www.client-customers-ppi.com

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 62.4.13.113, located in France and belongs to Online SAS, FR. The main domain is www.client-customers-ppi.com.
TLS certificate: Issued by R3 on November 8th 2021. Valid for: 3 months.

This is the only time www.client-customers-ppi.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 5	62.4.13.113 62.4.13.113	12876 (Online SAS) (Online SAS)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223e:8400:1d:d7f6:39cf:a761	16509 (AMAZON-02) (AMAZON-02)
5	3

5 62.4.13.113 (France) 2 redirects

ASN12876 (Online SAS, FR)

www.client-customers-ppi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223e:8400:1d:d7f6:39cf:a761 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	client-customers-ppi.com 2 redirects www.client-customers-ppi.com	35 KB
1	media-amazon.com m.media-amazon.com	28 KB
1	googleapis.com ajax.googleapis.com	88 KB
5	3

	Domain	Requested by
5	www.client-customers-ppi.com	2 redirects www.client-customers-ppi.com
1	m.media-amazon.com	www.client-customers-ppi.com
1	ajax.googleapis.com	www.client-customers-ppi.com
5	3

This site contains links to these domains. Also see Links.

Domain
www.amazon.fr

Subject Issuer	Validity	Valid
www.client-customers-ppi.com R3	`2021-11-08` - `2022-02-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-03-23` - `2022-03-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.client-customers-ppi.com/ap/signin/
Frame ID: 8944FF87B5F45E71672157D4283D7D98
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Connexion | Amazon

Page URL History Show full URLs

https://www.client-customers-ppi.com/ HTTP 302
https://www.client-customers-ppi.com/ap/ HTTP 302
https://www.client-customers-ppi.com/ap/signin/ Page URL

Page Statistics

5
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

150 kB
Transfer

335 kB
Size

1
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.fr/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=frflex&openid.return_to=https%3A%2F%2Fwww.amazon.fr%2F%3Fref_%3Dnav_custrec_signin&prevRID=4G31EHQR0CRSDCS2TZB9&openid.assoc_handle=frflex&openid.mode=checkid_setup&prepopulatedLoginId=eyJjaXBoZXIiOiJVTmRNSkN4b1V2N2JUTlJrelMyR0Q5bjFyZnY0b0NveVhsQmJnT1ZyaytFPSIsIklWIjoiejhWUFVyRTNVQnV3ZTk2TWRzUlFkZz09IiwidmVyc2lvbiI6MX0%3D&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&timestamp=1636330293000
Title: Mot de passe oublié

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html?nodeId=548524
Title: Conditions générales de vente

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html?nodeId=3329781
Title: Notice Protection de vos informations personnelles

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html?nodeId=201890250
Title: Notice Cookies

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html?nodeId=201909150
Title: Notice Annonces publicitaires basées sur vos centres d’intérêt

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.fr%2F%3Fref_%3Dnav_custrec_signin&prevRID=HZDER7FXNRKJ3CXNV26K&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=frflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=frflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Créer votre compte Amazon

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=548524
Title: Conditions d'utilisation

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=3329781
Title: Protection de vos informations personnelles

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html?nodeId=559912
Title: Aide

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html/?nodeId=201890250
Title: Cookies

Search URL Search Domain Scan URL

URL: https://www.amazon.fr/gp/help/customer/display.html/?nodeId=201909150
Title: Annonces basées sur vos centres d’intérêt

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.client-customers-ppi.com/ HTTP 302
https://www.client-customers-ppi.com/ap/ HTTP 302
https://www.client-customers-ppi.com/ap/signin/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.client-customers-ppi.com/ap/signin/
Redirect Chain

https://www.client-customers-ppi.com/
https://www.client-customers-ppi.com/ap/
https://www.client-customers-ppi.com/ap/signin/

17 KB
4 KB

136ms
136ms

Document
text/html

62.4.13.113
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.client-customers-ppi.com/ap/signin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.13.113 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Apache/2.4.38 (Debian) /
Resource Hash: 5b6fcbdbd0c8d18be1453b478f4ff16f5089cf36672e90ba9a5c1974eaec89d2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: fr-FR,fr;q=0.9

Response headers

Date: Mon, 08 Nov 2021 04:41:06 GMT
Server: Apache/2.4.38 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3494
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 08 Nov 2021 04:41:06 GMT
Server: Apache/2.4.38 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: signin/
Content-Length: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK AmazonUI.css
www.client-customers-ppi.com/assets/ 159 KB
23 KB 35ms
34ms Stylesheet
text/css 62.4.13.113
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.client-customers-ppi.com/assets/AmazonUI.css
Requested by: Host: www.client-customers-ppi.com
URL: https://www.client-customers-ppi.com/ap/signin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.13.113 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Apache/2.4.38 (Debian) /
Resource Hash: 6e4cfaf8ee78935abb8d18e9f56b6e5155c4fd40e508184f82c3a1b9dc7601fb

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.client-customers-ppi.com/ap/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Mon, 08 Nov 2021 04:41:06 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Nov 2021 04:30:41 GMT
Server: Apache/2.4.38 (Debian)
ETag: "27bf4-5d03f74a19354-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 23436

GET
H/1.1 200
OK Auth.css
www.client-customers-ppi.com/assets/ 44 KB
7 KB 77ms
29ms Stylesheet
text/css 62.4.13.113
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.client-customers-ppi.com/assets/Auth.css
Requested by: Host: www.client-customers-ppi.com
URL: https://www.client-customers-ppi.com/ap/signin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.13.113 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: Apache/2.4.38 (Debian) /
Resource Hash: 58b2fb77b73cf5b7fa32daba21c82d7b235bd85f6353ac1ba9c1179fdfa27683

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.client-customers-ppi.com/ap/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Mon, 08 Nov 2021 04:41:06 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Nov 2021 04:30:41 GMT
Server: Apache/2.4.38 (Debian)
ETag: "b111-5d03f74a0dfa3-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 6956

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
88 KB 98ms
31ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.client-customers-ppi.com
URL: https://www.client-customers-ppi.com/ap/signin/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.client-customers-ppi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sat, 06 Nov 2021 00:10:58 GMT
x-content-type-options: nosniff
age: 189008
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89476
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Sun, 06 Nov 2022 00:10:58 GMT

GET
H2 200 mPGmT0r6IeTyIee.png
m.media-amazon.com/images/S/sash/ 27 KB
28 KB 130ms
35ms Image
image/png 2600:9000:223e:8400:1d:d7f6:39cf:a761
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Requested by: Host: www.client-customers-ppi.com
URL: https://www.client-customers-ppi.com/assets/AmazonUI.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223e:8400:1d:d7f6:39cf:a761 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

Accept-Language: fr-FR,fr;q=0.9
Referer: https://www.client-customers-ppi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:56:39 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09489.cloudfront.net (CloudFront)
age: 20328470
edge-cache-tag: x-cache-317,/images/S/sash/mPGmT0r6IeTyIee
x-cache: Hit from cloudfront
content-length: 27972
surrogate-key: x-cache-317 /images/S/sash/mPGmT0r6IeTyIee
last-modified: Tue, 17 Nov 2020 23:31:33 GMT
server: Server
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=630720000,public
x-amz-ir-id: 34cc475b-0460-47f7-9a2b-4c73f91fd08a
x-amz-cf-pop: FRA56-P4
timing-allow-origin: https://www.amazon.in, https://www.amazon.com
x-amz-cf-id: UN3hQVh8k6WPpDUE_tQyqVRPzwJcXSHF1m4f6sfJLqQaFZm2dr4yRA==
expires: Tue, 12 Mar 2041 21:53:17 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.client-customers-ppi.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2latcudrhqlku6u5ce1j0vtgrn

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
m.media-amazon.com
www.client-customers-ppi.com
2600:9000:223e:8400:1d:d7f6:39cf:a761
2a00:1450:4001:82b::200a
62.4.13.113
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
58b2fb77b73cf5b7fa32daba21c82d7b235bd85f6353ac1ba9c1179fdfa27683
5b6fcbdbd0c8d18be1453b478f4ff16f5089cf36672e90ba9a5c1974eaec89d2
6e4cfaf8ee78935abb8d18e9f56b6e5155c4fd40e508184f82c3a1b9dc7601fb
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

www.client-customers-ppi.com Open in urlscan Pro 62.4.13.113 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

150 kBTransfer

335 kBSize

1 Cookies

11 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

www.client-customers-ppi.com Open in urlscan Pro
62.4.13.113 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

150 kB
Transfer

335 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!