amazon-kunden.tech Open in urlscan Pro
2400:cb00:2048:1::681f:4967 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://amazon-kunden.tech/
Effective URL:
http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=tr...
Submission: On August 03 via api (August 3rd 2017, 2:15:52 pm UTC) from CA

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2400:cb00:2048:1::681f:4967, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is amazon-kunden.tech.

This is the only time amazon-kunden.tech was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon DE (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	2400:cb00:204... 2400:cb00:2048:1::681f:4967	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
5	2400:cb00:204... 2400:cb00:2048:1::681f:4867	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
9	2

4 2400:cb00:2048:1::681f:4967 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

amazon-kunden.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2400:cb00:2048:1::681f:4867 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

amazon-kunden.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	amazon-kunden.tech amazon-kunden.tech	74 KB
9	1

	Domain	Requested by
9	amazon-kunden.tech	amazon-kunden.tech
9	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976
Frame ID: 16036.1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

9
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

74 kB
Transfer

158 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/ Redirect Chain http://amazon-kunden.tech/ http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976	3 KB 1 KB	108ms 107ms	Document text/html	2400:cb00:2048:1::681f:4967 CloudFlare
General Check archive.org Show headers Download Go to Full URL http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4967 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `241aee20c2f98721215bb85de862c4a44cbab5dbeaf4efee24681fb46772fc06` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Pragma no-cache Date Thu, 03 Aug 2017 14:15:40 GMT Content-Encoding gzip Server cloudflare-nginx Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Transfer-Encoding chunked Connection keep-alive CF-RAY 3889e3ef53cc6427-FRA Expires Thu, 19 Nov 1981 08:52:00 GMT Redirect headers Pragma no-cache Date Thu, 03 Aug 2017 14:15:40 GMT Server cloudflare-nginx Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Location http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection keep-alive CF-RAY 3889e3ec41656427-FRA Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	duajMpjUAwu7vm83BmeCNA8z.php amazon-kunden.tech/content/css/	4 KB 1 KB	614ms 614ms	Stylesheet text/css	2400:cb00:2048:1::681f:4967 CloudFlare
General Check archive.org Show headers Download Go to Full URL http://amazon-kunden.tech/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4967 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `67b5090f555401bde674983a1d56aec41393c2732af0fcdfc25be8068dd378be` Request headers Referer http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Pragma no-cache Date Thu, 03 Aug 2017 14:15:41 GMT Content-Encoding gzip Server cloudflare-nginx Vary Accept-Encoding Content-Type text/css;charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection keep-alive CF-RAY 3889e3f0046d6427-FRA Content-Length 1166 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	jquery.min.js Show response amazon-kunden.tech/content/js/	95 KB 33 KB	24ms 18ms	Script application/javascript	2400:cb00:2048:1::681f:4867 CloudFlare
General Check archive.org Show headers Download Go to Full URL http://amazon-kunden.tech/content/js/jquery.min.js Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4867 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers Referer http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Thu, 03 Aug 2017 14:15:40 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Fri, 28 Jul 2017 04:44:25 GMT Server cloudflare-nginx ETag "17b8b-5555955e61e60-gzip" Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3889e3f017b72768-FRA Content-Length 33760 Expires Thu, 03 Aug 2017 18:15:40 GMT
GET H/1.1	200 OK	logo.png amazon-kunden.tech/content/img/	5 KB 5 KB	8ms 8ms	Image image/png	2400:cb00:2048:1::681f:4867 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL http://amazon-kunden.tech/content/img/logo.png Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4867 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `75a3f6f2ba7fb644bf1b0e53b9451e73495ea37ef8bd45932e5115f88af20228` Request headers Referer http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Thu, 03 Aug 2017 14:15:41 GMT CF-Cache-Status HIT Last-Modified Fri, 28 Jul 2017 04:44:43 GMT Server cloudflare-nginx ETag "146c-5555956f82aa0" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3889e3f3e2502768-FRA Content-Length 5228 Expires Thu, 03 Aug 2017 18:15:41 GMT
GET H/1.1	200 OK	warning.png amazon-kunden.tech/content/img/	3 KB 3 KB	7ms 7ms	Image image/png	2400:cb00:2048:1::681f:4867 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL http://amazon-kunden.tech/content/img/warning.png Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4867 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `47db8119e1126e41c0cc98930273b4e1d303eef2b3e6b39ef019b68f0497cf64` Request headers Referer http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Thu, 03 Aug 2017 14:15:41 GMT CF-Cache-Status HIT Last-Modified Fri, 28 Jul 2017 04:44:29 GMT Server cloudflare-nginx ETag "c96-55559562ecfc0" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3889e3f3f25c2768-FRA Content-Length 3222 Expires Thu, 03 Aug 2017 18:15:41 GMT
GET H/1.1	200 OK	jsfunctions.php Show response amazon-kunden.tech/content/js/	20 KB 3 KB	585ms 584ms	Script application/javascript	2400:cb00:2048:1::681f:4867 CloudFlare
General Check archive.org Show headers Download Go to Full URL http://amazon-kunden.tech/content/js/jsfunctions.php?s=true Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4867 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `0c1db99b5d96ee8ee31eff5a5b29286cd96f7f9fb52c004d25baebc8e31f03ca` Request headers Referer http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Pragma no-cache Date Thu, 03 Aug 2017 14:15:41 GMT Content-Encoding gzip Server cloudflare-nginx Vary Accept-Encoding Content-Type application/javascript Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection keep-alive CF-RAY 3889e3f047d72768-FRA Content-Length 3449 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	ember.woff amazon-kunden.tech/content/fonts/	22 KB 22 KB	294ms 293ms	Font application/font-woff	2400:cb00:2048:1::681f:4967 CloudFlare
General Check archive.org Show headers Download Go to Full URL http://amazon-kunden.tech/content/fonts/ember.woff Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4967 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `781a806fe93972194da13561a137e0d322a46074fda7dd7cd39856e26451ab9e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Referer http://amazon-kunden.tech/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Origin http://amazon-kunden.tech Response headers Date Thu, 03 Aug 2017 14:15:41 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Fri, 28 Jul 2017 04:45:22 GMT Server cloudflare-nginx ETag W/"5684-55559594f8820" Vary Accept-Encoding Content-Type application/font-woff Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 3889e3f407656427-FRA Expires Thu, 03 Aug 2017 18:15:41 GMT
GET H/1.1	200 OK	cell1.png amazon-kunden.tech/content/img/	3 KB 3 KB	7ms 7ms	Image image/png	2400:cb00:2048:1::681f:4867 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL http://amazon-kunden.tech/content/img/cell1.png Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4867 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `7ffa9f937365e72b45a56e2f4570b6d7c5215c6489e63e8bf963671c27384594` Request headers Referer http://amazon-kunden.tech/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Thu, 03 Aug 2017 14:15:41 GMT CF-Cache-Status HIT Last-Modified Fri, 28 Jul 2017 04:44:58 GMT Server cloudflare-nginx ETag "b00-5555957def0c0" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3889e3f402662768-FRA Content-Length 2816 Expires Thu, 03 Aug 2017 18:15:41 GMT
GET H/1.1	200 OK	cell2.png amazon-kunden.tech/content/img/	3 KB 3 KB	18ms 12ms	Image image/png	2400:cb00:2048:1::681f:4967 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL http://amazon-kunden.tech/content/img/cell2.png Requested by Host: amazon-kunden.tech URL: http://amazon-kunden.tech/669026/sicherheit/germany/662150347232/onlinebanking/nrEcgP/?onlinebanking?operator=protect&s=true&userID=6976 Protocol HTTP/1.1 Server 2400:cb00:2048:1::681f:4967 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `417cf1581787c84d590e479623aad7efb4fb44c9b90fa98bc6878dae2980342b` Request headers Referer http://amazon-kunden.tech/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Thu, 03 Aug 2017 14:15:41 GMT CF-Cache-Status HIT Last-Modified Fri, 28 Jul 2017 04:44:56 GMT Server cloudflare-nginx ETag "b01-5555957ca0160" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3889e3f406fa2690-FRA Content-Length 2817 Expires Thu, 03 Aug 2017 18:15:41 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon DE (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon-kunden.tech/	1970-01-01 00:00:00	Name: PHPSESSID Value: gv4p01eo5og4mn7flkuhlcg073
			.amazon-kunden.tech/	2018-08-03 14:15:40	Name: __cfduid Value: dbb8f9ff8d48732482aedd213981b193d1501769740

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon-kunden.tech
2400:cb00:2048:1::681f:4867
2400:cb00:2048:1::681f:4967
0c1db99b5d96ee8ee31eff5a5b29286cd96f7f9fb52c004d25baebc8e31f03ca
241aee20c2f98721215bb85de862c4a44cbab5dbeaf4efee24681fb46772fc06
417cf1581787c84d590e479623aad7efb4fb44c9b90fa98bc6878dae2980342b
47db8119e1126e41c0cc98930273b4e1d303eef2b3e6b39ef019b68f0497cf64
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
67b5090f555401bde674983a1d56aec41393c2732af0fcdfc25be8068dd378be
75a3f6f2ba7fb644bf1b0e53b9451e73495ea37ef8bd45932e5115f88af20228
781a806fe93972194da13561a137e0d322a46074fda7dd7cd39856e26451ab9e
7ffa9f937365e72b45a56e2f4570b6d7c5215c6489e63e8bf963671c27384594

amazon-kunden.tech Open in urlscan Pro 2400:cb00:2048:1::681f:4967 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

9 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

74 kBTransfer

158 kBSize

2 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

amazon-kunden.tech Open in urlscan Pro
2400:cb00:2048:1::681f:4967 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

74 kB
Transfer

158 kB
Size

2
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!