customer-accounts.com Open in urlscan Pro
71.5.110.34  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set 61za0y6b8xz9p6l7 Show response customer-accounts.com/	8 KB 3 KB	825ms 445ms	Document text/html	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash 6171a9e09a938445034591ce772a7ebce77429e4245b3371cde99720114f7509 Request headers Host customer-accounts.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers Date Tue, 24 Mar 2020 13:00:28 GMT Server Lucy Set-Cookie PHPSESSID=sd3o041saqrvamb14ks5l6h3r5; path=/; secure; HttpOnly link=61za0y6b8xz9p6l7; expires=Thu, 23-Apr-2020 13:00:28 GMT; Max-Age=2592000; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Access-Control-Allow-Origin * Access-Control-Allow-Methods * Access-Control-Allow-Headers * Content-Length 2403 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	events.js Show response customer-accounts.com/js/	558 B 917 B	125ms 124ms	Script text/javascript	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/js/events.js Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150 Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 558 Keep-Alive timeout=5, max=99 Expires Wed, 25 Mar 2020 13:00:29 GMT
GET H/1.1	200 OK	style.css customer-accounts.com/public/campaign/131/166/11/	140 KB 24 KB	254ms 128ms	Stylesheet text/css	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/public/campaign/131/166/11/style.css Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash b59e8d79fff2cf72fb11816a5729683b34572f6b5cc809bc31f724100d2fac2a Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Content-Encoding gzip Last-Modified Tue, 25 Feb 2020 15:12:46 GMT Server Lucy ETag "2311b-59f67eb9ac942-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 24429
GET H/1.1	200 OK	logo.png customer-accounts.com/public/campaign/131/166/11/	2 KB 2 KB	489ms 122ms	Image image/png	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Show image Full URL https://customer-accounts.com/public/campaign/131/166/11/logo.png Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash 75f6119b2131557dade1f64eb6b63f603741f9fb8efeab3f9850164802e00ebe Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Last-Modified Tue, 25 Feb 2020 15:12:46 GMT Server Lucy ETag "8c9-59f67eb9ac942" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2249
GET H/1.1	200 OK	jquery-1.11.3.min.js Show response customer-accounts.com/public/campaign/131/166/11/	94 KB 33 KB	367ms 126ms	Script application/javascript	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/public/campaign/131/166/11/jquery-1.11.3.min.js Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash 15c7c891bfc85832abbc932c83934ca6849494bb4643e4ac4582feb87a82522e Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Content-Encoding gzip Last-Modified Tue, 25 Feb 2020 15:12:46 GMT Server Lucy ETag "176f9-59f67eb9ac942-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 33304
GET H/1.1	200 OK	timeme.min.js Show response customer-accounts.com/js/	4 KB 4 KB	236ms 122ms	Script text/javascript	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/js/timeme.min.js Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash 3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 4210 Keep-Alive timeout=5, max=100 Expires Wed, 25 Mar 2020 13:00:29 GMT
GET H/1.1	200 OK	time-tracker.js Show response customer-accounts.com/js/	927 B 1 KB	238ms 123ms	Script text/javascript	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/js/time-tracker.js Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash fa84ab42f56278cee474176c64f7c9441d0429387777d66e35a2b791e51a5728 Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 927 Keep-Alive timeout=5, max=100 Expires Wed, 25 Mar 2020 13:00:29 GMT
GET H/1.1	200 OK	analyse.js Show response customer-accounts.com/js/	3 KB 3 KB	358ms 122ms	Script text/javascript	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/js/analyse.js Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash df44e74c857de0cd2b94ae343fe1afced4203aacb6dce3a7107338b0c9a76593 Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 24 Mar 2020 13:00:29 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 2938 Keep-Alive timeout=5, max=99 Expires Wed, 25 Mar 2020 13:00:29 GMT
POST H/1.1	200 OK	run-analyse Show response customer-accounts.com/61za0y6b8xz9p6l7/	0 495 B	274ms 274ms	XHR text/html	71.5.110.34 ATOMIC
General Check archive.org Show headers Download Go to Full URL https://customer-accounts.com/61za0y6b8xz9p6l7/run-analyse Requested by Host: customer-accounts.com URL: https://customer-accounts.com/61za0y6b8xz9p6l7 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 71.5.110.34 Minneapolis, United States, ASN25694 (ATOMIC, US), Reverse DNS Software Lucy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://customer-accounts.com/61za0y6b8xz9p6l7 Origin https://customer-accounts.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundary6LhKvYFD7wHph8PQ Response headers Pragma no-cache Date Tue, 24 Mar 2020 13:00:29 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 0 Keep-Alive timeout=5, max=99 Expires Thu, 19 Nov 1981 08:52:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| lucyDispatchEvent function| $ function| jQuery number| cont_submit function| contSubmit object| TimeMe function| trackTime function| sendData object| dataAnalyse string| analysisUrl function| sendAnalyseData function| updateSocialStatus function| runAnalyse function| doAnalysis

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

customer-accounts.com
71.5.110.34
15c7c891bfc85832abbc932c83934ca6849494bb4643e4ac4582feb87a82522e
3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd
6171a9e09a938445034591ce772a7ebce77429e4245b3371cde99720114f7509
75f6119b2131557dade1f64eb6b63f603741f9fb8efeab3f9850164802e00ebe
a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150
b59e8d79fff2cf72fb11816a5729683b34572f6b5cc809bc31f724100d2fac2a
df44e74c857de0cd2b94ae343fe1afced4203aacb6dce3a7107338b0c9a76593
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa84ab42f56278cee474176c64f7c9441d0429387777d66e35a2b791e51a5728