amzsec.lawyercorp.info Open in urlscan Pro
47.251.32.76 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f
Submission: On August 03 via manual (August 3rd 2023, 3:14:28 pm UTC) from SA — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 47.251.32.76, located in Santa Clara, United States and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is amzsec.lawyercorp.info.
TLS certificate: Issued by R3 on July 30th 2023. Valid for: 3 months.

This is the only time amzsec.lawyercorp.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	47.251.32.76 47.251.32.76	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
2	162.19.58.158 162.19.58.158	16276 (OVH) (OVH)
3	2600:9000:239... 2600:9000:2394:b400:1d:d7f6:39d2:2dc1	16509 (AMAZON-02) (AMAZON-02)
8	3

3 47.251.32.76 (Santa Clara, United States)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

amzsec.lawyercorp.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.58.158 (France)

ASN16276 (OVH, FR)
PTR: ns3096590.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2394:b400:1d:d7f6:39d2:2dc1 (United States)

ASN16509 (AMAZON-02, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	lawyercorp.info amzsec.lawyercorp.info	10 KB
2	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 516	33 KB
2	ibb.co i.ibb.co — Cisco Umbrella Rank: 11021	20 KB
1	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 863	84 KB
8	4

	Domain	Requested by
3	amzsec.lawyercorp.info	amzsec.lawyercorp.info
2	m.media-amazon.com	amzsec.lawyercorp.info
2	i.ibb.co	amzsec.lawyercorp.info
1	images-na.ssl-images-amazon.com	amzsec.lawyercorp.info
8	4

This site contains no links.

Subject Issuer	Validity	Valid
amzsec.lawyercorp.info R3	`2023-07-30` - `2023-10-28`	3 months	crt.sh
i.ibb.co R3	`2023-06-11` - `2023-09-09`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-10-26` - `2023-10-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f
Frame ID: 31B6DB798E901B65C8CB6B62DF1165C2
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

تسجيل الدخول إلى Amazon

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

148 kB
Transfer

394 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin Show response amzsec.lawyercorp.info/ap/	7 KB 2 KB	1738ms 152ms	Document text/html	47.251.32.76 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.251.32.76 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `d79a3627701328dbd03c2258d79dd2b07d56a07b233ec1a553f7beab5caf4b36` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-length 2257 content-type text/html; charset=UTF-8 date Thu, 03 Aug 2023 15:14:23 GMT server Apache vary Accept-Encoding x-cache HIT
GET H2	200	pc1.css amzsec.lawyercorp.info/Resources/Assets/css/	12 KB 3 KB	206ms 205ms	Stylesheet text/css	47.251.32.76 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://amzsec.lawyercorp.info/Resources/Assets/css/pc1.css Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.251.32.76 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `2a119e867b8b5ead33ef9986f78181dee0a23efaba9a094192ef7e060583a95e` Request headers accept-language de-DE,de;q=0.9 Referer https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 03 Aug 2023 15:14:23 GMT content-encoding gzip last-modified Mon, 06 Sep 2021 17:40:38 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 3030
GET H2	200	pc1.js Show response amzsec.lawyercorp.info/Resources/Assets/js/	14 KB 5 KB	210ms 210ms	Script application/javascript	47.251.32.76 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://amzsec.lawyercorp.info/Resources/Assets/js/pc1.js Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.251.32.76 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `e900470f72fe43136df67b8fd87a8422a6d7f0f98332bd3907f901aac2cc4d5c` Request headers accept-language de-DE,de;q=0.9 Referer https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 03 Aug 2023 15:14:23 GMT content-encoding gzip last-modified Sat, 28 Aug 2021 16:34:27 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 4997
GET H2	200	amz.png i.ibb.co/LPZq55S/	18 KB 19 KB	51ms 14ms	Image image/png	162.19.58.158 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/LPZq55S/amz.png Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/ap/signin?eventid=0aa179e14eb426c8324a474212c96b3f Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.158 , France, ASN16276 (OVH, FR), Reverse DNS ns3096590.ip-162-19-58.eu Software nginx / Resource Hash `86d1a499e332023c7eac3329250ef84d74de1ea5181d103840e061dfd1681357` Request headers accept-language de-DE,de;q=0.9 Referer https://amzsec.lawyercorp.info/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 03 Aug 2023 15:14:23 GMT last-modified Mon, 24 Apr 2023 18:16:41 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 18747 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js Show response images-na.ssl-images-amazon.com/images/I/	309 KB 84 KB	79ms 16ms	Script application/x-javascript	2600:9000:2394:b400:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js?AUIClients/AmazonUI Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/Resources/Assets/js/pc1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2394:b400:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4` Request headers Referer https://amzsec.lawyercorp.info/ Origin https://amzsec.lawyercorp.info accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Tue, 25 Jul 2023 11:54:44 GMT content-encoding br via 1.1 2a46367687c8f1815bbea20c92c7d64c.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P2 age 789579 edge-cache-tag x-cache-711,/images/I/61-6nKPKyWL x-cache Hit from cloudfront x-nginx-cache-status HIT surrogate-key x-cache-711 /images/I/61-6nKPKyWL last-modified Thu, 12 Sep 2019 21:14:10 GMT server Server content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id ee7e9c6c-627d-4fb9-8ce0-d1c082f0fb65 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id Qc-v777jKcRxhwM_9eaAuWgnO4jlJVrYs2xCrIq8r_HJSGSWpN_Bvw== expires Sun, 19 Jul 2043 21:39:31 GMT
GET H2	200	pDxWAF1pBB0dzGB.woff2 m.media-amazon.com/images/S/sash/	16 KB 17 KB	91ms 14ms	Font application/font-woff2	2600:9000:2394:b400:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2 Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/Resources/Assets/css/pc1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2394:b400:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7` Request headers Referer https://amzsec.lawyercorp.info/ Origin https://amzsec.lawyercorp.info accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Sun, 16 Jul 2023 10:02:12 GMT via 1.1 76a2ca53c94ecdb2669e24612a611a48.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P2 age 1573931 edge-cache-tag x-cache-298,/images/S/sash/pDxWAF1pBB0dzGB x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 16616 surrogate-key x-cache-298 /images/S/sash/pDxWAF1pBB0dzGB last-modified Fri, 30 Oct 2020 21:19:16 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 5b1199ea-12ba-4130-bdad-081fb94461f9 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id QEmqQJ6ir3kzbz_kUKdjoQfgiE_O8Nm7zVxOCuo7wWYpyAchgxK6vw== expires Sun, 22 Feb 2043 06:09:50 GMT
GET H2	404	Bgn-Vcheb-DR5-Ds4h.png i.ibb.co/cTHnq49/	1 KB 1 KB	18ms 14ms	Image image/png	162.19.58.158 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/cTHnq49/Bgn-Vcheb-DR5-Ds4h.png Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/Resources/Assets/css/pc1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.158 , France, ASN16276 (OVH, FR), Reverse DNS ns3096590.ip-162-19-58.eu Software nginx / Resource Hash `63e3696c5e5e8b037e28e8fbef871184b0d1d60a7314c965b1426d9cce84dd69` Request headers accept-language de-DE,de;q=0.9 Referer https://amzsec.lawyercorp.info/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 03 Aug 2023 15:14:23 GMT server nginx content-length 1031 content-type image/png
GET H2	200	KFPk-9IF4FqAqY-.woff2 m.media-amazon.com/images/S/sash/	16 KB 17 KB	98ms 22ms	Font application/font-woff2	2600:9000:2394:b400:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2 Requested by Host: amzsec.lawyercorp.info URL: https://amzsec.lawyercorp.info/Resources/Assets/css/pc1.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2394:b400:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327` Request headers Referer https://amzsec.lawyercorp.info/ Origin https://amzsec.lawyercorp.info accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 13 Jul 2023 11:17:21 GMT via 1.1 76a2ca53c94ecdb2669e24612a611a48.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-P2 age 1828621 edge-cache-tag x-cache-751,/images/S/sash/KFPk-9IF4FqAqY- x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 16460 surrogate-key x-cache-751 /images/S/sash/KFPk-9IF4FqAqY- last-modified Fri, 30 Oct 2020 21:19:26 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id de539d7c-d1d4-40e3-9195-19e8982eb9a7 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id VSloWA9FsDGW1xpPtu_dne2iBYLyy1QkaadLklXWWlvCOTfoQNwgGw== expires Sat, 21 Feb 2043 05:16:17 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| jQuery16407986695958213448

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amzsec.lawyercorp.info/	1970-01-20 13:46:02	Name: X_CACHE_KEY Value: 4ad4ee2bcb814c9f639b597b75737f3c

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://i.ibb.co/cTHnq49/Bgn-Vcheb-DR5-Ds4h.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amzsec.lawyercorp.info
i.ibb.co
images-na.ssl-images-amazon.com
m.media-amazon.com
162.19.58.158
2600:9000:2394:b400:1d:d7f6:39d2:2dc1
47.251.32.76
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327
2a119e867b8b5ead33ef9986f78181dee0a23efaba9a094192ef7e060583a95e
512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4
63e3696c5e5e8b037e28e8fbef871184b0d1d60a7314c965b1426d9cce84dd69
86d1a499e332023c7eac3329250ef84d74de1ea5181d103840e061dfd1681357
d79a3627701328dbd03c2258d79dd2b07d56a07b233ec1a553f7beab5caf4b36
e900470f72fe43136df67b8fd87a8422a6d7f0f98332bd3907f901aac2cc4d5c

amzsec.lawyercorp.info Open in urlscan Pro 47.251.32.76 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

148 kBTransfer

394 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

amzsec.lawyercorp.info Open in urlscan Pro
47.251.32.76 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

148 kB
Transfer

394 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!