urlscan.io logo urlscan.io
SecurityTrails logo

securefile-amazon.com Open in urlscan Pro
45.143.201.100  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://r.email.myghs.com/tr/cl/ey0foMub4eRQPROvhPHYWgPd-IQ30nu7DHEJj-eebb5D69J81LMMTmtzTPMfSnxckViOsoulpRsrfFs4RxvbodoOWp...
Effective URL: https://securefile-amazon.com/view/
Submission: On December 15 via manual from US — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 45.143.201.100, located in Russian Federation and belongs to ERISHENNYA-ASN, UA. The main domain is securefile-amazon.com.
TLS certificate: Issued by R3 on December 14th 2023. Valid for: 3 months.
This is the only time securefile-amazon.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 1.179.112.197 396982 (GOOGLE-CL...)
1 45.143.201.144 210950 (ERISHENNY...)
1 6 45.143.201.100 210950 (ERISHENNY...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
7 3
Apex Domain
Subdomains		 Transfer
6 securefile-amazon.com
securefile-amazon.com
70 KB
2 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 5770
12 KB
1 abuse-alertsinstagr.com
abuse-alertsinstagr.com
352 B
1 myghs.com
r.email.myghs.com
208 B
7 4
Domain Requested by
6 securefile-amazon.com 1 redirects securefile-amazon.com
2 challenges.cloudflare.com 1 redirects securefile-amazon.com
1 abuse-alertsinstagr.com
1 r.email.myghs.com 1 redirects
7 4

This site contains links to these domains. Also see Links.

Domain
www.amazon.com
Subject Issuer Validity Valid
abuse-alertsinstagr.com
R3		 2023-12-13 -
2024-03-12		 3 months crt.sh
securefile-amazon.com
R3		 2023-12-14 -
2024-03-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://securefile-amazon.com/view/
Frame ID: 9CB21822DF813559454A005D1DB61BF9
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon Invoice Download

Page URL History Show full URLs

  1. https://r.email.myghs.com/tr/cl/ey0foMub4eRQPROvhPHYWgPd-IQ30nu7DHEJj-eebb5D69J81LMMTmtzTPMfSnxckViOso... HTTP 302
    https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d Page URL
  2. https://securefile-amazon.com/view HTTP 301
    https://securefile-amazon.com/view/ Page URL

Page Statistics

7
Requests

86 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

81 kB
Transfer

264 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://r.email.myghs.com/tr/cl/ey0foMub4eRQPROvhPHYWgPd-IQ30nu7DHEJj-eebb5D69J81LMMTmtzTPMfSnxckViOsoulpRsrfFs4RxvbodoOWpItE-PEYUVoU4Yg-mUWtRfbjM6-rP_U-AFPZqzDE9ZG6WipypGqU64taM4AefN0NFIxK20xAvSdfvhuuw4jVxWSlQ8yTrXORypW7f763re3zTeNObAPKhkkIJ-OKh_e9TnKHDPQ1Gj25f4zwIIjFe9H-MF2aH_dbDWFXhA1mLenMTGo8co5uf2opc8u1p1P96P7itISFU4Xotvky9Z4lSDmxw6GZGjXckFyvJb9rJ0YhNQsmRFVOsPDqjPsEC02u6LhnpWa7wGGWrc HTTP 302
    https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d Page URL
  2. https://securefile-amazon.com/view HTTP 301
    https://securefile-amazon.com/view/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://r.email.myghs.com/tr/cl/ey0foMub4eRQPROvhPHYWgPd-IQ30nu7DHEJj-eebb5D69J81LMMTmtzTPMfSnxckViOsoulpRsrfFs4RxvbodoOWpItE-PEYUVoU4Yg-mUWtRfbjM6-rP_U-AFPZqzDE9ZG6WipypGqU64taM4AefN0NFIxK20xAvSdfvhuuw4jVxWSlQ8yTrXORypW7f763re3zTeNObAPKhkkIJ-OKh_e9TnKHDPQ1Gj25f4zwIIjFe9H-MF2aH_dbDWFXhA1mLenMTGo8co5uf2opc8u1p1P96P7itISFU4Xotvky9Z4lSDmxw6GZGjXckFyvJb9rJ0YhNQsmRFVOsPDqjPsEC02u6LhnpWa7wGGWrc HTTP 302
  • https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d
Request Chain 1
  • https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/g/74bd6362/api.js?render=explicit

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
74686f6d61732e6861776573407765737465726e61737365742e636f6d
abuse-alertsinstagr.com/
Redirect Chain
  • https://r.email.myghs.com/tr/cl/ey0foMub4eRQPROvhPHYWgPd-IQ30nu7DHEJj-eebb5D69J81LMMTmtzTPMfSnxckViOsoulpRsrfFs4RxvbodoOWpItE-PEYUVoU4Yg-mUWtRfbjM6-rP_U-AFPZqzDE9ZG6WipypGqU64taM4AefN0NFIxK20xAvSdf...
  • https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d
78 B
352 B 		Document
General
Check archive.org
Download Go to
Full URL
https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
45.143.201.144 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
cl30.ntup.net
Software
nginx /
Resource Hash
ae262a977e3396aea0c67d27d1dd1b62f908d8241ca4db61cc471bf942a4577f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

cache-control
private, no-store, no-cache, max-age=0, must-revalidate, proxy-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 15 Dec 2023 21:38:19 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1

Redirect headers

content-length
113
content-type
text/html; charset=utf-8
date
Fri, 15 Dec 2023 21:38:19 GMT
location
https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d
x-content-type-options
nosniff
x-sib-server
gke-public-cluster-v2-1-179-112-175
x-xss-protection
1
Primary Request /
securefile-amazon.com/view/
Redirect Chain
  • https://securefile-amazon.com/view
  • https://securefile-amazon.com/view/
11 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securefile-amazon.com/view/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
45.143.201.100 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
colo30.ntup.net
Software
nginx /
Resource Hash
a285d0ea8c4b9f87b10870b1fcbbeba0950f5f8f981ecd664718c79db6bb807d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://abuse-alertsinstagr.com/74686f6d61732e6861776573407765737465726e61737365742e636f6d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Fri, 15 Dec 2023 21:38:19 GMT
etag
W/"657b9de8-2a89"
last-modified
Fri, 15 Dec 2023 00:29:28 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

content-length
162
content-type
text/html
date
Fri, 15 Dec 2023 21:38:19 GMT
location
https://securefile-amazon.com/view/
server
nginx
strict-transport-security
max-age=31536000
api.js
challenges.cloudflare.com/turnstile/v0/g/74bd6362/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
  • https://challenges.cloudflare.com/turnstile/v0/g/74bd6362/api.js?render=explicit
34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/74bd6362/api.js?render=explicit
Requested by
Host: securefile-amazon.com
URL: https://securefile-amazon.com/view/
Protocol
H2
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd9ac3177195b3d9537e0cf71222057ec70de67715715b570a80287ba78c8d3d

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://securefile-amazon.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 21:38:19 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
8361d53a0d372a7b-CDG
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Fri, 15 Dec 2023 21:38:19 GMT
server
cloudflare
vary
accept-encoding
access-control-allow-origin
*
location
/turnstile/v0/g/74bd6362/api.js?render=explicit
cache-control
max-age=300, public
cf-ray
8361d539dcdf2a7b-CDG
alt-svc
h3=":443"; ma=86400
61A6IErPNXL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css
securefile-amazon.com/view/ 		131 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securefile-amazon.com/view/61A6IErPNXL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css
Requested by
Host: securefile-amazon.com
URL: https://securefile-amazon.com/view/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
45.143.201.100 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
colo30.ntup.net
Software
nginx /
Resource Hash
7fa62283d529493ccb701386b37339660e6ec434fa34b1f0ee168e7cdc3a8ca6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://securefile-amazon.com/view/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 21:38:19 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 15 Dec 2023 00:24:33 GMT
server
nginx
etag
W/"657b9cc1-20c50"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sat, 16 Dec 2023 09:38:19 GMT
01SdjaY0ZsL._RC_31jdWD+JB+L.css,51ndJ60shfL.css_.css
securefile-amazon.com/view/ 		56 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securefile-amazon.com/view/01SdjaY0ZsL._RC_31jdWD+JB+L.css,51ndJ60shfL.css_.css
Requested by
Host: securefile-amazon.com
URL: https://securefile-amazon.com/view/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
45.143.201.100 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
colo30.ntup.net
Software
nginx /
Resource Hash
4d36f10334461ec6e9db11d7655722d253134fb35027f1ab47ab4249091233d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://securefile-amazon.com/view/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 21:38:19 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 15 Dec 2023 00:24:33 GMT
server
nginx
etag
W/"657b9cc1-dfe8"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sat, 16 Dec 2023 09:38:19 GMT
21PFuszay6L.css
securefile-amazon.com/view/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securefile-amazon.com/view/21PFuszay6L.css
Requested by
Host: securefile-amazon.com
URL: https://securefile-amazon.com/view/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
45.143.201.100 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
colo30.ntup.net
Software
nginx /
Resource Hash
036e15e2ecb1b4205f8f84bf042a24e15c7db619a2329d0838327e34c1c4dc85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://securefile-amazon.com/view/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 21:38:19 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 15 Dec 2023 00:24:33 GMT
server
nginx
etag
W/"657b9cc1-1107"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sat, 16 Dec 2023 09:38:19 GMT
mPGmT0r6IeTyIee.png
securefile-amazon.com/view/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securefile-amazon.com/view/mPGmT0r6IeTyIee.png
Requested by
Host: securefile-amazon.com
URL: https://securefile-amazon.com/view/61A6IErPNXL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css#us.not-trident
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
45.143.201.100 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),
Reverse DNS
colo30.ntup.net
Software
nginx /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://securefile-amazon.com/view/61A6IErPNXL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 21:38:19 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 15 Dec 2023 00:24:33 GMT
server
nginx
etag
"657b9cc1-6d44"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
27972
expires
Sun, 14 Jan 2024 21:38:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| turnstile function| setVerificationMessage function| verifyCode

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1