support-amaizon-co.jp.accincaxd.co

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 66.70.227.212, located in Trumbull, United States and belongs to OVH, FR. The main domain is support-amaizon-co.jp.accincaxd.co.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 16th 2017. Valid for: 3 months.

This is the only time support-amaizon-co.jp.accincaxd.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
5	66.70.227.212 66.70.227.212	16276 (OVH) (OVH)
2	52.84.127.66 52.84.127.66	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	2

5 66.70.227.212 (Trumbull, United States)

ASN16276 (OVH, FR)
PTR: ip212.ip-66-70-227.net

support-amaizon-co.jp.accincaxd.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.127.66 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-84-127-66.iad16.r.cloudfront.net

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	accincaxd.co support-amaizon-co.jp.accincaxd.co	161 KB
2	ssl-images-amazon.com images-na.ssl-images-amazon.com	28 KB
7	2

	Domain	Requested by
5	support-amaizon-co.jp.accincaxd.co	support-amaizon-co.jp.accincaxd.co
2	images-na.ssl-images-amazon.com	support-amaizon-co.jp.accincaxd.co
7	2

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid
support-amaizon-co.jp.accincaxd.co Let's Encrypt Authority X3	`2017-08-16` - `2017-11-14`	3 months	crt.sh
Images-na.ssl-images-amazon.com Symantec Class 3 Secure Server CA - G4	`2016-09-23` - `2017-10-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php
Frame ID: 2484.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

189 kB
Transfer

189 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ref=ap_frn_logo
Title: Amazon

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request step2.php Show response support-amaizon-co.jp.accincaxd.co/ap/confirmation/	10 KB 10 KB	808ms 127ms	Document text/html	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `2587409ec0b55c5accb751ed9f4978869af550fd129b6237bd5a336b1e1b893b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 03:27:52 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ClientSideMetricsAUIJavascript-6f4530fbabd6f27cfdd6766c550b5c5327f8aa3d._V2_.js Show response support-amaizon-co.jp.accincaxd.co/ap/confirmation/js/	18 KB 18 KB	278ms 94ms	Script application/javascript	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/js/ClientSideMetricsAUIJavascript-6f4530fbabd6f27cfdd6766c550b5c5327f8aa3d._V2_.js Requested by Host: support-amaizon-co.jp.accincaxd.co URL: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `481d432b9d9952da24ed30ff58462952b6635f2aebae16619be65888371f79f6` Request headers Referer https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 03:27:52 GMT Last-Modified Tue, 12 Apr 2016 22:22:54 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18305
GET H/1.1	200 OK	AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css support-amaizon-co.jp.accincaxd.co/ap/confirmation/css/	117 KB 117 KB	94ms 93ms	Stylesheet text/css	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/css/AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css Requested by Host: support-amaizon-co.jp.accincaxd.co URL: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `9fb53e780111203d3864dabd3c11adf9a721730f19a06e228b9e8c833d504f26` Request headers Referer https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 03:27:52 GMT Last-Modified Tue, 12 Apr 2016 22:22:54 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 120313
GET H/1.1	200 OK	AuthenticationPortalAssets-90049572e0ba71bab4f1eeaa84f8ad239ac52087._V2_.css support-amaizon-co.jp.accincaxd.co/ap/confirmation/css/	3 KB 3 KB	186ms 94ms	Stylesheet text/css	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/css/AuthenticationPortalAssets-90049572e0ba71bab4f1eeaa84f8ad239ac52087._V2_.css Requested by Host: support-amaizon-co.jp.accincaxd.co URL: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `c17797b91ea19d8ee8df451832ee58bdad1163d8b59a060cb86ec2f014652557` Request headers Referer https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 03:27:52 GMT Last-Modified Tue, 12 Apr 2016 22:22:54 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2913
GET H/1.1	200 OK	fwcim._CB342129162_.js Show response support-amaizon-co.jp.accincaxd.co/ap/confirmation/js/	13 KB 13 KB	277ms 93ms	Script application/javascript	66.70.227.212 OVH
General Check archive.org Show headers Download Go to Full URL https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/js/fwcim._CB342129162_.js Requested by Host: support-amaizon-co.jp.accincaxd.co URL: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.70.227.212 Trumbull, United States, ASN16276 (OVH, FR), Reverse DNS ip212.ip-66-70-227.net Software Apache / Resource Hash `ce80ee2ee4c7f0f305633f0b21df9706727e3cad8e33fdd770eaff7473eedf3a` Request headers Referer https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Mon, 21 Aug 2017 03:27:52 GMT Last-Modified Tue, 12 Apr 2016 22:22:54 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 12822
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	25 KB 25 KB	311ms 108ms	Image image/png	52.84.127.66 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-a45c662e707240b03417f6ca8b97bcb486f27428._V2_.png Requested by Host: support-amaizon-co.jp.accincaxd.co URL: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.84.127.66 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-84-127-66.iad16.r.cloudfront.net Software Server / Resource Hash `3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a` Request headers Referer https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/css/AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Wed, 31 May 2017 06:49:58 GMT Via 1.1 78ae32a88b9156d6c12be8f261f1c1b8.cloudfront.net (CloudFront) Age 7075529 X-Cache Hit from cloudfront Connection keep-alive Content-Length 25262 Last-Modified Fri, 27 May 2016 17:30:51 GMT Server Server Content-Type image/png; charset=utf-8 Access-Control-Allow-Origin * Access-Control-Expose-Headers content-length,x-cache Cache-Control max-age=630720000,public X-Amz-IR-Id 1e732123-f99b-414f-b196-613413208501 Timing-Allow-Origin https://www.amazon.com X-Amz-Cf-Id Fh8HwZDBu-7RmES9YdIjeyM5U0qWkYJvFyeDQ5xUdsfRMhPCEnpM6Q== Expires Wed, 18 May 2033 03:33:20 GMT
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea._V2_.png images-na.ssl-images-amazon.com/images/G/01/AUIClients/	4 KB 4 KB	308ms 102ms	Image image/png	52.84.127.66 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea._V2_.png Requested by Host: support-amaizon-co.jp.accincaxd.co URL: https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.84.127.66 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-84-127-66.iad16.r.cloudfront.net Software Server / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers Referer https://support-amaizon-co.jp.accincaxd.co/ap/confirmation/css/AmazonUI-aa65a0222011819ee197c9b5878a8baeb24dec67._V2_.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Thu, 08 Jun 2017 09:57:28 GMT Via 1.1 2f58837c73ff25163966d00a02414d37.cloudfront.net (CloudFront) Last-Modified Sat, 10 Oct 2015 00:40:08 GMT Server Server Age 6371654 X-Cache Hit from cloudfront Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=630720000,public Connection keep-alive Timing-Allow-Origin https://www.amazon.com Content-Length 3589 X-Amz-Cf-Id HUQkHUcT9GYhKkgEmGwMMdpCLRncs8U28-GeR54PZxT18Yv1XwtDWw== Expires Wed, 18 May 2033 03:33:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-na.ssl-images-amazon.com
support-amaizon-co.jp.accincaxd.co
52.84.127.66
66.70.227.212
2587409ec0b55c5accb751ed9f4978869af550fd129b6237bd5a336b1e1b893b
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
481d432b9d9952da24ed30ff58462952b6635f2aebae16619be65888371f79f6
9fb53e780111203d3864dabd3c11adf9a721730f19a06e228b9e8c833d504f26
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
c17797b91ea19d8ee8df451832ee58bdad1163d8b59a060cb86ec2f014652557
ce80ee2ee4c7f0f305633f0b21df9706727e3cad8e33fdd770eaff7473eedf3a

support-amaizon-co.jp.accincaxd.co Open in urlscan Pro 66.70.227.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

189 kBTransfer

189 kBSize

0 Cookies

1 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

support-amaizon-co.jp.accincaxd.co Open in urlscan Pro
66.70.227.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

189 kB
Transfer

189 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!