id78987845789654215verify-wallet-amazonwalletid.infoox.net
Open in
urlscan Pro
2a00:7ee0:9:3:41:1:0:78
Malicious Activity!
Public Scan
Submission Tags: @ecarlesi threat phishing amazon Search All
Submission: On October 14 via api from IT — Scanned from FR
Summary
TLS certificate: Issued by R10 on October 13th 2024. Valid for: 3 months.
This is the only time id78987845789654215verify-wallet-amazonwalletid.infoox.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:7ee0:9:3... 2a00:7ee0:9:3:41:1:0:78 | 210403 (LWS) (LWS) | |
7 | 2600:9000:225... 2600:9000:225e:8000:1d:d7f6:39d3:d9e1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:206... 2600:9000:206f:2200:1a:f1e1:7cc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 3.221.76.88 3.221.76.88 | 14618 (AMAZON-AES) (AMAZON-AES) | |
3 | 2600:9000:264... 2600:9000:2644:1400:1d:d7f6:39d3:d9e1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 44.215.129.188 44.215.129.188 | 14618 (AMAZON-AES) (AMAZON-AES) | |
15 | 6 |
ASN210403 (LWS, FR)
id78987845789654215verify-wallet-amazonwalletid.infoox.net |
ASN16509 (AMAZON-02, US)
images-na.ssl-images-amazon.com |
ASN16509 (AMAZON-02, US)
static.siege-amazon.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-76-88.compute-1.amazonaws.com
fls-na.amazon.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-215-129-188.compute-1.amazonaws.com
unagi.amazon.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 906 |
58 KB |
3 |
media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 482 |
87 KB |
2 |
amazon.com
fls-na.amazon.com — Cisco Umbrella Rank: 1305 unagi.amazon.com — Cisco Umbrella Rank: 1616 |
553 B |
2 |
infoox.net
id78987845789654215verify-wallet-amazonwalletid.infoox.net |
23 KB |
1 |
siege-amazon.com
static.siege-amazon.com — Cisco Umbrella Rank: 13003 |
1 KB |
15 | 5 |
Domain | Requested by | |
---|---|---|
7 | images-na.ssl-images-amazon.com |
id78987845789654215verify-wallet-amazonwalletid.infoox.net
|
3 | m.media-amazon.com |
id78987845789654215verify-wallet-amazonwalletid.infoox.net
images-na.ssl-images-amazon.com |
2 | id78987845789654215verify-wallet-amazonwalletid.infoox.net | |
1 | unagi.amazon.com |
id78987845789654215verify-wallet-amazonwalletid.infoox.net
|
1 | fls-na.amazon.com |
id78987845789654215verify-wallet-amazonwalletid.infoox.net
|
1 | static.siege-amazon.com |
id78987845789654215verify-wallet-amazonwalletid.infoox.net
|
15 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.amazon.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
id78987845789654215verify-wallet-amazonwalletid.infoox.net R10 |
2024-10-13 - 2025-01-11 |
3 months | crt.sh |
images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2024-01-05 - 2024-12-08 |
a year | crt.sh |
static.siege-amazon.com Amazon RSA 2048 M02 |
2024-01-30 - 2025-02-28 |
a year | crt.sh |
fls-na.amazon.com Amazon RSA 2048 M02 |
2023-12-21 - 2025-01-18 |
a year | crt.sh |
unagi-na.amazon.com Amazon RSA 2048 M01 |
2024-01-18 - 2025-01-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://id78987845789654215verify-wallet-amazonwalletid.infoox.net/login.php
Frame ID: AD53CD5EF6E52432065B062F072C33CE
Requests: 15 HTTP requests in this frame
5 Outgoing links
These are links going to different origins than the main page.
Title: Create account New to Amazon?
Search URL Search Domain Scan URL
Title: Create a free business account
Search URL Search Domain Scan URL
Title: Sign in Already a customer?
Search URL Search Domain Scan URL
Title: Forgot your password?
Search URL Search Domain Scan URL
Title: Shop on Amazon Business
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
id78987845789654215verify-wallet-amazonwalletid.infoox.net/ |
193 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61sm4DxXtPL._RC%7C11iHkiAT2oL.css,01wLsDqViEL.css,11MhAJ3QIgL.css,317ojtFHdqL.css,31AUj9-+WdL.css,01DHz7m6lhL.css_.css
images-na.ssl-images-amazon.com/images/I/ |
135 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,51XgAjgfSsL.css_.css
images-na.ssl-images-amazon.com/images/I/ |
63 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
21Tw7TldARL.css
images-na.ssl-images-amazon.com/images/I/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AuthenticationPortalSigninNA.js
static.siege-amazon.com/prod/profiles/ |
2 KB 1 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ATVPDKIKX0DER:143-4005067-4688113:BETJ78AB30G0S1VRV57J$uedata=s:%2Fap%2Fuedata%3Fstaticb%26id%3DBETJ78AB30G0S1VRV57J:0
fls-na.amazon.com/1/batch/1/OP/ |
43 B 150 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
41L55C17g2L._RC%7C41-WpIOxHtL.css,51PMob2AVUL.css_.css
images-na.ssl-images-amazon.com/images/I/ |
90 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
41LX-4RI3cL.css
images-na.ssl-images-amazon.com/images/I/ |
16 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
01+72+wCC9L.css
images-na.ssl-images-amazon.com/images/I/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
51a1r4esaNL._RC%7C21Vy1AgmcwL.css,21JE-awzjiL.css,31eNyfgmRYL.css_.css
images-na.ssl-images-amazon.com/images/I/ |
63 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new-nav-sprite-global-1x_blueheaven-privacy._CB588007131_.png
m.media-amazon.com/images/G/01/gno/sprites/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mPGmT0r6IeTyIee.png
m.media-amazon.com/images/S/sash/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Z8YwjOjqIHxqujG.png
m.media-amazon.com/images/S/sash/ |
45 KB 46 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
com.amazon.csm.csa.prod
unagi.amazon.com/1/events/ |
2 B 403 B |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
id78987845789654215verify-wallet-amazonwalletid.infoox.net/ |
315 B 452 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| aPageStart object| siegeCseConfig function| csa object| app object| amzn object| $Nav number| nav_t_after_preload_JS string| _navbarSpriteUrl number| nav_t_after_preload_sprite object| navmet number| nav_t_after_searchbar number| nav_t_after_navbar number| nav_t_end_nav function| cf1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
id78987845789654215verify-wallet-amazonwalletid.infoox.net/ | Name: PHPSESSID Value: er4quradc7suo95i15g4ruq324 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fls-na.amazon.com
id78987845789654215verify-wallet-amazonwalletid.infoox.net
images-na.ssl-images-amazon.com
m.media-amazon.com
static.siege-amazon.com
unagi.amazon.com
2600:9000:206f:2200:1a:f1e1:7cc0:93a1
2600:9000:225e:8000:1d:d7f6:39d3:d9e1
2600:9000:2644:1400:1d:d7f6:39d3:d9e1
2a00:7ee0:9:3:41:1:0:78
3.221.76.88
44.215.129.188
053dd134b1723da118c189819a77d6d4c3b6dfb7f23fd08f8c7a93fdf1d64f4b
0a4216a8c164de584e3220ee349e351419415b740046d8e8bc89d7f0feeff27e
0dbdb493accb1d764ff2138d4f1c3db1373dc8aeed1ef3ebb768cdb242ba943e
15cbc17e97d5f67ae49cbf422000f6aa0ff2d914e18f70d5d2cfffbe37b79eeb
35254dc4ee224bf5ffe1f6d2eae9d4103b7c74b6e9c18c421f9c57c28773d631
3db2f901ba78a59ab47afe63f8bf507f7dbc8d95b4906930cd4f02251680103e
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
5de5976c9fd46241c18a67081f88c2c2b81ab5592b025d7985b7ee693e34073b
6641ff165206f0f54cd94518ded93dfcbfc7436a806b0de96991cb3da4032a8b
6da4e741f1e44e8a6e60f74ce6d666292135be8a44c5a5d97621a0bd1371e782
9c7267555ee0db10193b6621585098535a921a16a1ad24884a432cb3741af655
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
c5dc3c672e583dafe8a77b73d0475446ece9402dca7c98d9b64879470d597c88
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3