www.amazon.tjhtpp.wang Open in urlscan Pro
137.220.137.122 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://accountupdate.amazon.qqqczb8.top/
Effective URL:
https://www.amazon.tjhtpp.wang/
Submission Tags: @phishunt_io
Submission: On November 01 via api (November 1st 2020, 9:58:59 am UTC) from ES

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 137.220.137.122, located in Cambodia and belongs to BCPL-SG BGPNET Global ASN, SG. The main domain is www.amazon.tjhtpp.wang.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 31st 2020. Valid for: 3 months.

This is the only time www.amazon.tjhtpp.wang was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	137.220.137.125 137.220.137.125	64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN)
1 2	137.220.137.122 137.220.137.122	64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN)
7	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a04:4e42:1b:... 2a04:4e42:1b::272	54113 (FASTLY) (FASTLY)
13	5

1 137.220.137.125 (Cambodia)

ASN64050 (BCPL-SG BGPNET Global ASN, SG)

accountupdate.amazon.qqqczb8.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 137.220.137.122 (Cambodia) 1 redirects

ASN64050 (BCPL-SG BGPNET Global ASN, SG)

amazon.tjhtpp.wang	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.amazon.tjhtpp.wang	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:1b::272 (Ascension Island)

ASN54113 (FASTLY, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	cloudflare.com cdnjs.cloudflare.com	12 KB
4	ssl-images-amazon.com images-na.ssl-images-amazon.com	11 KB
2	tjhtpp.wang 1 redirects amazon.tjhtpp.wang www.amazon.tjhtpp.wang	12 KB
1	qqqczb8.top accountupdate.amazon.qqqczb8.top	16 KB
13	4

	Domain	Requested by
7	cdnjs.cloudflare.com	www.amazon.tjhtpp.wang
4	images-na.ssl-images-amazon.com	www.amazon.tjhtpp.wang
1	www.amazon.tjhtpp.wang	accountupdate.amazon.qqqczb8.top
1	amazon.tjhtpp.wang	1 redirects
1	accountupdate.amazon.qqqczb8.top
13	5

This site contains no links.

Subject Issuer	Validity	Valid
accountupdate.amazon.srhjpj.wang Let's Encrypt Authority X3	`2020-10-31` - `2021-01-29`	3 months	crt.sh
amazon.qjhgpz.wang Let's Encrypt Authority X3	`2020-10-31` - `2021-01-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2020-09-16` - `2021-09-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.amazon.tjhtpp.wang/
Frame ID: D17546159D704C2063F7BF9BFE71444B
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://accountupdate.amazon.qqqczb8.top/ Page URL
https://amazon.tjhtpp.wang/ HTTP 301
https://www.amazon.tjhtpp.wang/ Page URL

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

50 kB
Transfer

118 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://accountupdate.amazon.qqqczb8.top/ Page URL
https://amazon.tjhtpp.wang/ HTTP 301
https://www.amazon.tjhtpp.wang/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
accountupdate.amazon.qqqczb8.top/ 20 KB
16 KB 1578ms
326ms Document
text/html 137.220.137.125
BCPL-SG BGPNET Gl...

General

Check archive.org

Show headers Download Go to

Full URL

https://accountupdate.amazon.qqqczb8.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.220.137.125 , Cambodia, ASN64050 (BCPL-SG BGPNET Global ASN, SG),

Reverse DNS

Software

openresty/1.15.8.1 /

Resource Hash

5d3af25baf098e6200f03204e3025fc5ceefb28b19f1e3c5246cbf575addb5f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Host: accountupdate.amazon.qqqczb8.top
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: openresty/1.15.8.1
Date: Sun, 01 Nov 2020 09:58:43 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7af9039026d259aa4649a5b1f3d6dadce932241441a7cd899db50e72283197e6

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1

200
OK

Primary Request / Show response
www.amazon.tjhtpp.wang/
Redirect Chain

https://amazon.tjhtpp.wang/
https://www.amazon.tjhtpp.wang/

15 KB
11 KB

2793ms
1579ms

Document
text/html

137.220.137.122
BCPL-SG BGPNET Gl...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.amazon.tjhtpp.wang/

Requested by

Host: accountupdate.amazon.qqqczb8.top
URL: https://accountupdate.amazon.qqqczb8.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

137.220.137.122 , Cambodia, ASN64050 (BCPL-SG BGPNET Global ASN, SG),

Reverse DNS

Software

openresty/1.15.8.1 /

Resource Hash

2b10e7108a3eee4bb53ca2370b75270a445be15703f3e1dfebae415c93890a9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Host: www.amazon.tjhtpp.wang
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://accountupdate.amazon.qqqczb8.top/

Response headers

Server: openresty/1.15.8.1
Date: Sun, 01 Nov 2020 09:58:50 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-amz-rid: D2RQ55TJ4FGA9B8YPK5D
vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
x-cache: Miss from cloudfront
via: 1.1 f53dc6828a13e140b658618bb5b5769c.cloudfront.net (CloudFront)
x-amz-cf-pop: OTP50-C1
x-amz-cf-id: C9YdnoHT8_gqpngWaFj0qTPIIXlgMqd8nCIgSFLL6wflZEVWPKRWzg==
x-anyproxy-origin-content-length: 2337
x-anyproxy-origin-content-encoding: gzip
x-anyproxy-origin-connection: close
Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip

Redirect headers

Server: openresty/1.15.8.1
Date: Sun, 01 Nov 2020 09:58:47 GMT
Content-Type: text/html
Content-Length: 8799
Connection: keep-alive
location: https://www.amazon.tjhtpp.wang/
x-anyproxy-origin-content-length: 179
x-anyproxy-origin-connection: close
Strict-Transport-Security: max-age=15724800; includeSubDomains

GET
H2 200 core.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ 4 KB
2 KB 21ms
18ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80d0635fe9783bec07a43419deb4e9969bf30a78f008386826c9723b7651f43c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://www.amazon.tjhtpp.wang/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 226161
x-via: cfworker/kv
status: 200
content-length: 1387
cf-request-id: 0624d7dd2300000605c93ca000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
etag: "5eb03e2d-f33"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7%2FPWHxRu9ILGME5alY%2BpcH2Am3PwaUHblb1Wd8dK8WB65Jnr44QtMO0hDD1mLGo8%2BfjJksIuSp7yM7lsjvaw%2BIswtVJuKjG1N%2FG4XkVFKzvBIK3mS0MGENyNsrx1QaruKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2750ba60605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 enc-base64.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ 1023 B
883 B 22ms
19ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/enc-base64.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3636a8a79dc6de7502ce35d07bb99a7afc1a00b796fc51fa6a3541dbe55161e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://www.amazon.tjhtpp.wang/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 903885
x-via: cfworker/kv
status: 200
content-length: 563
cf-request-id: 0624d7dd2200000605c022b000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
etag: "5eb03e2d-3ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jJpHqMb9545G0ZLx1VuooAs9IyMzGh3m%2B5WBjAvCYlRQ7qqo04T6ajPfKWgssn0MJCiABOjxJgRXmosVpTHddim35aLjAndBhJgvfFx5BtM00pb97w%2BJxGXTp%2FMWLFgVDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2750bab0605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 md5.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ 3 KB
1 KB 18ms
16ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/md5.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d7d23e660105f53d95b2362ffb198bfb1b6ec144146598d2971db1afe1f5188

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://www.amazon.tjhtpp.wang/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 220547
x-via: cfworker/kv
status: 200
content-length: 1069
cf-request-id: 0624d7dd2200000605ae30b000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
etag: "5eb03e2d-c78"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=s1jZcTNP11wOTq0QmEjt5YWaAucvD6Ah4X4atT8ntl2lggPq6DptKntf%2FFAChLy2nuGpN9C9JZ4N0nHzRetC7GDBYoZRqG%2FkXqgZq1khZUKulYqZJptUOQ4ReZlDLhjKkg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2750bad0605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 evpkdf.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ 752 B
709 B 20ms
17ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/evpkdf.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39a15249cda5dcf5002d51c374b39e4bcd241ff127452be23201ca1eb8db99d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://www.amazon.tjhtpp.wang/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 911323
x-via: cfworker/kv
status: 200
content-length: 386
cf-request-id: 0624d7dd2200000605b132d000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
etag: "5eb03e2d-2f0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iSGU%2BEsZnXFTVTTun1DWV%2BintNQ5eV4imLla9pNRMgZpb5et1s%2FK98WAIUGn8oJiui3MWCKTIxAv6CRvm6ZBAp%2B3LxOPrO2SsSI0PDGBTGRz2oGcP84Wgy%2Ba6PM5ZlBeTw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2750baf0605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 cipher-core.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ 4 KB
2 KB 26ms
24ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/cipher-core.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63b4955b08a7e94d15615f3c8ed80677acf7a21306f88327df0e2f97cbd3bc3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://www.amazon.tjhtpp.wang/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 911323
x-via: cfworker/kv
status: 200
content-length: 1448
cf-request-id: 0624d7dd2200000605b7b23000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
etag: "5eb03e2d-1064"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lPQj5hVYOYknnA%2BbSea23e68DCv62TGgGn7YB%2B9NyVTD0CKl0TqQCqJmyYgBm7Mz%2BQ0MacEg4L%2B%2B%2BYPULWlJUor6VrNt8z8Z0ank4hBMnBsCQEPVWASTngS1eMzoa9s8bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2750bb10605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 aes.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ 2 KB
1 KB 18ms
17ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/aes.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d2324da115b05d11b9876e759bb7bd2589fa772abde237c9dbdb572f6e2d5fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: https://www.amazon.tjhtpp.wang/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 912864
x-via: cfworker/kv
status: 200
content-length: 958
cf-request-id: 0624d7dd2200000605b80a9000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
etag: "5eb03e2d-960"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5eqBlKM3wPDsf2ft1uX4o%2BdOpwLL0NGSQlhqV5E1oc%2FI%2Btbuoh5tfaKzb6I3B3wIC2ukSVkWkxyEIiB1uKzJkWZ%2BEFJHPf%2BKP%2BXx5PwkOaIRtc4AhAPCtMbq5jNhkmv6qQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2750bb30605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 error-styles-ssl._CB244707579_.css
images-na.ssl-images-amazon.com/images/G/09/x-locale/common/errors-alerts/ 2 KB
765 B 103ms
101ms Stylesheet
text/css 2a04:4e42:1b::272
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://images-na.ssl-images-amazon.com/images/G/09/x-locale/common/errors-alerts/error-styles-ssl._CB244707579_.css
Requested by: Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05df8fd5cc0159af12601955c2b8be4657b7f0aa0e04339cacd83b2d29cfd571

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: gzip
age: 2221
x-cache: HIT from fastly, HIT from fastly
status: 200
content-length: 618
x-served-by: cache-dca17755-DCA, cache-hhn4069-HHN
last-modified: Thu, 16 Apr 2009 22:16:12 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=3600,public
x-amz-ir-id: 4d65532e-cfa3-4eb9-bdfe-8ba18be6d7e9
accept-ranges: bytes
timing-allow-origin: https://www.amazon.co.jp
expires: Sat, 31 Oct 2020 12:07:00 GMT

GET
H2 200 ap_global._CB350102798_.css
images-na.ssl-images-amazon.com/images/G/09/authportal/common/css/ 35 KB
7 KB 95ms
93ms Stylesheet
text/css 2a04:4e42:1b::272
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://images-na.ssl-images-amazon.com/images/G/09/authportal/common/css/ap_global._CB350102798_.css
Requested by: Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 877f02375bb11651eac028c7e20ee8b5ad0418a026d82d31c21f8606818f242d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: gzip
age: 342
x-cache: HIT from fastly, HIT from fastly
status: 200
content-length: 6729
x-served-by: cache-dca17741-DCA, cache-hhn4069-HHN
last-modified: Thu, 26 Jun 2014 19:11:32 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=3600,public
x-amz-ir-id: 231f0089-7742-44b2-a921-6f9d21ae0561
accept-ranges: bytes
timing-allow-origin: https://www.amazon.co.jp
expires: Sat, 31 Oct 2020 21:49:20 GMT

GET
H2 200 axios.min.js Show response
cdnjs.cloudflare.com/ajax/libs/axios/0.19.0/ 13 KB
5 KB 15ms
14ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/axios/0.19.0/axios.min.js

Requested by

Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b52781951c70cc8a2ae2afdaac5d673c656c3be0f1c769fa6c1e9e4f5ed8d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 227949
x-via: cfworker/kv
status: 200
content-length: 4224
cf-request-id: 0624d7deac00000605bf87e000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:06:02 GMT
server: cloudflare
etag: "5eb03d6a-3580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fTopJ7Jr9hrWXqFZCqsB60lE1iAnhqvd1FSGLbgIlIbJ3xh2QmKlDDLCzh%2BVVqdNgEz4LKuCU66HMeobIY%2FI2rAZdDL22aZNDb%2BcFxTFEUbxTL9Hf036G6Wgi7djg29TUw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5eb4c2777b2e0605-FRA
expires: Fri, 22 Oct 2021 09:58:50 GMT

GET
H2 200 amazon-logo._CB192194110_.gif
images-na.ssl-images-amazon.com/images/G/09/x-locale/common/ 3 KB
3 KB 7ms
6ms Image
image/gif 2a04:4e42:1b::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-na.ssl-images-amazon.com/images/G/09/x-locale/common/amazon-logo._CB192194110_.gif
Requested by: Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 491d82104f53a2fdee64aa0ad2a11ec2a64eae49b3f3353792123382e89f323d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
last-modified: Thu, 03 Jun 2010 00:12:04 GMT
age: 1371
status: 200
x-cache: HIT from fastly, HIT from fastly
content-type: image/gif
access-control-allow-origin: *
expires: Sat, 31 Oct 2020 23:19:10 GMT
cache-control: max-age=3600,public
x-amz-ir-id: 02eec782-37cf-4016-ab42-2e24295e513b
accept-ranges: bytes
timing-allow-origin: https://www.amazon.co.jp
content-length: 3171
x-served-by: cache-dca17758-DCA, cache-hhn4069-HHN

GET
H2 200 orange-arrow._CB192261655_.gif
images-na.ssl-images-amazon.com/images/G/09/x-locale/common/ 53 B
169 B 98ms
97ms Image
image/gif 2a04:4e42:1b::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-na.ssl-images-amazon.com/images/G/09/x-locale/common/orange-arrow._CB192261655_.gif
Requested by: Host: www.amazon.tjhtpp.wang
URL: https://www.amazon.tjhtpp.wang/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a92668456089fbfdf2a4b8e3345f264e063c5d9163b92b06b9be7c67bda2e843

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 01 Nov 2020 09:58:50 GMT
last-modified: Sun, 16 May 2010 04:33:24 GMT
age: 342
status: 200
x-cache: HIT from fastly, HIT from fastly
content-type: image/gif
access-control-allow-origin: *
expires: Sat, 31 Oct 2020 21:49:20 GMT
cache-control: max-age=3600,public
x-amz-ir-id: 22602a41-c93a-4a4e-b4d2-c6b755b66abf
accept-ranges: bytes
timing-allow-origin: https://www.amazon.co.jp
content-length: 53
x-served-by: cache-dca17725-DCA, cache-hhn4069-HHN

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accountupdate.amazon.qqqczb8.top
amazon.tjhtpp.wang
cdnjs.cloudflare.com
images-na.ssl-images-amazon.com
www.amazon.tjhtpp.wang
137.220.137.122
137.220.137.125
2606:4700::6810:135e
2a04:4e42:1b::272
05df8fd5cc0159af12601955c2b8be4657b7f0aa0e04339cacd83b2d29cfd571
1d7d23e660105f53d95b2362ffb198bfb1b6ec144146598d2971db1afe1f5188
2b10e7108a3eee4bb53ca2370b75270a445be15703f3e1dfebae415c93890a9b
39a15249cda5dcf5002d51c374b39e4bcd241ff127452be23201ca1eb8db99d6
491d82104f53a2fdee64aa0ad2a11ec2a64eae49b3f3353792123382e89f323d
4b52781951c70cc8a2ae2afdaac5d673c656c3be0f1c769fa6c1e9e4f5ed8d3b
5d3af25baf098e6200f03204e3025fc5ceefb28b19f1e3c5246cbf575addb5f4
63b4955b08a7e94d15615f3c8ed80677acf7a21306f88327df0e2f97cbd3bc3b
7af9039026d259aa4649a5b1f3d6dadce932241441a7cd899db50e72283197e6
80d0635fe9783bec07a43419deb4e9969bf30a78f008386826c9723b7651f43c
877f02375bb11651eac028c7e20ee8b5ad0418a026d82d31c21f8606818f242d
9d2324da115b05d11b9876e759bb7bd2589fa772abde237c9dbdb572f6e2d5fe
a3636a8a79dc6de7502ce35d07bb99a7afc1a00b796fc51fa6a3541dbe55161e
a92668456089fbfdf2a4b8e3345f264e063c5d9163b92b06b9be7c67bda2e843

www.amazon.tjhtpp.wang Open in urlscan Pro 137.220.137.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

50 kBTransfer

118 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.amazon.tjhtpp.wang Open in urlscan Pro
137.220.137.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

50 kB
Transfer

118 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!