![](/screenshots/9267a9c1-2b74-4e49-ad00-3bf7fc913871.png)
t.co
Open in
urlscan Pro
104.244.42.5
Malicious Activity!
Public Scan
Submission: On May 08 via manual from GB
Summary
TLS certificate: Issued by Symantec Class 3 EV SSL CA - G3 on August 10th 2015. Valid for: 2 years.
This is the only time t.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.5 104.244.42.5 | 13414 (TWITTER) (TWITTER - Twitter Inc.) | |
2 | 89.189.197.3 89.189.197.3 | 29468 (INFRACOM) (INFRACOM) | |
1 | 54.230.53.117 54.230.53.117 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 54.192.55.234 54.192.55.234 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
6 | 5 |
ASN29468 (INFRACOM, SE)
home.amazon.com.updates-on-our-policy.verifying-id.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-53-117.jfk6.r.cloudfront.net
images-na.ssl-images-amazon.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-55-234.jfk6.r.cloudfront.net
g-ecx.images-amazon.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
verifying-id.com
home.amazon.com.updates-on-our-policy.verifying-id.com Failed |
123 KB |
1 |
images-amazon.com
g-ecx.images-amazon.com |
6 KB |
1 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
25 KB |
1 |
t.co
t.co |
220 B |
6 | 4 |
Domain | Requested by | |
---|---|---|
2 | home.amazon.com.updates-on-our-policy.verifying-id.com |
home.amazon.com.updates-on-our-policy.verifying-id.com
|
1 | g-ecx.images-amazon.com | |
1 | images-na.ssl-images-amazon.com | |
1 | t.co | |
6 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co Symantec Class 3 EV SSL CA - G3 |
2015-08-10 - 2017-08-10 |
2 years | crt.sh |
home.amazon.com.updates-on-our-policy.verifying-id.com Let's Encrypt Authority X3 |
2017-05-06 - 2017-08-04 |
3 months | crt.sh |
Images-na.ssl-images-amazon.com Symantec Class 3 Secure Server CA - G4 |
2016-09-23 - 2017-10-26 |
a year | crt.sh |
This page contains 2 frames:
Frame:
https://home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/signin?_encoding=UTF8&openid.assoc_handle=usflex
Frame ID: 25124.1
Requests: 2 HTTP requests in this frame
Frame:
https://home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/signin?_encoding=UTF8&openid.assoc_handle=usflex
Frame ID: 25136.1
Requests: 4 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request 0- https://home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/
- https://home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/signin?_encoding=UTF8&openid.assoc_handle=usflex
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
fIZ4s2i2EK
t.co/ |
257 B 220 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
signin
home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin
home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/ Frame 2513 |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AmazonUI-def1dfe3edcac538e27845c3cfc11fa83c842d7e._V2_.css
home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/signin_css/ Frame 2513 |
117 KB 117 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ Frame 2513 |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
karriere1._V375547151_.jpg
g-ecx.images-amazon.com/images/G/03/careers/home/ Frame 2513 |
6 KB 6 KB |
Other
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- home.amazon.com.updates-on-our-policy.verifying-id.com
- URL
- https://home.amazon.com.updates-on-our-policy.verifying-id.com/8675f/ap/signin?_encoding=UTF8&openid.assoc_handle=usflex
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | referrer always; |
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
g-ecx.images-amazon.com
home.amazon.com.updates-on-our-policy.verifying-id.com
images-na.ssl-images-amazon.com
t.co
home.amazon.com.updates-on-our-policy.verifying-id.com
104.244.42.5
54.192.55.234
54.230.53.117
89.189.197.3
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
742342312f6eb51db6a9259962e1c010cae0a18014766610cc8e2ea1ff156c2d
937a688906be1e05b9820846e825a4f4dbd101917a6fd32e049635ceac488b4b
ac38cbcedd58b3e161136d8b08446a69ded0543f9764111c4e6d4d700951dafe
f673179c95a80604cf7306c3c23f90c263df6b1e61d2f2f9fa0804c6a785bc5c