amazon.com-confirmation.account-update.information-login.mailing.pt
Open in
urlscan Pro
94.46.15.39
Malicious Activity!
Public Scan
Submission: On April 11 via automatic, source phishtank
Summary
This is the only time amazon.com-confirmation.account-update.information-login.mailing.pt was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 94.46.15.39 94.46.15.39 | 24768 (ALMOUROLTEC) (ALMOUROLTEC) | |
5 | 1 |
ASN24768 (ALMOUROLTEC, PT)
PTR: cps9.webserver.pt
amazon.com-confirmation.account-update.information-login.mailing.pt |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
mailing.pt
amazon.com-confirmation.account-update.information-login.mailing.pt |
25 KB |
5 | 1 |
Domain | Requested by | |
---|---|---|
5 | amazon.com-confirmation.account-update.information-login.mailing.pt |
amazon.com-confirmation.account-update.information-login.mailing.pt
|
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://amazon.com-confirmation.account-update.information-login.mailing.pt/Amazon/index/?616d617a6f6e2e636f6d2d636f6e6669726d6174696f6e2e6163636f756e742d7570646174652e696e666f726d6174696f6e2d6c6f67696e2e6d61696c696e672e7074
Frame ID: C88FDE6495555D3162D57D18ADE4DD59
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
amazon.com-confirmation.account-update.information-login.mailing.pt/Amazon/index/ |
12 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hea2.js
amazon.com-confirmation.account-update.information-login.mailing.pt/Amazon/index/content/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ap-flex-reduced-nav._3C8_.css
amazon.com-confirmation.account-update.information-login.mailing.pt/Amazon/index/content/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sign-in-secure._V192194766_.gif
amazon.com-confirmation.account-update.information-login.mailing.pt/Amazon/index/content/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amazon_logo_no-org_mid._V153387053_.png
amazon.com-confirmation.account-update.information-login.mailing.pt/Amazon/index/content/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Amazon (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amazon.com-confirmation.account-update.information-login.mailing.pt
94.46.15.39
605f462159b4e3b5352c949d60bf5c3bc109f79d3507f07e9e9b9275c53e2532
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
7acc1217fece28b9cb451b8f11f2a3eceeb819ab1e412ceec28008fc922d8366
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
8b4b09c8b0cf59b3dea74498a973cf02053d935db923209f878c3e2ddc1252e1