504clientamazo23.dns.army Open in urlscan Pro
45.82.120.43 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://504clientamazo23.dns.army/
Effective URL:
https://504clientamazo23.dns.army/az
Submission: On August 18 via automatic, source certstream-suspicious (August 18th 2023, 8:43:57 pm UTC) — Scanned from DE

Summary HTTP 16 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 45.82.120.43, located in Germany and belongs to SYNLINQ synlinq.de, DE. The main domain is 504clientamazo23.dns.army.
TLS certificate: Issued by R3 on August 18th 2023. Valid for: 3 months.

This is the only time 504clientamazo23.dns.army was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 12	45.82.120.43 45.82.120.43	44486 (SYNLINQ s...) (SYNLINQ synlinq.de)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2600:9000:26d... 2600:9000:26db:8a00:1d:d7f6:39d2:2dc1	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:218... 2600:9000:218e:3e00:1d:d7f6:39d2:2dc1	16509 (AMAZON-02) (AMAZON-02)
16	4

12 45.82.120.43 (Germany) 1 redirects

ASN44486 (SYNLINQ synlinq.de, DE)
PTR: default.bero-host.de

504clientamazo23.dns.army	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26db:8a00:1d:d7f6:39d2:2dc1 (United States)

ASN16509 (AMAZON-02, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	dns.army 1 redirects 504clientamazo23.dns.army	112 KB
3	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 555	95 KB
1	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 998	12 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 985	30 KB
16	4

	Domain	Requested by
12	504clientamazo23.dns.army	1 redirects 504clientamazo23.dns.army code.jquery.com
3	m.media-amazon.com	504clientamazo23.dns.army
1	images-na.ssl-images-amazon.com	504clientamazo23.dns.army
1	code.jquery.com	504clientamazo23.dns.army
16	4

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
504clientamazo23.dns.army R3	`2023-08-18` - `2023-11-16`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-10-26` - `2023-10-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://504clientamazo23.dns.army/az
Frame ID: 0A2578371D25F225B06F280A87FB6419
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign In

Page URL History Show full URLs

https://504clientamazo23.dns.army/ HTTP 302
https://504clientamazo23.dns.army/az Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

249 kB
Transfer

665 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ref=navm_hdr_logo

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=anywhere_us&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fgp%2Fyourstore%2Fhome%3Fie%3DUTF8%26ref_%3Dnav_newcust&prevRID=HSN52S30J35SYS0HC52A&openid.assoc_handle=anywhere_v2_us&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/aw/help/ref=navm_ftr_cou?ie=UTF8&id=cou
Title: Conditions of Use

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/aw/help/ref=navm_ftr_iba?ie=UTF8&id=201308670
Title: Interest-Based Ads

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://504clientamazo23.dns.army/ HTTP 302
https://504clientamazo23.dns.army/az Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request az Show response 504clientamazo23.dns.army/ Redirect Chain https://504clientamazo23.dns.army/ https://504clientamazo23.dns.army/az	23 KB 5 KB	362ms 361ms	Document text/html	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `20a4c2a65be78422782fc20572c886fca9ad05ad25adc8bc8c34370b1b8a12cf` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 4912 Content-Type text/html; charset=UTF-8 Date Fri, 18 Aug 2023 20:43:53 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache/2.4.57 (Ubuntu) Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Fri, 18 Aug 2023 20:43:48 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.57 (Ubuntu) location /az
GET H/1.1	200 OK	main.css 504clientamazo23.dns.army/assets/az/css/	177 KB 27 KB	45ms 44ms	Stylesheet text/css	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/css/main.css Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `d4f56b9086c03e86da8967fe463c9be3f89bcbd067d85a140ab26b5852cd164e` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Mon, 08 Apr 2019 17:33:02 GMT Server Apache/2.4.57 (Ubuntu) ETag "2c37d-586083a728f80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 26991
GET H/1.1	200 OK	jqueryui.css 504clientamazo23.dns.army/assets/az/css/	41 KB 8 KB	122ms 44ms	Stylesheet text/css	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/css/jqueryui.css Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `555c846ca12b67df20feea60bdb994c67040bfdc1e13806a51375539bf74dbe4` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Fri, 22 Mar 2019 02:43:50 GMT Server Apache/2.4.57 (Ubuntu) ETag "a487-584a5d31e4580-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7490
GET H/1.1	200 OK	jquery-3.3.1.min.js Show response 504clientamazo23.dns.army/assets/az/js/	85 KB 30 KB	129ms 48ms	Script application/javascript	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/js/jquery-3.3.1.min.js Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Sun, 17 Mar 2019 08:59:32 GMT Server Apache/2.4.57 (Ubuntu) ETag "1538f-584467d850500-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30307
GET H/1.1	200 OK	jquery.form-validator.min.js Show response 504clientamazo23.dns.army/assets/az/js/	33 KB 11 KB	125ms 43ms	Script application/javascript	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/js/jquery.form-validator.min.js Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `1fb6d8a00c3bdfcaa09ecd7b3feef05adefb01f9c487bc8224c40650235cc500` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Fri, 01 Feb 2019 23:09:20 GMT Server Apache/2.4.57 (Ubuntu) ETag "839a-580dd3b9fa800-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 10449
GET H/1.1	200 OK	jquery.mask.js Show response 504clientamazo23.dns.army/assets/az/js/	18 KB 5 KB	131ms 47ms	Script application/javascript	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/js/jquery.mask.js Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Fri, 02 Nov 2018 14:50:04 GMT Server Apache/2.4.57 (Ubuntu) ETag "47fe-579afa68c3f00-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 4948
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	136ms 43ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://504clientamazo23.dns.army/ Origin https://504clientamazo23.dns.army accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Fri, 18 Aug 2023 20:43:53 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15d9d" vary Accept-Encoding x-hw 1692391433.dop151.fr8.t,1692391433.cds324.fr8.hn,1692391433.cds144.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H/1.1	200 OK	actions.js Show response 504clientamazo23.dns.army/assets/js/	644 B 635 B	174ms 40ms	Script application/javascript	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/js/actions.js?v=1692391433 Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Thu, 29 Jul 2021 07:18:16 GMT Server Apache/2.4.57 (Ubuntu) ETag "284-5c83de817fe00-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 286
GET H/1.1	200 OK	style.css 504clientamazo23.dns.army/assets/az/css/	82 KB 13 KB	120ms 42ms	Stylesheet text/css	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/css/style.css Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `0299dfa6dd554c6f3218ab41c316e0df35873f3dc668010348b91fb08dc06098` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Thu, 21 Mar 2019 21:31:30 GMT Server Apache/2.4.57 (Ubuntu) ETag "14852-584a176209080-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 12795
GET H/1.1	200 OK	suggestion.css 504clientamazo23.dns.army/assets/az/css/	4 KB 2 KB	123ms 44ms	Stylesheet text/css	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/assets/az/css/suggestion.css Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `04c0ec85c7bc17d59738178e7943f675902174ad5eea7a0dbf6a117c5b60513b` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Content-Encoding gzip Last-Modified Thu, 21 Mar 2019 21:32:44 GMT Server Apache/2.4.57 (Ubuntu) ETag "eda-584a17a89b700-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1204
GET H/1.1	200 OK	blue.png 504clientamazo23.dns.army/assets/az/images/	11 KB 11 KB	39ms 39ms	Image image/png	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://504clientamazo23.dns.army/assets/az/images/blue.png Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/az User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Fri, 18 Aug 2023 20:43:53 GMT Last-Modified Thu, 21 Mar 2019 20:45:04 GMT Server Apache/2.4.57 (Ubuntu) ETag "2c41-584a0d0119400" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 11329
GET H2	200	new-nav-sm-smile-sprite-global-1x_blueheaven._CB496507362_.png images-na.ssl-images-amazon.com/images/G/01/gno/sprites/	11 KB 12 KB	177ms 51ms	Image image/png	2600:9000:26db:8a00:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images-na.ssl-images-amazon.com/images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven._CB496507362_.png Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/az Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26db:8a00:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Fri, 18 Aug 2023 20:43:53 GMT via 1.1 b9c5f3514baef1f70c91fc9b0be37d2e.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P3 age 301 edge-cache-tag x-cache-985,/images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 11329 surrogate-key x-cache-985 /images/G/01/gno/sprites/new-nav-sm-smile-sprite-global-1x_blueheaven last-modified Wed, 02 May 2018 02:39:57 GMT server Server vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control max-age=3600,public x-amz-ir-id 98c6046f-c609-4d79-bea5-048ad2f4d43d accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id KmKNUz96N0fZSEr9ZLvAyRFXS0yamwqIefm8cyo5I_8oiJAOo1AB5Q== expires Fri, 18 Aug 2023 21:35:17 GMT
GET H2	200	AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1._V2_.png m.media-amazon.com/images/G/01/AUIClients/	60 KB 61 KB	200ms 57ms	Image image/png	2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1._V2_.png Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/assets/az/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a` Request headers accept-language de-DE,de;q=0.9 Referer https://504clientamazo23.dns.army/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Wed, 24 May 2023 10:00:10 GMT via 1.1 f3a3f62227549dcbb83000c9d8bb826a.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P1 age 7469023 edge-cache-tag x-cache-451,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1 x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 61917 surrogate-key x-cache-451 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_2x-a3d92a134e6afaec4974bceac0812b73d0b635c1 last-modified Fri, 22 Sep 2017 00:23:21 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id e16803b8-2da9-4605-afa0-1787f010a332 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id xcm-USdUK-Tajs1l8kM-O6KNxyLy6nIt2OWXYLAJRR-kNGgjhY3BoA== expires Fri, 15 May 2043 16:48:08 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	197ms 56ms	Font application/font-woff2	2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/assets/az/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7` Request headers Referer https://504clientamazo23.dns.army/ Origin https://504clientamazo23.dns.army accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 28 Mar 2023 10:50:58 GMT via 1.1 e61ad774b1bb9761f20e1bb4c1d6c734.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P1 age 12390775 edge-cache-tag x-cache-436,/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 16616 surrogate-key x-cache-436 /images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa last-modified Sat, 11 Jun 2016 01:31:21 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 7835fe62-e9af-4bad-9007-8e68d07c7020 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id ZLERAXWqTcSU8YuLVLZyCoOXsOFPmQkFHkqsnDLb3qWYUrM4t45fKw== expires Fri, 13 Mar 2043 02:58:10 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	204ms 64ms	Font application/font-woff2	2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b._V2_.woff2 Requested by Host: 504clientamazo23.dns.army URL: https://504clientamazo23.dns.army/assets/az/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:218e:3e00:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327` Request headers Referer https://504clientamazo23.dns.army/ Origin https://504clientamazo23.dns.army accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Sun, 14 May 2023 07:44:58 GMT via 1.1 e61ad774b1bb9761f20e1bb4c1d6c734.cloudfront.net (CloudFront) x-amz-cf-pop CDG52-P1 age 8341135 edge-cache-tag x-cache-423,/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 16460 surrogate-key x-cache-423 /images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_bd-46b91bda68161c14e554a779643ef4957431987b last-modified Sat, 11 Jun 2016 01:31:24 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id f216e30c-4b73-418a-9bcc-e27e3a6ac071 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id rkTYtPIxTUHh8F9tn3DTvAbhy3h8Iwcmg8xxUvhlme_w-h1pMPUIdQ== expires Thu, 07 May 2043 02:00:56 GMT
POST H/1.1	200 OK	action Show response 504clientamazo23.dns.army/apis/lr/	25 B 338 B	238ms 238ms	XHR text/html	45.82.120.43 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://504clientamazo23.dns.army/apis/lr/action Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.82.120.43 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS default.bero-host.de Software Apache/2.4.57 (Ubuntu) / Resource Hash `c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e` Request headers Accept / Referer https://504clientamazo23.dns.army/az X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Fri, 18 Aug 2023 20:43:54 GMT Server Apache/2.4.57 (Ubuntu) Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 25 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon Japan (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			504clientamazo23.dns.army/	1969-12-31 23:59:59	Name: PHPSESSID Value: 05u5g6rokh3qcdhf1d66ifrbmb

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

504clientamazo23.dns.army
code.jquery.com
images-na.ssl-images-amazon.com
m.media-amazon.com
2001:4de0:ac18::1:a:2b
2600:9000:218e:3e00:1d:d7f6:39d2:2dc1
2600:9000:26db:8a00:1d:d7f6:39d2:2dc1
45.82.120.43
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
0299dfa6dd554c6f3218ab41c316e0df35873f3dc668010348b91fb08dc06098
04c0ec85c7bc17d59738178e7943f675902174ad5eea7a0dbf6a117c5b60513b
0b15cdea4bc6280df1387a0441e1779ac3437c975e441065339d28058bebaf5d
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1fb6d8a00c3bdfcaa09ecd7b3feef05adefb01f9c487bc8224c40650235cc500
20a4c2a65be78422782fc20572c886fca9ad05ad25adc8bc8c34370b1b8a12cf
3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033
555c846ca12b67df20feea60bdb994c67040bfdc1e13806a51375539bf74dbe4
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d4f56b9086c03e86da8967fe463c9be3f89bcbd067d85a140ab26b5852cd164e
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

504clientamazo23.dns.army Open in urlscan Pro 45.82.120.43 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

249 kBTransfer

665 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

504clientamazo23.dns.army Open in urlscan Pro
45.82.120.43 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

249 kB
Transfer

665 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!