amazonsecurelogin.lhr.rocks Open in urlscan Pro
54.82.85.249 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://amazonsecurelogin.lhr.rocks/
Effective URL:
https://amazonsecurelogin.lhr.rocks/login.html
Submission: On May 07 via automatic, source certstream-suspicious (May 7th 2022, 3:07:27 am UTC) — Scanned from DE

Summary HTTP 23 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 23 HTTP transactions. The main IP is 54.82.85.249, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is amazonsecurelogin.lhr.rocks.
TLS certificate: Issued by R3 on May 7th 2022. Valid for: 3 months.

This is the only time amazonsecurelogin.lhr.rocks was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
3 6	54.82.85.249 54.82.85.249	14618 (AMAZON-AES) (AMAZON-AES)
3	2a04:4e42:600... 2a04:4e42:600::272	54113 (FASTLY) (FASTLY)
8	2600:9000:224... 2600:9000:224a:4e00:1d:d7f6:39d0:c781	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3030::6815:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	54.220.56.240 54.220.56.240	16509 (AMAZON-02) (AMAZON-02)
23	5

6 54.82.85.249 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-85-249.compute-1.amazonaws.com

amazonsecurelogin.lhr.rocks	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:600::272 (United States)

ASN54113 (FASTLY, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images-eu.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:224a:4e00:1d:d7f6:39d0:c781 (United States)

ASN16509 (AMAZON-02, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

www.synointcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.220.56.240 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-220-56-240.eu-west-1.compute.amazonaws.com

fls-eu.amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ssl-images-amazon.com images-eu.ssl-images-amazon.com — Cisco Umbrella Rank: 4355 images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 673	269 KB
8	amazon.com fls-eu.amazon.com — Cisco Umbrella Rank: 9572	1 KB
6	lhr.rocks 3 redirects amazonsecurelogin.lhr.rocks	51 KB
2	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 501	26 KB
1	synointcdn.com www.synointcdn.com	39 KB
23	5

	Domain	Requested by
8	fls-eu.amazon.com	images-eu.ssl-images-amazon.com
8	images-na.ssl-images-amazon.com	amazonsecurelogin.lhr.rocks
6	amazonsecurelogin.lhr.rocks	3 redirects
2	m.media-amazon.com	amazonsecurelogin.lhr.rocks images-na.ssl-images-amazon.com
1	www.synointcdn.com	amazonsecurelogin.lhr.rocks
1	images-eu.ssl-images-amazon.com	amazonsecurelogin.lhr.rocks
23	6

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
amazonsecurelogin.lhr.rocks R3	`2022-05-07` - `2022-08-05`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-02-01` - `2023-01-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-18` - `2022-07-17`	a year	crt.sh
fls-eu.amazon.com Amazon	`2021-07-01` - `2022-06-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amazonsecurelogin.lhr.rocks/login.html
Frame ID: F80449FFF36F01ABFA8299F25FC2CADB
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign In

Page URL History Show full URLs

https://amazonsecurelogin.lhr.rocks/ HTTP 302
https://amazonsecurelogin.lhr.rocks/login.html Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

23
Requests

91 %
HTTPS

60 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

386 kB
Transfer

1074 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=3600&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&marketPlaceId=ATVPDKIKX0DER&language=en_US&pageId=amzn_contactus_desktop_us&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fhz%2Fcontact-us%2Fforesight%2Fhubgateway%3Fref%3DafterSignIn&prevRID=E31YFYA8QR18BWA08V0V&openid.assoc_handle=amzn_contactus_desktop_us&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_signin_notification_condition_of_use?ie=UTF8&nodeId=508088
Title: Conditions of Use

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_signin_notification_privacy_notice?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/register?showRememberMe=true&openid.pape.max_auth_age=3600&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&marketPlaceId=ATVPDKIKX0DER&language=en_US&pageId=amzn_contactus_desktop_us&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fhz%2Fcontact-us%2Fforesight%2Fhubgateway%3Fref%3DafterSignIn&prevRID=9ZBK0AAW86T54AF702YG&openid.assoc_handle=amzn_contactus_desktop_us&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Create your Amazon account

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=508088
Title: Conditions of Use

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://amazonsecurelogin.lhr.rocks/ HTTP 302
https://amazonsecurelogin.lhr.rocks/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

https://amazonsecurelogin.lhr.rocks/ap/uedata?ld&v=0.200897.0&id=6105GHANE540GE228KG6&sw=1600&sh=1200&vw=1600&vh=1200&m=1&sc=6105GHANE540GE228KG6&ue=1&bb=97&cf=202&be=336&pc=432&tc=-1322&na_=-1322&ul_=-1651892842246&_ul=-1651892842246&rd_=-1322&_rd=-509&fe_=-509&lk_=-508&_lk=-508&co_=-508&_co=-312&sc_=-413&rq_=-312&rs_=-135&_rs=185&dl_=-133&di_=336&de_=336&_de=338&_dc=431&ld_=431&_ld=-1651892842246&ntd=-1&ty=0&rc=1&hob=0&hoe=1&ld=432&t=1651892842678&ctb=1&bfform=1&nrbf=1&rt=cf:9-6-3-0-3-0-0__ld:16-7-3-1-5-0-1&ec=4&ecf=4&csmtags=aui|aui:aui_build_date:3.17.8.3-2018-06-19|aui:aui_build_date:3.18.5-2018-04-12|fls-eu&viz=visible:1&pty=AuthenticationPortal&spty=SignInApplication&pti=undefined&tid=6105GHANE540GE228KG6&aftb=1 HTTP 302
https://amazonsecurelogin.lhr.rocks/ap/login.html

Request Chain 18

https://amazonsecurelogin.lhr.rocks/ap/uedata?at&v=0.200897.0&id=6105GHANE540GE228KG6&m=1&sc=adblk_no&pc=435&at=435&t=1651892842681&bfform=1&nrbf=1&csmtags=adblk_no&pty=AuthenticationPortal&spty=SignInApplication&pti=undefined&tid=6105GHANE540GE228KG6&aftb=1 HTTP 302
https://amazonsecurelogin.lhr.rocks/ap/login.html

23 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.html Show response amazonsecurelogin.lhr.rocks/ Redirect Chain https://amazonsecurelogin.lhr.rocks/ https://amazonsecurelogin.lhr.rocks/login.html	49 KB 50 KB	373ms 177ms	Document text/html	54.82.85.249 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://amazonsecurelogin.lhr.rocks/login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.82.85.249 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-82-85-249.compute-1.amazonaws.com Software / Resource Hash `b0dfd0c43aa63c49136dbb7136ae0772256273beaeec05845a2cbe6c116f4d00` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection close Content-Length 50600 Content-Type text/html; charset=UTF-8 Date Sat, 07 May 2022 03:07:22 GMT Host amazonsecurelogin.lhr.rocks Redirect headers Connection close Content-type text/html; charset=UTF-8 Date Sat, 07 May 2022 03:07:21 GMT Host amazonsecurelogin.lhr.rocks Location login.html X-Powered-By PHP/8.1.2
GET H2	200	showads.v2.js Show response m.media-amazon.com/images/G/01/csm/	23 B 389 B	60ms 6ms	Script application/x-javascript	2a04:4e42:600::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/csm/showads.v2.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `88ea58255d4cd82340f7acaabe0e6a99f195a4dc2ca6ef56ec503d03b331bee5` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 03:07:22 GMT content-encoding br age 32536 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT server-timing provider;desc="fy" content-length 28 x-served-by cache-iad-kcgs7200144-IAD, cache-hhn4061-HHN last-modified Mon, 28 Nov 2016 08:22:04 GMT vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400,public x-amz-ir-id 09c1d3af-25cf-4028-bdf0-e20d363df873 accept-ranges bytes timing-allow-origin https://www.amazon.com expires Tue, 05 Apr 2022 02:38:24 GMT
GET H2	200	ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Show response images-eu.ssl-images-amazon.com/images/G/01/AUIClients/	9 KB 4 KB	61ms 7ms	Script application/x-javascript	2a04:4e42:600::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `f58466e353c2d1a58687e7fc3a62c0611a28db622e1725fae8f50f3d46361440` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 03:07:22 GMT content-encoding br age 2174677 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status MISS server-timing provider;desc="fy" content-length 3803 x-served-by cache-iad-kcgs7200165-IAD, cache-hhn4034-HHN last-modified Wed, 21 Jun 2017 07:07:38 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id a23bc603-1b29-46c3-a505-8e87aaf2d783 accept-ranges bytes timing-allow-origin https://www.amazon.com expires Thu, 27 Mar 2042 15:29:54 GMT
GET H2	200	61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css images-na.ssl-images-amazon.com/images/I/	136 KB 23 KB	64ms 11ms	Stylesheet text/css	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `b06058dda50252e2ff430d60f9d799d44e0dbbad47006ea169aa9abd90146459` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Fri, 25 Feb 2022 06:22:06 GMT content-encoding gzip age 6122715 edge-cache-tag x-cache-156,/images/I/61gbb09bfIL x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-156 /images/I/61gbb09bfIL last-modified Thu, 16 Mar 2017 06:29:45 GMT server Server content-type text/css; charset=utf-8 via 1.1 5297df6326448099cefed6e96fd7b00a.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 01f50756-ac6e-4a5a-aab0-2494b08f284e x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id PoW-d52vjvq0sgDiN4BhsLCxxVyaCrgrBiXS7BhCPSTmfVkhmUbn5Q== expires Tue, 18 Feb 2042 05:55:13 GMT
GET H2	200	AuthenticationPortalAssets-60974eab2c51181b770605eaef55c2d69d69613c._V2_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	32 KB 7 KB	71ms 19ms	Stylesheet text/css	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-60974eab2c51181b770605eaef55c2d69d69613c._V2_.css Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `d7f0c84a144723f16e3e284bc646810e7007f552e7444e8138ce54f616f9975b` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sun, 06 Mar 2022 21:42:44 GMT content-encoding gzip age 5289878 edge-cache-tag x-cache-182,/images/G/01/AUIClients/AuthenticationPortalAssets-60974eab2c51181b770605eaef55c2d69d69613c x-nginx-cache-status MISS x-cache Hit from cloudfront server-timing cdn-cache-hit,cdn-pop;desc="DUS51-P1",cdn-rid;desc="Jro5NjFn3td42RFl6tFArmC05BijwDNFBNLYwJc4Fc4oI4tYrsW_Tg==",cdn-hit-layer;desc="EDGE" access-control-allow-origin * surrogate-key x-cache-182 /images/G/01/AUIClients/AuthenticationPortalAssets-60974eab2c51181b770605eaef55c2d69d69613c last-modified Thu, 08 Mar 2018 04:04:11 GMT server Server content-type text/css; charset=utf-8 via 1.1 5297df6326448099cefed6e96fd7b00a.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 87a13d3f-fecc-40b4-b99b-cd1897c892dc x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id Jro5NjFn3td42RFl6tFArmC05BijwDNFBNLYwJc4Fc4oI4tYrsW_Tg== expires Sat, 01 Mar 2042 21:42:44 GMT
GET H2	200	CVFAssets-e91ba5c6e67c58c7f9c4c413fa67697feade389e._V2_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	2 KB 1 KB	71ms 19ms	Stylesheet text/css	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/CVFAssets-e91ba5c6e67c58c7f9c4c413fa67697feade389e._V2_.css Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `ac6c8a640f5b8fea68c8aeaaad4e145c8261be36ba09df844e4121fb69e90cc7` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Fri, 25 Feb 2022 07:31:45 GMT content-encoding gzip age 6118537 edge-cache-tag x-cache-747,/images/G/01/AUIClients/CVFAssets-e91ba5c6e67c58c7f9c4c413fa67697feade389e x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-747 /images/G/01/AUIClients/CVFAssets-e91ba5c6e67c58c7f9c4c413fa67697feade389e last-modified Mon, 16 Oct 2017 21:31:50 GMT server Server content-type text/css; charset=utf-8 via 1.1 5297df6326448099cefed6e96fd7b00a.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id dcd7e954-6d2e-4992-a4f2-c952c5fec2d0 x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id xQ0f81X7LnhEtVBhhpO99YghL4HuPVbX4D6gp1cpJNw4WzqXdl7xKQ== expires Tue, 18 Feb 2042 03:02:14 GMT
GET H2	200	61tHvuwljLL._RC%7C11IYhapguOL.js,61Z-hR1QEiL.js,31pYyxAZJRL.js,31Qll8kfk9L.js,01N6xzIJxbL.js,516fQ5+zVmL.js,01rpauTep4L.js,31JzIBuTmgL.js,61uDiYnK9wL.js,01BBu+b9t0L.js_.js Show response images-na.ssl-images-amazon.com/images/I/	313 KB 97 KB	32ms 12ms	Script application/x-javascript	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61tHvuwljLL._RC%7C11IYhapguOL.js,61Z-hR1QEiL.js,31pYyxAZJRL.js,31Qll8kfk9L.js,01N6xzIJxbL.js,516fQ5+zVmL.js,01rpauTep4L.js,31JzIBuTmgL.js,61uDiYnK9wL.js,01BBu+b9t0L.js_.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `61fb9cb6d66cca3f549daf004fdb10cf72389a3cfbfd84f232f66ee1cee5be31` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Fri, 25 Feb 2022 06:22:07 GMT content-encoding gzip age 6122715 edge-cache-tag x-cache-330,/images/I/61tHvuwljLL x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-330 /images/I/61tHvuwljLL last-modified Wed, 08 Mar 2017 21:51:15 GMT server Server content-type application/x-javascript; charset=utf-8 via 1.1 d2f47ea7c79de35229ffbfc6942082c0.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 5799ca59-e4d8-4c27-bd41-4a051b3526d7 x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id HqXVPUOAS72FZBIWPKSqFRFLGW0paxh-whVp-BLXQ0CkxNfk6V8pvg== expires Wed, 19 Feb 2042 14:32:00 GMT
GET H2	200	AuthenticationPortalAssets-3cbd67cb821687489829ed6a61d9e8b52e65d2e3._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	75 KB 22 KB	45ms 26ms	Script application/x-javascript	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-3cbd67cb821687489829ed6a61d9e8b52e65d2e3._V2_.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `fc31430fa39ca1617e3956628fdd8f8da18f10a2e0b78e95e973a79f32fa0dbe` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sun, 06 Mar 2022 19:13:02 GMT content-encoding gzip age 5298860 edge-cache-tag x-cache-613,/images/G/01/AUIClients/AuthenticationPortalAssets-3cbd67cb821687489829ed6a61d9e8b52e65d2e3 x-nginx-cache-status MISS x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-613 /images/G/01/AUIClients/AuthenticationPortalAssets-3cbd67cb821687489829ed6a61d9e8b52e65d2e3 last-modified Thu, 08 Mar 2018 04:04:13 GMT server Server content-type application/x-javascript; charset=utf-8 via 1.1 d2f47ea7c79de35229ffbfc6942082c0.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id f6cec0a1-9a1b-41c3-9b1e-44bdf1eb2011 x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id zQD6u0EMo2dwY0Kwh1MWVzgQsUAakvEivAqON_506qVRYiMlZZX82A== expires Sat, 01 Mar 2042 19:13:02 GMT
GET H2	200	AuthenticationPortalInlineAssets-662783336058590306af126b0eeae5125982f026._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	518 B 1014 B	51ms 33ms	Script application/x-javascript	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalInlineAssets-662783336058590306af126b0eeae5125982f026._V2_.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `e605618a086fe7d6a8cf916fccd3201cb0fcad05d88b507a14afbbd32252a7cf` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Fri, 25 Feb 2022 06:22:07 GMT content-encoding gzip age 6122715 edge-cache-tag x-cache-767,/images/G/01/AUIClients/AuthenticationPortalInlineAssets-662783336058590306af126b0eeae5125982f026 x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-767 /images/G/01/AUIClients/AuthenticationPortalInlineAssets-662783336058590306af126b0eeae5125982f026 last-modified Mon, 24 Jul 2017 21:17:53 GMT server Server content-type application/x-javascript; charset=utf-8 via 1.1 d2f47ea7c79de35229ffbfc6942082c0.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 6f12e55a-29fc-462e-9af6-f85d80aea774 x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id SP__thyeWgpNnVnHqbXffPvrW2XehaMPACz1nhTjVXf_d317Ta5cpQ== expires Tue, 18 Feb 2042 03:03:13 GMT
GET H2	200	CVFAssets-53acd8e88d87f09d7e0bebd849f2fa4b112e99c7._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	8 KB 4 KB	51ms 33ms	Script application/x-javascript	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/CVFAssets-53acd8e88d87f09d7e0bebd849f2fa4b112e99c7._V2_.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `d9f499dc2e4755aea39befdb10b097560b67bda2d1788d14a68b793ed0f8477e` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Fri, 25 Feb 2022 07:31:46 GMT content-encoding gzip age 6118536 edge-cache-tag x-cache-219,/images/G/01/AUIClients/CVFAssets-53acd8e88d87f09d7e0bebd849f2fa4b112e99c7 x-nginx-cache-status MISS x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-219 /images/G/01/AUIClients/CVFAssets-53acd8e88d87f09d7e0bebd849f2fa4b112e99c7 last-modified Wed, 20 Jun 2018 06:10:05 GMT server Server content-type application/x-javascript; charset=utf-8 via 1.1 d2f47ea7c79de35229ffbfc6942082c0.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 777376ca-e30f-44bb-854a-c1d6f90bc3fd x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.com x-amz-cf-id DYwa5qpqTB-o3XJC0c9I9yuzS4JNpXGcJBMwGXSqu_q1qOuEcahmAA== expires Thu, 20 Feb 2042 07:31:46 GMT
GET H2	200	Amazon-Logo-PNG.png www.synointcdn.com/wp-content/uploads/2019/04/	39 KB 39 KB	332ms 303ms	Image image/png	2606:4700:3030::6815:4104 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.synointcdn.com/wp-content/uploads/2019/04/Amazon-Logo-PNG.png Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:4104 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fbf6a89c2c9b53977309305e2e5e3cd9b4832671a5c6fb4e0cb38bf576d4bb3b` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 03:07:22 GMT cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 39755 last-modified Mon, 13 Jul 2020 10:27:23 GMT server cloudflare etag "9b4b-5aa5022e398c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=duSXyZBhaNvQuxKLSugjyWu4zvGGS10PEqP%2Fn5QkXVJlljbuqHseWF%2BBDPbrGm8eMTuZCN%2B03DPxLlUMh5kn7NAsA52scBMZu29itqKja3uo8HGCGDn2Mvgvv2zUcaMDTkzSTNMv4e6lTAr95WVpb7E%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 7076beb8dc0f9bdd-FRA
POST H2	204	/ fls-eu.amazon.com/1/batch/1/OE/	0 166 B	160ms 42ms	Ping text/plain	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fls-eu.amazon.com/1/batch/1/OE/ Requested by Host: images-eu.ssl-images-amazon.com URL: https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://amazonsecurelogin.lhr.rocks/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sat, 07 May 2022 03:07:22 GMT x-amzn-requestid 4fc9a9e1-ff66-46ff-92e7-93ea5e309808 access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
POST H2	204	/ fls-eu.amazon.com/1/batch/1/OE/	0 165 B	129ms 42ms	Ping text/plain	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fls-eu.amazon.com/1/batch/1/OE/ Requested by Host: images-eu.ssl-images-amazon.com URL: https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://amazonsecurelogin.lhr.rocks/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sat, 07 May 2022 03:07:22 GMT x-amzn-requestid f0780ebd-cd42-4cdd-a440-130a7ebfdb4f access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
POST H2	204	/ fls-eu.amazon.com/1/batch/1/OE/	0 165 B	167ms 83ms	Ping text/plain	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fls-eu.amazon.com/1/batch/1/OE/ Requested by Host: images-eu.ssl-images-amazon.com URL: https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://amazonsecurelogin.lhr.rocks/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sat, 07 May 2022 03:07:22 GMT x-amzn-requestid 509dcde6-79ec-4adf-ba60-44b24bed516b access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
POST H2	204	/ fls-eu.amazon.com/1/batch/1/OE/	0 165 B	148ms 81ms	Ping text/plain	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fls-eu.amazon.com/1/batch/1/OE/ Requested by Host: images-eu.ssl-images-amazon.com URL: https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://amazonsecurelogin.lhr.rocks/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sat, 07 May 2022 03:07:22 GMT x-amzn-requestid 6405e2a3-7a5b-4860-b7e3-4d77e884adea access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
GET H2	200	fwcim._CB477506611_.js Show response images-na.ssl-images-amazon.com/images/G/02/x-locale/common/login/	384 KB 109 KB	112ms 112ms	Script application/x-javascript	2600:9000:224a:4e00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/02/x-locale/common/login/fwcim._CB477506611_.js Requested by Host: amazonsecurelogin.lhr.rocks URL: https://amazonsecurelogin.lhr.rocks/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:224a:4e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `db30660fb9fb9e87f176e179b29c5239f8def42613054792901c63b065d7f764` Request headers Referer https://amazonsecurelogin.lhr.rocks/ Origin https://amazonsecurelogin.lhr.rocks accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 03:07:22 GMT content-encoding gzip age 88 edge-cache-tag x-cache-763,/images/G/02/x-locale/common/login/fwcim x-nginx-cache-status EXPIRED x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-763 /images/G/02/x-locale/common/login/fwcim last-modified Mon, 15 Oct 2018 18:22:13 GMT server Server content-type application/x-javascript via 1.1 d2f47ea7c79de35229ffbfc6942082c0.cloudfront.net (CloudFront) cache-control max-age=3600,public x-amz-ir-id 762f11e3-ec70-413c-94a6-4b796a7f938d x-amz-cf-pop DUS51-P1 timing-allow-origin https://www.amazon.co.uk x-amz-cf-id LviR7LIXXrz7_4_seguAr9wNXfBLSiUQcSyY_goUshBfN4vZ6By-YA== expires Sat, 07 May 2022 04:05:54 GMT
GET H2	200	AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png m.media-amazon.com/images/G/01/AUIClients/	26 KB 26 KB	21ms 7ms	Image image/png	2a04:4e42:600::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61gbb09bfIL._RC%7C11Fd9tJOdtL.css,21ULbzscqzL.css,31Q3id-QR0L.css,31QszevPBSL.css_.css#AUIClients/AmazonUI.min Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d` Request headers accept-language de-DE,de;q=0.9 Referer https://images-na.ssl-images-amazon.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers timing-allow-origin https://www.amazon.com date Sat, 07 May 2022 03:07:22 GMT last-modified Thu, 15 Sep 2016 00:26:49 GMT age 3954197 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT access-control-allow-origin * expires Thu, 19 Sep 2041 19:45:41 GMT cache-control max-age=630720000,public x-amz-ir-id 34670189-8b2f-4958-8606-a9942c447cd5 server-timing provider;desc="fy" accept-ranges bytes content-type image/png content-length 26119 x-served-by cache-iad-kjyo7100083-IAD, cache-hhn4038-HHN
GET H/1.1	404 Not Found	login.html amazonsecurelogin.lhr.rocks/ap/ Redirect Chain https://amazonsecurelogin.lhr.rocks/ap/uedata?ld&v=0.200897.0&id=6105GHANE540GE228KG6&sw=1600&sh=1200&vw=1600&vh=1200&m=1&sc=6105GHANE540GE228KG6&ue=1&bb=97&cf=202&be=336&pc=432&tc=-1322&na_=-1322&... https://amazonsecurelogin.lhr.rocks/ap/login.html	546 B 546 B	417ms 214ms	Image text/html	54.82.85.249 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://amazonsecurelogin.lhr.rocks/ap/login.html Protocol HTTP/1.1 Server 54.82.85.249 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-82-85-249.compute-1.amazonaws.com Software / Resource Hash `6ff74b041207bd821e864b1bcf5543b793f614a0f2e43a58768c82908c176638` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers Date Sat, 07 May 2022 03:07:23 GMT Connection close Host amazonsecurelogin.lhr.rocks Content-Length 546 Content-Type text/html; charset=UTF-8 Redirect headers Location login.html Date Sat, 07 May 2022 03:07:23 GMT Connection close X-Powered-By PHP/8.1.2 Host amazonsecurelogin.lhr.rocks Content-type text/html; charset=UTF-8
GET H2	200	A1F83G8C2ARO7P:261-5441383-4343233:6105GHANE540GE228KG6$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.200897.0%26id%3D6105GHANE540GE228KG6%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3D6105... fls-eu.amazon.com/1/batch/1/OP/	43 B 150 B	42ms 42ms	Image image/gif	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fls-eu.amazon.com/1/batch/1/OP/A1F83G8C2ARO7P:261-5441383-4343233:6105GHANE540GE228KG6$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.200897.0%26id%3D6105GHANE540GE228KG6%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3D6105GHANE540GE228KG6%26ue%3D1%26bb%3D97%26cf%3D202%26be%3D336%26pc%3D432%26tc%3D-1322%26na_%3D-1322%26ul_%3D-1651892842246%26_ul%3D-1651892842246%26rd_%3D-1322%26_rd%3D-509%26fe_%3D-509%26lk_%3D-508%26_lk%3D-508%26co_%3D-508%26_co%3D-312%26sc_%3D-413%26rq_%3D-312%26rs_%3D-135%26_rs%3D185%26dl_%3D-133%26di_%3D336%26de_%3D336%26_de%3D338%26_dc%3D431%26ld_%3D431%26_ld%3D-1651892842246%26ntd%3D-1%26ty%3D0%26rc%3D1%26hob%3D0%26hoe%3D1%26ld%3D432%26t%3D1651892842678%26ctb%3D1%26bfform%3D1%26nrbf%3D1%26rt%3Dcf%3A9-6-3-0-3-0-0__ld%3A16-7-3-1-5-0-1%26ec%3D4%26ecf%3D4%26csmtags%3Daui%7Caui%3Aaui_build_date%3A3.17.8.3-2018-06-19%7Caui%3Aaui_build_date%3A3.18.5-2018-04-12%7Cfls-eu%26viz%3Dvisible%3A1%26pty%3DAuthenticationPortal%26spty%3DSignInApplication%26pti%3Dundefined%26tid%3D6105GHANE540GE228KG6%26aftb%3D1:433 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 03:07:22 GMT x-amzn-requestid d79bfd65-d958-446c-af65-fbfa48946a71 content-length 43 content-type image/gif
GET H/1.1	404 Not Found	login.html amazonsecurelogin.lhr.rocks/ap/ Redirect Chain https://amazonsecurelogin.lhr.rocks/ap/uedata?at&v=0.200897.0&id=6105GHANE540GE228KG6&m=1&sc=adblk_no&pc=435&at=435&t=1651892842681&bfform=1&nrbf=1&csmtags=adblk_no&pty=AuthenticationPortal&spty=Si... https://amazonsecurelogin.lhr.rocks/ap/login.html	546 B 546 B	418ms 214ms	Image text/html	54.82.85.249 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://amazonsecurelogin.lhr.rocks/ap/login.html Protocol HTTP/1.1 Server 54.82.85.249 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-82-85-249.compute-1.amazonaws.com Software / Resource Hash `6ff74b041207bd821e864b1bcf5543b793f614a0f2e43a58768c82908c176638` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers Date Sat, 07 May 2022 03:07:23 GMT Connection close Host amazonsecurelogin.lhr.rocks Content-Length 546 Content-Type text/html; charset=UTF-8 Redirect headers Location login.html Date Sat, 07 May 2022 03:07:23 GMT Connection close X-Powered-By PHP/8.1.2 Host amazonsecurelogin.lhr.rocks Content-type text/html; charset=UTF-8
GET H2	200	A1F83G8C2ARO7P:261-5441383-4343233:6105GHANE540GE228KG6$uedata=s:%2Fap%2Fuedata%3Fat%26v%3D0.200897.0%26id%3D6105GHANE540GE228KG6%26m%3D1%26sc%3Dadblk_no%26pc%3D435%26at%3D435%26t%3D1651892842681%2... fls-eu.amazon.com/1/batch/1/OP/	43 B 148 B	42ms 41ms	Image image/gif	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fls-eu.amazon.com/1/batch/1/OP/A1F83G8C2ARO7P:261-5441383-4343233:6105GHANE540GE228KG6$uedata=s:%2Fap%2Fuedata%3Fat%26v%3D0.200897.0%26id%3D6105GHANE540GE228KG6%26m%3D1%26sc%3Dadblk_no%26pc%3D435%26at%3D435%26t%3D1651892842681%26bfform%3D1%26nrbf%3D1%26csmtags%3Dadblk_no%26pty%3DAuthenticationPortal%26spty%3DSignInApplication%26pti%3Dundefined%26tid%3D6105GHANE540GE228KG6%26aftb%3D1:435 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce` Request headers accept-language de-DE,de;q=0.9 Referer https://amazonsecurelogin.lhr.rocks/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 03:07:22 GMT x-amzn-requestid 07dae411-180b-4122-937d-ade2a02f00fb content-length 43 content-type image/gif
POST H2	204	/ fls-eu.amazon.com/1/batch/1/OE/	0 165 B	42ms 42ms	Ping text/plain	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fls-eu.amazon.com/1/batch/1/OE/ Requested by Host: images-eu.ssl-images-amazon.com URL: https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://amazonsecurelogin.lhr.rocks/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sat, 07 May 2022 03:07:23 GMT x-amzn-requestid fdbd62b8-3623-4202-a6b3-8eaf9809fc63 access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date
POST H2	204	/ fls-eu.amazon.com/1/batch/1/OE/	0 165 B	45ms 44ms	Ping text/plain	54.220.56.240 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fls-eu.amazon.com/1/batch/1/OE/ Requested by Host: images-eu.ssl-images-amazon.com URL: https://images-eu.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-69ab801358dfe32338d0619802ae6aabc188b1bd._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.220.56.240 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-220-56-240.eu-west-1.compute.amazonaws.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://amazonsecurelogin.lhr.rocks/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Sat, 07 May 2022 03:07:26 GMT x-amzn-requestid 7755158b-bafb-4d6b-a664-72099c07fb27 access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazonsecurelogin.lhr.rocks/	1970-01-20 03:01:37	Name: csm-hit Value: s-6105GHANE540GE228KG6\|1651892842343

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://amazonsecurelogin.lhr.rocks/ap/login.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://amazonsecurelogin.lhr.rocks/ap/login.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazonsecurelogin.lhr.rocks
fls-eu.amazon.com
images-eu.ssl-images-amazon.com
images-na.ssl-images-amazon.com
m.media-amazon.com
www.synointcdn.com
2600:9000:224a:4e00:1d:d7f6:39d0:c781
2606:4700:3030::6815:4104
2a04:4e42:600::272
54.220.56.240
54.82.85.249
61fb9cb6d66cca3f549daf004fdb10cf72389a3cfbfd84f232f66ee1cee5be31
6ff74b041207bd821e864b1bcf5543b793f614a0f2e43a58768c82908c176638
88ea58255d4cd82340f7acaabe0e6a99f195a4dc2ca6ef56ec503d03b331bee5
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
ac6c8a640f5b8fea68c8aeaaad4e145c8261be36ba09df844e4121fb69e90cc7
b06058dda50252e2ff430d60f9d799d44e0dbbad47006ea169aa9abd90146459
b0dfd0c43aa63c49136dbb7136ae0772256273beaeec05845a2cbe6c116f4d00
d7f0c84a144723f16e3e284bc646810e7007f552e7444e8138ce54f616f9975b
d9f499dc2e4755aea39befdb10b097560b67bda2d1788d14a68b793ed0f8477e
db30660fb9fb9e87f176e179b29c5239f8def42613054792901c63b065d7f764
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e605618a086fe7d6a8cf916fccd3201cb0fcad05d88b507a14afbbd32252a7cf
f58466e353c2d1a58687e7fc3a62c0611a28db622e1725fae8f50f3d46361440
fbf6a89c2c9b53977309305e2e5e3cd9b4832671a5c6fb4e0cb38bf576d4bb3b
fc31430fa39ca1617e3956628fdd8f8da18f10a2e0b78e95e973a79f32fa0dbe

amazonsecurelogin.lhr.rocks Open in urlscan Pro 54.82.85.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

91 %HTTPS

60 %IPv6

5 Domains

6 Subdomains

5 IPs

2 Countries

386 kBTransfer

1074 kBSize

1 Cookies

8 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

51 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

amazonsecurelogin.lhr.rocks Open in urlscan Pro
54.82.85.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

91 %
HTTPS

60 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

386 kB
Transfer

1074 kB
Size

1
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!