amazon.works.ga Open in urlscan Pro
35.186.245.55  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request validateCaptcha Show response amazon.works.ga/errors/	6 KB 7 KB	526ms 340ms	Document text/html	35.186.245.55 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://amazon.works.ga/errors/validateCaptcha?amzn=PlUzLKF7ojrt5TxU8hyqSw==&amzn-r=/&field-keywords=YXJARX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 55.245.186.35.bc.googleusercontent.com Software / Express Resource Hash 652df75ab559e89b458e161ede4382dfd2a90fc2ea80597505e9622bb494b7cf Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html; charset=utf-8 date Tue, 18 Jan 2022 09:19:01 GMT etag W/"19bf-GKssvvofz6qMHfGPv+4oeZfQ0nM" expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" replit-cluster global x-powered-by Express content-length 6591
GET H2	200	AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css images-na.ssl-images-amazon.com/images/G/01/AUIClients/	165 KB 23 KB	119ms 9ms	Stylesheet text/css	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Requested by Host: amazon.works.ga URL: https://amazon.works.ga/errors/validateCaptcha?amzn=PlUzLKF7ojrt5TxU8hyqSw==&amzn-r=/&field-keywords=YXJARX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Fri, 22 Jan 2021 08:10:46 GMT content-encoding gzip age 31512462 edge-cache-tag x-cache-936,/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-936 /images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min last-modified Wed, 17 Jul 2013 22:49:32 GMT server Server content-type text/css via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id ed667990-3382-492d-83ec-8cd6854c9c71 x-amz-cf-pop FRA50-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id 3k-voGVOtlzp-VZOoALga9imrUmA4rKdNn3MQsFZYgf0_jkJrQt_5Q== expires Sun, 13 Jan 2041 15:51:19 GMT
GET H2	200	Captcha_arahivawgs.jpg images-na.ssl-images-amazon.com/captcha/rhnrlggh/	5 KB 6 KB	120ms 11ms	Image image/jpeg	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/captcha/rhnrlggh/Captcha_arahivawgs.jpg Requested by Host: amazon.works.ga URL: https://amazon.works.ga/errors/validateCaptcha?amzn=PlUzLKF7ojrt5TxU8hyqSw==&amzn-r=/&field-keywords=YXJARX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 02c47978b7f5115a9adf5fb3cd53afbdfb27c850190dd3a751b64c8758e61df2 Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Mon, 17 Jan 2022 10:55:37 GMT via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) age 86797 edge-cache-tag x-cache-826,/captcha/rhnrlggh/Captcha_arahivawgs x-nginx-cache-status HIT x-cache Hit from cloudfront content-length 5519 surrogate-key x-cache-826 /captcha/rhnrlggh/Captcha_arahivawgs last-modified Wed, 08 Feb 2012 17:16:31 GMT server Server content-type image/jpeg access-control-allow-origin * x-amz-ir-id 31af6fde-106a-4843-9e2c-a2e525030887 x-amz-cf-pop FRA50-C1 accept-ranges bytes x-amz-cf-id K7Ft2rEtUdt9A6k6ELiD3cJsKFIZhMGbzDue7zJxEr9nOAG7FNG6LA==
GET H2	200	aui_sprite_0007-1x._V383827579_.png images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/	17 KB 17 KB	11ms 11ms	Image image/png	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/aui_sprite_0007-1x._V383827579_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa Request headers Accept-Language de-DE,de;q=0.9 Referer https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sun, 07 Feb 2021 09:26:05 GMT via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) age 29946107 edge-cache-tag x-cache-478,/images/G/01/amazonui/sprites/aui_sprite_0007-1x x-cache Hit from cloudfront content-length 16972 surrogate-key x-cache-478 /images/G/01/amazonui/sprites/aui_sprite_0007-1x last-modified Wed, 15 May 2013 01:55:34 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 12f57767-234b-41e5-88fb-3f96ea388957 x-amz-cf-pop FRA50-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id eSeqoyEHo0qjk7ARFFRlUj8aDmN-hZPd9Evv09-qLl7P55XyA8FojA== expires Thu, 31 Jan 2041 18:57:14 GMT
GET H2	200	requestId=QSVJ8757ZN3870398K6J&js=1 fls-na.amazon.com/1/oc-csi/1/OP/	43 B 150 B	356ms 99ms	Image image/gif	34.196.245.46 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://fls-na.amazon.com/1/oc-csi/1/OP/requestId=QSVJ8757ZN3870398K6J&js=1 Requested by Host: amazon.works.ga URL: https://amazon.works.ga/errors/validateCaptcha?amzn=PlUzLKF7ojrt5TxU8hyqSw==&amzn-r=/&field-keywords=YXJARX Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.196.245.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-196-245-46.compute-1.amazonaws.com Software / Resource Hash a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Tue, 18 Jan 2022 09:19:02 GMT x-amzn-requestid e00d580f-4a4b-497d-8149-9fc5aa4175fa content-length 43 content-type image/gif
GET H2	200	csm-captcha-instrumentation.min.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	2 KB 2 KB	9ms 9ms	Script application/x-javascript	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js Requested by Host: amazon.works.ga URL: https://amazon.works.ga/errors/validateCaptcha?amzn=PlUzLKF7ojrt5TxU8hyqSw==&amzn-r=/&field-keywords=YXJARX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Tue, 18 Jan 2022 00:27:46 GMT content-encoding gzip age 31875 edge-cache-tag x-cache-076,/images/G/01/csminstrumentation/csm-captcha-instrumentation.min x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-076 /images/G/01/csminstrumentation/csm-captcha-instrumentation.min last-modified Mon, 12 Oct 2015 09:22:39 GMT server Server content-type application/x-javascript via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) cache-control max-age=86400,public x-amz-ir-id 58378787-9776-4eec-9730-c7ac04e9cc8e x-amz-cf-pop FRA50-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id kt-c4FDXJm3syAVGPfeSqgW_JMiXSgr1cLExM5C7Bboz1s9auBMz4g== expires Mon, 17 Jan 2022 23:07:56 GMT
GET H2	200	rd-script-6d68177fa6061598e9509dc4b5bdd08d.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	2 KB 1 KB	10ms 10ms	Script application/x-javascript	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d.js Requested by Host: amazon.works.ga URL: https://amazon.works.ga/errors/validateCaptcha?amzn=PlUzLKF7ojrt5TxU8hyqSw==&amzn-r=/&field-keywords=YXJARX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 0a7e3153f44d0e51c73dad9fa3034a14446bedbafc38e477915382dd02269123 Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Tue, 18 Jan 2022 07:15:01 GMT content-encoding gzip age 39233 edge-cache-tag x-cache-642,/images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-642 /images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d last-modified Fri, 20 Mar 2020 12:31:03 GMT server Server content-type application/x-javascript via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) cache-control max-age=86400,public x-amz-ir-id 7ff91297-3515-4987-849c-96b5c185daa9 x-amz-cf-pop FRA50-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id -itwdpmQEy9wRKGouPbX5HbsLLVTtueWlynBabafl7byxZcxDV2ohw== expires Tue, 18 Jan 2022 04:35:02 GMT
GET H2	200	ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Show response images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/	7 KB 4 KB	7ms 7ms	Script application/x-javascript	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37 Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 06 Feb 2021 07:06:40 GMT content-encoding gzip age 30099982 edge-cache-tag x-cache-647,/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-647 /images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1 last-modified Wed, 26 Aug 2015 14:52:49 GMT server Server content-type application/x-javascript via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 5a841340-3a27-4c87-a868-7de57c251e02 x-amz-cf-pop FRA50-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id 0WFjtZcow2ECq7vpUotJvm-n799mt5Ttlmu8LL3CmbtczVRAosz3fw== expires Wed, 30 Jan 2041 00:12:39 GMT
GET H2	200	ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Show response images-na.ssl-images-amazon.com/images/G/01/AUIClients/	19 KB 8 KB	13ms 12ms	Script application/x-javascript	2600:9000:2156:ce00:1d:d7f6:39cf:a761 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ce00:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042 Request headers Accept-Language de-DE,de;q=0.9 Referer https://amazon.works.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 10 Feb 2021 01:27:53 GMT content-encoding gzip age 30124084 edge-cache-tag x-cache-969,/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-969 /images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min last-modified Thu, 01 Oct 2015 10:17:43 GMT server Server content-type application/x-javascript via 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id f8250438-4ace-4637-8d91-c85b0c059f02 x-amz-cf-pop FRA50-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id 7GXZCjP-hS-GuTWlDfyKY69N25dEsyymZu8YxPtDdS8gnQ2CEspJCQ== expires Tue, 29 Jan 2041 17:30:57 GMT
POST H2	204	/ fls-na.amazon.com/1/batch/1/OE/	0 165 B	197ms 197ms	Ping text/plain	34.196.245.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fls-na.amazon.com/1/batch/1/OE/ Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.196.245.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-196-245-46.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://amazon.works.ga/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin * date Tue, 18 Jan 2022 09:19:02 GMT x-amzn-requestid 17f3d3d4-87ee-4824-b000-1b33837820bb access-control-expose-headers x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| ue_t0 object| ue_csm object| ue string| ue_furl string| ue_mid string| ue_sid string| ue_sn string| ue_id object| head string| prefix object| elem object| ue_modules object| cel_widgets string| ue_cel_ns number| ue_skc object| ue_err number| ueinit function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop function| ueLogError object| ue_cel object| ue_pdm object| ue_vpm object| ue_fem object| ue_mcm object| ue_mmm object| ue_rpl object| ue_kpm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon.works.ga/	1970-01-20 00:54:24	Name: csm-sid Value: 385-9298638-7150873

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.works.ga
fls-na.amazon.com
images-na.ssl-images-amazon.com
2600:9000:2156:ce00:1d:d7f6:39cf:a761
34.196.245.46
35.186.245.55
02c47978b7f5115a9adf5fb3cd53afbdfb27c850190dd3a751b64c8758e61df2
0a7e3153f44d0e51c73dad9fa3034a14446bedbafc38e477915382dd02269123
35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a
49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa
5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb
652df75ab559e89b458e161ede4382dfd2a90fc2ea80597505e9622bb494b7cf
877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855