main.d3firbroguy1zd.amplifyapp.com Open in urlscan Pro
18.66.122.57 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://main.d3firbroguy1zd.amplifyapp.com/
Effective URL:
https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes
Submission: On December 17 via manual (December 17th 2021, 11:33:04 am UTC) from IN — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 18.66.122.57, located in United States and belongs to AMAZON-02, US. The main domain is main.d3firbroguy1zd.amplifyapp.com.
TLS certificate: Issued by Amazon on December 12th 2021. Valid for: a year.

This is the only time main.d3firbroguy1zd.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 10	18.66.122.57 18.66.122.57		16509 (AMAZON-02) (AMAZON-02)
9	1

10 18.66.122.57 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-57.fra60.r.cloudfront.net

main.d3firbroguy1zd.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	amplifyapp.com 1 redirects main.d3firbroguy1zd.amplifyapp.com	28 KB
9	1

	Domain	Requested by
10	main.d3firbroguy1zd.amplifyapp.com	1 redirects main.d3firbroguy1zd.amplifyapp.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
*.d3firbroguy1zd.amplifyapp.com Amazon	`2021-12-12` - `2023-01-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes
Frame ID: 748D2F8F3267ABF1EFFA4A4811D8AEEC
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Wells Fargo Online Banking Security Verification

Page URL History Show full URLs

https://main.d3firbroguy1zd.amplifyapp.com/ Page URL
https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&e... Page URL

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

35 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://main.d3firbroguy1zd.amplifyapp.com/ Page URL
https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png HTTP 301
https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response main.d3firbroguy1zd.amplifyapp.com/	133 B 504 B	265ms 234ms	Document text/html	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d3firbroguy1zd.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html content-length 133 date Fri, 17 Dec 2021 11:33:00 GMT last-modified Sun, 12 Dec 2021 21:47:53 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 cache-control no-cache, s-maxage=2 etag "3bbf62fde972181e5c6802e8d32641f8" x-cache Miss from cloudfront via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P2 x-amz-cf-id 3Uq5WMfMW7_HbdmTVc1kMxxefE_cktCasZeePSf9IJhE_8W8vjjeeA==
GET H2	200	Primary Request inner_pag.html Show response main.d3firbroguy1zd.amplifyapp.com/	4 KB 2 KB	171ms 170ms	Document text/html	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `4cf1c9dd399bf10904d5f2b4d8e8833c63155450e75bcb1e900fd1bf4230fe13` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/ Response headers content-type text/html date Fri, 17 Dec 2021 11:33:01 GMT last-modified Sun, 12 Dec 2021 21:47:53 GMT x-amz-server-side-encryption AES256 server AmazonS3 cache-control no-cache, s-maxage=2 content-encoding gzip etag W/"e941cef533dd89d6974e4ef0c9e6363f" vary Accept-Encoding x-cache Miss from cloudfront via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P2 x-amz-cf-id qu_-nX-0aYQctAomAmCZU-b5GanDFRVo-9hZPiuXD9W42CRLjXBSDA==
GET H2	200	style.css main.d3firbroguy1zd.amplifyapp.com/css/	10 KB 2 KB	218ms 217ms	Stylesheet text/css	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `0d8f592d3aef440e69bc1b0c002930689e3334eb1f29206b021044e39a6d3dce` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 11:33:01 GMT content-encoding gzip etag W/"f5e73da88692d257c3aec5d79bf01454" last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Miss from cloudfront content-type text/css via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) cache-control no-cache, s-maxage=2 x-amz-cf-id P5D5qFarb99TvBpi_NO1aChfPKtgyfxn_KzckuEM2MZN4fOqig_idQ==
GET H2	200	logo.jpg main.d3firbroguy1zd.amplifyapp.com/images/	12 KB 13 KB	177ms 177ms	Image image/jpeg	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/logo.jpg Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `6a4c9bda55c400bcf557984c93d42375a390367bd171727ca75ba5207e43d919` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Fri, 17 Dec 2021 11:33:01 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 etag "87673e142907da15d749c074f102e286" x-cache Miss from cloudfront content-type image/jpeg cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 12523 x-amz-cf-id ImtpeaxU6UIc0rwtCfpnzPQszgZVUQw1qTdqS40l7E1DmiB3h4I0Ig==
GET H2	200	icon3.png main.d3firbroguy1zd.amplifyapp.com/images/	1 KB 1 KB	171ms 171ms	Image image/png	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/icon3.png Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `69f44920ee566a8cb7fe4a97463c5cd363e5b56ce883da11b29a5f5a3d4ef35b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/inner_pag.html?connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Fri, 17 Dec 2021 11:33:01 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 etag "b1f2220d162273cc35f3458ad747f019" x-cache Miss from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 1108 x-amz-cf-id xgfaJYfSlLa18__77PXaGApC0vmSbkoOz6ZoblfpTUISIpsASN93ag==
GET H2	404	/ main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/ Redirect Chain https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/	133 B 133 B	185ms 185ms	Image text/html	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/ Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 11:33:00 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop FRA60-P2 x-cache Error from cloudfront content-type text/html content-length 133 x-amz-cf-id zXHXj6Z2ADgHRD8XShZoYWVS0BO4NAAcRAYcLDIgpJ1dXq1c-ZRZng== Redirect headers date Fri, 17 Dec 2021 11:33:00 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) server AmazonS3 x-amz-cf-pop FRA60-P2 x-cache Miss from cloudfront content-type application/xml location /images/bg_top.png/ content-length 0 x-amz-cf-id afN6yx85EUxaglmSRyDsfQxvNcXMr1p5BEoOg5yXzjmIrkwq9hkxCw==
GET H2	200	img1.png main.d3firbroguy1zd.amplifyapp.com/images/	3 KB 3 KB	147ms 146ms	Image image/png	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/img1.png Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `499f5e44488bef9456f38b42790051343e8abffdd38cfae4599ecc2ac7c82e47` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Fri, 17 Dec 2021 11:33:01 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 etag "abacf27a0408017dd0969bcee925e0e6" x-cache Miss from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 3072 x-amz-cf-id W7KOPQM26mozc0RtcFDnZawzndwUQ3bZq8Nt2KAwrcmQ7WNHwdVrXQ==
GET H2	200	img2.png main.d3firbroguy1zd.amplifyapp.com/images/	3 KB 3 KB	171ms 171ms	Image image/png	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/img2.png Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `d12f68075437ba046b2dc85e53dc081f9c11669d25f5d04c7d985851aff31d65` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Fri, 17 Dec 2021 11:33:01 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 etag "64693f6ecaf19bd02c67b1e6744668db" x-cache Miss from cloudfront content-type image/png cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 3123 x-amz-cf-id fwo6QG1_LiSPXsL1NjIlJ-YNaSbMDUT2kOfqzJ4ANokn38-P50n_DA==
GET H2	200	icon2.jpg main.d3firbroguy1zd.amplifyapp.com/images/	1 KB 2 KB	409ms 409ms	Image image/jpeg	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.d3firbroguy1zd.amplifyapp.com/images/icon2.jpg Requested by Host: main.d3firbroguy1zd.amplifyapp.com URL: https://main.d3firbroguy1zd.amplifyapp.com/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash `a6f643918329fc1a927510f388543d5b084b85082e5d01f1080ff6518ec6f1f7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://main.d3firbroguy1zd.amplifyapp.com/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Fri, 17 Dec 2021 11:33:01 GMT via 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront) last-modified Sun, 12 Dec 2021 21:47:53 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 etag "bb2ef3ddb66faae16f9243da31677c50" x-cache Miss from cloudfront content-type image/jpeg cache-control no-cache, s-maxage=2 accept-ranges bytes content-length 1257 x-amz-cf-id JEHbjjkX1gSVOm5uffnHqHNf4OCLc5R6QFHG5GA7GYTeWU1vf9Meww==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://main.d3firbroguy1zd.amplifyapp.com/images/bg_top.png/ Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

main.d3firbroguy1zd.amplifyapp.com
18.66.122.57
0d8f592d3aef440e69bc1b0c002930689e3334eb1f29206b021044e39a6d3dce
499f5e44488bef9456f38b42790051343e8abffdd38cfae4599ecc2ac7c82e47
4cf1c9dd399bf10904d5f2b4d8e8833c63155450e75bcb1e900fd1bf4230fe13
69f44920ee566a8cb7fe4a97463c5cd363e5b56ce883da11b29a5f5a3d4ef35b
6a4c9bda55c400bcf557984c93d42375a390367bd171727ca75ba5207e43d919
a6f643918329fc1a927510f388543d5b084b85082e5d01f1080ff6518ec6f1f7
baa9fac0531a56ef7635f482fe693466f6998b8622ebe2f10eb8eebe04ccdda3
d12f68075437ba046b2dc85e53dc081f9c11669d25f5d04c7d985851aff31d65

main.d3firbroguy1zd.amplifyapp.com Open in urlscan Pro 18.66.122.57 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

27 kBTransfer

35 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

main.d3firbroguy1zd.amplifyapp.com Open in urlscan Pro
18.66.122.57 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

27 kB
Transfer

35 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!