urlscan.io logo urlscan.io
SecurityTrails logo

www.amazon.de.eamz-de.webredirect.org Open in urlscan Pro
130.185.250.216  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://sellercentral.amazon.de.eamz-de.webredirect.org/
Effective URL: https://www.amazon.de.eamz-de.webredirect.org/
Submission: On February 19 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 130.185.250.216, located in Bulgaria and belongs to GLOBALLAYER, NL. The main domain is www.amazon.de.eamz-de.webredirect.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 19th 2020. Valid for: 3 months.
This is the only time www.amazon.de.eamz-de.webredirect.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 130.185.250.216 49453 (GLOBALLAYER)
6 143.204.201.243 16509 (AMAZON-02)
2 52.208.222.215 16509 (AMAZON-02)
9 3
Domain Requested by
5 images-na.ssl-images-amazon.com www.amazon.de.eamz-de.webredirect.org
images-eu.ssl-images-amazon.com
2 fls-eu.amazon.de www.amazon.de.eamz-de.webredirect.org
images-na.ssl-images-amazon.com
1 images-eu.ssl-images-amazon.com www.amazon.de.eamz-de.webredirect.org
1 www.amazon.de.eamz-de.webredirect.org
1 sellercentral.amazon.de.eamz-de.webredirect.org 1 redirects
9 5

This site contains links to these domains. Also see Links.

Domain
www.amazon.de
Subject Issuer Validity Valid
sellercentral.amazon.de.eamz-de.webredirect.org
Let's Encrypt Authority X3		 2020-02-19 -
2020-05-19		 3 months crt.sh
Images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2019-05-02 -
2020-04-23		 a year crt.sh
fls-eu.amazon.com
Amazon		 2019-09-06 -
2020-09-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.amazon.de.eamz-de.webredirect.org/
Frame ID: F5F3E8A2586DE1805B272878FF60EA0F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://sellercentral.amazon.de.eamz-de.webredirect.org/ HTTP 302
    https://www.amazon.de.eamz-de.webredirect.org/ Page URL

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

3
IPs

3
Countries

66 kB
Transfer

221 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://sellercentral.amazon.de.eamz-de.webredirect.org/ HTTP 302
    https://www.amazon.de.eamz-de.webredirect.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.amazon.de.eamz-de.webredirect.org/
Redirect Chain
  • https://sellercentral.amazon.de.eamz-de.webredirect.org/
  • https://www.amazon.de.eamz-de.webredirect.org/
7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.amazon.de.eamz-de.webredirect.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
130.185.250.216 , Bulgaria, ASN49453 (GLOBALLAYER, NL),
Reverse DNS
Software
Server /
Resource Hash
150a6e65a6a4920acba6edd33aeb9dd63d49af18ce0186f808437577a6769cb6

Request headers

Host
www.amazon.de.eamz-de.webredirect.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

Connection
close
Content-Type
text/html
Date
Wed, 19 Feb 2020 05:19:12 GMT
Server
Server
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Amz-Rid
PN3ZTA08GMSFZ53VZ4H9

Redirect headers

Connection
close
Content-Type
text/html
Location
https://www.amazon.de.eamz-de.webredirect.org
Transfer-Encoding
chunked
AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		165 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css
Requested by
Host: www.amazon.de.eamz-de.webredirect.org
URL: https://www.amazon.de.eamz-de.webredirect.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.243 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-243.fra53.r.cloudfront.net
Software
Server /
Resource Hash
5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Fri, 20 Sep 2019 00:08:23 GMT
content-encoding
gzip
last-modified
Wed, 17 Jul 2013 22:51:32 GMT
server
Server
age
13151449
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=630720000,public
x-amz-cf-pop
FRA53-C1
access-control-allow-origin
*
x-amz-cf-id
k6eHKsR-SPqN9emvyjk3V-ywbU3UvgVciIsWELmC5bPDhqjkUy3oNQ==
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
expires
Wed, 18 May 2033 03:33:20 GMT
Captcha_fsvlikgwxa.jpg
images-na.ssl-images-amazon.com/captcha/lqbiackd/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-na.ssl-images-amazon.com/captcha/lqbiackd/Captcha_fsvlikgwxa.jpg
Requested by
Host: www.amazon.de.eamz-de.webredirect.org
URL: https://www.amazon.de.eamz-de.webredirect.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.243 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-243.fra53.r.cloudfront.net
Software
Server /
Resource Hash
3a8f54d9d922b55948f95fead2837089801e8c212ea027876dff3d3708e656ae

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 18 Feb 2020 04:24:10 GMT
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
surrogate-key
x-cache-932 /captcha/lqbiackd/Captcha_fsvlikgwxa
last-modified
Wed, 08 Feb 2012 17:14:09 GMT
server
Server
x-amz-cf-pop
FRA53-C1
edge-cache-tag
x-cache-932,/captcha/lqbiackd/Captcha_fsvlikgwxa
content-type
image/jpeg
status
200
x-amz-ir-id
8a685fae-181e-427a-ab9e-f4f827bfda90
x-cache
RefreshHit from cloudfront
access-control-allow-origin
*
content-length
5068
x-amz-cf-id
Wwbil_t5w-uCUJGzGKFXzBIzjXMhd9V08hEXPJEX39OysIUhsHZzTg==
aui_sprite_0007-1x._V383827579_.png
images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/aui_sprite_0007-1x._V383827579_.png
Requested by
Host: www.amazon.de.eamz-de.webredirect.org
URL: https://www.amazon.de.eamz-de.webredirect.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.243 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-243.fra53.r.cloudfront.net
Software
Server /
Resource Hash
49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa

Request headers

Referer
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Sun, 05 May 2019 00:50:07 GMT
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
age
25126673
x-cache
Hit from cloudfront
status
200
content-length
16972
last-modified
Wed, 15 May 2013 01:55:34 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
71e2838e-5f5f-4a0b-946d-33a236adec82
x-amz-cf-pop
FRA53-C1
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
LWJVg05NjKoeX0K1lRdYOrFeiCTqo2uyJhtzUz3s_fBtISkfB2asRg==
expires
Sun, 25 Jul 2038 07:49:42 GMT
requestId=PN3ZTA08GMSFZ53VZ4H9&js=1
fls-eu.amazon.de/1/oc-csi/1/OP/ 		43 B
149 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fls-eu.amazon.de/1/oc-csi/1/OP/requestId=PN3ZTA08GMSFZ53VZ4H9&js=1
Requested by
Host: www.amazon.de.eamz-de.webredirect.org
URL: https://www.amazon.de.eamz-de.webredirect.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.222.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-222-215.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 19 Feb 2020 05:19:12 GMT
x-amzn-requestid
264b1e86-4172-48d8-ba72-5d2a0079b743
content-length
43
content-type
image/gif
csm-captcha-instrumentation.min._V1582089552287_.js
images-eu.ssl-images-amazon.com/images/G/01/csminstrumentation/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-eu.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1582089552287_.js
Requested by
Host: www.amazon.de.eamz-de.webredirect.org
URL: https://www.amazon.de.eamz-de.webredirect.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.243 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-243.fra53.r.cloudfront.net
Software
Server /
Resource Hash
35cf72b3f65845c32617eb726119bbdd969738b7d62bb760c4381e82ce37ac4a

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 19 Feb 2020 05:19:12 GMT
content-encoding
gzip
x-amz-cf-pop
FRA53-C1
edge-cache-tag
x-cache-342,/images/G/01/csminstrumentation/csm-captcha-instrumentation.min
status
200
x-cache
Miss from cloudfront
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
surrogate-key
x-cache-342 /images/G/01/csminstrumentation/csm-captcha-instrumentation.min
last-modified
Mon, 12 Oct 2015 09:22:39 GMT
server
Server
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
6b5d0bf7-50a8-4789-b931-3ef75a2ca044
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
IgLEHprHUvyjRHtjj9649Tz4a1kPgBA5gzkci3fhmEU4dsnkrKF6Rw==
expires
Tue, 14 Feb 2040 05:19:12 GMT
ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js
images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js
Requested by
Host: images-eu.ssl-images-amazon.com
URL: https://images-eu.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1582089552287_.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.243 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-243.fra53.r.cloudfront.net
Software
Server /
Resource Hash
a538a2b295512c2a3b74f63e74047db79140733da941fb0fca2b95a1dfdada37

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 18 Sep 2019 00:39:28 GMT
content-encoding
gzip
age
13322384
x-cache
Hit from cloudfront
status
200
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
last-modified
Wed, 26 Aug 2015 14:52:49 GMT
server
Server
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
29135ebd-9c5e-48af-bb18-88fc2a4c1dad
x-amz-cf-pop
FRA53-C1
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
05F1KAW2S7LgRZwyD2Y0-A5KOZluk3A2WsJc0JoHApAmA_DDJnRguw==
expires
Mon, 05 Jul 2038 07:01:59 GMT
ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js
Requested by
Host: images-eu.ssl-images-amazon.com
URL: https://images-eu.ssl-images-amazon.com/images/G/01/csminstrumentation/csm-captcha-instrumentation.min._V1582089552287_.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.201.243 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-243.fra53.r.cloudfront.net
Software
Server /
Resource Hash
877c2c2a2da0a1a6c0ad0d7ac8071046a1d726e5ab9c63509e3786b8c8ec5042

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 17 Sep 2019 01:01:53 GMT
content-encoding
gzip
last-modified
Thu, 01 Oct 2015 10:19:43 GMT
server
Server
age
13407439
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=630720000,public
x-amz-cf-pop
FRA53-C1
access-control-allow-origin
*
x-amz-cf-id
K65Y-XkWONtplVTJcE0Gh-zWZHc1Chuf3-N6JbZWyp_eDZPMQCnc4w==
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront)
expires
Wed, 18 May 2033 03:33:20 GMT
/
fls-eu.amazon.de/1/batch/1/OE/ 		0
165 B 		Other
General
Check archive.org
Download Go to
Full URL
https://fls-eu.amazon.de/1/batch/1/OE/
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.222.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-222-215.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.amazon.de.eamz-de.webredirect.org/
Origin
https://www.amazon.de.eamz-de.webredirect.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

status
204
date
Wed, 19 Feb 2020 05:19:13 GMT
access-control-allow-origin
*
x-amzn-requestid
69dddf23-fa11-449d-9d82-665359f5feac
access-control-expose-headers
x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate number| ue_t0 object| ue_csm object| ue string| ue_furl string| ue_mid string| ue_sid string| ue_sn string| ue_id object| elem object| ue_modules object| cel_widgets string| ue_cel_ns number| ue_skc object| ue_err number| ueinit function| ues function| uet function| uex function| onLd function| onLdEnd function| onstop function| ueLogError object| ue_cel object| ue_pdm object| ue_vpm object| ue_fem object| ue_mcm object| ue_mmm object| ue_rpl object| ue_kpm

1 Cookies

Domain/Path Name / Value
www.amazon.de.eamz-de.webredirect.org/ Name: csm-sid
Value: 708-1317741-7084622