amazon-update.azurewebsites.net
Open in
urlscan Pro
104.43.129.105
Malicious Activity!
Public Scan
Submission: On April 11 via automatic, source openphish
Summary
TLS certificate: Issued by Microsoft IT TLS CA 4 on December 17th 2017. Valid for: 2 years.
This is the only time amazon-update.azurewebsites.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 104.43.129.105 104.43.129.105 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
4 | 143.204.99.194 143.204.99.194 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
10 | 2 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
amazon-update.azurewebsites.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-99-194.fra50.r.cloudfront.net
images-na.ssl-images-amazon.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
azurewebsites.net
amazon-update.azurewebsites.net |
67 KB |
4 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
56 KB |
10 | 2 |
Domain | Requested by | |
---|---|---|
6 | amazon-update.azurewebsites.net |
amazon-update.azurewebsites.net
|
4 | images-na.ssl-images-amazon.com |
amazon-update.azurewebsites.net
|
10 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.azurewebsites.net Microsoft IT TLS CA 4 |
2017-12-17 - 2019-12-17 |
2 years | crt.sh |
Images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2019-02-21 - 2019-07-19 |
5 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://amazon-update.azurewebsites.net/id/mm/9e10e8290325e5ff9dcb08e38314e61f/cirlo.php
Frame ID: 45B10D5700740255F0559B1F11CA3161
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Windows Server (Operating Systems) Expand
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
cirlo.php
amazon-update.azurewebsites.net/id/mm/9e10e8290325e5ff9dcb08e38314e61f/ |
31 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ap-flex-reduced-nav-2.1._V360593186_.css
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amazon_logo_no-org_mid._V153387053_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screen.css
amazon-update.azurewebsites.net/id/mm/9e10e8290325e5ff9dcb08e38314e61f/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
amazon-update.azurewebsites.net/id/mm/9e10e8290325e5ff9dcb08e38314e61f/lib/ |
122 KB 45 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.js
amazon-update.azurewebsites.net/id/mm/9e10e8290325e5ff9dcb08e38314e61f/ |
37 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cmxforms.js
amazon-update.azurewebsites.net/id/mm/9e10e8290325e5ff9dcb08e38314e61f/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-sprite.gif
images-na.ssl-images-amazon.com/images/G/01/x-locale/common/errors-alerts/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amznbtn-sprite03._V395592492_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
uedata
amazon-update.azurewebsites.net/ap/ |
103 B 103 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| ue_t0 string| ue_id object| ue_csm string| ue_url string| ue_pr string| ue_md number| ue_navtiming string| ue_mid string| ue_sid string| ue_furl number| ue_hob number| ueinit object| ue function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop number| ue_hoe function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.amazon-update.azurewebsites.net/ | Name: ARRAffinity Value: 13bb792150c31eb9bc6583dc93847bccd2b4a4aa8afafa5395b43dd48b32e982 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amazon-update.azurewebsites.net
images-na.ssl-images-amazon.com
104.43.129.105
143.204.99.194
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
30b9903f22b92d34d170f4cc0aa95becb2e1465e65bd5e53e75c8379037fa2a2
65fb0d927462babb4af3693d6c9e26100ac43359692cb828af45cd8c9716bac6
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1
b33084766584f9745823b8686c6b655a5f908b5e8cbb5ae96d6dc9441cbf7872
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a
d5d516d86c628dca6465b9b290a082a0b5e5ea6780dd908c7e0d539d2b87c7bf