ap-northeast-1.signin.aws
Open in
urlscan Pro
52.195.124.191
Public Scan
Effective URL: https://ap-northeast-1.signin.aws/platform/login?workflowStateHandle=fd018839-9412-4fa4-b021-e84b60e8cf97
Submission Tags: @phish_report
Submission: On December 28 via api from FI — Scanned from NZ
Summary
TLS certificate: Issued by Amazon RSA 2048 M01 on March 14th 2023. Valid for: a year.
This is the only time ap-northeast-1.signin.aws was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 3 | 136.143.190.99 136.143.190.99 | 2639 (ZOHO-AS) (ZOHO-AS) | |
1 1 | 136.143.190.100 136.143.190.100 | 2639 (ZOHO-AS) (ZOHO-AS) | |
1 4 | 54.95.4.148 54.95.4.148 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 18.67.100.57 18.67.100.57 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2600:9000:221... 2600:9000:2215:5600:18:92dc:e400:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 54.150.170.101 54.150.170.101 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 52.195.124.191 52.195.124.191 | () () | |
12 | 6 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-95-4-148.ap-northeast-1.compute.amazonaws.com
portal.sso.ap-northeast-1.amazonaws.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-67-100-57.syd62.r.cloudfront.net
avtaws.awsapps.com |
ASN16509 (AMAZON-02, US)
d1j3rmkozzizkg.cloudfront.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-150-170-101.ap-northeast-1.compute.amazonaws.com
website.sso-portal.ap-northeast-1.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
signin.aws
ap-northeast-1.signin.aws |
474 KB |
5 |
amazonaws.com
1 redirects
portal.sso.ap-northeast-1.amazonaws.com website.sso-portal.ap-northeast-1.amazonaws.com |
2 KB |
3 |
vwgroup.com.tw
3 redirects
one-it.vwgroup.com.tw |
2 KB |
2 |
cloudfront.net
d1j3rmkozzizkg.cloudfront.net |
5 MB |
1 |
awsapps.com
avtaws.awsapps.com |
1 KB |
1 |
zoho.com
1 redirects
accounts.zoho.com — Cisco Umbrella Rank: 34496 |
2 KB |
12 | 6 |
Domain | Requested by | |
---|---|---|
5 | ap-northeast-1.signin.aws |
d1j3rmkozzizkg.cloudfront.net
ap-northeast-1.signin.aws avtaws.awsapps.com |
4 | portal.sso.ap-northeast-1.amazonaws.com |
1 redirects
d1j3rmkozzizkg.cloudfront.net
|
3 | one-it.vwgroup.com.tw | 3 redirects |
2 | d1j3rmkozzizkg.cloudfront.net |
avtaws.awsapps.com
d1j3rmkozzizkg.cloudfront.net |
1 | website.sso-portal.ap-northeast-1.amazonaws.com |
d1j3rmkozzizkg.cloudfront.net
|
1 | avtaws.awsapps.com | |
1 | accounts.zoho.com | 1 redirects |
12 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.awsapps.com Amazon RSA 2048 M02 |
2023-02-13 - 2024-03-13 |
a year | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
portal.sso.ap-northeast-1.amazonaws.com Amazon RSA 2048 M01 |
2023-02-10 - 2024-03-10 |
a year | crt.sh |
website.sso-portal.ap-northeast-1.amazonaws.com Amazon RSA 2048 M02 |
2023-03-05 - 2024-04-02 |
a year | crt.sh |
ap-northeast-1.signin.aws Amazon RSA 2048 M01 |
2023-03-14 - 2024-03-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ap-northeast-1.signin.aws/platform/login?workflowStateHandle=fd018839-9412-4fa4-b021-e84b60e8cf97
Frame ID: 40EF6CE43368FEA0B414DBAAEF347EA7
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://one-it.vwgroup.com.tw/
HTTP 301
https://one-it.vwgroup.com.tw/ HTTP 302
https://one-it.vwgroup.com.tw/mobile/login.mb HTTP 302
https://accounts.zoho.com/samlauthrequest/yunghua.net?serviceurl=https://one-it.vwgroup.com.tw/OrgCrea... HTTP 302
https://portal.sso.ap-northeast-1.amazonaws.com/saml/assertion/MDk2NDE0OTE5NjQzX2lucy02NWVkNTZmMWY4ZTI2MmMz?SAMLRequest=fZJf... HTTP 303
https://avtaws.awsapps.com/start/?relayId=39540965-d155-429f-8016-611cb93ec4c0_3d3c03aa-2301-4eb2-aadd-... Page URL
- https://ap-northeast-1.signin.aws/platform/login?workflowStateHandle=fd018839-9412-4fa4-b021-e84b60e8cf97 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://one-it.vwgroup.com.tw/
HTTP 301
https://one-it.vwgroup.com.tw/ HTTP 302
https://one-it.vwgroup.com.tw/mobile/login.mb HTTP 302
https://accounts.zoho.com/samlauthrequest/yunghua.net?serviceurl=https://one-it.vwgroup.com.tw/OrgCreation.do HTTP 302
https://portal.sso.ap-northeast-1.amazonaws.com/saml/assertion/MDk2NDE0OTE5NjQzX2lucy02NWVkNTZmMWY4ZTI2MmMz?SAMLRequest=fZJfb5swFMW%2FCvI7%2FwwBYoVIrHRapCZlDWu3vEyucRuvYDNfk7b59HPIEkWa1kcf33vu7x57BrRre1IMZivv%2BO%2BBg3HeulYCGS9yNGhJFAUBRNKOAzGMrIvlDcFeQHqtjGKqRc6izNHPoEnSlE0bFmMcM8wfIzaNk2mTpUkTBWESpkGU4ily7rkGoWSOrIntBRj4QoKh0lgpwJEbYhdndYBJEJFJ7GXBdIOcz0ozPoLm6Im2wA%2BtFQUQO35Wqr9In4RshHz%2BmP%2FxWATkS11XbnW7rpFTAHBtLN2VkjB0XK%2B53gnGv93d5GhrTA%2FE9yljapAGvL3aKo%2BpzgfxLIX0D6FB76dZnE1wmmTIKW2iQlIz7nvq75U2tPUAlEd7V9rTllMwbujRju6VpK9wdLV2Pj0R%2BcvyBa%2FK6%2BC2vp6sfn3df8ftwN4DvHq4f1nVm2758CPe1Au87Jb7MYqdaLhe2b1ztLGkaD47OJIxcX3xzh%2FHdAZA89O%2BM%2F%2FC6Ojak8OgRVmpVrB3p2hb9XqlOTV2uNEDHx%2Bwo%2Bb%2Fs0IvHBXRuE9jKeEdFW3RNJoDWHj%2F3zln8fIHz%2F8A&RelayState=aHR0cHM6Ly9vbmUtaXQudndncm91cC5jb20udHcvT3JnQ3JlYXRpb24uZG9fX0lBTV9fbnVsbA%3D%3D HTTP 303
https://avtaws.awsapps.com/start/?relayId=39540965-d155-429f-8016-611cb93ec4c0_3d3c03aa-2301-4eb2-aadd-d7a00278a9b5 Page URL
- https://ap-northeast-1.signin.aws/platform/login?workflowStateHandle=fd018839-9412-4fa4-b021-e84b60e8cf97 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://one-it.vwgroup.com.tw/ HTTP 301
- https://one-it.vwgroup.com.tw/ HTTP 302
- https://one-it.vwgroup.com.tw/mobile/login.mb HTTP 302
- https://accounts.zoho.com/samlauthrequest/yunghua.net?serviceurl=https://one-it.vwgroup.com.tw/OrgCreation.do HTTP 302
- https://portal.sso.ap-northeast-1.amazonaws.com/saml/assertion/MDk2NDE0OTE5NjQzX2lucy02NWVkNTZmMWY4ZTI2MmMz?SAMLRequest=fZJfb5swFMW%2FCvI7%2FwwBYoVIrHRapCZlDWu3vEyucRuvYDNfk7b59HPIEkWa1kcf33vu7x57BrRre1IMZivv%2BO%2BBg3HeulYCGS9yNGhJFAUBRNKOAzGMrIvlDcFeQHqtjGKqRc6izNHPoEnSlE0bFmMcM8wfIzaNk2mTpUkTBWESpkGU4ily7rkGoWSOrIntBRj4QoKh0lgpwJEbYhdndYBJEJFJ7GXBdIOcz0ozPoLm6Im2wA%2BtFQUQO35Wqr9In4RshHz%2BmP%2FxWATkS11XbnW7rpFTAHBtLN2VkjB0XK%2B53gnGv93d5GhrTA%2FE9yljapAGvL3aKo%2BpzgfxLIX0D6FB76dZnE1wmmTIKW2iQlIz7nvq75U2tPUAlEd7V9rTllMwbujRju6VpK9wdLV2Pj0R%2BcvyBa%2FK6%2BC2vp6sfn3df8ftwN4DvHq4f1nVm2758CPe1Au87Jb7MYqdaLhe2b1ztLGkaD47OJIxcX3xzh%2FHdAZA89O%2BM%2F%2FC6Ojak8OgRVmpVrB3p2hb9XqlOTV2uNEDHx%2Bwo%2Bb%2Fs0IvHBXRuE9jKeEdFW3RNJoDWHj%2F3zln8fIHz%2F8A&RelayState=aHR0cHM6Ly9vbmUtaXQudndncm91cC5jb20udHcvT3JnQ3JlYXRpb24uZG9fX0lBTV9fbnVsbA%3D%3D HTTP 303
- https://avtaws.awsapps.com/start/?relayId=39540965-d155-429f-8016-611cb93ec4c0_3d3c03aa-2301-4eb2-aadd-d7a00278a9b5
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
avtaws.awsapps.com/start/ Redirect Chain
|
735 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
orchestrator.js
d1j3rmkozzizkg.cloudfront.net/assets/Prod/ap-northeast-1/7c578ce8f48f67f25547e57b0c3d33b3/ |
169 KB 170 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0.js
d1j3rmkozzizkg.cloudfront.net/assets/Prod/ap-northeast-1/7c578ce8f48f67f25547e57b0c3d33b3/ |
5 MB 5 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
whoAmI
portal.sso.ap-northeast-1.amazonaws.com/token/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
whoAmI
portal.sso.ap-northeast-1.amazonaws.com/token/ |
114 B 413 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
55 KB 55 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
log
website.sso-portal.ap-northeast-1.amazonaws.com/ |
0 357 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login
portal.sso.ap-northeast-1.amazonaws.com/ |
147 B 613 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login
ap-northeast-1.signin.aws/platform/ |
469 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
ap-northeast-1.signin.aws/assets/css/ |
468 KB 470 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
ap-northeast-1.signin.aws/assets/js/ |
1 MB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cspreport
ap-northeast-1.signin.aws/metrics/ |
0 1 KB |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cspreportonly
ap-northeast-1.signin.aws/metrics/ |
0 1 KB |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ap-northeast-1.signin.aws/platform | Name: platform-ubid Value: 732-2387046-1207282 |
|
avtaws.awsapps.com/start/ | Name: loginCsrfToken Value: 949982744 |
|
one-it.vwgroup.com.tw/ | Name: 6bc9ae5955 Value: 5d9b87a0b6f7a2e742ded0b710bb5c14 |
|
one-it.vwgroup.com.tw/ | Name: sdpcscook Value: eecbf4b0-c727-4bd3-b3bc-f3ef5ce5c554 |
|
one-it.vwgroup.com.tw/ | Name: _zcsr_tmp Value: eecbf4b0-c727-4bd3-b3bc-f3ef5ce5c554 |
|
one-it.vwgroup.com.tw/ | Name: JSESSIONID Value: C6DBD6DEFE86C67407467319B54947F6 |
|
accounts.zoho.com/ | Name: e188bc05fe Value: 4d6e62173a764ac5410d1192f41034cd |
|
accounts.zoho.com/ | Name: iamcsr Value: c832f26c-5df5-4c78-a94c-ed9134cbd24e |
|
accounts.zoho.com/ | Name: _zcsr_tmp Value: c832f26c-5df5-4c78-a94c-ed9134cbd24e |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.zoho.com
ap-northeast-1.signin.aws
avtaws.awsapps.com
d1j3rmkozzizkg.cloudfront.net
one-it.vwgroup.com.tw
portal.sso.ap-northeast-1.amazonaws.com
website.sso-portal.ap-northeast-1.amazonaws.com
136.143.190.100
136.143.190.99
18.67.100.57
2600:9000:2215:5600:18:92dc:e400:21
52.195.124.191
54.150.170.101
54.95.4.148
16c6a4b1defb0d7ad7153004a6c86ec2e3e8dec6a944074b953ceb698a7844dc
2e425973aaf08883fbd84f8a9cb860267362de0ac2e1b9ec8cca1790078bfcda
7097a5907a17cbd0f69ea3a6571fcd602fc9259688f53df30e00cda797047775
9319d1ec506512bcec50bf214583b0026aeba06c8bac1e4a1fbcb06ce1f72aa7
c4f9c712c29cf0bf3a3a7022d1e108e3e3c024ba0b1cf8e75f320efaccb1e16c
cdf3a351b9edaa6d1538eaae0cb55c4e48b422bb8a1d6bb497c9fd0120e29df1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec73dcbd81caebb94b42bb7c303f961ee25a246a106da096a2cfc9447ca28d53
fb833a5653c30d65b31125564d5d75a8a31591826ab0c3cabef56eb6bdd4a113