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/ |
65 KB 66 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
collect
z.clarity.ms/ |
0 318 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| startScan function| playSound object| date string| current_date string| current_time string| date_time function| $ function| jQuery function| clarity object| elem function| openFullscreen function| closeFullscreen object| t string| ipadd string| city string| country string| isp string| currtime10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.clarity.ms/ | Name: CLID Value: 900d6a51828f41789ae39efe5781cc58.20240207.20250206 |
|
.amplifyapp.com/ | Name: _clck Value: ykcg0w%7C2%7Cfj2%7C0%7C1498 |
|
.bing.com/ | Name: MUID Value: 0CEF126A4F916D633DCD06744E7B6CFB |
|
.c.bing.com/ | Name: MR Value: 0 |
|
.c.bing.com/ | Name: SRM_B Value: 0CEF126A4F916D633DCD06744E7B6CFB |
|
.c.clarity.ms/ | Name: SM Value: C |
|
.clarity.ms/ | Name: MUID Value: 0CEF126A4F916D633DCD06744E7B6CFB |
|
.c.clarity.ms/ | Name: MR Value: 0 |
|
.c.clarity.ms/ | Name: ANONCHK Value: 0 |
|
.amplifyapp.com/ | Name: _clsk Value: 17nmp53%7C1707266176610%7C1%7C1%7Cz.clarity.ms%2Fcollect |
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.bing.com
c.clarity.ms
cdn.jsdelivr.net
cdnjs.cloudflare.com
ipwho.is
maxcdn.bootstrapcdn.com
nestorli.d2ukqkfzpwwt88.amplifyapp.com
www.clarity.ms
z.clarity.ms
103.126.138.87
18.172.52.99
20.10.16.51
20.205.115.81
2606:4700::6811:190e
2606:4700::6812:acf
2620:1ec:48:1::46
2620:1ec:c11::200
2a04:4e42:200::485
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
1bf48a5cd34c15a6e932824fecf897b3f5ffd5840d320b6317c9729a97599ad6
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c
3e194f01c82b4d1ed2b7c414e8a2ca6be75003c76c09f539c29ea1fb5d306b51
441f996d10674814d7b63cfbef1798535a52b32c9eb73fdc1d48711c9cb2830e
46b5242c5eb6b3b71ef2606f2d0d700142ae58b53c6d018e6bf06bab62437e1b
46ebb2640aac2186a7cf13f528c03648fa9a498910289cdad41ba87b9770eb14
477157a8127d918670405e216eee8735e7b6446b902e4e0d4478fc778f5891ee
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
50e48abaa10c98fd61b4858cfe98922f7eefb6d7d76d1b05dae5c298698849d0
70b240708894db13b6b2280fc081429e4b4229bea6adecf1a3cc137d768c00f8
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
b67a7c07a045d7cb0f2e216a557aec0d99405e17c36d1a6b1ff3e2733aa35348
c3ad6aa1c03fd108854f008cfec2753ba623e1470a4d61798b5d8c050e474868
cbcfb303a1e7d1f9da8965565b535f4122f2de2f1f3ed9f61f3f9e2dad3dcf9d
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
e0c90d1692be2429d952cb1343a3e66f877b3c631a134768fde2f4417a439a01
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea4bc1169a865b478dd2fd83020e8adf4bdb1f3b3cfeb4af882e4224d40aa171
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995