auth-identfamz58722398signin9812.com Open in urlscan Pro
162.240.169.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://auth-identfamz58722398signin9812.com/
Effective URL:
https://auth-identfamz58722398signin9812.com/
Submission Tags: scythethephish
Submission: On May 17 via api (May 17th 2024, 9:49:17 pm UTC) from RO — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 162.240.169.156, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is auth-identfamz58722398signin9812.com.
TLS certificate: Issued by R3 on May 14th 2024. Valid for: 3 months.

This is the only time auth-identfamz58722398signin9812.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon Japan (Online) Amazon (Online)

Domain & IP information

	IP Address		AS Autonomous System
12	162.240.169.156 162.240.169.156		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
12	1

12 162.240.169.156 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-240-169-156.unifiedlayer.com

auth-identfamz58722398signin9812.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	auth-identfamz58722398signin9812.com auth-identfamz58722398signin9812.com	562 KB
12	1

	Domain	Requested by
12	auth-identfamz58722398signin9812.com	auth-identfamz58722398signin9812.com
12	1

This site contains no links.

Subject Issuer	Validity	Valid
auth-identfamz58722398signin9812.com R3	`2024-05-14` - `2024-08-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://auth-identfamz58722398signin9812.com/
Frame ID: B05577FF924576A3ACD3F4FF87AAC0EF
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign-in

Page URL History Show full URLs

http://auth-identfamz58722398signin9812.com/ HTTP 307
https://auth-identfamz58722398signin9812.com/ Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

562 kB
Transfer

555 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://auth-identfamz58722398signin9812.com/ HTTP 307
https://auth-identfamz58722398signin9812.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
auth-identfamz58722398signin9812.com/
Redirect Chain

http://auth-identfamz58722398signin9812.com/
https://auth-identfamz58722398signin9812.com/

3 KB
4 KB

2366ms
1998ms

Document
text/html

162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Access-Control-Allow-Methods: POST, OPTIONS, GET
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 17 May 2024 21:49:09 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Redirect headers

Location: https://auth-identfamz58722398signin9812.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK main.5b4ecdfc.chunk.css
auth-identfamz58722398signin9812.com/static/css/ 103 KB
103 KB 176ms
176ms Stylesheet
text/css 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:11 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 105323
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK 3.4ee97899.chunk.js Show response
auth-identfamz58722398signin9812.com/static/js/ 247 KB
248 KB 527ms
177ms Script
application/javascript 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/js/3.4ee97899.chunk.js

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:11 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 253097
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK main.1082ca0f.chunk.js Show response
auth-identfamz58722398signin9812.com/static/js/ 55 KB
56 KB 528ms
178ms Script
application/javascript 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/js/main.1082ca0f.chunk.js

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

d06182ce5527252e06c54adb2ce5fa5dfe93a8a510f0820ef817481ea5717c17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:11 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 56418
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

POST
H/1.1 200
OK supply Show response
auth-identfamz58722398signin9812.com/api/ 2 KB
2 KB 186ms
185ms XHR
text/html 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/api/supply

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

b07d6d8f91af1f224a60acaa856438e183d0d8cee337df4d63b74da50bc3b637

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept: application/json, text/plain, */*
Referer: https://auth-identfamz58722398signin9812.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=99
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK pDxWAF1pBB0dzGB.2c1d70d6.woff2
auth-identfamz58722398signin9812.com/static/media/ 16 KB
17 KB 293ms
180ms Font
font/woff2 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/media/pDxWAF1pBB0dzGB.2c1d70d6.woff2

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css
Origin: https://auth-identfamz58722398signin9812.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16616
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

POST
H/1.1 200
OK ping Show response
auth-identfamz58722398signin9812.com/api/ 2 B
544 B 693ms
693ms XHR
text/html 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/api/ping

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://auth-identfamz58722398signin9812.com/ap/signin?session=50q3tmlo0z8qpv36069fwltr74g1v398m6pirnsh7sxglr2urxoxxqvj6lbl5way
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=99
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 0.c8f46ac8.chunk.js Show response
auth-identfamz58722398signin9812.com/static/js/ 22 KB
23 KB 178ms
178ms Script
application/javascript 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/js/0.c8f46ac8.chunk.js

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/ap/signin?session=50q3tmlo0z8qpv36069fwltr74g1v398m6pirnsh7sxglr2urxoxxqvj6lbl5way
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 22750
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK 13.d414ac36.chunk.js Show response
auth-identfamz58722398signin9812.com/static/js/ 13 KB
14 KB 355ms
176ms Script
application/javascript 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/js/13.d414ac36.chunk.js

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/ap/signin?session=50q3tmlo0z8qpv36069fwltr74g1v398m6pirnsh7sxglr2urxoxxqvj6lbl5way
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 13782
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

GET
H/1.1 200
OK main.d33128ec.png
auth-identfamz58722398signin9812.com/static/media/ 60 KB
61 KB 176ms
176ms Image
image/png 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth-identfamz58722398signin9812.com/static/media/main.d33128ec.png

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 61917
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=96

GET
H/1.1 200
OK KFPk-9IF4FqAqY-.4de52a40.woff2
auth-identfamz58722398signin9812.com/static/media/ 16 KB
17 KB 176ms
176ms Font
font/woff2 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/static/media/KFPk-9IF4FqAqY-.4de52a40.woff2

Requested by

Host: auth-identfamz58722398signin9812.com
URL: https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/static/css/main.5b4ecdfc.chunk.css
Origin: https://auth-identfamz58722398signin9812.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16460
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

GET
H/1.1 200
OK favicon.ico
auth-identfamz58722398signin9812.com/ 17 KB
18 KB 172ms
172ms Other
image/x-icon 162.240.169.156
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth-identfamz58722398signin9812.com/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.240.169.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

162-240-169-156.unifiedlayer.com

Software

Apache /

Resource Hash

17d02e2db6dbedb95dd449d06868c147ac2c3b5371497bcb9407e75336a99e09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://auth-identfamz58722398signin9812.com/ap/signin?session=50q3tmlo0z8qpv36069fwltr74g1v398m6pirnsh7sxglr2urxoxxqvj6lbl5way
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 21:49:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 14 May 2024 20:48:22 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: image/x-icon
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 17542
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon Japan (Online) Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonpa

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			auth-identfamz58722398signin9812.com/	1970-01-20 20:39:46	Name: session Value: N4B5Jb237qtppkXppiaAh4NDmy7Wf5Qz
			auth-identfamz58722398signin9812.com/	1970-01-20 20:39:46	Name: language Value: de

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://auth-identfamz58722398signin9812.com/static/js/main.1082ca0f.chunk.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth-identfamz58722398signin9812.com
162.240.169.156
17d02e2db6dbedb95dd449d06868c147ac2c3b5371497bcb9407e75336a99e09
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e
837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a
aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02
b07d6d8f91af1f224a60acaa856438e183d0d8cee337df4d63b74da50bc3b637
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
d06182ce5527252e06c54adb2ce5fa5dfe93a8a510f0820ef817481ea5717c17
d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977
e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743

auth-identfamz58722398signin9812.com Open in urlscan Pro 162.240.169.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

562 kBTransfer

555 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

2 Cookies

1 Console Messages

Security Headers

Indicators

auth-identfamz58722398signin9812.com Open in urlscan Pro
162.240.169.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

562 kB
Transfer

555 kB
Size

2
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!