main.dquvxneatcvlx.amplifyapp.com
Open in
urlscan Pro
18.66.15.85
Malicious Activity!
Public Scan
Submitted URL: https://main.dquvxneatcvlx.amplifyapp.com/
Effective URL: https://main.dquvxneatcvlx.amplifyapp.com/b.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAP092q
Submission: On September 28 via api from BE — Scanned from DE
Effective URL: https://main.dquvxneatcvlx.amplifyapp.com/b.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAP092q
Submission: On September 28 via api from BE — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 18.66.15.85, located in
United States and
belongs to AMAZON-02, US.
The main domain is main.dquvxneatcvlx.amplifyapp.com.
TLS certificate: Issued by Amazon on September 26th 2022. Valid for: a year.
This is the only time main.dquvxneatcvlx.amplifyapp.com was scanned on urlscan.io!
TLS certificate: Issued by Amazon on September 26th 2022. Valid for: a year.
This is the only time main.dquvxneatcvlx.amplifyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 18.66.15.85 18.66.15.85 | 16509 (AMAZON-02) (AMAZON-02) | |
| 7 | 1 |
7
18.66.15.85
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-18-66-15-85.vie50.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-18-66-15-85.vie50.r.cloudfront.net
| main.dquvxneatcvlx.amplifyapp.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
amplifyapp.com
main.dquvxneatcvlx.amplifyapp.com |
38 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | main.dquvxneatcvlx.amplifyapp.com |
main.dquvxneatcvlx.amplifyapp.com
|
| 7 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.dquvxneatcvlx.amplifyapp.com Amazon |
2022-09-26 - 2023-10-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://main.dquvxneatcvlx.amplifyapp.com/b.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAP092q
Frame ID: DEF8FD9D7970325BC6AC9BC6034AC41F
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Amazon Billing Verification CenterPage URL History Show full URLs
- https://main.dquvxneatcvlx.amplifyapp.com/ Page URL
- https://main.dquvxneatcvlx.amplifyapp.com/b.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAP092q Page URL
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: http://www.amazon.com/gp/feature.html/ref=nav_sap_clddrive_1a?ie=UTF8&docId=1000796931
Search URL Search Domain Scan URL
URL: http://www.amazon.com/b/ref=nav_sap_audible_a?ie=UTF8&node=2402172011
Search URL Search Domain Scan URL
URL: http://www.amazon.com/New-Future-Releases/b/ref=nav_sap_vg_sony?ie=UTF8&node=496994
Search URL Search Domain Scan URL
URL: http://www.amazon.com/Women-Clothing/b/ref=nav_sap_clothing_image?ie=UTF8&node=1040660
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://main.dquvxneatcvlx.amplifyapp.com/ Page URL
- https://main.dquvxneatcvlx.amplifyapp.com/b.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAP092q Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
main.dquvxneatcvlx.amplifyapp.com/ |
128 B 508 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
b.html
main.dquvxneatcvlx.amplifyapp.com/ |
88 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
site-wide-a04329._V1_.css
main.dquvxneatcvlx.amplifyapp.com/content/ |
31 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
BeaconSprite-US-01._V141013396_.png
main.dquvxneatcvlx.amplifyapp.com/content/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
transparent-pixel._V192234675_.gif
main.dquvxneatcvlx.amplifyapp.com/content/ |
43 B 423 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
confirm-card._V17236_.png
main.dquvxneatcvlx.amplifyapp.com/content/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
navAmazonLogoFooter._V169459313_.gif
main.dquvxneatcvlx.amplifyapp.com/content/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| container object| AmazonPopoverImages string| _navbarSpriteUrl function| Navbar object| _navbar undefined| iss string| issHost string| issMktid object| issSearchAliases function| updateISSCompletion undefined| dealNotifier object| errant0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
main.dquvxneatcvlx.amplifyapp.com
18.66.15.85
10765b5e83a4ccbc5edbfcc4f3ada63b02c76cc1d29c21f1202fc54bd018710c
4514d4d04b4644de38864be5ac0c945f94eec540dcef27061330658e46d848a9
b924ce130dc972a751e5bd741fb35cd7cb8d7a94894916d941f48e35abddf5dc
bde31848f3c02d44b188927f63b8724262cf12a30a2bef988f81698ecbbf5790
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
cc109786c5a13f2eb0f76ba41f6a8e8eb9b162a204bb0d18ece4cae9f4225f2a
f1c7b8aca7dc227db935da88c0f51c74a11fab93e64168b54f3b626849343278