amazon.de.w7-konto-jt0-amazon-gum.ru
Open in
urlscan Pro
47.52.193.63
Malicious Activity!
Public Scan
URL:
https://amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/signin_assoc...
Submission: On February 18 via automatic, source phishtank
Submission: On February 18 via automatic, source phishtank
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 47.52.193.63, located in
San Mateo, United States and
belongs to CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN.
The main domain is amazon.de.w7-konto-jt0-amazon-gum.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 2nd 2018. Valid for: 3 months.
This is the only time amazon.de.w7-konto-jt0-amazon-gum.ru was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on February 2nd 2018. Valid for: 3 months.
This is the only time amazon.de.w7-konto-jt0-amazon-gum.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 47.52.193.63 47.52.193.63 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co.) | |
| 1 | 94.31.29.54 94.31.29.54 | 54104 (AS-STACKPATH) (AS-STACKPATH - netDNA) | |
| 6 | 2 |
5
47.52.193.63
(San Mateo, United States)
ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN)
ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN)
| amazon.de.w7-konto-jt0-amazon-gum.ru |
1
94.31.29.54
(United Kingdom)
ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.54.IPYX-077437-ZYO.above.net
ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.54.IPYX-077437-ZYO.above.net
| code.jquery.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
w7-konto-jt0-amazon-gum.ru
amazon.de.w7-konto-jt0-amazon-gum.ru |
70 KB |
| 1 |
jquery.com
code.jquery.com |
38 KB |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 5 | amazon.de.w7-konto-jt0-amazon-gum.ru |
amazon.de.w7-konto-jt0-amazon-gum.ru
code.jquery.com |
| 1 | code.jquery.com |
amazon.de.w7-konto-jt0-amazon-gum.ru
|
| 6 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| amazon.de.w7-konto-jt0-amazon-gum.ru Let's Encrypt Authority X3 |
2018-02-02 - 2018-05-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/signin_assoc.handle.php?assoc_handle=cje6EI9xhPoOlaJpvKVWdHYqXr0AUf&openid_claim=pW1mYhKZHdALNiejs5Ix&identifier_select=s1eWV739iQIc5ZKfrD0A&pape_max=ELgXCl63MGNFS7RZvf84dq1YmDjKwH
Frame ID: (A5978C9AE5B903533EDE9F09D05DE793)
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
SWFObject
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^SWFObject$/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
signin_assoc.handle.php
amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
eb250580d6759e6f8f5aa7179debc59d2.css
amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/src/css/ |
130 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
5e94f1e067b7539e6b328414233d3f163.css
amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/src/css/ |
31 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery-1.11.0.min.js
code.jquery.com/ |
94 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a.js
amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/src/js/ |
46 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite_img.png
amazon.de.w7-konto-jt0-amazon-gum.ru/318531/fHe9XMa7rp4tDQP/YfxzXNathVGwT4D/936333055887/k5hodXa62DlEZqA/IlLzJEynHcN64T0/src/img/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| deployJava function| Detector function| murmurhash3_32_gc object| swfobject function| ClientJS function| UAParser1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| amazon.de.w7-konto-jt0-amazon-gum.ru/ | Name: PHPSESSID Value: b3tiiihkn1i5vousfpamjnbdp3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amazon.de.w7-konto-jt0-amazon-gum.ru
code.jquery.com
47.52.193.63
94.31.29.54
33d5bb052d2e705ad78416e2f4cdfd1283c0c5c7271ee69209046d48cb204ee2
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
591c48a161f91ce005b11fa41df8645cff1859ae842c615dbcf929cd8ee108f8
ad723e06914eb47b2a01bfb2ac8e0eec1a190300fc188f51a40d94a31bedc141
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
d1357a46dfc240c97d783ea3dcd220c56769703e0a1218d1e0fff2736b18d2cf