page.login-amazon.customerid-page.com Open in urlscan Pro
40.74.87.101  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://page.login-amazon.customerid-page.com/?amz Page URL
2. https://page.login-amazon.customerid-page.com/ap/signin?session=22c25824c6813a96499bd3b40ddb3f6a64d458ea Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set / Show response page.login-amazon.customerid-page.com/	121 B 772 B	1541ms 915ms	Document text/html	40.74.87.101 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://page.login-amazon.customerid-page.com/?amz Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 40.74.87.101 Osaka, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software www.fbi.gov / Resource Hash b80e4b0f53658fb7dab3cfd89ce844fde4dfda7a7889eb5e3227373dc034b70a Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Host page.login-amazon.customerid-page.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 21 Nov 2020 09:16:22 GMT Server www.fbi.gov Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=e7f312b34077cf3456ddf0e6364eaa07; path=/ X-Content-Type nosniff X_FORWARDED_FOR 104.16.77.187 REMOTE_ADDR 104.16.77.187 Connection keep-alive, Keep-Alive Host www.fbi.gov Origin https://www.fbi.gov Referer https://www.fbi.gov X-Forwarded-Host www.fbi.gov X-Forwarded-Proto https X-XSS-Protection 1; mode=block Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request signin Show response page.login-amazon.customerid-page.com/ap/	7 KB 8 KB	929ms 929ms	Document text/html	40.74.87.101 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://page.login-amazon.customerid-page.com/ap/signin?session=22c25824c6813a96499bd3b40ddb3f6a64d458ea Requested by Host: page.login-amazon.customerid-page.com URL: https://page.login-amazon.customerid-page.com/?amz Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 40.74.87.101 Osaka, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software www.fbi.gov / Resource Hash 04792f2a1c0619a8833f0d53773e85447a45974c55bfed22ca1709c5bda5e6fb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Host page.login-amazon.customerid-page.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://page.login-amazon.customerid-page.com/?amz Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie PHPSESSID=e7f312b34077cf3456ddf0e6364eaa07 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://page.login-amazon.customerid-page.com/?amz Response headers Date Sat, 21 Nov 2020 09:16:23 GMT Server www.fbi.gov Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache X-Content-Type nosniff X_FORWARDED_FOR 104.16.77.187 REMOTE_ADDR 104.16.77.187 Connection keep-alive, Keep-Alive Host www.fbi.gov Origin https://www.fbi.gov Referer https://www.fbi.gov X-Forwarded-Host www.fbi.gov X-Forwarded-Proto https X-XSS-Protection 1; mode=block X-Content-Type-Options nosniff Keep-Alive timeout=5, max=99 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	main.css page.login-amazon.customerid-page.com/assets/css/	173 KB 174 KB	256ms 255ms	Stylesheet text/css	40.74.87.101 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://page.login-amazon.customerid-page.com/assets/css/main.css Requested by Host: page.login-amazon.customerid-page.com URL: https://page.login-amazon.customerid-page.com/ap/signin?session=22c25824c6813a96499bd3b40ddb3f6a64d458ea Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 40.74.87.101 Osaka, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://page.login-amazon.customerid-page.com/ap/signin?session=22c25824c6813a96499bd3b40ddb3f6a64d458ea User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 21 Nov 2020 09:16:24 GMT Origin https://www.fbi.gov Connection keep-alive, Keep-Alive X_FORWARDED_FOR 104.16.77.187 X-Forwarded-Proto https Content-Length 177536 X-XSS-Protection 1; mode=block Server Apache X-Content-Type nosniff REMOTE_ADDR 104.16.77.187 Last-Modified Sat, 23 Feb 2019 06:33:34 GMT X-Forwarded-Host www.fbi.gov Host www.fbi.gov Content-Type text/css Referer https://www.fbi.gov Accept-Ranges bytes Keep-Alive timeout=5, max=98
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	43ms 14ms	Image image/png	2600:9000:2104:7e00:1d:d7f6:39ce:af41 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: page.login-amazon.customerid-page.com URL: https://page.login-amazon.customerid-page.com/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2104:7e00:1d:d7f6:39ce:af41 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5 Request headers Referer https://page.login-amazon.customerid-page.com/assets/css/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Sep 2020 20:51:19 GMT via 1.1 d3d7cb5a7de36091f7284546b4190a33.cloudfront.net (CloudFront) age 7308648 edge-cache-tag x-cache-882,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 x-cache Hit from cloudfront content-length 27972 surrogate-key x-cache-882 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 last-modified Fri, 22 Sep 2017 00:23:19 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id b708def8-d0d1-4de5-80be-04ef3c8c5508 x-amz-cf-pop AMS1-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id tgHnYtX0XmUL4PbqQYOT0h6DwicVdlww5Ohoo0c_w8kRTiBXlUYGjA== expires Thu, 23 Aug 2040 19:05:36 GMT
GET H2	200	AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 m.media-amazon.com/images/G/01/AUIClients/	16 KB 17 KB	43ms 15ms	Font application/font-woff2	2600:9000:2104:7e00:1d:d7f6:39ce:af41 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa._V2_.woff2 Requested by Host: page.login-amazon.customerid-page.com URL: https://page.login-amazon.customerid-page.com/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2104:7e00:1d:d7f6:39ce:af41 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash 013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7 Request headers Origin https://page.login-amazon.customerid-page.com Referer https://page.login-amazon.customerid-page.com/assets/css/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 19 Oct 2020 23:23:15 GMT via 1.1 e029c86e892e2d8a35492f6625a1d26e.cloudfront.net (CloudFront) age 3171877 edge-cache-tag x-cache-509,/images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa x-cache Hit from cloudfront content-length 16616 surrogate-key x-cache-509 /images/G/01/AUIClients/AmazonUIBaseCSS-amazonember_rg-cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa last-modified Sat, 11 Jun 2016 01:31:21 GMT server Server content-type application/font-woff2; charset=utf-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 7f3e86c2-be49-4a43-92cb-68383721269a x-amz-cf-pop AMS1-C1 timing-allow-origin https://www.amazon.com x-amz-cf-id BUX4c_9M170dtg0TYwfWnsjXkyxFRPsZgqhgCLE-z0riCTsDA48dKg== expires Wed, 10 Oct 2040 16:11:47 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated number| ue_t0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			page.login-amazon.customerid-page.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: e7f312b34077cf3456ddf0e6364eaa07

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.media-amazon.com
page.login-amazon.customerid-page.com
2600:9000:2104:7e00:1d:d7f6:39ce:af41
40.74.87.101
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
04792f2a1c0619a8833f0d53773e85447a45974c55bfed22ca1709c5bda5e6fb
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
b80e4b0f53658fb7dab3cfd89ce844fde4dfda7a7889eb5e3227373dc034b70a
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19