www.amazonqac.xyz
Open in
urlscan Pro
112.175.150.41
Malicious Activity!
Public Scan
Effective URL: https://www.amazonqac.xyz/ap/signin.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F%3Fre...
Submission: On December 06 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by R3 on December 6th 2020. Valid for: 3 months.
This is the only time www.amazonqac.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 9 | 112.175.150.41 112.175.150.41 | 4766 (KIXS-AS-K...) (KIXS-AS-KR Korea Telecom) | |
7 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
amazonqac.xyz
2 redirects
www.amazonqac.xyz |
114 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
9 | www.amazonqac.xyz |
2 redirects
www.amazonqac.xyz
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.amazonqac.xyz R3 |
2020-12-06 - 2021-03-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.amazonqac.xyz/ap/signin.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F%3Fref_%3Dnav_custrec_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=jpflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Frame ID: B10E2FF06142EE7876586F0D03A8615C
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.amazonqac.xyz/
HTTP 302
https://www.amazonqac.xyz/ap/index.php HTTP 302
https://www.amazonqac.xyz/ap/signin.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.amazonqac.xyz/
HTTP 302
https://www.amazonqac.xyz/ap/index.php HTTP 302
https://www.amazonqac.xyz/ap/signin.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F%3Fref_%3Dnav_custrec_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=jpflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
signin.php
www.amazonqac.xyz/ap/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.min.css
www.amazonqac.xyz/ap/library/bootstrap/css/ |
142 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
www.amazonqac.xyz/ap/sheets/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.min.js
www.amazonqac.xyz/ap/library/jquery/ |
95 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.min.js
www.amazonqac.xyz/ap/library/pooper/ |
19 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.min.js
www.amazonqac.xyz/ap/library/bootstrap/js/ |
48 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amazonui.png
www.amazonqac.xyz/ap/assets/img/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap object| jQuery1122097008338030273731 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.amazonqac.xyz/ | Name: PHPSESSID Value: konk0jtrd7v7vhrng1hk2agbj2 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.amazonqac.xyz
112.175.150.41
210340809e4654f42db908ea8809b48d42461489018f79947e30dde4553429a3
5fdcc37d94c47957503f9179b02413622e099fd1a75b20bcb0620a66de769a5e
9e2f253611674e98d2ac2b7828bd45bc5ac68d5bd63686462a8415e440ef8460
bcf5788947b251c6dd23e5cd8491c0506ad88a5cbb0f4f59d264023fdda0d959
d3d37f2912a1713bdd3fd57b60cd4ddf65a73e830e4740e4aac84344c7eec786
e33319d7825f9033b725b9e4d134c9b2aaec61f4236f5612bf59b3df6cf7a9c3
ec04663239fea919da72507f114272933d61b9e3cb5d2f66e52dbf01aa048a11