amazon-jp.4yr40f.cn Open in urlscan Pro
182.16.85.114  Malicious Activity! Public Scan

URL: https://amazon-jp.4yr40f.cn/
Submission: On December 13 via automatic, source phishtank — Scanned from JP

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 182.16.85.114, located in Hong Kong and belongs to NETSEC-HK Netsec Limited, HK. The main domain is amazon-jp.4yr40f.cn.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on December 12th 2022. Valid for: 3 months.
This is the only time amazon-jp.4yr40f.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

IP Address AS Autonomous System
9 182.16.85.114 45753 (NETSEC-HK...)
2 2600:9000:213... 16509 (AMAZON-02)
11 2
Apex Domain
Subdomains
Transfer
9 4yr40f.cn
amazon-jp.4yr40f.cn
281 KB
2 ssl-images-amazon.com
images-cn.ssl-images-amazon.com — Cisco Umbrella Rank: 376887
32 KB
11 2
Domain Requested by
9 amazon-jp.4yr40f.cn amazon-jp.4yr40f.cn
2 images-cn.ssl-images-amazon.com amazon-jp.4yr40f.cn
11 2

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp
Subject Issuer Validity Valid
amazon-jp.4yr40f.cn
ZeroSSL RSA Domain Secure Site CA
2022-12-12 -
2023-03-12
3 months crt.sh
images-cn.ssl-images-amazon.com
Amazon
2022-11-14 -
2023-12-12
a year crt.sh

This page contains 1 frames:

Primary Page: https://amazon-jp.4yr40f.cn/
Frame ID: 30BB64BEBE09EEF00E8192EF5C1B0656
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Amazonサインイン

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

313 kB
Transfer

311 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
amazon-jp.4yr40f.cn/
12 KB
12 KB
Document
General
Full URL
https://amazon-jp.4yr40f.cn/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
c8480f91512e6bb334fe92e5c4e12d76cdb03184f2c8bab86ec0c2b52b3f5908

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Connection
keep-alive
Content-Length
12177
Content-Type
text/html
61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
amazon-jp.4yr40f.cn/static/file_pc/index_files/
131 KB
131 KB
Stylesheet
General
Full URL
https://amazon-jp.4yr40f.cn/static/file_pc/index_files/61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
f8398641cd3b832deaf47e23bd07e052e17bcaad4fdfa60ab9d674741df81b9f

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
133768
Content-Type
text/css
01SdjaY0ZsL._RC_31jdWD+JB+L.css,41CoXfMtudL.css_.css
amazon-jp.4yr40f.cn/static/file_pc/index_files/
36 KB
36 KB
Stylesheet
General
Full URL
https://amazon-jp.4yr40f.cn/static/file_pc/index_files/01SdjaY0ZsL._RC_31jdWD+JB+L.css,41CoXfMtudL.css_.css
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
d677760fa69d216fe4dafd1a4548587e1b482f74b34f08e57085796d2187fd3d

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
36584
Content-Type
text/css
11JNAJswl5L.css
amazon-jp.4yr40f.cn/static/file_pc/index_files/
2 KB
3 KB
Stylesheet
General
Full URL
https://amazon-jp.4yr40f.cn/static/file_pc/index_files/11JNAJswl5L.css
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
e0d431809e06e686cfe3bd266b39e35964eaa28507eff4751f9fb99717854e72

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
2537
Content-Type
text/css
main.js
amazon-jp.4yr40f.cn/static/main/
3 KB
3 KB
Script
General
Full URL
https://amazon-jp.4yr40f.cn/static/main/main.js
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
7774ec42f1109d7dd18222b1b97839c964a786112ff76da2652dc74402b1c19c

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
3060
Content-Type
application/x-javascript
loading.css
amazon-jp.4yr40f.cn/static/main/
2 KB
2 KB
Stylesheet
General
Full URL
https://amazon-jp.4yr40f.cn/static/main/loading.css
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
5b2e0604209e9726a0ae78837a04455dda0a6b53ccb4a88deed788ddeb553ab7

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
1576
Content-Type
text/css
jquery-1.9.1.min.js
amazon-jp.4yr40f.cn/static/main/
90 KB
91 KB
Script
General
Full URL
https://amazon-jp.4yr40f.cn/static/main/jquery-1.9.1.min.js
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
92629
Content-Type
application/x-javascript
loading.js
amazon-jp.4yr40f.cn/static/main/
1 KB
2 KB
Script
General
Full URL
https://amazon-jp.4yr40f.cn/static/main/loading.js
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
e8badccc3c42bb234fc7db5ddc5487307a795faf01dee904ea439823becc4ad5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
1503
Content-Type
application/x-javascript
jquery.cookie.js
amazon-jp.4yr40f.cn/static/main/
3 KB
3 KB
Script
General
Full URL
https://amazon-jp.4yr40f.cn/static/main/jquery.cookie.js
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/static/main/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
182.16.85.114 , Hong Kong, ASN45753 (NETSEC-HK Netsec Limited, HK),
Reverse DNS
Software
/
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
3121
Content-Type
application/x-javascript
mPGmT0r6IeTyIee.png
images-cn.ssl-images-amazon.com/images/S/sash/
27 KB
28 KB
Image
General
Full URL
https://images-cn.ssl-images-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/static/file_pc/index_files/61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2138:6200:10:1731:ff49:ac01 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Thu, 25 Aug 2022 11:06:55 GMT
via
1.1 b38c57a60399790a1fa70b4a0858128e.cloudfront.net (CloudFront)
x-amz-cf-pop
NRT12-C2
age
9479636
edge-cache-tag
x-cache-686,/images/S/sash/mPGmT0r6IeTyIee
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
27972
surrogate-key
x-cache-686 /images/S/sash/mPGmT0r6IeTyIee
last-modified
Tue, 17 Nov 2020 23:31:33 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
62a6d5a3-7bcc-4a19-aa4f-a1f0481dc156
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
wsiPR5ZJGIdPnOo7alAqZ3JRVroSNE4ymS4FGRv-eHzZFTr9L29y2A==
expires
Sun, 17 Aug 2042 00:43:04 GMT
EYzhM86N6ZcDPtA.png
images-cn.ssl-images-amazon.com/images/S/sash/
4 KB
4 KB
Image
General
Full URL
https://images-cn.ssl-images-amazon.com/images/S/sash/EYzhM86N6ZcDPtA.png
Requested by
Host: amazon-jp.4yr40f.cn
URL: https://amazon-jp.4yr40f.cn/static/file_pc/index_files/61Tlxk0K9QL._RC_11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31GjtQRomzL.css_.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2138:6200:10:1731:ff49:ac01 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://amazon-jp.4yr40f.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Thu, 10 Nov 2022 13:01:35 GMT
via
1.1 b38c57a60399790a1fa70b4a0858128e.cloudfront.net (CloudFront)
x-amz-cf-pop
NRT12-C2
age
2819956
edge-cache-tag
x-cache-741,/images/S/sash/EYzhM86N6ZcDPtA
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
3589
surrogate-key
x-cache-741 /images/S/sash/EYzhM86N6ZcDPtA
last-modified
Tue, 17 Nov 2020 23:31:29 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
8a1663f1-b85d-4779-8495-08275354e8b2
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
1beKERcWA_PQSeKZVE_2IP88F6z0pGgUo2vovJDTcBMmhNE0gdO1aQ==
expires
Tue, 04 Nov 2042 13:16:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| postvalue function| $ function| jQuery function| loadDiv function| LayerShow function| Position function| LayerHide function| del function| cf

1 Cookies

Domain/Path Name / Value
amazon-jp.4yr40f.cn/ Name: Token_ID
Value: 074326759493862890