ap-amazon2.com Open in urlscan Pro
207.148.69.105 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/GJ4B15MAfT?signature=newsletter&trackingid=645196004876659
Effective URL:
https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
Submission: On March 23 via manual (March 23rd 2024, 3:15:19 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 207.148.69.105, located in Singapore, Singapore and belongs to AS-CHOOPA, US. The main domain is ap-amazon2.com.
TLS certificate: Issued by R3 on March 19th 2024. Valid for: 3 months.

This is the only time ap-amazon2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon Japan (Online) Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1 1	91.216.203.17 91.216.203.17	202568 (IVISION-ASN) (IVISION-ASN)
11	207.148.69.105 207.148.69.105	20473 (AS-CHOOPA) (AS-CHOOPA)
12	2

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.216.203.17 (France) 1 redirects

ASN202568 (IVISION-ASN, FR)
PTR: www.eksio.fr

www.eksio.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 207.148.69.105 (Singapore, Singapore)

ASN20473 (AS-CHOOPA, US)
PTR: 207.148.69.105.vultrusercontent.com

ap-amazon2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	ap-amazon2.com ap-amazon2.com	544 KB
1	eksio.fr 1 redirects www.eksio.fr	364 B
1	t.co t.co — Cisco Umbrella Rank: 766	588 B
12	3

	Domain	Requested by
11	ap-amazon2.com	t.co ap-amazon2.com
1	www.eksio.fr	1 redirects
1	t.co
12	3

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
mail.ap-amazon2.com R3	`2024-03-19` - `2024-06-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
Frame ID: D4439166FC1D738A6A48B0E42CEF20AD
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign-in

Page URL History Show full URLs

https://t.co/GJ4B15MAfT?signature=newsletter&trackingid=645196004876659 Page URL
https://www.eksio.fr/wp-content/plugins/classic-editor/intl.php?view=picture HTTP 302
https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4 Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

545 kB
Transfer

538 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/GJ4B15MAfT?signature=newsletter&trackingid=645196004876659 Page URL
https://www.eksio.fr/wp-content/plugins/classic-editor/intl.php?view=picture HTTP 302
https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 GJ4B15MAfT
t.co/ 386 B
588 B 143ms
119ms Document
text/html 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/GJ4B15MAfT?signature=newsletter&trackingid=645196004876659

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 216
content-type: text/html; charset=utf-8
date: Sat, 23 Mar 2024 15:15:04 GMT
expires: Sat, 23 Mar 2024 15:20:05 GMT
perf: 7469935968
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: f8ac41c47990ac434b7055e868146ad37761c4fc66d765d1cd17453b8a613a5a
x-response-time: 112
x-transaction-id: ef03493d4baab0d3
x-xss-protection: 0

GET
H/1.1

200
OK

Primary Request / Show response
ap-amazon2.com/
Redirect Chain

https://www.eksio.fr/wp-content/plugins/classic-editor/intl.php?view=picture
https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

3 KB
4 KB

6596ms
5888ms

Document
text/html

207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

Requested by

Host: t.co
URL: https://t.co/GJ4B15MAfT?signature=newsletter&trackingid=645196004876659

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://t.co/GJ4B15MAfT?signature=newsletter&trackingid=645196004876659
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Access-Control-Allow-Methods: POST, OPTIONS, GET
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sat, 23 Mar 2024 15:15:07 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: Upgrade, Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sat, 23 Mar 2024 15:15:05 GMT
Keep-Alive: timeout=5, max=100
LOCATION: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
Server: Apache
Strict-Transport-Security: max-age=63072000
Upgrade: h2
X-FRAME-OPTIONS: SAMEORIGIN

GET
H/1.1 200
OK main.5b4ecdfc.chunk.css
ap-amazon2.com/static/css/ 103 KB
103 KB 300ms
300ms Stylesheet
text/css 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 105323
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK 3.4ee97899.chunk.js Show response
ap-amazon2.com/static/js/ 247 KB
248 KB 495ms
165ms Script
text/javascript 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/js/3.4ee97899.chunk.js

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 253097
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK main.1082ca0f.chunk.js Show response
ap-amazon2.com/static/js/ 55 KB
56 KB 761ms
251ms Script
text/javascript 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/js/main.1082ca0f.chunk.js

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

49c01c86ddca26898e29a9d2e43aec7f3b426cac7ee1603f68f9ece6144545d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 56390
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

POST
H/1.1 200
OK supply Show response
ap-amazon2.com/api/ 1 KB
2 KB 268ms
268ms XHR
text/html 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/api/supply

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

b2d917bdc641a8e71efbabcd484eec249063bec445e12ce27a3f91a26490c75d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=99
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK pDxWAF1pBB0dzGB.2c1d70d6.woff2
ap-amazon2.com/static/media/ 16 KB
17 KB 169ms
168ms Font
font/woff2 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/media/pDxWAF1pBB0dzGB.2c1d70d6.woff2

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css
Origin: https://ap-amazon2.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16616
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99

POST
H/1.1 200
OK ping Show response
ap-amazon2.com/api/ 2 B
544 B 3461ms
3461ms XHR
text/html 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/api/ping

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://ap-amazon2.com/ap/signin?session=4t94rqj1m3v9x18hkmje0v910parq98igejsahwt3q7abgugag162bt50yyyhwyy
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-Type: application/json

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=98
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 0.c8f46ac8.chunk.js Show response
ap-amazon2.com/static/js/ 22 KB
23 KB 251ms
168ms Script
text/javascript 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/js/0.c8f46ac8.chunk.js

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap-amazon2.com/ap/signin?session=4t94rqj1m3v9x18hkmje0v910parq98igejsahwt3q7abgugag162bt50yyyhwyy
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 22750
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK 13.d414ac36.chunk.js Show response
ap-amazon2.com/static/js/ 13 KB
14 KB 421ms
271ms Script
text/javascript 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/js/13.d414ac36.chunk.js

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/?return=&visitorId=65fef1facf433fa350547bc4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap-amazon2.com/ap/signin?session=4t94rqj1m3v9x18hkmje0v910parq98igejsahwt3q7abgugag162bt50yyyhwyy
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 13782
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK main.d33128ec.png
ap-amazon2.com/static/media/ 60 KB
61 KB 270ms
270ms Image
image/png 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ap-amazon2.com/static/media/main.d33128ec.png

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 61917
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

GET
H/1.1 200
OK KFPk-9IF4FqAqY-.4de52a40.woff2
ap-amazon2.com/static/media/ 16 KB
17 KB 168ms
168ms Font
font/woff2 207.148.69.105
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://ap-amazon2.com/static/media/KFPk-9IF4FqAqY-.4de52a40.woff2

Requested by

Host: ap-amazon2.com
URL: https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

207.148.69.105 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

207.148.69.105.vultrusercontent.com

Software

Apache /

Resource Hash

4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ap-amazon2.com/static/css/main.5b4ecdfc.chunk.css
Origin: https://ap-amazon2.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 15:15:14 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 Mar 2024 17:09:54 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16460
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon Japan (Online) Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonpa

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 04:50:21	Name: muc Value: e3b89c7b-8d1b-4f41-a928-89a031906144
ap-amazon2.com/	1970-01-20 19:20:10	Name: session Value: 38xKWOoxmX6sjTy4ZlyPdUfc0h9ELu3K
ap-amazon2.com/	1970-01-20 19:20:10	Name: language Value: de

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://ap-amazon2.com/static/js/main.1082ca0f.chunk.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ap-amazon2.com
t.co
www.eksio.fr
104.244.42.197
207.148.69.105
91.216.203.17
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
49c01c86ddca26898e29a9d2e43aec7f3b426cac7ee1603f68f9ece6144545d0
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e
837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a
aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02
b2d917bdc641a8e71efbabcd484eec249063bec445e12ce27a3f91a26490c75d
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977
e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743

ap-amazon2.com Open in urlscan Pro 207.148.69.105 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

545 kBTransfer

538 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

ap-amazon2.com Open in urlscan Pro
207.148.69.105 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

545 kB
Transfer

538 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!