aonzmo.xyz Open in urlscan Pro
2606:4700:3035::6812:2dfc Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/34oZAv5
Effective URL:
https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Submission: On December 24 via automatic, source phishtank (December 24th 2020, 9:04:19 am UTC)

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::6812:2dfc, located in United States and belongs to CLOUDFLARENET, US. The main domain is aonzmo.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 17th 2020. Valid for: a year.

This is the only time aonzmo.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
2 12	2606:4700:303... 2606:4700:3035::6812:2dfc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:816::2001	15169 (GOOGLE) (GOOGLE)
13	4

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:3035::6812:2dfc (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

aonzmo.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

amazon-scama.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	aonzmo.xyz 2 redirects aonzmo.xyz	74 KB
1	blogspot.com amazon-scama.blogspot.com
1	cloudflare.com cdnjs.cloudflare.com	7 KB
1	jquery.com code.jquery.com	30 KB
1	bit.ly 1 redirects bit.ly	263 B
13	5

	Domain	Requested by
12	aonzmo.xyz	2 redirects aonzmo.xyz code.jquery.com
1	amazon-scama.blogspot.com	aonzmo.xyz
1	cdnjs.cloudflare.com	aonzmo.xyz
1	code.jquery.com	aonzmo.xyz
1	bit.ly	1 redirects
13	5

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-12-17` - `2021-12-16`	a year	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
misc-sni.blogspot.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Frame ID: C0B1C23C02497736E9E4D1AFF379BDB1
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/34oZAv5 HTTP 301
https://aonzmo.xyz/?code=WdTsSzMzEqYxRiGu HTTP 302
http://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/ HTTP 301
https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

110 kB
Transfer

378 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/34oZAv5 HTTP 301
https://aonzmo.xyz/?code=WdTsSzMzEqYxRiGu HTTP 302
http://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/ HTTP 301
https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Redirect Chain

https://bit.ly/34oZAv5
https://aonzmo.xyz/?code=WdTsSzMzEqYxRiGu
http://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/

3 KB
1 KB

416ms
415ms

Document
text/html

2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19193c3e455f0c13a2baedaad2420760f118f904f133fea46e73c5187bc20735

Request headers

:method: GET
:authority: aonzmo.xyz
:scheme: https
:path: /sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d5f6eef5a71b5b953786182e55a0734481608800627; PHPSESSID=b42865ecaf37fe8f5c4c8155c4aa98e0; code=WdTsSzMzEqYxRiGu; SVR=svr1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 073596c30d00004a7fba0b0000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HGrHeyrGeymboY9ZGi5XvLR8m3H12xTIVO0tse8x5Ufj4u6Bq74ZP%2BjZHasGeoBdjubVuVb%2FPJLz0s6FpUbwsBmeWfEQu2Hd%2FgwOzWKACnPYHJCd0j4%2B"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 606927181d8a4a7f-FRA
content-encoding: br

Redirect headers

Date: Thu, 24 Dec 2020 09:04:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 24 Dec 2020 10:04:03 GMT
Location: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
cf-request-id: 073596c2fa0000145aad293000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CIYpoYX8ktlLlDjq0lAHqn0%2BqhDGW6aEmW4%2FjM9UWa%2BZtZ137IGExHcDBWO8z%2Bx5Rs3IEIfMuJwWssGlWpUdliIR9FDNM2uPCXGgPp0%2FSt4yRM6YA%2B4E"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 60692717fcd3145a-FRA

GET
H2 200 style3.css
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/ 168 KB
22 KB 15ms
12ms Stylesheet
text/css 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style3.css
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf1b6c1393473201b637b3d9738fc0ad599a52c7a998379d07ba01d6b75f4a9

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2526
cf-request-id: 073596c4b200004a7fc09f2000000001
last-modified: Wed, 25 Jul 2018 14:09:18 GMT
server: cloudflare
etag: W/"29e38-571d36c9fbf80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0weKlY4%2BaxDPD1mThm3fOom9DILS9in5i5WG2J69U1YbDRrc%2FDLJoorfBeF21TIwZuDZQxHwVQM%2BrMwZw5sMWOGDhxECb8ldqjvqkWhlod0jqNTWn3P4"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=36000
cf-ray: 6069271abfc14a7f-FRA
expires: Thu, 24 Dec 2020 18:21:58 GMT

GET
H2 200 style2.css
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/ 39 KB
6 KB 16ms
14ms Stylesheet
text/css 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style2.css
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f395d4f7e16a56f78b3ebb62ce61a099e8c6f909bfae191927a20a36b5f6256c

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2525
cf-request-id: 073596c4b200004a7fb3930000000001
last-modified: Wed, 25 Jul 2018 13:48:38 GMT
server: cloudflare
etag: W/"9c2d-571d322b6d980-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fzkWE%2BUqGQtUsGV5pd%2B3Cn8wOqbB%2BWJk68pWqMqLQFfkuZwM8kEIAsrH9SRZezLxYtfDX6gtZkiVLZSFBeb1mlEQAppzHBw%2B3nrNNrb0XolxVwAm6Mvz"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=36000
cf-ray: 6069271abfc24a7f-FRA
expires: Thu, 24 Dec 2020 18:21:58 GMT

GET
H2 200 style1.css
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/ 3 KB
1 KB 12ms
10ms Stylesheet
text/css 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style1.css
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0a8fe444d2f024caca0fb2ff1132b1201239ea44d7c675a5839b3b7058d9910

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2526
cf-request-id: 073596c4b200004a7f9aa2b000000001
last-modified: Wed, 25 Jul 2018 13:59:06 GMT
server: cloudflare
etag: W/"b7a-571d348255e80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sJ%2BTprNtatONa%2Be%2BQZS7%2Bhe5t1XaSoCi78A%2FYZ%2BYpaif1YOUOWhTHpxFc%2FbkVnP0nRu7K6I%2BQzPZopaCpg%2B%2FFFlgAh8l%2FvCevZ%2BkTJO3czrd0HHYNYgT"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=36000
cf-ray: 6069271abfc34a7f-FRA
expires: Thu, 24 Dec 2020 18:21:58 GMT

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 10ms
8ms Script
application/javascript 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Origin: https://aonzmo.xyz
Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
etag: W/"5eb09f0f-15d84"
vary: Accept-Encoding
x-hw: 1608800644.dop013.fr8.t,1608800644.cds221.fr8.hn,1608800644.cds142.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H2 200 jquery.validate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/ 24 KB
7 KB 99ms
97ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.2/jquery.validate.min.js

Requested by

Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8110a988bd0e88b0bf2c1dcbe276d0eb34e7593b70bd2ed14fb45d87d1d3872

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 539291
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
content-length: 6970
cf-request-id: 073596c4b70000bdffa338c000000001
timing-allow-origin: *
last-modified: Fri, 29 May 2020 16:54:59 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5ed13e63-5f7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=556etgJH5dyJYJvI1P9t7%2FAcBPaVyxYOi4biVvAM6GPoTIKcFipnz9Uyp%2FKZVJ%2FpbAkPiueIoyp04xyGsWSjiIf7ERiJmFXOdbPK1D%2Fa%2Fxi2BC9tQ%2Ftd4ZbTeO7%2BZmaAgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6069271aba13bdff-AMS
expires: Tue, 14 Dec 2021 09:04:04 GMT

GET
H2 200 jquery.cookie.min.js Show response
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/ 1 KB
1 KB 11ms
9ms Script
application/javascript 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/jquery.cookie.min.js
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfcc22d197db65b2991542ddb35450493e299781d1491c95015d0f8537ccdf4f

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2525
cf-request-id: 073596c4b200004a7f82234000000001
last-modified: Fri, 25 Sep 2020 01:12:24 GMT
server: cloudflare
etag: W/"5d7-5b019025eee00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FqpLR78y1QX3JwuUbUHOgeJVGo9T6%2B8%2BqcR%2FajoRXIvr4G3dUYO9LwT84W9wZqSr8SNUvs4G%2B6MSlnNQYO1DL8LFzLT5W5talVZfE7I0fF%2BRjnuKa9Yx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=36000
cf-ray: 6069271abfc54a7f-FRA
expires: Thu, 24 Dec 2020 18:21:58 GMT

GET
H2 200 cryptojs-aes.min.js Show response
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/ 13 KB
5 KB 12ms
10ms Script
application/javascript 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/cryptojs-aes.min.js
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2525
cf-request-id: 073596c4b300004a7f8db1d000000001
last-modified: Wed, 13 May 2020 00:11:54 GMT
server: cloudflare
etag: W/"3430-5a57c6d6de680-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2C1gfWrYDGG2vHexfcoi75uB5BNearBCN5jhSMEHe4kk7kaTRe2su8nfyBkdTQK1AqaDx9ByDmsAD4f%2BBXr4jwOKF92p26SxmaYCe3CKIuMy59EWM2vk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=36000
cf-ray: 6069271abfc64a7f-FRA
expires: Thu, 24 Dec 2020 18:21:58 GMT

GET
H2 200 cryptojs-aes-format.js Show response
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/ 806 B
642 B 12ms
11ms Script
application/javascript 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/cryptojs-aes-format.js
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ae5817d4a1ebe39df0983a82a0d65c0ec2450e3e0fe77653390627b268a34b9

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2526
cf-request-id: 073596c4b300004a7fcc004000000001
last-modified: Wed, 13 May 2020 00:11:54 GMT
server: cloudflare
etag: W/"326-5a57c6d6de680-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hZQUE%2BVt0AlA%2F4ZHR5bk8Z2UrESIO8dv8JctmV5AfZ0fikN6fo4NfM8GT81taVJ2GlQDCO1RSV1i1LgR9R3WudjNCGl%2BAC2fXgSkmw7zPUkzLX6YcZzB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=36000
cf-ray: 6069271abfc74a7f-FRA
expires: Thu, 24 Dec 2020 18:21:58 GMT

GET
H2 200 index.php Show response
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/ 10 KB
8 KB 1463ms
1463ms XHR
text/html 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/index.php?action=info
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e936a1fb4815863ede937f33d69358a05c51e213341346031ded60b79b1f394

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Dec 2020 09:04:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Jqp%2Ba0WeG128%2FU4u7ntxl5OK4WcIzNWQMTOMIypZjNzRZhsyaCsjwNT4ad%2Fke9rMB97QSPIMoE%2FViEZYwDr1NdXiynLZRkhRDhQ0BDclrftOxbZ49tF%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
cf-ray: 6069271b68434a7f-FRA
cf-request-id: 073596c51e00004a7f9020c000000001
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 jquery.min.php Show response
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/ 3 KB
1 KB 321ms
321ms XHR
text/javascript 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/js/jquery.min.php
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7e94c9ced66d93b4a30f417f9d9b25529492e760e3fc91ecef56ad8754b93b6

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Dec 2020 09:04:06 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fQyH1qljQWQWOrgqEOdXqtD7XIuIfkSdQeO4XP969IRsa%2F3OWTvFgPCrk%2BGHTDOXbB2ml3N3wbi2LOVJfm43Pbw7RUJXD5aMBXJYFaddAYxIZaxtsqy5"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
cf-ray: 60692724e81d4a7f-FRA
cf-request-id: 073596cb0f00004a7faf132000000001
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 /
amazon-scama.blogspot.com/ 0
0 166ms
138ms Image
text/html 2a00:1450:4001:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://amazon-scama.blogspot.com/
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style3.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png
aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/img/ 26 KB
26 KB 11ms
10ms Image
image/png 2606:4700:3035::6812:2dfc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/img/AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png
Requested by: Host: aonzmo.xyz
URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style3.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2dfc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d

Request headers

Referer: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/style/style3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Dec 2020 09:04:06 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2526
content-length: 26119
cf-request-id: 073596cc6000004a7f03378000000001
last-modified: Sun, 17 Jun 2018 18:51:26 GMT
server: cloudflare
etag: "6607-56edaefa44780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qXGtDbNkxYhDd%2BVyGSXOUuvAnzBoAAPewZq7WgVP3vcC%2BHoZkkaVDT9n13qVVHOLWx9iSU0Sd3oqMAy%2B6VLzsqIplnFWIFbS96pcB1OBSe5%2F6w3VEf67"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=36000
accept-ranges: bytes
cf-ray: 60692726f9d24a7f-FRA
expires: Thu, 24 Dec 2020 18:22:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
aonzmo.xyz/	1969-12-31 23:59:59	Name: SVR Value: svr1
aonzmo.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: b42865ecaf37fe8f5c4c8155c4aa98e0
aonzmo.xyz/	1970-01-19 23:38:56	Name: code Value: WdTsSzMzEqYxRiGu
.aonzmo.xyz/	1970-01-19 15:36:32	Name: __cfduid Value: d5f6eef5a71b5b953786182e55a0734481608800627

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://aonzmo.xyz/sxlq-jqgs-jxow-fcpw/amazon-account-verify/en/pc/(Line 45) Message: <div id='nav-blidya' class="a-section a-padding-medium auth-workflow"> <div class="a-section a-spacing-none auth-navbar"> <div class="a-section a-spacing-medium a-text-center"> <a class="a-link-nav-icon" tabindex="-1" href="#"> <i class="a-icon a-icon-logo" aria-label="Amazon"><span class="a-icon-alt">Amazon</span></i> </a> </div> </div> <div id="authportal-center-section" class="a-section"> <div id="authportal-main-section" class="a-section"> <div class="a-section a-spacing-base auth-pagelet-container"> <div id="auth-cookie-warning-message" class="a-box a-alert a-alert-warning"> <div class="a-box-inner a-alert-container"> <h4 class="a-alert-heading">Please Enable Cookies to Continue</h4><i class="a-icon a-icon-alert"></i> <div class="a-alert-content"> <p> <a class="a-link-normal" href="#"> </a> </p> </div> </div> </div> </div> <div class="a-section auth-pagelet-container"> <div class="a-section a-spacing-base"> <div class="a-section"> <div id="zwimel" class="zwimel" style="display:none;"></div> <form name="signineml" method="post" id="signineml" action="" class="auth-validate-form auth-real-time-validation a-spacing-none fwcim-form" required> <div class="a-section"> <div class="a-box"> <div class="a-box-inner a-padding-extra-large"> <h1 class="a-spacing-small"> Sign in </h1> <div class="a-row a-spacing-base"> <label for="ap_email" class="a-form-label"> Email (phone for mobile accounts) </label> <input type="email" id="email" name="email" class="a-input-text a-span12 auth-autofocus auth-required-field" value="" required> </div> <div class="a-section"> <span id="continue" class="a-button a-button-span12 a-button-primary"><span class="a-button-inner"><input id="continue" tabindex="5" class="a-button-input" type="submit" aria-labelledby="continue-announce"><span id="continue-announce" class="a-button-text" aria-hidden="true"> Continue </span></span> </span> </div> <div class="a-section"> <div aria-live="polite" class="a-row a-expander-container a-expander-inline-container"> <a href="#"><i class="a-icon a-icon-expand"></i><span class="a-expander-prompt"> Need help? </span></a> <div aria-expanded="false" class="a-expander-content a-expander-inline-content a-expander-inner" style="display:none"> <a id="auth-fpp-link-bottom" class="a-link-normal" href="#"> Forgot your password? </a> </div> <div aria-expanded="false" class="a-expander-content a-expander-inline-content a-expander-inner" style="display:none"> <a id="ap-other-signin-issues-link" class="a-link-normal" href="#"> Other issues with sign in </a> </div> </div> </div> </div> </div> </div> </form> </div> <div class="a-divider a-divider-break"> <h5>New to Amazon?</h5></div> <span id="auth-create-account-link" class="a-button a-button-span12"><span class="a-button-inner"><a id="createAccountSubmit" tabindex="6" href="#" class="a-button-text" role="button"> Create your Amazon account </a></span></span> </div> </div> </div> </div> <div id="right-2"> </div> <div class="a-section a-spacing-top-extra-large auth-footer"> <div class="a-divider a-divider-section"> <div class="a-divider-inner"></div> </div> <div class="a-section a-spacing-small a-text-center a-size-mini"> <span class="auth-footer-seperator"></span> <a class="a-link-normal" target="_blank" rel="noopener noreferrer" href="#"> Conditions of Use </a> <span class="auth-footer-seperator"></span> <a class="a-link-normal" target="_blank" rel="noopener noreferrer" href="#"> Privacy Notice </a> <span class="auth-footer-seperator"></span> <a class="a-link-normal" target="_blank" rel="noopener noreferrer" href="/help"> Help </a> <span class="auth-footer-seperator"></span> </div> <div class="a-section a-spacing-none a-text-center"> <span class="a-size-mini a-color-secondary"> © 1996-2019, Amazon.com, Inc. or its affiliates </span> </div> </div> </div> <div id="auth-external-javascript" class="auth-external-javascript"> </div> <div id="be" style="display:none;visibility:hidden;"> </div> <div id="a-popover-root" style="z-index:-1;position:absolute;"></div> <div class="fwcim-container"></div> <script src="../../js/jquery.min.php"></script>

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon-scama.blogspot.com
aonzmo.xyz
bit.ly
cdnjs.cloudflare.com
code.jquery.com
2001:4de0:ac19::1:b:1a
2606:4700:3035::6812:2dfc
2606:4700::6810:135e
2a00:1450:4001:816::2001
67.199.248.10
19193c3e455f0c13a2baedaad2420760f118f904f133fea46e73c5187bc20735
4ae5817d4a1ebe39df0983a82a0d65c0ec2450e3e0fe77653390627b268a34b9
5e936a1fb4815863ede937f33d69358a05c51e213341346031ded60b79b1f394
a0a8fe444d2f024caca0fb2ff1132b1201239ea44d7c675a5839b3b7058d9910
bcf1b6c1393473201b637b3d9738fc0ad599a52c7a998379d07ba01d6b75f4a9
cfcc22d197db65b2991542ddb35450493e299781d1491c95015d0f8537ccdf4f
d7e94c9ced66d93b4a30f417f9d9b25529492e760e3fc91ecef56ad8754b93b6
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f395d4f7e16a56f78b3ebb62ce61a099e8c6f909bfae191927a20a36b5f6256c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8110a988bd0e88b0bf2c1dcbe276d0eb34e7593b70bd2ed14fb45d87d1d3872
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

aonzmo.xyz Open in urlscan Pro 2606:4700:3035::6812:2dfc Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

4 IPs

3 Countries

110 kBTransfer

378 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

4 Cookies

1 Console Messages

Indicators

aonzmo.xyz Open in urlscan Pro
2606:4700:3035::6812:2dfc Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

110 kB
Transfer

378 kB
Size

4
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!