auth2-signin-account-amazon.ooguy.com
Open in
urlscan Pro
139.59.78.208
Malicious Activity!
Public Scan
Effective URL: https://auth2-signin-account-amazon.ooguy.com/ap/signin?session=7db43a25d6b4fbef42c5470efaf1f6d99f819257
Submission: On May 18 via manual from IN
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 16th 2020. Valid for: 3 months.
This is the only time auth2-signin-account-amazon.ooguy.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2.21.36.253 2.21.36.253 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 35.238.70.19 35.238.70.19 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5914 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2606:4700::68... 2606:4700::6810:85e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
3 | 139.59.78.208 139.59.78.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2a04:4e42:1b:... 2a04:4e42:1b::272 | 54113 (FASTLY) (FASTLY) | |
14 | 8 |
ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-21-36-253.deploy.static.akamaitechnologies.com
chat.tokopedia.com |
ASN15169 (GOOGLE, US)
PTR: 19.70.238.35.bc.googleusercontent.com
rplg.co |
ASN20446 (HIGHWINDS3, US)
stackpath.bootstrapcdn.com | |
maxcdn.bootstrapcdn.com |
ASN14061 (DIGITALOCEAN-ASN, US)
auth2-signin-account-amazon.ooguy.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
rplg.co
rplg.co |
24 KB |
3 |
ooguy.com
auth2-signin-account-amazon.ooguy.com |
182 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com maxcdn.bootstrapcdn.com |
30 KB |
1 |
media-amazon.com
m.media-amazon.com |
28 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
googleapis.com
fonts.googleapis.com |
660 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
5 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net |
84 KB |
1 |
tokopedia.com
1 redirects
chat.tokopedia.com |
141 B |
14 | 9 |
Domain | Requested by | |
---|---|---|
4 | rplg.co |
rplg.co
|
3 | auth2-signin-account-amazon.ooguy.com |
rplg.co
auth2-signin-account-amazon.ooguy.com |
1 | m.media-amazon.com | |
1 | code.jquery.com |
rplg.co
|
1 | maxcdn.bootstrapcdn.com |
rplg.co
|
1 | fonts.googleapis.com |
rplg.co
|
1 | cdnjs.cloudflare.com |
rplg.co
|
1 | stackpath.bootstrapcdn.com |
rplg.co
|
1 | cdn.jsdelivr.net |
rplg.co
|
1 | chat.tokopedia.com | 1 redirects |
14 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.amazon.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
rplg.co Sectigo RSA Domain Validation Secure Server CA |
2019-10-19 - 2020-10-18 |
a year | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-04-06 - 2020-10-09 |
6 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-04-28 - 2020-07-21 |
3 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
auth2-signin-account-amazon.ooguy.com cPanel, Inc. Certification Authority |
2020-05-16 - 2020-08-14 |
3 months | crt.sh |
images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2019-10-02 - 2020-10-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://auth2-signin-account-amazon.ooguy.com/ap/signin?session=7db43a25d6b4fbef42c5470efaf1f6d99f819257
Frame ID: A7216087B14DEB307EABE9D3882928C3
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://chat.tokopedia.com/tc/v1/redirect_external/deafb97a5d113b64c022244061e239c8d9a603e298b5b049bc57...
HTTP 307
https://rplg.co/a1a264c0 Page URL
- https://auth2-signin-account-amazon.ooguy.com/?stanley Page URL
- https://auth2-signin-account-amazon.ooguy.com/ap/signin?session=7db43a25d6b4fbef42c5470efaf1f6d99f819257 Page URL
Detected technologies
Lua (Programming Languages) ExpandDetected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
OpenResty (Web Servers) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Forgot your password?
Search URL Search Domain Scan URL
Title: Create your Amazon account
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://chat.tokopedia.com/tc/v1/redirect_external/deafb97a5d113b64c022244061e239c8d9a603e298b5b049bc57935f81952c8deefe9b305c4cce354fe2057fb405d7ce0e064ae7b3ef962020f788524519a26b21186b2a45584b5e425c41fd271bdca83f2422818963c6191f89924b63058b46f8353bfd047a2912549b8530df8ef51b1080280938acf4cd65a87a2e6579d27928241d5bb0b632b9bf5024e97c2b9f40a4cc65cb?FANL1WBBF4
HTTP 307
https://rplg.co/a1a264c0 Page URL
- https://auth2-signin-account-amazon.ooguy.com/?stanley Page URL
- https://auth2-signin-account-amazon.ooguy.com/ap/signin?session=7db43a25d6b4fbef42c5470efaf1f6d99f819257 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://chat.tokopedia.com/tc/v1/redirect_external/deafb97a5d113b64c022244061e239c8d9a603e298b5b049bc57935f81952c8deefe9b305c4cce354fe2057fb405d7ce0e064ae7b3ef962020f788524519a26b21186b2a45584b5e425c41fd271bdca83f2422818963c6191f89924b63058b46f8353bfd047a2912549b8530df8ef51b1080280938acf4cd65a87a2e6579d27928241d5bb0b632b9bf5024e97c2b9f40a4cc65cb?FANL1WBBF4 HTTP 307
- https://rplg.co/a1a264c0
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
a1a264c0
rplg.co/ Redirect Chain
|
1 KB 921 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
rplg.co/static/ |
36 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
linkauth.css
rplg.co/static/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cdn.jsdelivr.net/npm/vue/dist/ |
334 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ |
156 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.19.2/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 660 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
code.jquery.com/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-icon.css
rplg.co/static/ |
97 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
/
auth2-signin-account-amazon.ooguy.com/ |
121 B 502 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
signin
auth2-signin-account-amazon.ooguy.com/ap/ |
7 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
auth2-signin-account-amazon.ooguy.com/assets/css/ |
173 KB 174 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate number| ue_t00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth2-signin-account-amazon.ooguy.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
chat.tokopedia.com
code.jquery.com
fonts.googleapis.com
m.media-amazon.com
maxcdn.bootstrapcdn.com
rplg.co
stackpath.bootstrapcdn.com
139.59.78.208
2.21.36.253
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:3b
2606:4700::6810:5914
2606:4700::6810:85e5
2a00:1450:4001:808::200a
2a04:4e42:1b::272
35.238.70.19
02da52333e455e51d073a83ff7e9d501e969168ee2cbad4f0c3bdc13d73d03ad
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0ded6f068f0e45350bf31567fcded2b4786871b7918e2224aab3138c6cac036e
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
352baa818da109925437a8433057ddc6f91ec48efe88bc5741b2f9e34450fdce
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
4ff7fb4a3bb565f34d7c187bb245a7d22765081708dd1c1d2d24b8fc8ecd40a4
56f75652cafe32709c637370cd25dea57928492dc74f1e7622ff293f8b6847f3
58228ac1574bf9366f3fc3eea08d4a14c3fbdc1ddc603f613fd318c127675463
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8df124a7a1c497f5955573b243efa684aff9f56c2edae6a44c078a4a8c89bd83
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19
c9256bd9f9b7ade7d4878d0f96c9265a48e12b92a99481536d5122b29fcd39bd