URL: https://www.ymdzg.xyz/
Submission: On December 07 via api from JP — Scanned from JP

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 88.218.193.18, located in Germany and belongs to XNNET, US. The main domain is www.ymdzg.xyz.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on December 7th 2022. Valid for: 3 months.
This is the only time www.ymdzg.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

IP Address AS Autonomous System
9 88.218.193.18 6134 (XNNET)
2 2600:9000:213... 16509 (AMAZON-02)
11 2
Apex Domain
Subdomains
Transfer
9 ymdzg.xyz
www.ymdzg.xyz
281 KB
2 ssl-images-amazon.com
images-cn.ssl-images-amazon.com — Cisco Umbrella Rank: 288928
32 KB
11 2
Domain Requested by
9 www.ymdzg.xyz www.ymdzg.xyz
2 images-cn.ssl-images-amazon.com www.ymdzg.xyz
11 2

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp
Subject Issuer Validity Valid
www.ymdzg.xyz
ZeroSSL RSA Domain Secure Site CA
2022-12-07 -
2023-03-07
3 months crt.sh
images-cn.ssl-images-amazon.com
Amazon
2022-11-14 -
2023-12-12
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.ymdzg.xyz/
Frame ID: 090F34BE9165F8F2A68B51A8A8B79D3C
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Amazonサインイン

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

313 kB
Transfer

311 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.ymdzg.xyz/
12 KB
12 KB
Document
General
Full URL
https://www.ymdzg.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
c8480f91512e6bb334fe92e5c4e12d76cdb03184f2c8bab86ec0c2b52b3f5908

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Connection
keep-alive
Content-Length
12177
Content-Type
text/html
61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
www.ymdzg.xyz/static/file_pc/index_files/
131 KB
131 KB
Stylesheet
General
Full URL
https://www.ymdzg.xyz/static/file_pc/index_files/61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
f8398641cd3b832deaf47e23bd07e052e17bcaad4fdfa60ab9d674741df81b9f

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
133768
Content-Type
text/css
01SdjaY0ZsL._RC_31jdWD+JB+L.css,41CoXfMtudL.css_.css
www.ymdzg.xyz/static/file_pc/index_files/
36 KB
36 KB
Stylesheet
General
Full URL
https://www.ymdzg.xyz/static/file_pc/index_files/01SdjaY0ZsL._RC_31jdWD+JB+L.css,41CoXfMtudL.css_.css
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
d677760fa69d216fe4dafd1a4548587e1b482f74b34f08e57085796d2187fd3d

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
36584
Content-Type
text/css
11JNAJswl5L.css
www.ymdzg.xyz/static/file_pc/index_files/
2 KB
3 KB
Stylesheet
General
Full URL
https://www.ymdzg.xyz/static/file_pc/index_files/11JNAJswl5L.css
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
e0d431809e06e686cfe3bd266b39e35964eaa28507eff4751f9fb99717854e72

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
2537
Content-Type
text/css
main.js
www.ymdzg.xyz/static/main/
3 KB
3 KB
Script
General
Full URL
https://www.ymdzg.xyz/static/main/main.js
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
7774ec42f1109d7dd18222b1b97839c964a786112ff76da2652dc74402b1c19c

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
3060
Content-Type
application/x-javascript
loading.css
www.ymdzg.xyz/static/main/
2 KB
2 KB
Stylesheet
General
Full URL
https://www.ymdzg.xyz/static/main/loading.css
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
5b2e0604209e9726a0ae78837a04455dda0a6b53ccb4a88deed788ddeb553ab7

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
1576
Content-Type
text/css
jquery-1.9.1.min.js
www.ymdzg.xyz/static/main/
90 KB
91 KB
Script
General
Full URL
https://www.ymdzg.xyz/static/main/jquery-1.9.1.min.js
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
92629
Content-Type
application/x-javascript
loading.js
www.ymdzg.xyz/static/main/
1 KB
2 KB
Script
General
Full URL
https://www.ymdzg.xyz/static/main/loading.js
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
e8badccc3c42bb234fc7db5ddc5487307a795faf01dee904ea439823becc4ad5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
1503
Content-Type
application/x-javascript
jquery.cookie.js
www.ymdzg.xyz/static/main/
3 KB
3 KB
Script
General
Full URL
https://www.ymdzg.xyz/static/main/jquery.cookie.js
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
88.218.193.18 , Germany, ASN6134 (XNNET, US),
Reverse DNS
88.218.193.18.static.xtom.com
Software
/
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
3121
Content-Type
application/x-javascript
mPGmT0r6IeTyIee.png
images-cn.ssl-images-amazon.com/images/S/sash/
27 KB
28 KB
Image
General
Full URL
https://images-cn.ssl-images-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/static/file_pc/index_files/61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2138:4000:10:1731:ff49:ac01 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 11:06:55 GMT
via
1.1 01d4e8d94c61f8f56aebaa1af365cc6e.cloudfront.net (CloudFront)
x-amz-cf-pop
NRT12-C2
age
8974951
edge-cache-tag
x-cache-686,/images/S/sash/mPGmT0r6IeTyIee
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
27972
surrogate-key
x-cache-686 /images/S/sash/mPGmT0r6IeTyIee
last-modified
Tue, 17 Nov 2020 23:31:33 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
62a6d5a3-7bcc-4a19-aa4f-a1f0481dc156
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
b41KsNk-zX1BCF5EhsmVcWUHdbg6xdNsXoM9IK9e2ojWrV3h7_mFvw==
expires
Sun, 17 Aug 2042 00:43:04 GMT
EYzhM86N6ZcDPtA.png
images-cn.ssl-images-amazon.com/images/S/sash/
4 KB
4 KB
Image
General
Full URL
https://images-cn.ssl-images-amazon.com/images/S/sash/EYzhM86N6ZcDPtA.png
Requested by
Host: www.ymdzg.xyz
URL: https://www.ymdzg.xyz/static/file_pc/index_files/61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2138:4000:10:1731:ff49:ac01 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.ymdzg.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Thu, 10 Nov 2022 13:01:35 GMT
via
1.1 01d4e8d94c61f8f56aebaa1af365cc6e.cloudfront.net (CloudFront)
x-amz-cf-pop
NRT12-C2
age
2315271
edge-cache-tag
x-cache-741,/images/S/sash/EYzhM86N6ZcDPtA
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
3589
surrogate-key
x-cache-741 /images/S/sash/EYzhM86N6ZcDPtA
last-modified
Tue, 17 Nov 2020 23:31:29 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
8a1663f1-b85d-4779-8495-08275354e8b2
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
sP7EVWzUOKybgm8fNcpyfQhPI3S8xWu32s6FMzSqIecZuwD7hFwioQ==
expires
Tue, 04 Nov 2042 13:16:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| postvalue function| $ function| jQuery function| loadDiv function| LayerShow function| Position function| LayerHide function| del function| cf

1 Cookies

Domain/Path Name / Value
www.ymdzg.xyz/ Name: Token_ID
Value: 475712621921621081