main.d3firbroguy1zd.amplifyapp.com Open in urlscan Pro
143.204.98.124 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://main.d3firbroguy1zd.amplifyapp.com/
Effective URL:
https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes
Submission: On December 16 via manual (December 16th 2021, 4:18:50 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 143.204.98.124, located in United States and belongs to AMAZON-02, US. The main domain is main.d3firbroguy1zd.amplifyapp.com.
TLS certificate: Issued by Amazon on December 12th 2021. Valid for: a year.

This is the only time main.d3firbroguy1zd.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 10	143.204.98.124 143.204.98.124		16509 (AMAZON-02) (AMAZON-02)
9	1

10 143.204.98.124 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-124.fra50.r.cloudfront.net

main.d3firbroguy1zd.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	amplifyapp.com 1 redirects main.d3firbroguy1zd.amplifyapp.com	28 KB
9	1

	Domain	Requested by
10	main.d3firbroguy1zd.amplifyapp.com	1 redirects main.d3firbroguy1zd.amplifyapp.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
*.d3firbroguy1zd.amplifyapp.com Amazon	`2021-12-12` - `2023-01-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes
Frame ID: C6684AFDABAA30C5CA90FE3E05B58D52
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Wells Fargo Online Banking Security Verification

Page URL History Show full URLs

https://main.d3firbroguy1zd.amplifyapp.com/ Page URL
https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&e... Page URL

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

35 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://main.d3firbroguy1zd.amplifyapp.com/ Page URL
https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png HTTP 301
https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response main.d3firbroguy1zd.amplifyapp.com/	133 B 504 B	272ms 237ms	Document text/html	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d3firbroguy1zd.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html content-length 133 date Thu, 16 Dec 2021 16:18:46 GMT last-modified Sun, 12 Dec 2021 21:47:53 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 cache-control no-cache, s-maxage=2 etag "3bbf62fde972181e5c6802e8d32641f8" x-cache Miss from cloudfront via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id ohuD0aHp13_dEarjsB6yRd4zdgRrGkiIcMKSmr8NeQScjR4riOttNw==
GET H2	200	Primary Request inner_pag.html Show response main.d3firbroguy1zd.amplifyapp.com/	4 KB 2 KB	479ms 479ms	Document text/html	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `4cf1c9dd399bf10904d5f2b4d8e8833c63155450e75bcb1e900fd1bf4230fe13` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/ Response headers content-type text/html date Thu, 16 Dec 2021 16:18:47 GMT last-modified Sun, 12 Dec 2021 21:47:53 GMT x-amz-server-side-encryption AES256 server AmazonS3 cache-control no-cache, s-maxage=2 content-encoding gzip etag W/"e941cef533dd89d6974e4ef0c9e6363f" vary Accept-Encoding x-cache Miss from cloudfront via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id P40zeoacpfVLzKAoJ8ZtTJmVAeNt9cWBIJ1towxcV-D5Q6DrlMW9Jw==
GET H2	200	style.css main.d3firbroguy1zd.amplifyapp.com/css/	10 KB 2 KB	195ms 195ms	Stylesheet text/css	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `0d8f592d3aef440e69bc1b0c002930689e3334eb1f29206b021044e39a6d3dce` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 16:18:47 GMT content-encoding gzip etag W/"f5e73da88692d257c3aec5d79bf01454" last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Miss from cloudfront content-type text/css via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) cache-control no-cache, s-maxage=2 x-amz-cf-id llwnhrjqMFbk08pyLl3norN6bBkbOwOvZmLthzhscsQ6c-thxHo-ZQ==
GET H2	200	logo.jpg main.d3firbroguy1zd.amplifyapp.com/images/	12 KB 13 KB	208ms 207ms	Image image/jpeg	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/logo.jpg Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `6a4c9bda55c400bcf557984c93d42375a390367bd171727ca75ba5207e43d919` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 16 Dec 2021 16:18:47 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "87673e142907da15d749c074f102e286" x-cache Miss from cloudfront content-type image/jpeg cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 12523 x-amz-cf-id 5hfafYKLZhI-eTVJ05iQKW_yxliV6jW-VNEWYQlYy0vvceuQ4t8ndQ==
GET H2	200	icon3.png main.d3firbroguy1zd.amplifyapp.com/images/	1 KB 1 KB	987ms 986ms	Image image/png	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/icon3.png Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `69f44920ee566a8cb7fe4a97463c5cd363e5b56ce883da11b29a5f5a3d4ef35b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 16 Dec 2021 16:18:47 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "b1f2220d162273cc35f3458ad747f019" x-cache Miss from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 1108 x-amz-cf-id MZyUy8OFP42eigoi4Nr8M0-O5Xp_h52ChkRUUixtOlaOULCHN-wAjg==
GET H2	404	/ main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/ Redirect Chain https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/	133 B 133 B	211ms 210ms	Image text/html	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/ Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 16:18:46 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop FRA50-C1 x-cache Error from cloudfront content-type text/html content-length 133 x-amz-cf-id 4Qbfz7_rQzjhU16AyBHnsv0EOFtevxCu_Ncarvo59acoR1wP2rEqGg== Redirect headers date Thu, 16 Dec 2021 16:18:45 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront content-type application/xml location /images/bg_top.png/ content-length 0 x-amz-cf-id -HjG3Nz-ZWvE-lkOlYvlxXGcxtOTiLyjUiMw--dYffRxjfovTL5dJg==
GET H2	200	img1.png main.d3firbroguy1zd.amplifyapp.com/images/	3 KB 3 KB	192ms 192ms	Image image/png	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/img1.png Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `499f5e44488bef9456f38b42790051343e8abffdd38cfae4599ecc2ac7c82e47` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 16 Dec 2021 16:18:47 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "abacf27a0408017dd0969bcee925e0e6" x-cache Miss from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 3072 x-amz-cf-id 401COb0SYBR466gsG1pUkWHTsEUf0oksdn1afewvGNf8OfdvQLbhoA==
GET H2	200	img2.png main.d3firbroguy1zd.amplifyapp.com/images/	3 KB 3 KB	190ms 190ms	Image image/png	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/img2.png Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `d12f68075437ba046b2dc85e53dc081f9c11669d25f5d04c7d985851aff31d65` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 16 Dec 2021 16:18:47 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "64693f6ecaf19bd02c67b1e6744668db" x-cache Miss from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 3123 x-amz-cf-id LGf-qLGRkUF7cGWOFEVNVq5T204sdzd-qeqmGL0LU8CPSg8TB2oVMw==
GET H2	200	icon2.jpg main.d3firbroguy1zd.amplifyapp.com/images/	1 KB 2 KB	206ms 206ms	Image image/jpeg	143.204.98.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/icon2.jpg Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-124.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `a6f643918329fc1a927510f388543d5b084b85082e5d01f1080ff6518ec6f1f7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Thu, 16 Dec 2021 16:18:47 GMT via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "bb2ef3ddb66faae16f9243da31677c50" x-cache Miss from cloudfront content-type image/jpeg cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 1257 x-amz-cf-id 8z6KlWi81X8ItiejsRyNDw9oXWrZn8cf9tGeSwteMeZ1Ssvitw3dYw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/ Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

main.d3firbroguy1zd.amplifyapp.com
143.204.98.124
0d8f592d3aef440e69bc1b0c002930689e3334eb1f29206b021044e39a6d3dce
499f5e44488bef9456f38b42790051343e8abffdd38cfae4599ecc2ac7c82e47
4cf1c9dd399bf10904d5f2b4d8e8833c63155450e75bcb1e900fd1bf4230fe13
69f44920ee566a8cb7fe4a97463c5cd363e5b56ce883da11b29a5f5a3d4ef35b
6a4c9bda55c400bcf557984c93d42375a390367bd171727ca75ba5207e43d919
a6f643918329fc1a927510f388543d5b084b85082e5d01f1080ff6518ec6f1f7
baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3
d12f68075437ba046b2dc85e53dc081f9c11669d25f5d04c7d985851aff31d65

main.d3firbroguy1zd.amplifyapp.com Open in urlscan Pro 143.204.98.124 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

27 kBTransfer

35 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

main.d3firbroguy1zd.amplifyapp.com Open in urlscan Pro
143.204.98.124 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

35 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!