URL: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Submission: On January 27 via automatic, source openphish — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 184.168.119.143, located in Singapore, Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is amaz.tomokazukamai.icu.
This is the only time amaz.tomokazukamai.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
7 184.168.119.143 26496 (AS-26496-...)
7 1
Apex Domain
Subdomains
Transfer
7 tomokazukamai.icu
amaz.tomokazukamai.icu
110 KB
7 1
Domain Requested by
7 amaz.tomokazukamai.icu amaz.tomokazukamai.icu
7 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Frame ID: FACFDB5A86733E2613DF1931D5181B66
Requests: 7 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

110 kB
Transfer

416 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request signin.php?country=gb-united+kingdom&lang=en
amaz.tomokazukamai.icu/a/ap/
3 KB
1 KB
Document
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache / PHP/7.4.26
Resource Hash
8df4883ecf49a77b44163df21d1719cf3b9729a03de0f7b79858f33707c591f8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Thu, 27 Jan 2022 13:22:44 GMT
Server
Apache
X-Powered-By
PHP/7.4.26
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1128
Keep-Alive
timeout=5
Content-Type
text/html; charset=UTF-8
main.min.css
amaz.tomokazukamai.icu/a/ap/library/bootstrap/css/
141 KB
20 KB
Stylesheet
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/library/bootstrap/css/main.min.css
Requested by
Host: amaz.tomokazukamai.icu
URL: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
c4b6ed2645519ec2c128badb2a2e7720052f8441ffa94c4f0bceca02311004da

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Thu, 27 Jan 2022 13:22:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 May 2018 21:25:54 GMT
Server
Apache
ETag
"4d61617-235f3-56bcc8c3f1c80-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
20565
index.css
amaz.tomokazukamai.icu/a/ap/sheets/
4 KB
2 KB
Stylesheet
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/sheets/index.css
Requested by
Host: amaz.tomokazukamai.icu
URL: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
66e730aff72788bb008ddacd2fc467613011a49613e751a51594e5f549d836a2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Thu, 27 Jan 2022 13:22:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Jul 2020 20:06:20 GMT
Server
Apache
ETag
"4d615a3-1175-5a97af11f0700-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
1276
main.min.js
amaz.tomokazukamai.icu/a/ap/library/jquery/
148 KB
38 KB
Script
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/library/jquery/main.min.js
Requested by
Host: amaz.tomokazukamai.icu
URL: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
38ffe02b7083d0d0a7eb50ced86cf2f56f42066151078457e4d37e1139d76717

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Thu, 27 Jan 2022 13:22:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 10:55:58 GMT
Server
Apache
ETag
"4d615d2-24e18-5add9c7f84b80-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
38962
main.min.js
amaz.tomokazukamai.icu/a/ap/library/pooper/
28 KB
8 KB
Script
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/library/pooper/main.min.js
Requested by
Host: amaz.tomokazukamai.icu
URL: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
fa25824ecd6e226af5f42b7fa1a377f11768d958acb5bbf8c38f21a4ae77edde

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Thu, 27 Jan 2022 13:22:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 10:55:32 GMT
Server
Apache
ETag
"4d615de-6ebc-5add9c66b9100-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
7677
main.min.js
amaz.tomokazukamai.icu/a/ap/library/bootstrap/js/
67 KB
14 KB
Script
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/library/bootstrap/js/main.min.js
Requested by
Host: amaz.tomokazukamai.icu
URL: http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
6778e1c02adde018f442ea27a4542f75f10e56035ac315cac633d47fb640d704

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://amaz.tomokazukamai.icu/a/ap/signin.php?country=gb-united+kingdom&lang=en
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Thu, 27 Jan 2022 13:22:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 27 Aug 2020 11:00:04 GMT
Server
Apache
ETag
"4d6161a-10b4d-5add9d6a1f500-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
14498
amazonui.png
amaz.tomokazukamai.icu/a/ap/assets/img/
26 KB
26 KB
Image
General
Full URL
http://amaz.tomokazukamai.icu/a/ap/assets/img/amazonui.png
Requested by
Host: amaz.tomokazukamai.icu
URL: http://amaz.tomokazukamai.icu/a/ap/sheets/index.css
Protocol
HTTP/1.1
Server
184.168.119.143 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-184-168-119-143.ip.secureserver.net
Software
Apache /
Resource Hash
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://amaz.tomokazukamai.icu/a/ap/sheets/index.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date
Thu, 27 Jan 2022 13:22:45 GMT
Last-Modified
Wed, 05 Aug 2020 20:01:36 GMT
Server
Apache
ETag
"4d615e4-6607-5ac26d6cc4800"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
26119

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies