amazon.us-securelogon.xyz Open in urlscan Pro
2606:4700:3033::ac43:a5ad  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response amazon.us-securelogon.xyz/	3 KB 2 KB	126ms 108ms	Document text/html	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 38f8ca21b22b7bdd2cb854d2ea064cda9540e02932ee08362d7dec773a7fd84a Request headers :method GET :authority amazon.us-securelogon.xyz :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287; expires=Thu, 27-May-21 17:08:07 GMT; path=/; domain=.us-securelogon.xyz; HttpOnly; SameSite=Lax; Secure vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 09b5e67f740000323c1fb55000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PGbUcTkzUmvsavu77o7Lo%2F8aeOat2d6O0fRW%2FbEuXMvIE%2FGb3caPuveuEqDaxuYLUIFoh4xvog0gYtfM8EA1c%2F6hyc2%2F3KjHuFGpe3MNkS9R5Y2B29iNLqZYS0IAOrCV92XDvybw"}]} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6469a6abecea323c-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3-29	200	bootstrap-grid.min.css amazon.us-securelogon.xyz/css/	47 KB 5 KB	128ms 115ms	Stylesheet text/css	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/css/bootstrap-grid.min.css Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2101fcb9d7be8eafb85ec8fa0eac21b16ee842bc9156d0f83e72d53979ae648 Request headers :path /css/bootstrap-grid.min.css pragma no-cache cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/ :scheme https sec-fetch-site same-origin :method GET Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 27 Apr 2021 17:06:26 GMT server cloudflare etag W/"bc8d-5c0f74853f390" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MEiP8qH9lQUvSxXtULc3y%2BS9Ke58xDYAYApoLhgFqHVZiekidzTGkEx7ImKMfakDJeUKv%2Fy7LqKXG4rrw8M6ObJHhJGTudM1ISC7zV4x8nni3O2jC02lqnJxu2FX2J4uElnoQzhv"}],"max_age":604800} content-type text/css cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 6469a6acb99b2b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e67ff300002b1e1a939000000001
GET H3-29	200	style.css amazon.us-securelogon.xyz/css/	6 KB 2 KB	116ms 103ms	Stylesheet text/css	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/css/style.css Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 304aed270a44ead805a366a2e47f4f1a052fd130f15992bc60aedad3b5b8aafc Request headers :path /css/style.css pragma no-cache cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/ :scheme https sec-fetch-site same-origin :method GET Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} cf-polished origSize=6183 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e67ff300002b1eda1ef000000001 last-modified Tue, 27 Apr 2021 17:06:26 GMT server cloudflare etag W/"1827-5c0f7485366ef" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=afjyqpxFbK3QG3lOdK2n5gpXcKb2oseUHArVXEFZplHoNshmnh3ljA%2FV6NNsPd1zKvi0nkVKlGbr%2FKwtHpvFFbjTYZWpTQVngGK1wPqi66MerEUOeWtMCblspZMgS2DN0sqivTj4"}],"max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 6469a6acb9982b1e-FRA cf-bgj minify
GET H3-29	200	logo.png amazon.us-securelogon.xyz/img/	5 KB 6 KB	113ms 101ms	Image image/png	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://amazon.us-securelogon.xyz/img/logo.png Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2f9c5d11c3e6c08f4535bc3bedbee7387277be26abd2333be94754a0b3a41222 Request headers :path /img/logo.png pragma no-cache cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/ :scheme https sec-fetch-site same-origin :method GET Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 5595 cf-request-id 09b5e67ff400002b1ee60c0000000001 last-modified Tue, 27 Apr 2021 17:06:31 GMT server cloudflare etag "15db-5c0f748a1b60c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Qz1Agp2xT5CoP%2BiKSM4kArA9SfNRpwtS6FXIjBlSZ9GLoDujfdkOl8ScpfOLKzHSm90fKfb96BjctYNljX%2Fm8xioWNHbQJIB20Iyj4BXBgxVGS37MZS5BjhcC60p%2B5nLtAAqzfvS"}],"max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 6469a6acb9a32b1e-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	88 KB 35 KB	35ms 35ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-109753969-1 Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 283ce68eb481382c64248559f2235bbff145380d2a3bbe860d8d27dda2fe1ad1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35806 x-xss-protection 0 last-modified Tue, 27 Apr 2021 15:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 27 Apr 2021 17:08:07 GMT
GET H3-29	200	jquery-3.4.1.min.js Show response amazon.us-securelogon.xyz/js/	86 KB 30 KB	120ms 109ms	Script application/javascript	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/js/jquery-3.4.1.min.js Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 736173659d4431b8a53a08aacc1bec3ad3a2f44df5209c09d76c265374698302 Request headers :path /js/jquery-3.4.1.min.js pragma no-cache cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/ :scheme https sec-fetch-site same-origin :method GET Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT content-encoding br cf-cache-status HIT last-modified Tue, 27 Apr 2021 17:06:32 GMT server cloudflare etag W/"157fb-5c0f748ace175" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IwUWQujxjdqnpVNVc0mJOr%2FyV1qjzkHnw%2BwZDe4D4681mvLfw5GNpc01Zyj%2Bgg4F27a28eQwkKf9M%2BQw8idXtbe6Os6fIw%2FcnxY3R6duKbQARyvc3sbma%2F31j0vCTHjSTOaZrSgS"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 6469a6acb9922b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e67ff200002b1ee7a76000000001
GET H3-29	200	main.js Show response amazon.us-securelogon.xyz/js/	384 B 788 B	114ms 102ms	Script application/javascript	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/js/main.js Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85d323dd5e77cc3a87b9e185661588dd49ffd1277c6a67d9f932431eea880ae3 Request headers :path /js/main.js pragma no-cache cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/ :scheme https sec-fetch-site same-origin :method GET Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:07 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e67ff400002b1ec3254000000001 last-modified Tue, 27 Apr 2021 17:06:33 GMT server cloudflare etag W/"180-5c0f748bf2163" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ujs%2F6zEVOSUdfUuhYexqgV7YAdvthumG0yF0FPsqoN%2BSey52z9GmwhmUMSny2NdFPRWL9FezsgsDMDgKTzjknz9j0YcvlFSXmAZEZkDfNZ%2FdE5lF3jBY72TNqEvYx5ra37JTgjEC"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 6469a6acb99e2b1e-FRA cf-bgj minify
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-109753969-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 09 Apr 2021 23:59:54 GMT server Golfe2 age 6325 date Tue, 27 Apr 2021 15:22:42 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19569 expires Tue, 27 Apr 2021 17:22:42 GMT
GET H3-29	404	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 amazon.us-securelogon.xyz/fonts/	0 0	104ms 103ms	Font text/html	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/fonts/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/css/style.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-fetch-mode cors origin https://amazon.us-securelogon.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 :path /fonts/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/css/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://amazon.us-securelogon.xyz Referer https://amazon.us-securelogon.xyz/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:08 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=680sonlibaR5LVzOB7C7cJyWtkcbhESusvju0tmMaz%2FMVYaJQpZatDApKMP2VS%2Bi2G4bINmh9iMc1t7KHeYUZIDP6ewhyT1p8hXTMjhZQHALgMMNU0uK0guAt4ovl2SOD6ImmXVS"}],"max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6469a6ad9bc72b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e6808300002b1ec620f000000001
GET H3-29	404	AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 amazon.us-securelogon.xyz/fonts/	0 0	112ms 112ms	Font text/html	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/fonts/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/css/style.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-fetch-mode cors origin https://amazon.us-securelogon.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287 :path /fonts/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/css/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://amazon.us-securelogon.xyz Referer https://amazon.us-securelogon.xyz/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:08 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gqtmdis4PdJusvTIqCZXTmMuOLrhgrMl86S9hDkuW0DuM4gX58fi3Uqp8cbkt0MWS%2FrG14jzjNC3xZqKqOndpxXdlnngyucvsz6t3qIlVU3MjR%2BeH6vKEIY7u3mP0PS1BRCR3z7%2F"}],"max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6469a6ad9bcf2b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e6808400002b1ece880000000001
POST H3-29	200	collect Show response www.google-analytics.com/j/	2 B 22 B	27ms 13ms	XHR text/plain	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1653086633&t=pageview&_s=1&dl=https%3A%2F%2Famazon.us-securelogon.xyz%2F&ul=en-us&de=UTF-8&dt=Amazon&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=614341974&gjid=1696478533&cid=1459278700.1619543288&tid=UA-109753969-1&_gid=1634922789.1619543288&_r=1&gtm=2ou4e1&z=1781732668 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 27 Apr 2021 17:08:07 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://amazon.us-securelogon.xyz cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 95 B	15ms 15ms	XHR text/plain	2a00:1450:400c:c0c::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-109753969-1&cid=1459278700.1619543288&jid=614341974&gjid=1696478533&_gid=1634922789.1619543288&_u=IEBAAUAAAAAAAC~&z=1469317163 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 27 Apr 2021 17:08:08 GMT content-type text/plain access-control-allow-origin https://amazon.us-securelogon.xyz cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	53ms 52ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-109753969-1&cid=1459278700.1619543288&jid=614341974&_u=IEBAAUAAAAAAAC~&z=1525151952 Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 27 Apr 2021 17:08:08 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	46ms 46ms	Image image/gif	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-109753969-1&cid=1459278700.1619543288&jid=614341974&_u=IEBAAUAAAAAAAC~&z=1525151952 Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://amazon.us-securelogon.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 27 Apr 2021 17:08:08 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	404	AmazonUIBaseCSS-amazonember_rg-8a9db402d8966ae93717c348b9ab0bd08703a7a7._V2_.woff amazon.us-securelogon.xyz/fonts/	0 0	101ms 101ms	Font text/html	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/fonts/AmazonUIBaseCSS-amazonember_rg-8a9db402d8966ae93717c348b9ab0bd08703a7a7._V2_.woff Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/css/style.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-fetch-mode cors origin https://amazon.us-securelogon.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287; _ga=GA1.2.1459278700.1619543288; _gid=GA1.2.1634922789.1619543288; _gat_gtag_UA_109753969_1=1 :path /fonts/AmazonUIBaseCSS-amazonember_rg-8a9db402d8966ae93717c348b9ab0bd08703a7a7._V2_.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/css/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://amazon.us-securelogon.xyz Referer https://amazon.us-securelogon.xyz/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:08 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OW%2BinABD98wA329igmhm5s6ybjDNUbsRe9EykxS2w6rxYQAEDpTCm6HwWd1uZqJL9D3uhEIWG5WQAeE5P5gRFngaWNBZDPLnG080D8F%2FE2%2FXrgZVR1R13lXhy72u1ASnVveXdZLA"}],"max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6469a6ae4dd22b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e680e900002b1ec621f000000001
GET H3-29	404	AmazonUIBaseCSS-amazonember_bd-b605252f87b8b3df5ae206596dac0938fc5888bc._V2_.woff amazon.us-securelogon.xyz/fonts/	0 0	102ms 102ms	Font text/html	2606:4700:3033::ac43:a5ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://amazon.us-securelogon.xyz/fonts/AmazonUIBaseCSS-amazonember_bd-b605252f87b8b3df5ae206596dac0938fc5888bc._V2_.woff Requested by Host: amazon.us-securelogon.xyz URL: https://amazon.us-securelogon.xyz/css/style.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:a5ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-fetch-mode cors origin https://amazon.us-securelogon.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __cfduid=ddfa0dadee1e478bafb66344b41a078a41619543287; _ga=GA1.2.1459278700.1619543288; _gid=GA1.2.1634922789.1619543288; _gat_gtag_UA_109753969_1=1 :path /fonts/AmazonUIBaseCSS-amazonember_bd-b605252f87b8b3df5ae206596dac0938fc5888bc._V2_.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority amazon.us-securelogon.xyz referer https://amazon.us-securelogon.xyz/css/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://amazon.us-securelogon.xyz Referer https://amazon.us-securelogon.xyz/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 27 Apr 2021 17:08:08 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=T4FEcBgq1K52YDDyKY2METthliWCR79U4Tzjv5Diwh9HdEHa15B0KlAu4rJ0L232Ng6UYL45UEWFAWin1JNBQGkeVju1X6%2FlpZxeRx%2FzR4m%2Fce3XRz15AJH5ibTXMG9QlefffOp7"}],"max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6469a6ae4df62b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09b5e680f200002b1e142c0000000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| google_tag_manager object| dataLayer function| gtag object| google_tag_data string| GoogleAnalyticsObject function| ga function| $ function| jQuery object| gaplugins object| gaGlobal object| gaData

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.us-securelogon.xyz/	1970-01-20 11:23:35	Name: _ga Value: GA1.2.1459278700.1619543288
			.us-securelogon.xyz/	1970-01-19 17:52:23	Name: _gat_gtag_UA_109753969_1 Value: 1
			.us-securelogon.xyz/	1970-01-19 17:53:49	Name: _gid Value: GA1.2.1634922789.1619543288
			.us-securelogon.xyz/	1970-01-19 18:35:35	Name: __cfduid Value: ddfa0dadee1e478bafb66344b41a078a41619543287

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.us-securelogon.xyz
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
2606:4700:3033::ac43:a5ad
2a00:1450:4001:80e::2004
2a00:1450:4001:812::200e
2a00:1450:4001:813::2008
2a00:1450:4001:827::2003
2a00:1450:4001:82f::200e
2a00:1450:400c:c0c::9a
283ce68eb481382c64248559f2235bbff145380d2a3bbe860d8d27dda2fe1ad1
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2f9c5d11c3e6c08f4535bc3bedbee7387277be26abd2333be94754a0b3a41222
304aed270a44ead805a366a2e47f4f1a052fd130f15992bc60aedad3b5b8aafc
38f8ca21b22b7bdd2cb854d2ea064cda9540e02932ee08362d7dec773a7fd84a
736173659d4431b8a53a08aacc1bec3ad3a2f44df5209c09d76c265374698302
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85d323dd5e77cc3a87b9e185661588dd49ffd1277c6a67d9f932431eea880ae3
d2101fcb9d7be8eafb85ec8fa0eac21b16ee842bc9156d0f83e72d53979ae648
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629