amazon.accountfixuk.com

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 198.54.115.153, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is amazon.accountfixuk.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 6th 2021. Valid for: a year.

This is the only time amazon.accountfixuk.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	198.54.115.153 198.54.115.153	22612 (NAMECHEAP...) (NAMECHEAP-NET)
5	2a04:4e42:3::272 2a04:4e42:3::272	54113 (FASTLY) (FASTLY)
7	2

3 198.54.115.153 (Los Angeles, United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server109-3.web-hosting.com

amazon.accountfixuk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:4e42:3::272 (Ascension Island)

ASN54113 (FASTLY, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	media-amazon.com m.media-amazon.com	93 KB
3	accountfixuk.com 1 redirects amazon.accountfixuk.com	48 KB
2	ssl-images-amazon.com images-na.ssl-images-amazon.com	23 KB
7	3

	Domain	Requested by
3	m.media-amazon.com	amazon.accountfixuk.com
3	amazon.accountfixuk.com	1 redirects amazon.accountfixuk.com
2	images-na.ssl-images-amazon.com	amazon.accountfixuk.com
7	3

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
amazon.accountfixuk.com Sectigo RSA Domain Validation Secure Server CA	`2021-01-06` - `2022-01-06`	a year	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2020-09-16` - `2021-09-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amazon.accountfixuk.com/
Frame ID: 5BA73CCBC9D05D063B06438959FC302A
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://amazon.accountfixuk.com/ HTTP 301
https://amazon.accountfixuk.com/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

165 kB
Transfer

482 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=anywhere_us&ignoreAuthState=1&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&prevRID=190AJEQY3C9HHF86K2VN&openid.assoc_handle=anywhere_v2_us&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&ubid=133-4331051-9829606
Title: Create account. New to Amazon?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://amazon.accountfixuk.com/ HTTP 301
https://amazon.accountfixuk.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response amazon.accountfixuk.com/ Redirect Chain http://amazon.accountfixuk.com/ https://amazon.accountfixuk.com/	99 KB 12 KB	775ms 372ms	Document text/html	198.54.115.153 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://amazon.accountfixuk.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.153 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server109-3.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash `7bee0ffb858a673be9b01fa6d7c294cb314d81546409d8a46aa6903af5077fb8` Request headers :method GET :authority amazon.accountfixuk.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:54 GMT server Apache x-powered-by PHP/7.2.34 vary Accept-Encoding content-encoding gzip content-length 12063 content-type text/html; charset=UTF-8 Redirect headers date Thu, 07 Jan 2021 02:53:54 GMT server Apache location https://amazon.accountfixuk.com/ content-length 240 content-type text/html; charset=iso-8859-1
GET H2	200	mobile_login.css amazon.accountfixuk.com/assets/css/	210 KB 36 KB	223ms 223ms	Stylesheet text/css	198.54.115.153 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://amazon.accountfixuk.com/assets/css/mobile_login.css Requested by Host: amazon.accountfixuk.com URL: https://amazon.accountfixuk.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.115.153 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server109-3.web-hosting.com Software Apache / Resource Hash `18fb397d2782484fe19e39551a0ae0ac31db7d80f7d5bb66740b3cab30a6a9a0` Request headers Referer https://amazon.accountfixuk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:55 GMT content-encoding gzip last-modified Sat, 23 Feb 2019 11:05:58 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 36623
GET H2	200	51tK4vb5u4L._RC%7C31zsNEvQFKL.css,01+72+wCC9L.css_.css images-na.ssl-images-amazon.com/images/I/	69 KB 12 KB	21ms 6ms	Stylesheet text/css	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/51tK4vb5u4L._RC%7C31zsNEvQFKL.css,01+72+wCC9L.css_.css?AUIClients/AmazonNavigationMobileMetaAsset Requested by Host: amazon.accountfixuk.com URL: https://amazon.accountfixuk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `533aa3146ba4a00a68d57ab5f5a3d2b0801596f2751cd528d456a354c62361c0` Request headers Referer https://amazon.accountfixuk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:55 GMT content-encoding gzip last-modified Tue, 08 Jan 2019 04:32:59 GMT age 4815067 vary Accept-Encoding x-cache HIT from fastly, HIT from fastly content-type text/css; charset=utf-8 access-control-allow-origin * expires Wed, 07 Nov 2040 09:22:48 GMT cache-control max-age=630720000,public x-amz-ir-id 5356fa8a-0ea9-4e24-a219-62dc1e5ee09d accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com content-length 12127 x-served-by cache-dca17728-DCA, cache-fra19146-FRA
GET H2	200	new-nav-sm-smile-sprite-global-1x_blueheaven._CB496507362_.png images-na.ssl-images-amazon.com/images/G/01/gno/sprites/	11 KB 11 KB	99ms 99ms	Image image/png	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven._CB496507362_.png Requested by Host: amazon.accountfixuk.com URL: https://amazon.accountfixuk.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d` Request headers Referer https://amazon.accountfixuk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:55 GMT last-modified Wed, 02 May 2018 02:39:57 GMT age 1076 x-cache HIT from fastly, HIT from fastly content-type image/png access-control-allow-origin * expires Fri, 01 Jan 2021 19:18:55 GMT cache-control max-age=3600,public x-amz-ir-id 36a5db7a-df06-4d3f-8e61-b8ffcea83ae5 accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 11329 x-served-by cache-dca17751-DCA, cache-fra19146-FRA
GET H2	200	AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1._V2_.png m.media-amazon.com/images/G/01/AUIClients/	60 KB 61 KB	7ms 6ms	Image image/png	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1._V2_.png Requested by Host: amazon.accountfixuk.com URL: https://amazon.accountfixuk.com/assets/css/mobile_login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a` Request headers Referer https://amazon.accountfixuk.com/assets/css/mobile_login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:55 GMT last-modified Fri, 22 Sep 2017 00:23:21 GMT age 24828456 x-cache HIT from fastly, HIT from fastly content-type image/png access-control-allow-origin * expires Tue, 20 Mar 2040 18:06:18 GMT cache-control max-age=630720000,public x-amz-ir-id a28700d9-dfda-4f31-9060-bbb2e778b9c3 accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 61917 x-served-by cache-dca17721-DCA, cache-fra19146-FRA
GET H2	200	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	18ms 6ms	Font application/font-woff2	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Requested by Host: amazon.accountfixuk.com URL: https://amazon.accountfixuk.com/assets/css/mobile_login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7` Request headers Origin https://amazon.accountfixuk.com Referer https://amazon.accountfixuk.com/assets/css/mobile_login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:55 GMT last-modified Sat, 11 Jun 2016 01:31:21 GMT age 24937585 x-cache HIT from fastly, HIT from fastly content-type application/font-woff2; charset=utf-8 access-control-allow-origin * expires Mon, 19 Mar 2040 11:47:31 GMT cache-control max-age=630720000,public x-amz-ir-id c4938db2-267d-4756-b34a-9652d1c73e87 accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 16616 x-served-by cache-dca17767-DCA, cache-fra19142-FRA
GET H2	200	AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 16 KB	15ms 7ms	Font application/font-woff2	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 Requested by Host: amazon.accountfixuk.com URL: https://amazon.accountfixuk.com/assets/css/mobile_login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327` Request headers Origin https://amazon.accountfixuk.com Referer https://amazon.accountfixuk.com/assets/css/mobile_login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 07 Jan 2021 02:53:55 GMT last-modified Sat, 11 Jun 2016 01:31:24 GMT age 24977849 x-cache HIT from fastly, HIT from fastly content-type application/font-woff2; charset=utf-8 access-control-allow-origin * expires Mon, 19 Mar 2040 00:36:28 GMT cache-control max-age=630720000,public x-amz-ir-id 16827405-4151-4d26-b98a-f59d6eba6a1c accept-ranges bytes timing-allow-origin https://www.amazon.com content-length 16460 x-served-by cache-dca17763-DCA, cache-fra19142-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.accountfixuk.com
images-na.ssl-images-amazon.com
m.media-amazon.com
198.54.115.153
2a04:4e42:3::272
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327
18fb397d2782484fe19e39551a0ae0ac31db7d80f7d5bb66740b3cab30a6a9a0
533aa3146ba4a00a68d57ab5f5a3d2b0801596f2751cd528d456a354c62361c0
7bee0ffb858a673be9b01fa6d7c294cb314d81546409d8a46aa6903af5077fb8
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a

amazon.accountfixuk.com Open in urlscan Pro 198.54.115.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

165 kBTransfer

482 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

amazon.accountfixuk.com Open in urlscan Pro
198.54.115.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

165 kB
Transfer

482 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!