main.d1r5epmaoyt6i9.amplifyapp.com Open in urlscan Pro
18.64.79.67 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/=
Submission Tags: demotag1 demotag2 Search All
Submission: On January 23 via api (January 23rd 2022, 8:42:41 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 18.64.79.67, located in United States and belongs to AMAZON-02, US. The main domain is main.d1r5epmaoyt6i9.amplifyapp.com.
TLS certificate: Issued by Amazon on January 17th 2022. Valid for: a year.

This is the only time main.d1r5epmaoyt6i9.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 9	18.64.79.67 18.64.79.67		16509 (AMAZON-02) (AMAZON-02)
8	1

9 18.64.79.67 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-64-79-67.txl50.r.cloudfront.net

main.d1r5epmaoyt6i9.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	amplifyapp.com 1 redirects main.d1r5epmaoyt6i9.amplifyapp.com	27 KB
8	1

	Domain	Requested by
9	main.d1r5epmaoyt6i9.amplifyapp.com	1 redirects main.d1r5epmaoyt6i9.amplifyapp.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid
*.d1r5epmaoyt6i9.amplifyapp.com Amazon	`2022-01-17` - `2023-02-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/=
Frame ID: 3A51A8F60455A9FF8026C64E4980797A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Wells Fargo Online Banking Security Verification

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

35 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png HTTP 301
https://main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png/

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request inner_pag.html Show response main.d1r5epmaoyt6i9.amplifyapp.com/	4 KB 2 KB	188ms 143ms	Document text/html	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `4eddf5bb03728fe2ac2d56e0e286d6b979833e00fd465013905c9633fa6d4fd2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html date Sun, 23 Jan 2022 20:42:36 GMT last-modified Mon, 17 Jan 2022 11:39:58 GMT x-amz-server-side-encryption AES256 server AmazonS3 cache-control no-cache, s-maxage=2 content-encoding gzip etag W/"a6406b9e0d117e05661a737e3cb03af4" vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) x-amz-cf-pop TXL50-P2 x-amz-cf-id sAzDZaHrP-N6diLMRnoRerERMZGhAZKoow4gd24vwFC0vRwNs8qkJg==
GET H2	200	style.css main.d1r5epmaoyt6i9.amplifyapp.com/css/	10 KB 2 KB	231ms 231ms	Stylesheet text/css	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `0d8f592d3aef440e69bc1b0c002930689e3334eb1f29206b021044e39a6d3dce` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sun, 23 Jan 2022 20:42:37 GMT content-encoding gzip etag W/"f5e73da88692d257c3aec5d79bf01454" last-modified Mon, 17 Jan 2022 11:39:58 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache RefreshHit from cloudfront content-type text/css via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) cache-control no-cache, s-maxage=2 x-amz-cf-id 9s86Vxtov-RH8DKwn9AyTDm30LEqv4G9nb75MQQ_yEoOtwm_UFAWSg==
GET H2	200	logo.jpg main.d1r5epmaoyt6i9.amplifyapp.com/images/	12 KB 13 KB	351ms 351ms	Image image/jpeg	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/images/logo.jpg Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `6a4c9bda55c400bcf557984c93d42375a390367bd171727ca75ba5207e43d919` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 23 Jan 2022 20:42:37 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) last-modified Mon, 17 Jan 2022 11:39:58 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 etag "87673e142907da15d749c074f102e286" x-cache RefreshHit from cloudfront content-type image/jpeg cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 12523 x-amz-cf-id N5Vj5wyYIN3KFmwbkM6iO4WJd2bE0L13mXug6XBiar7I7Us4wA3QBQ==
GET H2	200	icon3.png main.d1r5epmaoyt6i9.amplifyapp.com/images/	1 KB 1 KB	138ms 138ms	Image image/png	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/images/icon3.png Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `69f44920ee566a8cb7fe4a97463c5cd363e5b56ce883da11b29a5f5a3d4ef35b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 23 Jan 2022 20:42:37 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) last-modified Mon, 17 Jan 2022 11:39:58 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 etag "b1f2220d162273cc35f3458ad747f019" x-cache RefreshHit from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 1108 x-amz-cf-id x92FLBOciyOecQLEUVg-ANmuf-YmDBpAvvQYeupljHgAOzECbnu12Q==
GET H2	404	/ main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png/ Redirect Chain https://main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png https://main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png/	133 B 133 B	123ms 123ms	Image text/html	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png/ Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css Protocol H2 Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sun, 23 Jan 2022 20:42:36 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop TXL50-P2 x-cache Error from cloudfront content-type text/html content-length 133 x-amz-cf-id QTJBWQL0UHOVIem5Endc6WlKNhXBs86Ti46X2TNObMiwxSF_ZBDzjA== Redirect headers date Sun, 23 Jan 2022 20:42:36 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop TXL50-P2 x-cache Error from cloudfront content-type application/xml location /images/bg_top.png/ content-length 0 x-amz-cf-id 8PybSjnC3_DUyiYPtz38trU749kwN1vo7vdja9XghntfKNjn70swfw==
GET H2	200	img1.png main.d1r5epmaoyt6i9.amplifyapp.com/images/	3 KB 3 KB	127ms 126ms	Image image/png	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/images/img1.png Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `499f5e44488bef9456f38b42790051343e8abffdd38cfae4599ecc2ac7c82e47` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 23 Jan 2022 20:42:37 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) last-modified Mon, 17 Jan 2022 11:39:58 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 etag "abacf27a0408017dd0969bcee925e0e6" x-cache RefreshHit from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 3072 x-amz-cf-id NFV2YxdcdlZIlWmwY6Sm_M5K3tD_dgWDVDeghQPxjwuLP6GeMge-Qg==
GET H2	200	img2.png main.d1r5epmaoyt6i9.amplifyapp.com/images/	3 KB 3 KB	511ms 510ms	Image image/png	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/images/img2.png Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `d12f68075437ba046b2dc85e53dc081f9c11669d25f5d04c7d985851aff31d65` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 23 Jan 2022 20:42:37 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) last-modified Mon, 17 Jan 2022 11:39:58 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 etag "64693f6ecaf19bd02c67b1e6744668db" x-cache RefreshHit from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 3123 x-amz-cf-id t-ySPkYUhQ5kOyLDfkQxPJvtcLeT4BziQWyfcqeVhk4CB5H9iMip9A==
GET H2	200	icon2.jpg main.d1r5epmaoyt6i9.amplifyapp.com/images/	1 KB 2 KB	112ms 112ms	Image image/jpeg	18.64.79.67 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d1r5epmaoyt6i9.amplifyapp.com/images/icon2.jpg Requested by Host: main.d1r5epmaoyt6i9.amplifyapp.com URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.64.79.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-64-79-67.txl50.r.cloudfront.net Software AmazonS3 / Resource Hash `a6f643918329fc1a927510f388543d5b084b85082e5d01f1080ff6518ec6f1f7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d1r5epmaoyt6i9.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 23 Jan 2022 20:42:37 GMT via 1.1 334890575cfef347bd1a869a0eafe90a.cloudfront.net (CloudFront) last-modified Mon, 17 Jan 2022 11:39:58 GMT server AmazonS3 x-amz-cf-pop TXL50-P2 etag "bb2ef3ddb66faae16f9243da31677c50" x-cache RefreshHit from cloudfront content-type image/jpeg cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 1257 x-amz-cf-id A-ZJ2s9VjznOix_MiFrZ7JMpCW3zilZmMyiErc3eC1hzkimpb92-xA==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://main.d1r5epmaoyt6i9.amplifyapp.com/images/bg_top.png/ Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

main.d1r5epmaoyt6i9.amplifyapp.com
18.64.79.67
0d8f592d3aef440e69bc1b0c002930689e3334eb1f29206b021044e39a6d3dce
499f5e44488bef9456f38b42790051343e8abffdd38cfae4599ecc2ac7c82e47
4eddf5bb03728fe2ac2d56e0e286d6b979833e00fd465013905c9633fa6d4fd2
69f44920ee566a8cb7fe4a97463c5cd363e5b56ce883da11b29a5f5a3d4ef35b
6a4c9bda55c400bcf557984c93d42375a390367bd171727ca75ba5207e43d919
a6f643918329fc1a927510f388543d5b084b85082e5d01f1080ff6518ec6f1f7
baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3
d12f68075437ba046b2dc85e53dc081f9c11669d25f5d04c7d985851aff31d65

main.d1r5epmaoyt6i9.amplifyapp.com Open in urlscan Pro 18.64.79.67 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

88 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

27 kBTransfer

35 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

main.d1r5epmaoyt6i9.amplifyapp.com Open in urlscan Pro
18.64.79.67 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

35 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!