urlscan.io logo urlscan.io
SecurityTrails logo

autodiscov.d3qqe7qrcm2509.amplifyapp.com Open in urlscan Pro
65.8.20.107  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/
Submission: On July 23 via automatic, source phishtank — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 65.8.20.107, located in United States and belongs to AMAZON-02, US. The main domain is autodiscov.d3qqe7qrcm2509.amplifyapp.com.
TLS certificate: Issued by Amazon RSA 2048 M03 on July 22nd 2024. Valid for: a year.
This is the only time autodiscov.d3qqe7qrcm2509.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 3 65.8.20.107 16509 (AMAZON-02)
2 2
Apex Domain
Subdomains		 Transfer
3 amplifyapp.com
autodiscov.d3qqe7qrcm2509.amplifyapp.com
59 KB
2 1
Domain Requested by
3 autodiscov.d3qqe7qrcm2509.amplifyapp.com 1 redirects autodiscov.d3qqe7qrcm2509.amplifyapp.com
2 1

This site contains links to these domains. Also see Links.

Domain
office.com
Subject Issuer Validity Valid
*.d3qqe7qrcm2509.amplifyapp.com
Amazon RSA 2048 M03		 2024-07-22 -
2025-08-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/
Frame ID: 89C07C32140821B07AB65F006F4A1E83
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outlook Web App

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

59 kB
Transfer

246 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/& HTTP 301
  • https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/&/

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
autodiscov.d3qqe7qrcm2509.amplifyapp.com/ 		221 KB
54 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.8.20.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-8-20-107.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2eadab7b2a5466b1c96fff804ae1675fab4873bd1c08b2938c18ff968e47bf20

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, s-maxage=2
content-encoding
br
content-type
text/html
date
Tue, 23 Jul 2024 05:43:59 GMT
etag
W/"c76eca8eae0da2b176e632d09d832dc0"
last-modified
Mon, 22 Jul 2024 06:38:39 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 a5b4cf1adb73fe635c9ad54a1ed17d0c.cloudfront.net (CloudFront)
x-amz-cf-id
s1GZmD7Ew_modPuJp8IEwJV17PQLnVoSd_vB2p3ZB4nC6wCUuP1f4A==
x-amz-cf-pop
BOS50-C3
x-cache
Miss from cloudfront
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
/
autodiscov.d3qqe7qrcm2509.amplifyapp.com/&/
Redirect Chain
  • https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/&
  • https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/&/
5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/&/
Requested by
Host: autodiscov.d3qqe7qrcm2509.amplifyapp.com
URL: https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/
Protocol
H2
Server
65.8.20.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-8-20-107.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5065e94491e69744d9d0f133facb721f276c6df86ce890426f9d93bba54c2987

Request headers

Referer
https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 23 Jul 2024 05:43:59 GMT
content-encoding
br
via
1.1 a5b4cf1adb73fe635c9ad54a1ed17d0c.cloudfront.net (CloudFront)
last-modified
Mon, 22 Jul 2024 06:38:39 GMT
server
AmazonS3
x-amz-cf-pop
BOS50-C3
etag
W/"c76eca8eae0da2b176e632d09d832dc0"
vary
Accept-Encoding
x-cache
Error from cloudfront
content-type
text/html
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
j1RgDMEe22YqA49msAY6eEYMtAle4REH4WyZMwnRzGZbX-rvGsRIeg==

Redirect headers

date
Tue, 23 Jul 2024 05:43:59 GMT
via
1.1 a5b4cf1adb73fe635c9ad54a1ed17d0c.cloudfront.net (CloudFront)
server
AmazonS3
x-amz-cf-pop
BOS50-C3
x-cache
Miss from cloudfront
location
/&/
alt-svc
h3=":443"; ma=86400
content-length
0
x-amz-cf-id
SM9sb5XyF5VqDj3lcpPhJTCUxhr202O7DUjiYvN8YHSYd_R0xCPOUQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x2c1fb8 function| _0x1989 function| _0x35ad35 function| _0x12759a function| _0x2f9d20 function| _0x25b327 function| _0xb0338c function| _0x30a695 function| _0x46e77e function| _0x3b76ad function| _0x339421 object| emailInput function| _0x6dd6c function| _0x589d43 object| passwordInput string| ssss function| _0x187597 function| ValidateEmail function| _0x1946f4 function| _0x57abe5 function| _0xba92f3 function| redirrectPage function| _0x5b8a22 number| counter function| _0x1db9 function| _0x20f9b4 function| _0xb7364e function| _0x5c4b9a

0 Cookies

2 Console Messages

Source Level URL
Text
recommendation verbose URL: https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network error URL: https://autodiscov.d3qqe7qrcm2509.amplifyapp.com/&/#39;data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAANvCAYAAADk40vJAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAA+VpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEzNDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczpkYz0iaHR0cDovL3B1cmwub3JnL2RjL2VsZW1lbnRzLzEuMS8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M1IFdpbmRvd3MiIHhtcDpDcmVhdGVEYXRlPSIyMDEyLTA1LTE1VDEzOjEwOjU5LTA3OjAwIiB4bXA6TW9kaWZ5RGF0ZT0iMjAxMi0wNS0xNVQxMzoxMTo0Ni0wNzowMCIgeG1wOk1ldGFkYXRhRGF0ZT0iMjAxMi0wNS0xNVQxMzoxMTo0Ni0wNzowMCIgZGM6Zm9ybWF0PSJpbWFnZS9wbmciIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6MzI2NTAzNjQ5RUNBMTFFMUFBNkRCNDc2QzU0RjhERUYiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6MzI2NTAzNjU5RUNBMTFFMUFBNkRCNDc2QzU0RjhERUYiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDozMjY1MDM2MjlFQ0ExMUUxQUE2REI0NzZDNTRGOERFRiIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDozMjY1MDM2MzlFQ0ExMUUxQUE2REI0NzZDNTRGOERFRiIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PnYK5fsAAAFLSURBVHja7NthDoIwDAZQNN7/vCTKKifQgZh12yPx30uG/bqyGLyt6xpLxXVfKi8QBEEQBEEQBEEQBEEQBEEQBEEQBEEQBEEQBEEQBMFh4WP/ePUSBEEQBEHQIQ4EQRA0cUHQdgVBe0Z5QN0Dalx1lAwoGcmAklEeyShP2/I8QlNoCuWRzJXlCeXRuGfvMSSjcX1rjat7NK6llUcyyqM8kvlh6X3dIhmNe2pp5ZGMpQ8nE8qT9R6LZFLeY0xYHnvm69G1h/NjmXJpjWukSGa4ZGIzUpI+C3vYMzM+C6Nu6XmH/XwjpZc9I5mkwz6K8iRtXMlI5mwy0TKZV/Zhf/kZd6g903akxJyN28Ow3ySTdKQ0SyZajpRyKfzPr1wNG3czUj5t1x6G/TbhSKlMZqiRcuhk365xI/2wj6aN+0y+Z25R98LQWH8QeQswAHk7x/k/TxxLAAAAAElFTkSuQmCC'
Message:
Failed to load resource: the server responded with a status of 404 ()