urlscan.io logo urlscan.io
SecurityTrails logo

fghrthgtertrhgfexcwevse.xyz Open in urlscan Pro
212.70.149.207  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://fghrthgtertrhgfexcwevse.xyz/Login/login.php
Submission: On March 03 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 212.70.149.207, located in Bulgaria and belongs to GCN-AS GCN AD - Sofia, Bulgaria, BG. The main domain is fghrthgtertrhgfexcwevse.xyz.
TLS certificate: Issued by R3 on February 15th 2024. Valid for: 3 months.
This is the only time fghrthgtertrhgfexcwevse.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 212.70.149.207 12615 (GCN-AS GC...)
4 2600:9000:239... 16509 (AMAZON-02)
5 2
Apex Domain
Subdomains		 Transfer
4 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 1065
119 KB
1 fghrthgtertrhgfexcwevse.xyz
fghrthgtertrhgfexcwevse.xyz
25 KB
5 2
Domain Requested by
4 images-na.ssl-images-amazon.com fghrthgtertrhgfexcwevse.xyz
images-na.ssl-images-amazon.com
1 fghrthgtertrhgfexcwevse.xyz
5 2

This site contains no links.

Subject Issuer Validity Valid
fghrthgtertrhgfexcwevse.xyz
R3		 2024-02-15 -
2024-05-15		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2024-01-05 -
2024-12-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://fghrthgtertrhgfexcwevse.xyz/Login/login.php
Frame ID: AB7E51A417D89C9A192D08E1BD60D5C8
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

144 kB
Transfer

441 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
fghrthgtertrhgfexcwevse.xyz/Login/ 		25 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fghrthgtertrhgfexcwevse.xyz/Login/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
212.70.149.207 , Bulgaria, ASN12615 (GCN-AS GCN AD - Sofia, Bulgaria, BG),
Reverse DNS
Software
Apache /
Resource Hash
b4a41e4484572d50aba2ff4fbf128c3fd0563c5ebbbebe1cd4ec69184ddad4be

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sun, 03 Mar 2024 13:14:58 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		113 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
Requested by
Host: fghrthgtertrhgfexcwevse.xyz
URL: https://fghrthgtertrhgfexcwevse.xyz/Login/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2394:a800:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
02f9e4f6271092d6fa6ac1854427e1ab744a58b9b7f58a02afe29f81a914baec

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fghrthgtertrhgfexcwevse.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 13 Dec 2023 09:13:09 GMT
content-encoding
br
via
1.1 fbbc548a3de404eb87126afd4e3999ba.cloudfront.net (CloudFront)
age
6223099
x-amz-cf-pop
AMS1-P2
edge-cache-tag
x-cache-823,/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
server-timing
provider;desc="cf"
alt-svc
h3=":443"; ma=86400
surrogate-key
x-cache-823 /images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4
last-modified
Fri, 05 Feb 2016 03:02:58 GMT
server
Server
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
32756f3b-5d58-484b-b905-966d15adc2eb
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
2lR-VIe0eEpk3BThEoGjsxIW2DeTG9Uf0vzH-LjxbxIhmpi11kEpSg==
expires
Tue, 08 Dec 2043 09:13:09 GMT
AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		256 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js
Requested by
Host: fghrthgtertrhgfexcwevse.xyz
URL: https://fghrthgtertrhgfexcwevse.xyz/Login/login.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:2394:a800:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
16aecd5524ada4c6ff3326d33ac9e3af9cfa3c1ec117de4e0f19966bf0af4b1a

Request headers

Referer
https://fghrthgtertrhgfexcwevse.xyz/
Origin
https://fghrthgtertrhgfexcwevse.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 02:24:11 GMT
content-encoding
br
via
1.1 01abec7ece24959c09067a58477de9ee.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-P2
age
1610831
x-cache
Hit from cloudfront
edge-cache-tag
x-cache-928,/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736
x-nginx-cache-status
HIT
server-timing
provider;desc="cf",cdn-rid;desc="HReGpUnxc8nPViQWDpjn2Qen54MCeHUZUu5y9I7v1NUWf18jYgEUpw==",cdn-downstream-fbl;dur=4
alt-svc
h3=":443"; ma=86400
surrogate-key
x-cache-928 /images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736
last-modified
Wed, 03 Feb 2016 20:16:14 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
615ab2e8-905b-4b71-bdb3-5a25033d12cc
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
HReGpUnxc8nPViQWDpjn2Qen54MCeHUZUu5y9I7v1NUWf18jYgEUpw==
expires
Sun, 31 Jan 2044 02:24:11 GMT
AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js
Requested by
Host: fghrthgtertrhgfexcwevse.xyz
URL: https://fghrthgtertrhgfexcwevse.xyz/Login/login.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:2394:a800:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
7d7566ca5de5262510d5409e340be9ab6f1e5f9730bda17a2ca1538442c01928

Request headers

Referer
https://fghrthgtertrhgfexcwevse.xyz/
Origin
https://fghrthgtertrhgfexcwevse.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Fri, 09 Feb 2024 07:13:06 GMT
content-encoding
br
via
1.1 01abec7ece24959c09067a58477de9ee.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-P2
age
1628819
x-cache
Hit from cloudfront
edge-cache-tag
x-cache-739,/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f
x-nginx-cache-status
HIT
server-timing
provider;desc="cf",cdn-rid;desc="FT-4BNJw3t1VTl175Aagb-bHPl2973VhYIr6f_4kgZFgRY3jfzq8kw==",cdn-downstream-fbl;dur=4
alt-svc
h3=":443"; ma=86400
surrogate-key
x-cache-739 /images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f
last-modified
Sat, 26 Mar 2016 01:05:52 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
cf68eda5-76ab-4a9e-b865-3f99ab8c0d20
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
FT-4BNJw3t1VTl175Aagb-bHPl2973VhYIr6f_4kgZFgRY3jfzq8kw==
expires
Thu, 04 Feb 2044 07:13:06 GMT
AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css#AUIClients/AmazonUI.fr.rendering_engine-not-trident.secure.min
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2394:a800:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
84ea8004fab8c9fd2911393bcc36020df3ba4f83e2762425fbe0e79653a8b3f2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 19 Oct 2023 07:03:23 GMT
via
1.1 fbbc548a3de404eb87126afd4e3999ba.cloudfront.net (CloudFront)
age
8973964
x-amz-cf-pop
AMS1-P2
edge-cache-tag
x-cache-266,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
server-timing
provider;desc="cf"
alt-svc
h3=":443"; ma=86400
content-length
24594
surrogate-key
x-cache-266 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d
last-modified
Tue, 20 Oct 2015 02:26:17 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
7f9400c8-49a7-46c0-88ad-95311f3aac0e
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
jpIPY3Qn6rkoguwfV5MmFkuDhb2sCxXYR8gbIn9mI0xugC0d1AEXRw==
expires
Wed, 14 Oct 2043 07:03:23 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| ue_t0 undefined| cel_widgets object| amzn function| cf object| jQuery164013554147032617503

0 Cookies