amz00000.com Open in urlscan Pro
91.209.70.205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://amz00000.com/
Effective URL:
https://amz00000.com/Files/login.php
Submission: On April 03 via api (April 3rd 2019, 4:40:47 pm UTC) from GB

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 91.209.70.205, located in Russian Federation and belongs to FISHNET-AS, RU. The main domain is amz00000.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 3rd 2019. Valid for: 3 months.

This is the only time amz00000.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	91.209.70.205 91.209.70.205	43317 (FISHNET-AS) (FISHNET-AS)
7	54.192.201.153 54.192.201.153	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
8	2

2 91.209.70.205 (Russian Federation) 1 redirects

ASN43317 (FISHNET-AS, RU)

amz00000.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 54.192.201.153 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-192-201-153.fra50.r.cloudfront.net

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	media-amazon.com m.media-amazon.com	78 KB
3	ssl-images-amazon.com images-na.ssl-images-amazon.com	31 KB
2	amz00000.com 1 redirects amz00000.com	13 KB
8	3

	Domain	Requested by
4	m.media-amazon.com
3	images-na.ssl-images-amazon.com	amz00000.com
2	amz00000.com	1 redirects
8	3

This site contains no links.

Subject Issuer	Validity	Valid
amz00000.com cPanel, Inc. Certification Authority	`2019-04-03` - `2019-07-02`	3 months	crt.sh
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2019-02-21` - `2019-07-19`	5 months	crt.sh

This page contains 1 frames:

Primary Page: https://amz00000.com/Files/login.php
Frame ID: 3C0179FC745167F7CCCDF8911D3EF74A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://amz00000.com/ HTTP 302
https://amz00000.com/Files/login.php Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

122 kB
Transfer

262 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://amz00000.com/ HTTP 302
https://amz00000.com/Files/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response amz00000.com/Files/ Redirect Chain https://amz00000.com/ https://amz00000.com/Files/login.php	12 KB 12 KB	48ms 48ms	Document text/html	91.209.70.205 FISHNET-AS
General Check archive.org Show headers Download Go to Full URL https://amz00000.com/Files/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.209.70.205 , Russian Federation, ASN43317 (FISHNET-AS, RU), Reverse DNS Software Apache / Resource Hash `07c4f3a8bd5ca65eae7993fb45cdf64bfa3508e6f7208793093d1069b47090e7` Request headers Host amz00000.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 16:40:32 GMT Server Apache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Wed, 03 Apr 2019 16:40:32 GMT Server Apache Location Files/login.php Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css images-na.ssl-images-amazon.com/images/I/	137 KB 23 KB	56ms 8ms	Stylesheet text/css	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI Requested by Host: amz00000.com URL: https://amz00000.com/Files/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `8ff52030ae312e1688bd111f80d21dc533e457cdefd9cdf07722ec9f51de79bb` Request headers Referer https://amz00000.com/Files/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 15 Nov 2018 23:24:48 GMT content-encoding gzip last-modified Wed, 03 Jan 2018 00:13:54 GMT server Server age 12033517 x-cache Hit from cloudfront content-type text/css; charset=utf-8 status 200 cache-control max-age=630720000,public x-amz-ir-id a4a89870-a9e9-489b-a5f3-8668fe602b87 timing-allow-origin https://www.amazon.com access-control-allow-origin * x-amz-cf-id sbfEFwVO4iwDoTSQxw4wKm_JOs9QQOMkynrPQPlsxVRYQCT0IfuOHA== via 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront) expires Wed, 10 Nov 2038 10:01:55 GMT
GET H2	200	01SdjaY0ZsL._RC%7C41SyweC3CeL.css,21PbmxV-RyL.css_.css images-na.ssl-images-amazon.com/images/I/	34 KB 7 KB	62ms 15ms	Stylesheet text/css	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C41SyweC3CeL.css,21PbmxV-RyL.css_.css?AUIClients/AuthenticationPortalAssets Requested by Host: amz00000.com URL: https://amz00000.com/Files/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `49cccad8a2f9cd45a4daca661106cbb5d03cb529e21ebeed0fb0aac889bc8ea0` Request headers Referer https://amz00000.com/Files/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sun, 24 Mar 2019 22:54:49 GMT content-encoding gzip last-modified Sat, 30 May 2015 02:58:48 GMT server Server age 861266 x-cache Hit from cloudfront content-type text/css status 200 cache-control max-age=630720000,public x-amz-ir-id 46ac2b6b-5eb5-4a34-a26b-8683a95e7993 timing-allow-origin https://www.amazon.com access-control-allow-origin * x-amz-cf-id Cx24xOB_ZT3NtL-DRQYoAm_uoRgvqvcbEe64eH0c9k33mThccNTSOw== via 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront) expires Sat, 19 Mar 2039 17:26:06 GMT
GET H2	200	11BFk7eGdOL.css images-na.ssl-images-amazon.com/images/I/	2 KB 1 KB	55ms 9ms	Stylesheet text/css	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/11BFk7eGdOL.css?AUIClients/CVFAssets Requested by Host: amz00000.com URL: https://amz00000.com/Files/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `ac6c8a640f5b8fea68c8aeaaad4e145c8261be36ba09df844e4121fb69e90cc7` Request headers Referer https://amz00000.com/Files/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 28 Nov 2018 18:04:41 GMT content-encoding gzip last-modified Mon, 16 Oct 2017 21:31:50 GMT server Server age 11075936 x-cache Hit from cloudfront content-type text/css; charset=utf-8 status 200 cache-control max-age=630720000,public x-amz-ir-id aaa29a99-3ad5-49c7-a96e-c5e5419d6f43 timing-allow-origin https://www.amazon.com access-control-allow-origin * x-amz-cf-id gkyFA5v8WKF1RuMlvww_XSiYGa5YOD3-EUZ5UTGgHeGNCDXwMwVnuw== via 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront) expires Fri, 29 Oct 2038 07:11:30 GMT
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	32ms 9ms	Image image/png	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers Referer https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Tue, 26 Mar 2019 13:33:57 GMT via 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront) last-modified Fri, 22 Sep 2017 00:23:19 GMT server Server age 5541061 x-cache Hit from cloudfront content-type image/png status 200 cache-control max-age=630720000,public x-amz-ir-id e677b91f-73c8-49b7-86ec-2ddfa836a9a2 timing-allow-origin https://www.amazon.com access-control-allow-origin * content-length 27972 x-amz-cf-id GQmOpdX3OguMuzWgnD6kA9kNfRVDXRfhS8v50NI3iqltApD7OwTTxw== expires Mon, 24 Jan 2039 13:29:31 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	52ms 9ms	Font application/font-woff2	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI Origin https://amz00000.com Response headers date Thu, 15 Nov 2018 23:47:11 GMT via 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront) last-modified Sat, 11 Jun 2016 01:31:21 GMT server Server age 12179083 x-cache Hit from cloudfront content-type application/font-woff2; charset=utf-8 status 200 cache-control max-age=630720000,public x-amz-ir-id 7fc3d956-899b-4524-aa5a-7a4108ed34da timing-allow-origin https://www.amazon.com access-control-allow-origin * content-length 16616 x-amz-cf-id NTOvNCPuhT3c3YcK-_rBDVn-ZOyaHJnw6AsxRiQQATj5bIO6iRmxoA== expires Mon, 08 Nov 2038 17:35:49 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	54ms 17ms	Font application/font-woff2	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI Origin https://amz00000.com Response headers date Thu, 15 Nov 2018 23:47:11 GMT via 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront) last-modified Sat, 11 Jun 2016 01:31:24 GMT server Server age 12042890 x-cache Hit from cloudfront content-type application/font-woff2; charset=utf-8 status 200 cache-control max-age=630720000,public x-amz-ir-id 85b394c3-ec0c-42aa-9c0e-24887c329a52 timing-allow-origin https://www.amazon.com access-control-allow-origin * content-length 16460 x-amz-cf-id 9anb0RtYD0CXo1sWWm8zRWGZE_Kn6Q4ilAI1XmP9cGRMjPYhYDtmSw== expires Wed, 10 Nov 2038 07:25:42 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_rgit-9cc1bb64eb270135f1adf3a4881c2ee5e7c37be5._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	17 KB 17 KB	50ms 15ms	Font application/font-woff2	54.192.201.153 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rgit-9cc1bb64eb270135f1adf3a4881c2ee5e7c37be5._V2_.woff2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.192.201.153 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-54-192-201-153.fra50.r.cloudfront.net Software Server / Resource Hash `cb0f25ca005489d2399434c33762f291bd8746714eae3aa72de20aca08edc458` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI Origin https://amz00000.com Response headers date Sun, 14 Oct 2018 21:46:49 GMT via 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront) last-modified Sat, 11 Jun 2016 01:31:22 GMT server Server age 14827833 x-cache Hit from cloudfront content-type application/font-woff2; charset=utf-8 status 200 cache-control max-age=630720000,public x-amz-ir-id 1e928881-3e39-4b62-9577-de113fb78f06 timing-allow-origin https://www.amazon.com access-control-allow-origin * content-length 17336 x-amz-cf-id NaWijRiiqX0PEB0ivYLet40YH8KIeO_p5x3-jBbFt4Yubb_gt94GLw== expires Sat, 09 Oct 2038 01:49:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amz00000.com
images-na.ssl-images-amazon.com
m.media-amazon.com
54.192.201.153
91.209.70.205
07c4f3a8bd5ca65eae7993fb45cdf64bfa3508e6f7208793093d1069b47090e7
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
49cccad8a2f9cd45a4daca661106cbb5d03cb529e21ebeed0fb0aac889bc8ea0
8ff52030ae312e1688bd111f80d21dc533e457cdefd9cdf07722ec9f51de79bb
ac6c8a640f5b8fea68c8aeaaad4e145c8261be36ba09df844e4121fb69e90cc7
cb0f25ca005489d2399434c33762f291bd8746714eae3aa72de20aca08edc458
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

amz00000.com Open in urlscan Pro 91.209.70.205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

122 kBTransfer

262 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

amz00000.com Open in urlscan Pro
91.209.70.205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

122 kB
Transfer

262 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!