nedmain.d69m3w8gt7qmj.amplifyapp.com Open in urlscan Pro
13.32.121.47 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cornerstone-systems.com/ned/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver3.php
Effective URL:
https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029=
Submission: On December 22 via manual (December 22nd 2022, 8:46:51 pm UTC) from ZA — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 13.32.121.47, located in United States and belongs to AMAZON-02, US. The main domain is nedmain.d69m3w8gt7qmj.amplifyapp.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on December 20th 2022. Valid for: a year.

This is the only time nedmain.d69m3w8gt7qmj.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nedbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	23.111.252.216 23.111.252.216	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
6	13.32.121.47 13.32.121.47	16509 (AMAZON-02) (AMAZON-02)
5	168.142.204.82 168.142.204.82	3741 (IS) (IS)
11	2

1 23.111.252.216 (Potomac, United States) 1 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

cornerstone-systems.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.32.121.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-47.fra60.r.cloudfront.net

nedmain.d69m3w8gt7qmj.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 168.142.204.82 (Johannesburg, South Africa)

ASN3741 (IS, ZA)

secured.nedbank.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	amplifyapp.com nedmain.d69m3w8gt7qmj.amplifyapp.com	203 KB
5	nedbank.co.za secured.nedbank.co.za
1	cornerstone-systems.com 1 redirects cornerstone-systems.com — Cisco Umbrella Rank: 746392	185 B
11	3

	Domain	Requested by
6	nedmain.d69m3w8gt7qmj.amplifyapp.com	nedmain.d69m3w8gt7qmj.amplifyapp.com
5	secured.nedbank.co.za	nedmain.d69m3w8gt7qmj.amplifyapp.com
1	cornerstone-systems.com	1 redirects
11	3

This site contains no links.

Subject Issuer	Validity	Valid
*.d69m3w8gt7qmj.amplifyapp.com Amazon RSA 2048 M01	`2022-12-20` - `2024-01-19`	a year	crt.sh
secured.nedbank.co.za Entrust Certification Authority - L1M	`2022-09-05` - `2023-10-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029=
Frame ID: 3D05D6E12610E9759DFC6F3E1824020B
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nedbank Money

Page URL History Show full URLs

https://cornerstone-systems.com/ned/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver3.php HTTP 302
https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

203 kB
Transfer

514 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cornerstone-systems.com/ned/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver3.php HTTP 302
https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html Show response nedmain.d69m3w8gt7qmj.amplifyapp.com/ Redirect Chain https://cornerstone-systems.com/ned/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver3.php https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029=	196 KB 27 KB	333ms 237ms	Document text/html	13.32.121.47 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-47.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `e4f2b16c4e5cfd7ebcc52001be5e927ed63c4921b97104bd6b5d302215b84e23` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Thu, 22 Dec 2022 20:46:46 GMT etag W/"1fcc1780233c941672271eff6b35b027" last-modified Tue, 20 Dec 2022 06:21:47 GMT server AmazonS3 vary Accept-Encoding via 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) x-amz-cf-id CeziifJWuJ5dqAbRnvBD2dTkqKIQe-nivsvxsRxHjPou6SjvO7481Q== x-amz-cf-pop FRA60-P1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront Redirect headers content-encoding br content-length 5 content-type text/html; charset=UTF-8 date Thu, 22 Dec 2022 20:46:45 GMT location https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= server Apache vary Accept-Encoding
GET H2	200	styles.css nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/	173 KB 30 KB	224ms 224ms	Stylesheet text/css	13.32.121.47 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/styles.css Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-47.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 22 Dec 2022 20:46:47 GMT content-encoding gzip via 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) last-modified Tue, 20 Dec 2022 06:21:47 GMT server AmazonS3 x-amz-cf-pop FRA60-P1 etag W/"4806d0340f18231c3e440b2ef31ba0d3" x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 x-amz-cf-id aP0Y9lj3lRn8grrMRqZyrNTUKWy-aXDTwN_RAww9qulJbXGpY-MKaQ==
GET H2	200	jquery.min.js.download Show response nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/	95 KB 95 KB	253ms 252ms	Script application/octet-stream	13.32.121.47 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/jquery.min.js.download Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-47.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 22 Dec 2022 20:46:47 GMT via 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) last-modified Tue, 20 Dec 2022 06:21:47 GMT server AmazonS3 x-amz-cf-pop FRA60-P1 etag "4f252523d4af0b478c810c2547a63e19" x-amz-server-side-encryption AES256 x-cache Miss from cloudfront content-type application/octet-stream cache-control public, max-age=0, s-maxage=2 accept-ranges bytes content-length 97163 x-amz-cf-id P7alpimLCfbf3ocAdBf8iKp-BBl-imybprTEfNt05_xI5MC-GTuhVA==
GET H2	200	logo.PNG nedmain.d69m3w8gt7qmj.amplifyapp.com/LWxlZnQgPiAuYXJyb3csW3Vp_files/	50 KB 51 KB	225ms 225ms	Image image/png	13.32.121.47 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://nedmain.d69m3w8gt7qmj.amplifyapp.com/LWxlZnQgPiAuYXJyb3csW3Vp_files/logo.PNG Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-47.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `387eb324b928bd34df5a8e5ec66bd548c64598c979c16a4bd100269d46940c0d` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 22 Dec 2022 20:46:47 GMT via 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) last-modified Tue, 20 Dec 2022 06:21:47 GMT server AmazonS3 x-amz-cf-pop FRA60-P1 x-amz-server-side-encryption AES256 etag "b593b661140ec418f761a7aacee763fc" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes content-length 51356 x-amz-cf-id dBpBnQF7Em_p8bb2NaQOiRDuYsZ7hRzo0zgoWBCmYhEudSVZ7-7oBA==
GET H/1.1	200 OK	NedbanklogoBig.6565daa3d61b85155a08.svg secured.nedbank.co.za/	0 0	1215ms 403ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/NedbanklogoBig.6565daa3d61b85155a08.svg Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers
GET H2	404	FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/	0 0	657ms 657ms	Font text/html	13.32.121.47 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/styles.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-47.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/styles.css Origin https://nedmain.d69m3w8gt7qmj.amplifyapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 22 Dec 2022 20:46:46 GMT content-encoding gzip via 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop FRA60-P1 vary Accept-Encoding x-cache Error from cloudfront content-type text/html x-amz-cf-id ruZ0q_rOy2esJEUnBhadED3Mq3AfS0sWztlkjMqP9zzGHlIj2p3f9Q==
GET H2	404	FontFont%20-%20MarkPro-Medium.8531ae94f5ad973be8b7.otf nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/	0 0	248ms 248ms	Font text/html	13.32.121.47 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/FontFont%20-%20MarkPro-Medium.8531ae94f5ad973be8b7.otf Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/styles.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.121.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-121-47.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/styles.css Origin https://nedmain.d69m3w8gt7qmj.amplifyapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 22 Dec 2022 20:46:46 GMT content-encoding gzip via 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop FRA60-P1 vary Accept-Encoding x-cache Error from cloudfront content-type text/html x-amz-cf-id 0uOhV-Mtoh7tJBA0vLvPRjw0p_mGcekjBqdBaiZ4VOIR2TA71nyMig==
GET H/1.1	200 OK	contact-footer.ff0deb4d99b5c501e332.svg secured.nedbank.co.za/	0 0	1211ms 406ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-footer.ff0deb4d99b5c501e332.svg Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank.e36d304f8628a21886d3.svg secured.nedbank.co.za/	0 0	1217ms 409ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank.e36d304f8628a21886d3.svg Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers
GET H/1.1	200 OK	phoneicon.d20aa97e94487e70b840.svg secured.nedbank.co.za/	0 0	1220ms 412ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/phoneicon.d20aa97e94487e70b840.svg Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers
GET H/1.1	200 OK	tncs.04b64534a4bbcb7c2676.svg secured.nedbank.co.za/	0 0	1214ms 406ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/tncs.04b64534a4bbcb7c2676.svg Requested by Host: nedmain.d69m3w8gt7qmj.amplifyapp.com URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ZHRoPSI0MHB4IiBoZWlnaHQ9IjQwcHgiIHZpZXdCb3g9IjAgMCA1M_ver7.html?rr0298938029= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://nedmain.d69m3w8gt7qmj.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nedbank (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/FontFont%20-%20MarkPro-Medium.8531ae94f5ad973be8b7.otf Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://nedmain.d69m3w8gt7qmj.amplifyapp.com/otp_files/FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cornerstone-systems.com
nedmain.d69m3w8gt7qmj.amplifyapp.com
secured.nedbank.co.za
13.32.121.47
168.142.204.82
23.111.252.216
387eb324b928bd34df5a8e5ec66bd548c64598c979c16a4bd100269d46940c0d
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f2b16c4e5cfd7ebcc52001be5e927ed63c4921b97104bd6b5d302215b84e23

nedmain.d69m3w8gt7qmj.amplifyapp.com Open in urlscan Pro 13.32.121.47 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

203 kBTransfer

514 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

nedmain.d69m3w8gt7qmj.amplifyapp.com Open in urlscan Pro
13.32.121.47 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

203 kB
Transfer

514 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!