urlscan.io logo urlscan.io
SecurityTrails logo

amazon-test.afs-incentives.de Open in urlscan Pro
5.45.109.248  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://amazon-test.afs-incentives.de/
Submission Tags: @phishunt_io
Submission: On December 09 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 5.45.109.248, located in Nuremberg, Germany and belongs to netcup-AS netcup GmbH, DE. The main domain is amazon-test.afs-incentives.de.
TLS certificate: Issued by E6 on December 9th 2024. Valid for: 3 months.
This is the only time amazon-test.afs-incentives.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
5 5.45.109.248 197540 (netcup-AS...)
3 2600:9000:225... 16509 (AMAZON-02)
8 2
Apex Domain
Subdomains		 Transfer
5 afs-incentives.de
amazon-test.afs-incentives.de
224 KB
3 media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 442
110 KB
8 2
Domain Requested by
5 amazon-test.afs-incentives.de amazon-test.afs-incentives.de
3 m.media-amazon.com amazon-test.afs-incentives.de
8 2

This site contains links to these domains. Also see Links.

Domain
www.amazon.de
Subject Issuer Validity Valid
amazon-test.afs-incentives.de
E6		 2024-12-09 -
2025-03-09		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2024-10-10 -
2025-09-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://amazon-test.afs-incentives.de/
Frame ID: 344D126EC13DAE46EDA6C95F6C691B79
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

334 kB
Transfer

350 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
amazon-test.afs-incentives.de/ 		27 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://amazon-test.afs-incentives.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
5.45.109.248 Nuremberg, Germany, ASN197540 (netcup-AS netcup GmbH, DE),
Reverse DNS
v2202104147576151995.megasrv.de
Software
nginx/1.22.1 /
Resource Hash
cd0d907b558e1f58a11ee638380467ae5c9e114ca2898e8e0001fbc948473ec0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 09 Dec 2024 10:07:47 GMT
Server
nginx/1.22.1
Transfer-Encoding
chunked
61B8bUeUR1L._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31WoRZHct0L..css
amazon-test.afs-incentives.de/Amazon-Dateien/ 		131 KB
132 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amazon-test.afs-incentives.de/Amazon-Dateien/61B8bUeUR1L._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31WoRZHct0L..css
Requested by
Host: amazon-test.afs-incentives.de
URL: https://amazon-test.afs-incentives.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
5.45.109.248 Nuremberg, Germany, ASN197540 (netcup-AS netcup GmbH, DE),
Reverse DNS
v2202104147576151995.megasrv.de
Software
nginx/1.22.1 /
Resource Hash
a939020079f4160f16ffeea9bfb9e27c3d3a988adf399ba9ccefe456cd82da84

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://amazon-test.afs-incentives.de/

Response headers

ETag
"6756a93c-20df5"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
134645
Date
Mon, 09 Dec 2024 10:07:47 GMT
Content-Type
text/css
Last-Modified
Mon, 09 Dec 2024 08:24:28 GMT
Server
nginx/1.22.1
01SdjaY0ZsL._RC_31jdWD+JB+L.css,51E5CuE4VpL.css_.css
amazon-test.afs-incentives.de/Amazon-Dateien/ 		62 KB
62 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amazon-test.afs-incentives.de/Amazon-Dateien/01SdjaY0ZsL._RC_31jdWD+JB+L.css,51E5CuE4VpL.css_.css
Requested by
Host: amazon-test.afs-incentives.de
URL: https://amazon-test.afs-incentives.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
5.45.109.248 Nuremberg, Germany, ASN197540 (netcup-AS netcup GmbH, DE),
Reverse DNS
v2202104147576151995.megasrv.de
Software
nginx/1.22.1 /
Resource Hash
4769c705ae0bfa3087930ce7e06cd17c0ee5fe7599f53a9ecb7ed893ee2f0314

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://amazon-test.afs-incentives.de/

Response headers

ETag
"6756a93c-f7e5"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
63461
Date
Mon, 09 Dec 2024 10:07:47 GMT
Content-Type
text/css
Last-Modified
Mon, 09 Dec 2024 08:24:28 GMT
Server
nginx/1.22.1
21cwI2AAWQL.css
amazon-test.afs-incentives.de/Amazon-Dateien/ 		5 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://amazon-test.afs-incentives.de/Amazon-Dateien/21cwI2AAWQL.css
Requested by
Host: amazon-test.afs-incentives.de
URL: https://amazon-test.afs-incentives.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
5.45.109.248 Nuremberg, Germany, ASN197540 (netcup-AS netcup GmbH, DE),
Reverse DNS
v2202104147576151995.megasrv.de
Software
nginx/1.22.1 /
Resource Hash
14a51947c7e59e5fb51284df59673595073d9a07243d664f82b904b10ecbff4b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://amazon-test.afs-incentives.de/

Response headers

ETag
"6756a93c-1538"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5432
Date
Mon, 09 Dec 2024 10:07:47 GMT
Content-Type
text/css
Last-Modified
Mon, 09 Dec 2024 08:24:28 GMT
Server
nginx/1.22.1
mPGmT0r6IeTyIee.png
m.media-amazon.com/images/S/sash/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Requested by
Host: amazon-test.afs-incentives.de
URL: https://amazon-test.afs-incentives.de/Amazon-Dateien/61B8bUeUR1L._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31WoRZHct0L..css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1600:1d:d7f6:39d4:e6e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://amazon-test.afs-incentives.de/

Response headers

x-amz-ir-id
b570b2ca-509f-40c9-b095-f94914e8519c
surrogate-key
x-cache-739 /images/S/sash/mPGmT0r6IeTyIee
age
10835373
expires
Fri, 22 Jul 2044 23:02:54 GMT
alt-svc
h3=":443"; ma=86400
server-timing
provider;desc="cf"
x-cache
Hit from cloudfront
x-amz-cf-id
gu0GQN3qezfAz3hG7PB0JINhGntylkpGb5S8V6iqX22kkPqkVZrZbw==
date
Sat, 27 Jul 2024 23:02:54 GMT
content-type
image/png
vary
Accept-Encoding
x-nginx-cache-status
HIT
last-modified
Tue, 17 Nov 2020 23:31:33 GMT
edge-cache-tag
x-cache-739,/images/S/sash/mPGmT0r6IeTyIee
cache-control
max-age=630720000,public
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
accept-ch
Sec-CH-UA-Form-Factors, Sec-CH-Viewport-Width, Sec-CH-Width, Sec-CH-Viewport-Height, Sec-CH-DPR, ECT
via
1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
27972
x-amz-cf-pop
FRA60-P3
server
Server
pDxWAF1pBB0dzGB.woff2
m.media-amazon.com/images/S/sash/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2
Requested by
Host: amazon-test.afs-incentives.de
URL: https://amazon-test.afs-incentives.de/Amazon-Dateien/61B8bUeUR1L._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31WoRZHct0L..css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1600:1d:d7f6:39d4:e6e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://amazon-test.afs-incentives.de
Referer
https://amazon-test.afs-incentives.de/

Response headers

x-amz-ir-id
4fdce50e-16ed-42bc-b6f3-3f079f140567
surrogate-key
x-cache-788 /images/S/sash/pDxWAF1pBB0dzGB
age
4580146
expires
Fri, 15 Apr 2044 16:33:19 GMT
alt-svc
h3=":443"; ma=86400
server-timing
provider;desc="cf"
x-cache
Hit from cloudfront
x-amz-cf-id
_TJgP9DV428KhSJHsVuSqG3eoomM4V2PLQRvZeJSryiCuRQO9jgm7A==
date
Fri, 29 Nov 2024 21:15:18 GMT
content-type
application/font-woff2; charset=utf-8
last-modified
Fri, 30 Oct 2020 21:19:16 GMT
x-nginx-cache-status
HIT
edge-cache-tag
x-cache-788,/images/S/sash/pDxWAF1pBB0dzGB
cache-control
max-age=630720000,public
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
accept-ch
Sec-CH-UA-Form-Factors, Sec-CH-Viewport-Width, Sec-CH-Width, Sec-CH-Viewport-Height, Sec-CH-DPR, ECT
via
1.1 544814e402956ba93c0a2d2b923e94c2.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
16616
x-amz-cf-pop
FRA60-P3
server
Server
AmazonEmber_W_Bd.woff2
m.media-amazon.com/images/G/01/wg/assets/fonts/ 		64 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://m.media-amazon.com/images/G/01/wg/assets/fonts/AmazonEmber_W_Bd.woff2
Requested by
Host: amazon-test.afs-incentives.de
URL: https://amazon-test.afs-incentives.de/Amazon-Dateien/01SdjaY0ZsL._RC_31jdWD+JB+L.css,51E5CuE4VpL.css_.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1600:1d:d7f6:39d4:e6e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
fae8d9892169edc72006fbc01c8a55c20c98ddd38f1fb927e817d290f398ca92

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://amazon-test.afs-incentives.de
Referer
https://amazon-test.afs-incentives.de/

Response headers

x-amz-ir-id
8aed38a3-32af-492f-abd5-078674738420
surrogate-key
x-cache-874 /images/G/01/wg/assets/fonts/AmazonEmber_W_Bd
age
86306
expires
Sun, 08 Dec 2024 15:25:17 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cdn-cache-hit,cdn-pop;desc="FRA60-P3",cdn-rid;desc="3rG1dkH4xA445Agg7vZPIVO-_zIJFISy5CHJdQqGDszaXvrut3DUzQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=1,provider;desc="cf"
x-cache
Hit from cloudfront
x-amz-cf-id
3rG1dkH4xA445Agg7vZPIVO-_zIJFISy5CHJdQqGDszaXvrut3DUzQ==
date
Sun, 08 Dec 2024 11:24:40 GMT
content-type
application/font-woff2
vary
Accept-Encoding
x-nginx-cache-status
HIT
last-modified
Mon, 20 Nov 2017 19:35:22 GMT
edge-cache-tag
x-cache-874,/images/G/01/wg/assets/fonts/AmazonEmber_W_Bd
cache-control
max-age=86400,public
timing-allow-origin
https://www.amazon.com
accept-ch
Sec-CH-UA-Form-Factors, Sec-CH-Viewport-Width, Sec-CH-Width, Sec-CH-Viewport-Height, Sec-CH-DPR, ECT
via
1.1 544814e402956ba93c0a2d2b923e94c2.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
65400
x-amz-cf-pop
FRA60-P3
server
Server
favicon.ico
amazon-test.afs-incentives.de/Amazon-Dateien/ 		17 KB
17 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://amazon-test.afs-incentives.de/Amazon-Dateien/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
5.45.109.248 Nuremberg, Germany, ASN197540 (netcup-AS netcup GmbH, DE),
Reverse DNS
v2202104147576151995.megasrv.de
Software
nginx/1.22.1 /
Resource Hash
17d02e2db6dbedb95dd449d06868c147ac2c3b5371497bcb9407e75336a99e09

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://amazon-test.afs-incentives.de/

Response headers

ETag
"6756a93c-4486"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
17542
Date
Mon, 09 Dec 2024 10:07:47 GMT
Content-Type
image/x-icon
Last-Modified
Mon, 09 Dec 2024 08:24:28 GMT
Server
nginx/1.22.1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| eMailFenster object| passwortFenster object| errorMessage object| mailAdressenUebergabe function| weiter function| ShowErrorDiv

0 Cookies

2 Console Messages

Source Level URL
Text
recommendation verbose URL: https://amazon-test.afs-incentives.de/
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
recommendation verbose URL: https://amazon-test.afs-incentives.de/
Message:
[DOM] Password forms should have (optionally hidden) username fields for accessibility: (More info: https://goo.gl/9p2vKq) %o