165.84.180.46 - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 1 domains to perform 6 HTTP transactions. The main IP is 165.84.180.46, located in Hong Kong and belongs to HKBN-AS-AP HK Broadband Network Ltd., HK. The main domain is 165.84.180.46.

This is the only time 165.84.180.46 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	165.84.180.46 165.84.180.46	10103 (HKBN-AS-A...) (HKBN-AS-AP HK Broadband Network Ltd.)
3	2a04:4e42:3::272 2a04:4e42:3::272	54113 (FASTLY) (FASTLY)
2	27.148.154.7 27.148.154.7	133774 (CHINATELE...) (CHINATELECOM-FUJIAN-FUZHOU-IDC1 Fuzhou)
6	3

1 165.84.180.46 (Hong Kong)

ASN10103 (HKBN-AS-AP HK Broadband Network Ltd., HK)
PTR: 165084180046.ctinets.com

165.84.180.46	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:3::272 (Ascension Island)

ASN54113 (FASTLY, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 27.148.154.7 (China)

ASN133774 (CHINATELECOM-FUJIAN-FUZHOU-IDC1 Fuzhou, CN)

images-cn.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ssl-images-amazon.com images-na.ssl-images-amazon.com images-cn.ssl-images-amazon.com	65 KB
6	1

	Domain	Requested by
3	images-na.ssl-images-amazon.com	165.84.180.46
2	images-cn.ssl-images-amazon.com	images-na.ssl-images-amazon.com
6	2

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2020-09-16` - `2021-09-21`	a year	crt.sh
images-cn-8.ssl-images-amazon.com DigiCert SHA2 High Assurance Server CA	`2020-06-24` - `2022-06-29`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp
Frame ID: 7263D97D3782E5E68F3A7D953CB33DEB
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

83 %
HTTPS

33 %
IPv6

1
Domains

2
Subdomains

3
IPs

3
Countries

69 kB
Transfer

224 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ap/help/customer/display.html/ref=ap_cookie_error_help

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/help/customer/display.html/ref=ap_signin_notification_condition_of_use?ie=UTF8&nodeId=643006
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/help/customer/display.html/ref=ap_signin_notification_privacy_notice?ie=UTF8&nodeId=643000
Title: プライバシー規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=jpflex&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F%3Fref_%3Dnav_custrec_signin&prevRID=4X90FBA09G13EHPW6RKS&openid.assoc_handle=jpflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: パスワードを忘れた場合

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/help/customer/account-issues/ref=ap_login_with_otp_claim_collection?ie=UTF8
Title: その他のログインに関する問題

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F%3Fref_%3Dnav_custrec_signin&prevRID=4X90FBA09G13EHPW6RKS&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=jpflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=jpflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Amazonアカウントを作成する

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=643006
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=643000
Title: プライバシー規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/help
Title: ヘルプ

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request signin Show response 165.84.180.46/ap/	11 KB 4 KB	629ms 616ms	Document text/html	165.84.180.46 HKBN-AS-AP HK Bro...
General Check archive.org Show headers Download Go to Full URL http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp Protocol HTTP/1.1 Server 165.84.180.46 , Hong Kong, ASN10103 (HKBN-AS-AP HK Broadband Network Ltd., HK), Reverse DNS 165084180046.ctinets.com Software nginx / PHP/7.4.10 Resource Hash `0c53ac1ab9deae845fea4fcd1a266297ecaeafde0c6bfc903dc6ea2ecd4a1eef` Request headers Host 165.84.180.46 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Mon, 05 Oct 2020 05:12:05 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Powered-By PHP/7.4.10 Content-Encoding gzip
GET H2	200	61ECVh+vn2L._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,314YUrkEzTL.css_.css images-na.ssl-images-amazon.com/images/I/	134 KB 22 KB	24ms 6ms	Stylesheet text/css	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61ECVh+vn2L._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,314YUrkEzTL.css_.css?AUIClients/AmazonUI Requested by Host: 165.84.180.46 URL: http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `dcd0056093ab95e17042b51793826382dc9bb170f402757db08a338d77ac149e` Request headers Referer http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 05 Oct 2020 05:12:05 GMT content-encoding gzip age 7149146 x-cache HIT from fastly, HIT from fastly status 200 content-length 22706 x-served-by cache-dca17748-DCA, cache-fra19182-FRA last-modified Tue, 10 Jul 2018 19:36:49 GMT vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 766ac5a8-746d-417f-8396-0abb0e6d444a accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Mon, 09 Jul 2040 11:19:40 GMT
GET H2	200	01SdjaY0ZsL._RC%7C419sIPk+mYL.css,41yEFdgL45L.css_.css images-na.ssl-images-amazon.com/images/I/	46 KB 9 KB	29ms 12ms	Stylesheet text/css	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C419sIPk+mYL.css,41yEFdgL45L.css_.css?AUIClients/AuthenticationPortalAssets Requested by Host: 165.84.180.46 URL: http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `8c23ec3cf642a3bdb329d68c6038db8172b01fcad5270f36cf447235c2594ffa` Request headers Referer http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 05 Oct 2020 05:12:05 GMT content-encoding gzip age 2013784 x-cache HIT from fastly, HIT from fastly status 200 content-length 8862 x-served-by cache-dca17738-DCA, cache-fra19182-FRA last-modified Sat, 30 May 2015 02:58:48 GMT vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 757d036e-ba04-49b2-b370-d08ac1febcd0 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Thu, 06 Sep 2040 21:49:00 GMT
GET H2	200	11E08O3eXDL.css images-na.ssl-images-amazon.com/images/I/	2 KB 1 KB	23ms 6ms	Stylesheet text/css	2a04:4e42:3::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/11E08O3eXDL.css?AUIClients/CVFAssets Requested by Host: 165.84.180.46 URL: http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `122a38d736dd4b129af47e1d4f6d955d335f55256f2f231d8ccd1a58562cd381` Request headers Referer http://165.84.180.46/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 05 Oct 2020 05:12:05 GMT content-encoding gzip age 16375212 x-cache HIT from fastly, HIT from fastly status 200 content-length 896 x-served-by cache-dca17725-DCA, cache-fra19182-FRA last-modified Fri, 27 Mar 2020 19:40:05 GMT vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 8de2c8bd-afec-4e88-96f4-e3c7b5595f00 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Sat, 24 Mar 2040 16:31:52 GMT
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png images-cn.ssl-images-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	771ms 244ms	Image image/png	27.148.154.7 CHINATELECOM-FUJI...
General Check archive.org Show headers Download Go to Show image Full URL https://images-cn.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61ECVh+vn2L._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,314YUrkEzTL.css_.css?AUIClients/AmazonUI Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 27.148.154.7 , China, ASN133774 (CHINATELECOM-FUJIAN-FUZHOU-IDC1 Fuzhou, CN), Reverse DNS Software PWS/8.3.1.0.8 / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers Referer https://images-na.ssl-images-amazon.com/images/I/61ECVh+vn2L._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,314YUrkEzTL.css_.css?AUIClients/AmazonUI User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 05 Oct 2020 05:12:06 GMT Age 1 Edge-Cache-Tag x-cache-917,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 X-Via 1.1 anxinxiazai52:6 (W), 1.1 hdx46:13 (W), 1.1 fuzhoudianxin13:13 (W) Connection keep-alive Content-Length 27972 Surrogate-key x-cache-917 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 Last-Modified Fri, 22 Sep 2017 00:23:19 GMT Server PWS/8.3.1.0.8 X-Ws-Request-Id 5f7aab26_PS-FOC-01fPv70_35752-24733 Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=630720000,public X-Amz-IR-Id c9c834d3-ec66-47fc-8d74-0a2506917658 Timing-Allow-Origin https://www.amazon.com Expires Thu, 27 Sep 2040 09:45:02 GMT
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea._V2_.png images-cn.ssl-images-amazon.com/images/G/01/AUIClients/	4 KB 4 KB	1243ms 244ms	Image image/png	27.148.154.7 CHINATELECOM-FUJI...
General Check archive.org Show headers Download Go to Show image Full URL https://images-cn.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea._V2_.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61ECVh+vn2L._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,314YUrkEzTL.css_.css?AUIClients/AmazonUI Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 27.148.154.7 , China, ASN133774 (CHINATELECOM-FUJIAN-FUZHOU-IDC1 Fuzhou, CN), Reverse DNS Software PWS/8.3.1.0.8 / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers Referer https://images-na.ssl-images-amazon.com/images/I/61ECVh+vn2L._RC%7C11Fd9tJOdtL.css,21y5jWQoUML.css,31Q3id-QR0L.css,314YUrkEzTL.css_.css?AUIClients/AmazonUI User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 05 Oct 2020 05:12:06 GMT Age 1 Edge-Cache-Tag x-cache-768,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea X-Via 1.1 z54:10 (W), 1.1 PS-000-01GiW213:9 (W), 1.1 fuzhoudianxin12:2 (W) Connection keep-alive Content-Length 3589 Surrogate-key x-cache-768 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_jp_1x-f8582354fc42b464ef5eb709dd98f9371d3eafea Last-Modified Tue, 06 Oct 2015 22:39:54 GMT Server PWS/8.3.1.0.8 X-Ws-Request-Id 5f7aab26_PS-FOC-01fPv70_35752-24786 Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=630720000,public X-Amz-IR-Id a2d8f6bd-bef3-4cfd-a98d-853e10e12b12 Timing-Allow-Origin https://www.amazon.com Expires Thu, 27 Sep 2040 00:59:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

images-cn.ssl-images-amazon.com
images-na.ssl-images-amazon.com
165.84.180.46
27.148.154.7
2a04:4e42:3::272
0c53ac1ab9deae845fea4fcd1a266297ecaeafde0c6bfc903dc6ea2ecd4a1eef
122a38d736dd4b129af47e1d4f6d955d335f55256f2f231d8ccd1a58562cd381
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
8c23ec3cf642a3bdb329d68c6038db8172b01fcad5270f36cf447235c2594ffa
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
dcd0056093ab95e17042b51793826382dc9bb170f402757db08a338d77ac149e

165.84.180.46 Open in urlscan Pro 165.84.180.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

33 %IPv6

1 Domains

2 Subdomains

3 IPs

3 Countries

69 kBTransfer

224 kBSize

0 Cookies

9 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

165.84.180.46 Open in urlscan Pro
165.84.180.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

33 %
IPv6

1
Domains

2
Subdomains

3
IPs

3
Countries

69 kB
Transfer

224 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!