preformanceamazon-it-non-complia.effectiveflux.ro

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 89.35.77.25, located in Romania and belongs to ACTIVENET-AS ACTIV NET SRL, RO. The main domain is preformanceamazon-it-non-complia.effectiveflux.ro.
TLS certificate: Issued by R11 on November 25th 2024. Valid for: 3 months.

This is the only time preformanceamazon-it-non-complia.effectiveflux.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	89.35.77.25 89.35.77.25	49302 (ACTIVENET...) (ACTIVENET-AS ACTIV NET SRL)
4	18.244.13.234 18.244.13.234	16509 (AMAZON-02) (AMAZON-02)
6	2

2 89.35.77.25 (Romania)

ASN49302 (ACTIVENET-AS ACTIV NET SRL, RO)
PTR: cp2.activ.net

preformanceamazon-it-non-complia.effectiveflux.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.244.13.234 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-13-234.fra56.r.cloudfront.net

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 856	32 KB
2	effectiveflux.ro preformanceamazon-it-non-complia.effectiveflux.ro	26 KB
1	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 442	28 KB
6	3

	Domain	Requested by
3	images-na.ssl-images-amazon.com	preformanceamazon-it-non-complia.effectiveflux.ro
2	preformanceamazon-it-non-complia.effectiveflux.ro
1	m.media-amazon.com	images-na.ssl-images-amazon.com
6	3

This site contains links to these domains. Also see Links.

Domain
www.amazon.it

Subject Issuer	Validity	Valid
preformanceamazon-it-non-complia.effectiveflux.ro R11	`2024-11-25` - `2025-02-23`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2024-10-10` - `2025-09-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html
Frame ID: 3EB94336DAC0E72305B3609073BFCDE7
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Accedi

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

86 kB
Transfer

238 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.it/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=itflex&openid.return_to=https%3A%2F%2Fwww.amazon.it%2F%3Fref_%3Dnav_signin&prevRID=P3SQF22V8FEDG93HM4ST&openid.assoc_handle=itflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Password dimenticata

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request openid.pape.max.html Show response preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/	8 KB 8 KB	835ms 206ms	Document text/html	89.35.77.25 ACTIVENET-AS ACTI...
General Check archive.org Show headers Download Go to Full URL https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 89.35.77.25 , Romania, ASN49302 (ACTIVENET-AS ACTIV NET SRL, RO), Reverse DNS cp2.activ.net Software nginx / Resource Hash `bf853936609f9076708993995da3b185f18d9624157f63fb8fd13182bc3291e1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 8388 Content-Type text/html Date Tue, 26 Nov 2024 07:57:39 GMT Last-Modified Sat, 03 Feb 2024 12:22:56 GMT Server nginx
GET H2	200	61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css images-na.ssl-images-amazon.com/images/I/	137 KB 23 KB	1347ms 264ms	Stylesheet text/css	18.244.13.234 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI Requested by Host: preformanceamazon-it-non-complia.effectiveflux.ro URL: https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.244.13.234 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-244-13-234.fra56.r.cloudfront.net Software Server / Resource Hash `8ff52030ae312e1688bd111f80d21dc533e457cdefd9cdf07722ec9f51de79bb` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://preformanceamazon-it-non-complia.effectiveflux.ro/ Response headers x-amz-ir-id 2f63f6de-0fb6-4fd0-b2f5-93494152ffdb surrogate-key x-cache-407 /images/I/61Brdu0o6LL content-encoding gzip age 5046646 expires Mon, 12 Sep 2044 17:23:39 GMT alt-svc h3=":443"; ma=86400 server-timing provider;desc="cf" x-cache Hit from cloudfront x-amz-cf-id zigHbZCjbJTDQ88Z9Bby-YqvFWS4UUXXvPDmpGtVhGfLaAE8-oPLEw== date Tue, 17 Sep 2024 17:23:39 GMT content-type text/css; charset=utf-8 last-modified Wed, 03 Jan 2018 00:13:54 GMT x-nginx-cache-status HIT edge-cache-tag x-cache-407,/images/I/61Brdu0o6LL cache-control max-age=630720000,public timing-allow-origin https://www.amazon.in, https://www.amazon.com via 1.1 6571e9f709b2287f8a30275c17d07140.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P11 server Server
GET H2	200	01SdjaY0ZsL._RC%7C419sIPk+mYL.css,41+ENBGOqUL.css_.css images-na.ssl-images-amazon.com/images/I/	46 KB 8 KB	1470ms 387ms	Stylesheet text/css	18.244.13.234 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C419sIPk+mYL.css,41+ENBGOqUL.css_.css?AUIClients/AuthenticationPortalAssets Requested by Host: preformanceamazon-it-non-complia.effectiveflux.ro URL: https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.244.13.234 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-244-13-234.fra56.r.cloudfront.net Software Server / Resource Hash `379abf5c20c39001941fa149c641d61154d10bfe6a2e009f9c25dc060919480e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://preformanceamazon-it-non-complia.effectiveflux.ro/ Response headers x-amz-ir-id 514c3930-e8a9-403d-a7b6-068b50dccee9 surrogate-key x-cache-981 /images/I/01SdjaY0ZsL content-encoding br age 599936 expires Mon, 14 Nov 2044 09:17:40 GMT alt-svc h3=":443"; ma=86400 server-timing provider;desc="cf" x-cache Hit from cloudfront x-amz-cf-id Qs0JzBVeGzhVU9mZly63kZWWoe575aEbWR2GCPC3JPpdlBE0BYyeNQ== date Tue, 19 Nov 2024 09:18:44 GMT content-type text/css last-modified Sat, 30 May 2015 02:58:48 GMT x-nginx-cache-status HIT edge-cache-tag x-cache-981,/images/I/01SdjaY0ZsL cache-control max-age=630720000,public timing-allow-origin https://www.amazon.in, https://www.amazon.com via 1.1 6571e9f709b2287f8a30275c17d07140.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P11 server Server
GET H2	200	11E08O3eXDL.css images-na.ssl-images-amazon.com/images/I/	2 KB 1 KB	1469ms 386ms	Stylesheet text/css	18.244.13.234 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/11E08O3eXDL.css?AUIClients/CVFAssets Requested by Host: preformanceamazon-it-non-complia.effectiveflux.ro URL: https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.244.13.234 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-244-13-234.fra56.r.cloudfront.net Software Server / Resource Hash `122a38d736dd4b129af47e1d4f6d955d335f55256f2f231d8ccd1a58562cd381` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://preformanceamazon-it-non-complia.effectiveflux.ro/ Response headers x-amz-ir-id 8439bae2-7460-44a3-8e49-e7ef516a3370 surrogate-key x-cache-571 /images/I/11E08O3eXDL content-encoding br age 4965916 expires Sun, 18 Sep 2044 22:12:33 GMT alt-svc h3=":443"; ma=86400 server-timing provider;desc="cf" x-cache Hit from cloudfront x-amz-cf-id G7eIZFCUxDVG0rMHFlJ3sxQGkwgKh2mRa6zabGHv-f9lJ_UquEHC4w== date Mon, 23 Sep 2024 22:12:33 GMT content-type text/css; charset=utf-8 last-modified Fri, 27 Mar 2020 19:40:05 GMT x-nginx-cache-status HIT edge-cache-tag x-cache-571,/images/I/11E08O3eXDL cache-control max-age=630720000,public timing-allow-origin https://www.amazon.in, https://www.amazon.com via 1.1 6571e9f709b2287f8a30275c17d07140.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P11 server Server
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	175ms 123ms	Image image/png	18.244.13.234 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61Brdu0o6LL._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,31P8A7PnBZL.css_.css?AUIClients/AmazonUI#us.not-trident Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.244.13.234 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-244-13-234.fra56.r.cloudfront.net Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://images-na.ssl-images-amazon.com/ Response headers x-amz-ir-id b9f4ae67-c4a4-4026-8437-bf32034270d4 surrogate-key x-cache-716 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 age 26995987 expires Fri, 04 Dec 2043 11:38:07 GMT alt-svc h3=":443"; ma=86400 server-timing provider;desc="cf" x-cache Hit from cloudfront x-amz-cf-id FYpVn4oL3YyBW40nw_NMbY1ttQgcYBwh_xnqB1ky7X0fXs4KXozjHw== date Sat, 09 Dec 2023 11:38:07 GMT content-type image/png last-modified Fri, 22 Sep 2017 00:23:19 GMT x-nginx-cache-status HIT edge-cache-tag x-cache-716,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 cache-control max-age=630720000,public timing-allow-origin https://www.amazon.com via 1.1 6571e9f709b2287f8a30275c17d07140.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 27972 x-amz-cf-pop FRA56-P11 server Server
GET H/1.1	200 OK	favicon.ico preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/	17 KB 17 KB	281ms 281ms	Other image/x-icon	89.35.77.25 ACTIVENET-AS ACTI...
General Check archive.org Show headers Download Go to Full URL https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 89.35.77.25 , Romania, ASN49302 (ACTIVENET-AS ACTIV NET SRL, RO), Reverse DNS cp2.activ.net Software nginx / Resource Hash `17d02e2db6dbedb95dd449d06868c147ac2c3b5371497bcb9407e75336a99e09` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html Response headers Accept-Ranges bytes Content-Length 17542 Date Tue, 26 Nov 2024 07:57:41 GMT Content-Type image/x-icon Last-Modified Thu, 22 Oct 2020 16:51:42 GMT Server nginx Connection keep-alive

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://preformanceamazon-it-non-complia.effectiveflux.ro/amazonit/index/openid.pape.max.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-na.ssl-images-amazon.com
m.media-amazon.com
preformanceamazon-it-non-complia.effectiveflux.ro
18.244.13.234
89.35.77.25
122a38d736dd4b129af47e1d4f6d955d335f55256f2f231d8ccd1a58562cd381
17d02e2db6dbedb95dd449d06868c147ac2c3b5371497bcb9407e75336a99e09
379abf5c20c39001941fa149c641d61154d10bfe6a2e009f9c25dc060919480e
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
8ff52030ae312e1688bd111f80d21dc533e457cdefd9cdf07722ec9f51de79bb
bf853936609f9076708993995da3b185f18d9624157f63fb8fd13182bc3291e1

preformanceamazon-it-non-complia.effectiveflux.ro Open in urlscan Pro 89.35.77.25 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

86 kBTransfer

238 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

preformanceamazon-it-non-complia.effectiveflux.ro Open in urlscan Pro
89.35.77.25 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

86 kB
Transfer

238 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!