tybllndx.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 206.188.192.50, located in Amarillo, United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is tybllndx.com.

This is the only time tybllndx.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
3 7	206.188.192.50 206.188.192.50	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	2600:9000:215... 2600:9000:2156:ac00:1d:d7f6:39d0:c781	16509 (AMAZON-02) (AMAZON-02)
5	2

7 206.188.192.50 (Amarillo, United States) 3 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: vux.netsolhost.com

tybllndx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:ac00:1d:d7f6:39d0:c781 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	tybllndx.com 3 redirects tybllndx.com	41 KB
1	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 557	28 KB
5	2

	Domain	Requested by
7	tybllndx.com	3 redirects tybllndx.com
1	m.media-amazon.com	tybllndx.com
5	2

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-02-01` - `2023-01-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/
Frame ID: 2D1E70802648AB52E02894E92632083B
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Αmazon Billing

Page URL History Show full URLs

http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00 HTTP 301
http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/ HTTP 302
http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64 HTTP 301
http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Page URL

Page Statistics

5
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

68 kB
Transfer

205 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ref=ap_frn_logo

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_cookie_error_help

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=508088
Title: Conditions of Use

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.com/help
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00 HTTP 301
http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/ HTTP 302
http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64 HTTP 301
http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Redirect Chain http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00 http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/ http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64 http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/	8 KB 3 KB	358ms 358ms	Document text/html	206.188.192.50 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Protocol HTTP/1.1 Server 206.188.192.50 Amarillo, United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS vux.netsolhost.com Software openresty/1.19.9.1 / PHP/8.0.10 Resource Hash `e4fee3044880e6087552fc0967509c2a30b8f6b7015500b04906bb703eb46183` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Tue, 31 May 2022 13:23:42 GMT Server openresty/1.19.9.1 Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/8.0.10 X-Webcom-Cache-Status BYPASS Redirect headers Connection keep-alive Content-Length 298 Content-Type text/html; charset=iso-8859-1 Date Tue, 31 May 2022 13:23:42 GMT Location http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Server openresty/1.19.9.1 X-Webcom-Cache-Status BYPASS
GET H/1.1	200 OK	61FHWUKEhjL.css tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/	132 KB 28 KB	167ms 167ms	Stylesheet text/css	206.188.192.50 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/61FHWUKEhjL.css Requested by Host: tybllndx.com URL: http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Protocol HTTP/1.1 Server 206.188.192.50 Amarillo, United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS vux.netsolhost.com Software openresty/1.19.9.1 / Resource Hash `2987b5d91353836ef5eece9de0bb03541966255f6550042e585df01f64542ca7` Request headers accept-language de-DE,de;q=0.9 Referer http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Tue, 31 May 2022 13:23:43 GMT Content-Encoding gzip Last-Modified Tue, 31 May 2022 13:23:42 GMT Server openresty/1.19.9.1 X-Webcom-Cache-Status BYPASS ETag W/"20f79-5e04eae7263a7" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	01SdjaY0ZsL.css tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/	36 KB 8 KB	496ms 381ms	Stylesheet text/css	206.188.192.50 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/01SdjaY0ZsL.css Requested by Host: tybllndx.com URL: http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Protocol HTTP/1.1 Server 206.188.192.50 Amarillo, United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS vux.netsolhost.com Software openresty/1.19.9.1 / Resource Hash `d677760fa69d216fe4dafd1a4548587e1b482f74b34f08e57085796d2187fd3d` Request headers accept-language de-DE,de;q=0.9 Referer http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Tue, 31 May 2022 13:23:43 GMT Content-Encoding gzip Last-Modified Tue, 31 May 2022 13:23:42 GMT Server openresty/1.19.9.1 X-Webcom-Cache-Status BYPASS ETag W/"8ee8-5e04eae723c8d" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	113GJdhRnnL.css tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/	2 KB 1 KB	271ms 155ms	Stylesheet text/css	206.188.192.50 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/113GJdhRnnL.css Requested by Host: tybllndx.com URL: http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ Protocol HTTP/1.1 Server 206.188.192.50 Amarillo, United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS vux.netsolhost.com Software openresty/1.19.9.1 / Resource Hash `686bad9ed0ebf2f7cdbf20a0dbcfeb109f45b626bb09d7fe4937c9b23a07113c` Request headers accept-language de-DE,de;q=0.9 Referer http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Tue, 31 May 2022 13:23:43 GMT Content-Encoding gzip Last-Modified Tue, 31 May 2022 13:23:42 GMT Server openresty/1.19.9.1 X-Webcom-Cache-Status BYPASS ETag W/"9c5-5e04eae724821" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H2	200	mPGmT0r6IeTyIee.png m.media-amazon.com/images/S/sash/	27 KB 28 KB	89ms 24ms	Image image/png	2600:9000:2156:ac00:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png Requested by Host: tybllndx.com URL: http://tybllndx.com/kkk/66ffd5126eabf947e78647fb01c5bd00/173af0cd3cea6fee870e05aebc3ddc64/index_files/61FHWUKEhjL.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ac00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers accept-language de-DE,de;q=0.9 Referer http://tybllndx.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers date Tue, 21 Sep 2021 22:15:55 GMT via 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront) age 21740868 edge-cache-tag x-cache-991,/images/S/sash/mPGmT0r6IeTyIee x-nginx-cache-status HIT x-cache Hit from cloudfront content-length 27972 surrogate-key x-cache-991 /images/S/sash/mPGmT0r6IeTyIee last-modified Tue, 17 Nov 2020 23:31:33 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 30d9575f-9b98-45af-971e-3a5fea6d6278 x-amz-cf-pop FRA50-C1 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id TxqtcBioj3KYJIMCXbhnsi-27aFwJEVU1G3c9MIFHKR8RARisRZ5-Q== expires Sun, 08 Sep 2041 16:02:30 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.media-amazon.com
tybllndx.com
206.188.192.50
2600:9000:2156:ac00:1d:d7f6:39d0:c781
2987b5d91353836ef5eece9de0bb03541966255f6550042e585df01f64542ca7
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
686bad9ed0ebf2f7cdbf20a0dbcfeb109f45b626bb09d7fe4937c9b23a07113c
d677760fa69d216fe4dafd1a4548587e1b482f74b34f08e57085796d2187fd3d
e4fee3044880e6087552fc0967509c2a30b8f6b7015500b04906bb703eb46183

tybllndx.com Open in urlscan Pro 206.188.192.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

20 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

68 kBTransfer

205 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

tybllndx.com Open in urlscan Pro
206.188.192.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

68 kB
Transfer

205 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!