emazon.azurewebsites.net
Open in
urlscan Pro
40.86.96.177
Malicious Activity!
Public Scan
URL:
http://emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/cirlo.php?cmd=login_submit&id=$praga$praga&se...
Submission: On July 03 via automatic, source phishtank
Submission: On July 03 via automatic, source phishtank
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 40.86.96.177, located in
Des Moines, United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US.
The main domain is emazon.azurewebsites.net.
This is the only time emazon.azurewebsites.net was scanned on urlscan.io!
This is the only time emazon.azurewebsites.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 40.86.96.177 40.86.96.177 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
| 4 | 52.222.152.248 52.222.152.248 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 12 | 2 |
8
40.86.96.177
(Des Moines, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
| emazon.azurewebsites.net |
4
52.222.152.248
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-152-248.fra53.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-152-248.fra53.r.cloudfront.net
| images-na.ssl-images-amazon.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
azurewebsites.net
emazon.azurewebsites.net |
67 KB |
| 4 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com |
56 KB |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | emazon.azurewebsites.net |
emazon.azurewebsites.net
|
| 4 | images-na.ssl-images-amazon.com |
emazon.azurewebsites.net
|
| 12 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| Images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2019-05-02 - 2020-04-23 |
a year | crt.sh |
| 1970-01-01 - 1970-01-01 |
a few seconds | crt.sh |
This page contains 1 frames:
Primary Page:
http://emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/cirlo.php?cmd=login_submit&id=$praga$praga&session=$praga$praga
Frame ID: DFE9E87245A2EA1FD3957D9E13DA5144
Requests: 12 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
cirlo.php
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/ |
31 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ap-flex-reduced-nav-2.1._V360593186_.css
images-na.ssl-images-amazon.com/images/G/01/authportal/flex/reduced-nav/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amazon_logo_no-org_mid._V153387053_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
screen.css
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/lib/ |
122 KB 45 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.validate.js
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/ |
37 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cmxforms.js
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
screen.css
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
error-sprite.gif
images-na.ssl-images-amazon.com/images/G/01/x-locale/common/errors-alerts/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cmxforms.js
emazon.azurewebsites.net/amazon/mm/c6ccd28975dc08f8b909fb2645ad7ef3/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
amznbtn-sprite03._V395592492_.png
images-na.ssl-images-amazon.com/images/G/01/authportal/common/images/ |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uedata
emazon.azurewebsites.net/ap/ |
103 B 103 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| ue_t0 string| ue_id object| ue_csm string| ue_url string| ue_pr string| ue_md number| ue_navtiming string| ue_mid string| ue_sid string| ue_furl number| ue_hob number| ueinit object| ue function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop number| ue_hoe function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .emazon.azurewebsites.net/ | Name: ARRAffinity Value: e512d7bc8674ddf2389cbb780f3db4d66a35afdee9a98d6559f8d13e4125b603 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
emazon.azurewebsites.net
images-na.ssl-images-amazon.com
40.86.96.177
52.222.152.248
1d83288b114c973e481163f5c89ecfec3d8ba74009fb8214aaf5b405be13a2aa
233648d2a278ebdd22f4878b3d44556e627905da3624c37418de98ef0ace406c
30b9903f22b92d34d170f4cc0aa95becb2e1465e65bd5e53e75c8379037fa2a2
65fb0d927462babb4af3693d6c9e26100ac43359692cb828af45cd8c9716bac6
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1
b33084766584f9745823b8686c6b655a5f908b5e8cbb5ae96d6dc9441cbf7872
c63853fc233ec156a77f8a5766aaf18f2cd7b5ef0424f79676b26ca974feda1a