motonauticaangerese.it
Open in
urlscan Pro
89.96.90.14
Malicious Activity!
Public Scan
URL:
http://motonauticaangerese.it/AmazonSignIn.html
Submission: On September 12 via manual from US
Submission: On September 12 via manual from US
Summary
This website contacted 7 IPs
in 3 countries
across 6 domains to perform 20 HTTP transactions.
The main IP is 89.96.90.14, located in
Meda, Italy and
belongs to FASTWEB, IT.
The main domain is motonauticaangerese.it.
This is the only time motonauticaangerese.it was scanned on urlscan.io!
This is the only time motonauticaangerese.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 89.96.90.14 89.96.90.14 | 12874 (FASTWEB) (FASTWEB) | |
| 2 | 13.32.220.80 13.32.220.80 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 2 | 13.32.220.249 13.32.220.249 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 4 | 54.239.35.173 54.239.35.173 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 6 | 13.32.220.124 13.32.220.124 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 1 | 13.32.220.34 13.32.220.34 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 20 | 7 |
2
13.32.220.80
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-80.fra56.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-80.fra56.r.cloudfront.net
| images-na.ssl-images-amazon.com |
2
13.32.220.249
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-249.fra56.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-249.fra56.r.cloudfront.net
| images-na.ssl-images-amazon.com | |
| images-eu.ssl-images-amazon.com |
6
13.32.220.124
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-124.fra56.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-124.fra56.r.cloudfront.net
| images-na.ssl-images-amazon.com | |
| m.media-amazon.com |
1
13.32.220.34
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-34.fra56.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-220-34.fra56.r.cloudfront.net
| m.media-amazon.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com images-eu.ssl-images-amazon.com |
261 KB |
| 4 |
amazon.com
fls-eu.amazon.com |
129 B |
| 3 |
motonauticaangerese.it
motonauticaangerese.it |
47 KB |
| 2 |
media-amazon.com
m.media-amazon.com |
26 KB |
| 0 |
wittinhohemmo.net
Failed
wittinhohemmo.net Failed |
|
| 0 |
amazon.co.uk
Failed
www.amazon.co.uk Failed |
|
| 20 | 6 |
| Domain | Requested by | |
|---|---|---|
| 8 | images-na.ssl-images-amazon.com |
motonauticaangerese.it
|
| 4 | fls-eu.amazon.com |
motonauticaangerese.it
images-eu.ssl-images-amazon.com |
| 3 | motonauticaangerese.it | |
| 2 | m.media-amazon.com |
motonauticaangerese.it
|
| 1 | images-eu.ssl-images-amazon.com |
motonauticaangerese.it
|
| 0 | wittinhohemmo.net Failed |
motonauticaangerese.it
|
| 0 | www.amazon.co.uk Failed |
motonauticaangerese.it
|
| 20 | 7 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.co.uk |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| Images-na.ssl-images-amazon.com Symantec Class 3 Secure Server CA - G4 |
2016-09-23 - 2017-10-26 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
http://motonauticaangerese.it/AmazonSignIn.html
Frame ID: 29542.1
Requests: 18 HTTP requests in this frame
Frame:
https://www.amazon.co.uk/gp/css/order-history/utils/ap-prefetch-iframe.html/ref=ya_prefetch_order_ap
Frame ID: 29542.2
Requests: 1 HTTP requests in this frame
Frame:
http://wittinhohemmo.net/order.php
Frame ID: 29542.3
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /php\/?([\d.]+)?/i
Perl
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /mod_perl(?:\/([\d\.]+))?/i
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
OpenSSL
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
mod_perl
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /mod_perl(?:\/([\d\.]+))?/i
mod_ssl
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /mod_ssl(?:\/([\d.]+))?/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
- headers server /mod_perl(?:\/([\d\.]+))?/i
- headers server /mod_ssl(?:\/([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.amazon.co.uk/ap/forgotpassword?showRmrMe=1&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&accountStatusPolicy=P1&pageId=webcs-yourorder&openid.return_to=https%3A%2F%2Fwww.amazon.co.uk%2Fgp%2Fyour-account%2Forder-details%3Fie%3DUTF8%26orderID%3D026-7435261-2900300%26ref_%3Dya_st_od_cant_show_or&prevRID=K8VW8A6242XYAEPR53N9&openid.assoc_handle=gbflex&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot Password
Title: Forgot Password
Search URL Search Domain Scan URL
URL: https://www.amazon.co.uk/ap/register?showRmrMe=1&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&accountStatusPolicy=P1&pageId=webcs-yourorder&openid.return_to=https%3A%2F%2Fwww.amazon.co.uk%2Fgp%2Fyour-account%2Forder-details%3Fie%3DUTF8%26orderID%3D026-7435261-2900300%26ref_%3Dya_st_od_cant_show_or&prevRID=K8VW8A6242XYAEPR53N9&openid.assoc_handle=gbflex&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Create your Amazon account
Title: Create your Amazon account
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
AmazonSignIn.html
motonauticaangerese.it/ |
47 KB 47 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css
images-na.ssl-images-amazon.com/images/I/ |
136 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
AuthenticationPortalAssets-798807b0ddb1f6ba8f2ce889cc550b2495702500._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ |
32 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CVFAssets-cd48a867491eb52809d40b2bea696ec381b969e3._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ |
2 KB 773 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
A1F83G8C2ARO7P:257-0264827-1740779:K8VW8A6242XYAEPR53N9$uedata=s:%2Fap%2Fuedata%3Fstaticb%26id%3DK8VW8A6242XYAEPR53N9:0
fls-eu.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fwcim._CB516155363_.js
images-na.ssl-images-amazon.com/images/G/02/x-locale/common/login/ |
376 KB 106 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
61tHvuwljLL._RC%7C11IYhapguOL.js,61Z-hR1QEiL.js,31pYyxAZJRL.js,31Qll8kfk9L.js,01N6xzIJxbL.js,516fQ5+zVmL.js,01rpauTep4L.js,31JzIBuTmgL.js,61uDiYnK9wL.js,01BBu+b9t0L.js_.js
images-na.ssl-images-amazon.com/images/I/ |
313 KB 97 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
AuthenticationPortalAssets-a46fc017f6cc2a802586f39235cba9a92be8645d._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ |
74 KB 21 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
AuthenticationPortalInlineAssets-662783336058590306af126b0eeae5125982f026._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ |
518 B 361 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CVFAssets-a41f37f3840288589cb4e40cf004dfa7623947a2._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ref=ya_prefetch_order_ap
www.amazon.co.uk/gp/css/order-history/utils/ap-prefetch-iframe.html/ Frame 2954 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
order.php
wittinhohemmo.net/ Frame 2954 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uedata
motonauticaangerese.it/ap/ |
968 B 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
A1F83G8C2ARO7P:257-0264827-1740779:K8VW8A6242XYAEPR53N9$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.831.26%26id%3DK8VW8A6242XYAEPR53N9%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3DK8VW8A...
fls-eu.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js
images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ |
9 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
showads.v2.js
m.media-amazon.com/images/G/01/csm/ |
23 B 49 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uedata
motonauticaangerese.it/ap/ |
968 B 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
A1F83G8C2ARO7P:257-0264827-1740779:K8VW8A6242XYAEPR53N9$uedata=s:%2Fap%2Fuedata%3Fat%26v%3D0.831.26%26id%3DK8VW8A6242XYAEPR53N9%26m%3D1%26sc%3Dadblk_no%26pc%3D6028%26at%3D6028%26t%3D1505230324204%2...
fls-eu.amazon.com/1/batch/1/OP/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
/
fls-eu.amazon.com/1/batch/1/OE/ |
0 0 |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.amazon.co.uk
- URL
- https://www.amazon.co.uk/gp/css/order-history/utils/ap-prefetch-iframe.html/ref=ya_prefetch_order_ap
- Domain
- wittinhohemmo.net
- URL
- http://wittinhohemmo.net/order.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| motonauticaangerese.it/ | Name: csm-hit Value: s-K8VW8A6242XYAEPR53N9|1505230318254 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fls-eu.amazon.com
images-eu.ssl-images-amazon.com
images-na.ssl-images-amazon.com
m.media-amazon.com
motonauticaangerese.it
wittinhohemmo.net
www.amazon.co.uk
wittinhohemmo.net
www.amazon.co.uk
13.32.220.124
13.32.220.249
13.32.220.34
13.32.220.80
54.239.35.173
89.96.90.14
36797f57e6e009244b8f2db1ebe64301a582abb291c3a4e57a8e078c837add83
580fd7514cfb4fdfde68b5976bb21fc12857522d343b075707169f6643f2868b
61fb9cb6d66cca3f549daf004fdb10cf72389a3cfbfd84f232f66ee1cee5be31
77ebf4cb736c1fcb00f552112dd56d879bf0581394a524e63b39c3b248b012ae
88ea58255d4cd82340f7acaabe0e6a99f195a4dc2ca6ef56ec503d03b331bee5
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
b06058dda50252e2ff430d60f9d799d44e0dbbad47006ea169aa9abd90146459
c58895f835f394febc82a3fce81dc9044de612621bc4dba56e329a53744378b3
c5c390bb2dc2768028fe80f208eb8d531621139eb8c0117071bc41e9667f9da6
cf1b1273a043ea0b1376652b5c9201b9cfc1c12de1a1ac1f39f6a323b191811b
d4573b6ec7a63e9047faa7be6c060fe0e93f49b5d6f571d050d94582eeb7db33
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e605618a086fe7d6a8cf916fccd3201cb0fcad05d88b507a14afbbd32252a7cf
f58466e353c2d1a58687e7fc3a62c0611a28db622e1725fae8f50f3d46361440