support-amaizon-co.jp.theaccincaxd.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 66.70.227.212, located in Trumbull, United States and belongs to OVH, FR. The main domain is support-amaizon-co.jp.theaccincaxd.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 15th 2017. Valid for: 3 months.

This is the only time support-amaizon-co.jp.theaccincaxd.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
5	66.70.227.212 66.70.227.212	16276 (OVH) (OVH)
2	52.85.88.69 52.85.88.69	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	2

5 66.70.227.212 (Trumbull, United States)

ASN16276 (OVH, FR)
PTR: ip212.ip-66-70-227.net

support-amaizon-co.jp.theaccincaxd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.85.88.69 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-88-69.jfk6.r.cloudfront.net

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	theaccincaxd.com support-amaizon-co.jp.theaccincaxd.com	161 KB
2	ssl-images-amazon.com images-na.ssl-images-amazon.com	28 KB
7	2

	Domain	Requested by
5	support-amaizon-co.jp.theaccincaxd.com	support-amaizon-co.jp.theaccincaxd.com
2	images-na.ssl-images-amazon.com	support-amaizon-co.jp.theaccincaxd.com
7	2

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid
support-amaizon-co.jp.theaccincaxd.com Let's Encrypt Authority X3	`2017-08-15` - `2017-11-13`	3 months	crt.sh
Images-na.ssl-images-amazon.com Symantec Class 3 Secure Server CA - G4	`2016-09-23` - `2017-10-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php
Frame ID: 23812.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

189 kB
Transfer

189 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ref=ap_frn_logo
Title: Amazon

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request step2.php Show response support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/	10 KB 10 KB	1952ms 141ms	Document text/html	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `2587409ec0b55c5accb751ed9f4978869af550fd129b6237bd5a336b1e1b893b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 14:49:23 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ClientSideMetricsAUIJavascript-6f4530fbabd6f27cfdd6766c550b5c5327f8aa3d._V2_.js Show response support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/js/	18 KB 18 KB	291ms 98ms	Script application/javascript	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/js/ClientSideMetricsAUIJavascript-6f4530fbabd6f27cfdd6766c550b5c5327f8aa3d._V2_.js Requested by Host: support-amaizon-co.jp.theaccincaxd.com URL: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `481d432b9d9952da24ed30ff58462952b6635f2aebae16619be65888371f79f6` Request headers Referer https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 14:49:23 GMT Last-Modified Tue, 15 Aug 2017 09:52:52 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18305
GET H/1.1	200 OK	AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/css/	117 KB 117 KB	97ms 97ms	Stylesheet text/css	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/css/AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css Requested by Host: support-amaizon-co.jp.theaccincaxd.com URL: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `9fb53e780111203d3864dabd3c11adf9a721730f19a06e228b9e8c833d504f26` Request headers Referer https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 14:49:23 GMT Last-Modified Tue, 15 Aug 2017 09:52:52 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 120313
GET H/1.1	200 OK	AuthenticationPortalAssets-90049572e0ba71bab4f1eeaa84f8ad239ac52087._V2_.css support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/css/	3 KB 3 KB	292ms 100ms	Stylesheet text/css	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/css/AuthenticationPortalAssets-90049572e0ba71bab4f1eeaa84f8ad239ac52087._V2_.css Requested by Host: support-amaizon-co.jp.theaccincaxd.com URL: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `c17797b91ea19d8ee8df451832ee58bdad1163d8b59a060cb86ec2f014652557` Request headers Referer https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 14:49:23 GMT Last-Modified Tue, 15 Aug 2017 09:52:52 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2913
GET H/1.1	200 OK	fwcim._CB342129162_.js Show response support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/js/	13 KB 13 KB	289ms 97ms	Script application/javascript	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/js/fwcim._CB342129162_.js Requested by Host: support-amaizon-co.jp.theaccincaxd.com URL: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `ce80ee2ee4c7f0f305633f0b21df9706727e3cad8e33fdd770eaff7473eedf3a` Request headers Referer https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 14:49:23 GMT Last-Modified Tue, 15 Aug 2017 09:52:52 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 12822
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	25 KB 25 KB	280ms 99ms	Image image/png	52.85.88.69 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png Requested by Host: support-amaizon-co.jp.theaccincaxd.com URL: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.85.88.69 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-85-88-69.jfk6.r.cloudfront.net Software Server / Resource Hash `3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a` Request headers Referer https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/css/AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Wed, 31 May 2017 06:49:58 GMT Via 1.1 01ecdc212033db2688d221d4212e4efd.cloudfront.net (CloudFront) Age 7116421 X-Cache Hit from cloudfront Connection keep-alive Content-Length 25262 Last-Modified Fri, 27 May 2016 17:30:51 GMT Server Server Content-Type image/png; charset=utf-8 Access-Control-Allow-Origin * Access-Control-Expose-Headers content-length,x-cache Cache-Control max-age=630720000,public X-Amz-IR-Id 1e732123-f99b-414f-b196-613413208501 Timing-Allow-Origin https://www.amazon.com X-Amz-Cf-Id yUcKSR23ij3E5P5rPlFlEcn3uWDjOKS-iVVv02TkEGdwWQEHbGF4kw== Expires Wed, 18 May 2033 03:33:20 GMT
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	4 KB 4 KB	274ms 93ms	Image image/png	52.85.88.69 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea._V2_.png Requested by Host: support-amaizon-co.jp.theaccincaxd.com URL: https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.85.88.69 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-85-88-69.jfk6.r.cloudfront.net Software Server / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers Referer https://support-amaizon-co.jp.theaccincaxd.com/ap/confirmation/css/AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 10 Oct 2016 20:55:16 GMT Via 1.1 a536f7c9dbedc2b462a158901fcd8254.cloudfront.net (CloudFront) Last-Modified Sat, 10 Oct 2015 00:40:08 GMT Server Server Age 27196286 X-Cache Hit from cloudfront Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=630720000,public Connection keep-alive Content-Length 3589 X-Amz-Cf-Id fX-ozsmZm4jAhsddr9jXZ6twe7GkraAWjTfW4tz3hhlPbkn_5E9YuA== Expires Wed, 18 May 2033 03:33:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-na.ssl-images-amazon.com
support-amaizon-co.jp.theaccincaxd.com
52.85.88.69
66.70.227.212
2587409ec0b55c5accb751ed9f4978869af550fd129b6237bd5a336b1e1b893b
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
481d432b9d9952da24ed30ff58462952b6635f2aebae16619be65888371f79f6
9fb53e780111203d3864dabd3c11adf9a721730f19a06e228b9e8c833d504f26
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
c17797b91ea19d8ee8df451832ee58bdad1163d8b59a060cb86ec2f014652557
ce80ee2ee4c7f0f305633f0b21df9706727e3cad8e33fdd770eaff7473eedf3a

support-amaizon-co.jp.theaccincaxd.com Open in urlscan Pro 66.70.227.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

189 kBTransfer

189 kBSize

0 Cookies

1 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

support-amaizon-co.jp.theaccincaxd.com Open in urlscan Pro
66.70.227.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

189 kB
Transfer

189 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!