main.d159idr690ah86.amplifyapp.com Open in urlscan Pro
99.86.241.71  Malicious Activity! Public Scan

Submitted URL: http://main.d159idr690ah86.amplifyapp.com/
Effective URL: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Submission: On June 11 via api from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 99.86.241.71, located in United States and belongs to AMAZON-02, US. The main domain is main.d159idr690ah86.amplifyapp.com.
TLS certificate: Issued by Amazon on June 10th 2021. Valid for: a year.
This is the only time main.d159idr690ah86.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 8 99.86.241.71 16509 (AMAZON-02)
7 1
Apex Domain
Subdomains
Transfer
8 amplifyapp.com
main.d159idr690ah86.amplifyapp.com
39 KB
7 1
Domain Requested by
8 main.d159idr690ah86.amplifyapp.com 1 redirects main.d159idr690ah86.amplifyapp.com
7 1

This site contains links to these domains. Also see Links.

Domain
www.amazon.com
Subject Issuer Validity Valid
*.d159idr690ah86.amplifyapp.com
Amazon
2021-06-10 -
2022-07-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Frame ID: 40A4AE25AAAAC5EDEC634B11C1B3F727
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://main.d159idr690ah86.amplifyapp.com/ HTTP 301
    https://main.d159idr690ah86.amplifyapp.com/ Page URL
  2. https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2O... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
  • headers server /^AmazonS3$/i

Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

38 kB
Transfer

134 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://main.d159idr690ah86.amplifyapp.com/ HTTP 301
    https://main.d159idr690ah86.amplifyapp.com/ Page URL
  2. https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://main.d159idr690ah86.amplifyapp.com/ HTTP 301
  • https://main.d159idr690ah86.amplifyapp.com/

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
main.d159idr690ah86.amplifyapp.com/
Redirect Chain
  • http://main.d159idr690ah86.amplifyapp.com/
  • https://main.d159idr690ah86.amplifyapp.com/
136 B
509 B
Document
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1475fda7a4d309c9341051023781959c711902cfe480c4426e0d62e73dded943

Request headers

:method
GET
:authority
main.d159idr690ah86.amplifyapp.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
text/html
content-length
136
date
Fri, 11 Jun 2021 17:00:58 GMT
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
x-amz-server-side-encryption
AES256
accept-ranges
bytes
server
AmazonS3
cache-control
no-cache, s-maxage=2
etag
"e16920f700fd588ede13d860b83a1710"
x-cache
Miss from cloudfront
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-C1
x-amz-cf-id
HDvmlHImKbTtpT0R5DhKbOMOx2R2poL6J-gQnDiaq7Nl8vnlDWuUzA==

Redirect headers

Server
CloudFront
Date
Fri, 11 Jun 2021 17:00:56 GMT
Content-Type
text/html
Content-Length
183
Connection
keep-alive
Location
https://main.d159idr690ah86.amplifyapp.com/
X-Cache
Redirect from cloudfront
Via
1.1 e6726d8c260dc6d0bdf74050840f4b1b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
VIE50-C1
X-Amz-Cf-Id
jB3LYbW5oExJNvN_O5FTamnaUigttAfqR7jUnOPV38Cld19hUeXF2g==
Primary Request billing.html
main.d159idr690ah86.amplifyapp.com/
93 KB
20 KB
Document
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
457ed328fcd8bdfefa5e90d071f160b138d299dc2fbfe5a81a5b28dae9fd77ae

Request headers

:method
GET
:authority
main.d159idr690ah86.amplifyapp.com
:scheme
https
:path
/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://main.d159idr690ah86.amplifyapp.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://main.d159idr690ah86.amplifyapp.com/

Response headers

content-type
text/html
date
Fri, 11 Jun 2021 17:00:58 GMT
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
x-amz-server-side-encryption
AES256
server
AmazonS3
cache-control
no-cache, s-maxage=2
content-encoding
gzip
etag
W/"d197eb157376c696a7a1851cb9903209"
vary
Accept-Encoding
x-cache
Miss from cloudfront
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-C1
x-amz-cf-id
eQctVwAlOiHYtyRE3zS9qJNv6UGnC6QuVzMipw-cfGQAIFiIPMCC6Q==
site-wide-a04329._V1_.css
main.d159idr690ah86.amplifyapp.com/content/
31 KB
7 KB
Stylesheet
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/content/site-wide-a04329._V1_.css
Requested by
Host: main.d159idr690ah86.amplifyapp.com
URL: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
10765b5e83a4ccbc5edbfcc4f3ada63b02c76cc1d29c21f1202fc54bd018710c

Request headers

:path
/content/site-wide-a04329._V1_.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
main.d159idr690ah86.amplifyapp.com
referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 11 Jun 2021 17:00:59 GMT
content-encoding
gzip
etag
W/"c5b431e3ddb3b23e34e512492e79b9f3"
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C1
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/css
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
cache-control
no-cache, s-maxage=2
x-amz-cf-id
tSRWrFqVKi-rJxYo1jJkDeqnOHLdJE0Pxop72ABpio9WMmB8BcUj-A==
BeaconSprite-US-01._V141013396_.png
main.d159idr690ah86.amplifyapp.com/content/
6 KB
6 KB
Image
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/content/BeaconSprite-US-01._V141013396_.png
Requested by
Host: main.d159idr690ah86.amplifyapp.com
URL: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4514d4d04b4644de38864be5ac0c945f94eec540dcef27061330658e46d848a9

Request headers

:path
/content/BeaconSprite-US-01._V141013396_.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
main.d159idr690ah86.amplifyapp.com
referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 11 Jun 2021 17:00:59 GMT
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C1
etag
"ce0ad8aebf91c79d98779ea2686ee3a8"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
no-cache, s-maxage=2
accept-ranges
bytes
content-length
6148
x-amz-cf-id
d9CBMq9Qudk6h9MOMYnlMZMsFKm5gLEUT9F3y7OZFE2jrGpuNIfs8w==
transparent-pixel._V192234675_.gif
main.d159idr690ah86.amplifyapp.com/content/
43 B
417 B
Image
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/content/transparent-pixel._V192234675_.gif
Requested by
Host: main.d159idr690ah86.amplifyapp.com
URL: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Request headers

:path
/content/transparent-pixel._V192234675_.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
main.d159idr690ah86.amplifyapp.com
referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 11 Jun 2021 17:00:59 GMT
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C1
etag
"6851dbf491ae442da3314f19e8aff085"
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
no-cache, s-maxage=2
accept-ranges
bytes
content-length
43
x-amz-cf-id
r1wP3eZSP_TldnsoK_r7JYERLXrhkJVX7472MUlxlnwjJ5xSlBXq8A==
confirm-card._V17236_.png
main.d159idr690ah86.amplifyapp.com/content/
2 KB
2 KB
Image
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/content/confirm-card._V17236_.png
Requested by
Host: main.d159idr690ah86.amplifyapp.com
URL: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b924ce130dc972a751e5bd741fb35cd7cb8d7a94894916d941f48e35abddf5dc

Request headers

:path
/content/confirm-card._V17236_.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
main.d159idr690ah86.amplifyapp.com
referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 11 Jun 2021 17:00:59 GMT
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C1
etag
"7e55e6c7d2697e6cac416c1f2eaf9d65"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
no-cache, s-maxage=2
accept-ranges
bytes
content-length
2167
x-amz-cf-id
XrUOAR0CaIY_r23n_kO7D4hzBhK8jK3AoB837rfxw4eyJ22sa5aICQ==
navAmazonLogoFooter._V169459313_.gif
main.d159idr690ah86.amplifyapp.com/content/
1 KB
2 KB
Image
General
Full URL
https://main.d159idr690ah86.amplifyapp.com/content/navAmazonLogoFooter._V169459313_.gif
Requested by
Host: main.d159idr690ah86.amplifyapp.com
URL: https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.241.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-241-71.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bde31848f3c02d44b188927f63b8724262cf12a30a2bef988f81698ecbbf5790

Request headers

:path
/content/navAmazonLogoFooter._V169459313_.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
main.d159idr690ah86.amplifyapp.com
referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://main.d159idr690ah86.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 11 Jun 2021 17:00:59 GMT
via
1.1 f39b904b3d29bdb5e473689299f6dedd.cloudfront.net (CloudFront)
last-modified
Thu, 10 Jun 2021 11:55:13 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C1
etag
"c195e2f844e4a1c00a03570593ce5ecf"
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
no-cache, s-maxage=2
accept-ranges
bytes
content-length
1216
x-amz-cf-id
PaMrB5RQ1FeEbKuY8Ghfw0Ur7XAfu53Oo78XBghX-KN1D_FToTiaog==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| container object| AmazonPopoverImages string| _navbarSpriteUrl function| Navbar object| _navbar undefined| iss string| issHost string| issMktid object| issSearchAliases function| updateISSCompletion undefined| dealNotifier object| errant

0 Cookies