account-update.amazon.co.jp.dadf.info Open in urlscan Pro
52.119.1.119 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://account-update.amazon.co.jp.dadf.info/
Submission: On August 23 via manual (August 23rd 2019, 2:04:22 am UTC) from JP

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 52.119.1.119, located in Los Angeles, United States and belongs to AS40676 - Psychz Networks, US. The main domain is account-update.amazon.co.jp.dadf.info.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 22nd 2019. Valid for: 3 months.

This is the only time account-update.amazon.co.jp.dadf.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon Japan (Online)

Domain & IP information

	IP Address		AS Autonomous System
4	52.119.1.119 52.119.1.119		40676 (AS40676) (AS40676 - Psychz Networks)
14	2

4 52.119.1.119 (Los Angeles, United States)

ASN40676 (AS40676 - Psychz Networks, US)

account-update.amazon.co.jp.dadf.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	dadf.info account-update.amazon.co.jp.dadf.info	71 KB
0	daefd.info Failed account-update.amazon.co.jp.daefd.info Failed
14	2

	Domain	Requested by
4	account-update.amazon.co.jp.dadf.info	account-update.amazon.co.jp.dadf.info
0	account-update.amazon.co.jp.daefd.info Failed	account-update.amazon.co.jp.dadf.info
14	2

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid
daefd.info Let's Encrypt Authority X3	`2019-08-22` - `2019-11-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://account-update.amazon.co.jp.dadf.info/
Frame ID: 1493C2098ECA15BB76E706930C9C4948
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

14
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

71 kB
Transfer

75 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ref=ap_frn_logo
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response account-update.amazon.co.jp.dadf.info/	8 KB 3 KB	524ms 165ms	Document text/html	52.119.1.119 Psychz Networks
General Check archive.org Show headers Download Go to Full URL https://account-update.amazon.co.jp.dadf.info/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 52.119.1.119 Los Angeles, United States, ASN40676 (AS40676 - Psychz Networks, US), Reverse DNS Software nginx / Resource Hash `cd13088f818957486cd113d5dfd371a0beac25138a15f50807292a5dc502e710` Request headers :method GET :authority account-update.amazon.co.jp.dadf.info :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 server nginx date Fri, 23 Aug 2019 02:03:44 GMT content-type text/html;charset=UTF-8 vary Accept-Encoding set-cookie JSESSIONID=0EF2D41138004CEE15943BED997AAA10;path=/;HttpOnly expires Fri, 23 Aug 2019 14:03:44 GMT cache-control max-age=43200 no-cache x-cache MISS content-encoding gzip
GET		main.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET		index.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET		tnof.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET H2	200	sUxIE.css account-update.amazon.co.jp.dadf.info/login/	145 B 349 B	169ms 164ms	Stylesheet text/css	52.119.1.119 Psychz Networks
General Check archive.org Show headers Download Go to Full URL https://account-update.amazon.co.jp.dadf.info/login/sUxIE.css Requested by Host: account-update.amazon.co.jp.dadf.info URL: https://account-update.amazon.co.jp.dadf.info/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 52.119.1.119 Los Angeles, United States, ASN40676 (AS40676 - Psychz Networks, US), Reverse DNS Software nginx / Resource Hash `f7032edc18df9d0e332e1a15b985029a7507c65613ce71a15255e34cade206d9` Request headers Sec-Fetch-Mode no-cors Referer https://account-update.amazon.co.jp.dadf.info/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 23 Aug 2019 02:03:44 GMT last-modified Mon, 18 Mar 2019 04:13:02 GMT server nginx x-cache MISS content-type text/css;charset=utf-8 status 200 cache-control max-age=43200, no-cache accept-ranges bytes content-length 145 expires Fri, 23 Aug 2019 14:03:44 GMT
GET		jOErH.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET		aOIgx.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET		SciJM.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET		VlRqo.css account-update.amazon.co.jp.daefd.info//login/	0 0

GET		main_002.js.%E4%B8%8B%E8%BD%BD account-update.amazon.co.jp.daefd.info//login/	0 0

GET		main_003.js.%E4%B8%8B%E8%BD%BD account-update.amazon.co.jp.daefd.info//login/	0 0

GET		main.js.%E4%B8%8B%E8%BD%BD account-update.amazon.co.jp.daefd.info//login/	0 0

GET H2	200	amazon.png account-update.amazon.co.jp.dadf.info/css/	60 KB 61 KB	1934ms 327ms	Image image/png	52.119.1.119 Psychz Networks
General Check archive.org Show headers Download Go to Show image Full URL https://account-update.amazon.co.jp.dadf.info/css/amazon.png Requested by Host: account-update.amazon.co.jp.dadf.info URL: https://account-update.amazon.co.jp.dadf.info/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 52.119.1.119 Los Angeles, United States, ASN40676 (AS40676 - Psychz Networks, US), Reverse DNS Software nginx / Resource Hash `c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a` Request headers Sec-Fetch-Mode no-cors Referer https://account-update.amazon.co.jp.dadf.info/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 23 Aug 2019 02:04:15 GMT last-modified Fri, 08 Mar 2019 05:57:34 GMT server nginx x-cache MISS content-type image/png;charset=utf-8 status 200 cache-control max-age=43200, no-cache accept-ranges bytes content-length 61917 expires Fri, 23 Aug 2019 14:04:15 GMT
GET H2	200	amanon2.png account-update.amazon.co.jp.dadf.info/css/	7 KB 7 KB	1772ms 164ms	Image image/png	52.119.1.119 Psychz Networks
General Check archive.org Show headers Download Go to Show image Full URL https://account-update.amazon.co.jp.dadf.info/css/amanon2.png Requested by Host: account-update.amazon.co.jp.dadf.info URL: https://account-update.amazon.co.jp.dadf.info/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 52.119.1.119 Los Angeles, United States, ASN40676 (AS40676 - Psychz Networks, US), Reverse DNS Software nginx / Resource Hash `5ad2ea1ac285aacee78ec964213ff95cdeb6428d6fad55cbc0a7f9dc3437c9e9` Request headers Sec-Fetch-Mode no-cors Referer https://account-update.amazon.co.jp.dadf.info/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 23 Aug 2019 02:04:15 GMT last-modified Fri, 08 Mar 2019 05:57:58 GMT server nginx x-cache MISS content-type image/png;charset=utf-8 status 200 cache-control max-age=43200, no-cache accept-ranges bytes content-length 7057 expires Fri, 23 Aug 2019 14:04:15 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/main.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/index.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/tnof.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/jOErH.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/aOIgx.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/SciJM.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/VlRqo.css

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/main_002.js.%E4%B8%8B%E8%BD%BD

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/main_003.js.%E4%B8%8B%E8%BD%BD

Domain: account-update.amazon.co.jp.daefd.info
URL: https://account-update.amazon.co.jp.daefd.info//login/main.js.%E4%B8%8B%E8%BD%BD

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon Japan (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account-update.amazon.co.jp.dadf.info
account-update.amazon.co.jp.daefd.info
account-update.amazon.co.jp.daefd.info
52.119.1.119
5ad2ea1ac285aacee78ec964213ff95cdeb6428d6fad55cbc0a7f9dc3437c9e9
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cd13088f818957486cd113d5dfd371a0beac25138a15f50807292a5dc502e710
f7032edc18df9d0e332e1a15b985029a7507c65613ce71a15255e34cade206d9

account-update.amazon.co.jp.dadf.info Open in urlscan Pro 52.119.1.119 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

71 kBTransfer

75 kBSize

0 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

account-update.amazon.co.jp.dadf.info Open in urlscan Pro
52.119.1.119 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

71 kB
Transfer

75 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!