secure-servintl3-amz0n.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure-servintl3-amz0n.com.
TLS certificate: Issued by GTS CA 1P5 on August 6th 2023. Valid for: 3 months.

This is the only time secure-servintl3-amz0n.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:236... 2600:9000:236e:a000:1d:d7f6:39d2:2dc1	16509 (AMAZON-02) (AMAZON-02)
4	2

3 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

secure-servintl3-amz0n.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:236e:a000:1d:d7f6:39d2:2dc1 (United States)

ASN16509 (AMAZON-02, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	secure-servintl3-amz0n.com secure-servintl3-amz0n.com	64 KB
1	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 504	28 KB
4	2

	Domain	Requested by
3	secure-servintl3-amz0n.com	secure-servintl3-amz0n.com
1	m.media-amazon.com	secure-servintl3-amz0n.com
4	2

This site contains no links.

Subject Issuer	Validity	Valid
secure-servintl3-amz0n.com GTS CA 1P5	`2023-08-06` - `2023-11-04`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-10-26` - `2023-10-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://secure-servintl3-amz0n.com/?b3076a246304acdbb779d28c91cf0070c2cc7ba8=15c2f6f9416d00cec8b4f729460293c0&p=signin&country=ID&lang=en&verify=a2ce17fb9ed0b7190c308eb892822344fc482789
Frame ID: 114BD8046D50F8D48A498C30D393CC13
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign In

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

92 kB
Transfer

299 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response secure-servintl3-amz0n.com/	13 KB 3 KB	1986ms 1879ms	Document text/html	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-servintl3-amz0n.com/?b3076a246304acdbb779d28c91cf0070c2cc7ba8=15c2f6f9416d00cec8b4f729460293c0&p=signin&country=ID&lang=en&verify=a2ce17fb9ed0b7190c308eb892822344fc482789 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c9b34e5df20e5f5a79bf7fed8ba63051aa3daf4d4d0a5491ce6207c0d446cb39` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 7f4a7cfd8f501ca7-AMS content-encoding br content-type text/html; charset=UTF-8 date Thu, 10 Aug 2023 19:01:36 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eUCTgg2W3y6vg0CUen2C%2FeiXAyWC6bs9EMGZxYDXBpKO7HDXR3fI2L5uyg8P2tZDByRNGIry2LjSYDjODlPtH4%2BmOLwUFeIdNrX7Nl1a0BygNZO2WtWwQZXwnEwCh8nZUv8gPp69jod7cgMui4gVgLeyC96nvYlM2Q%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	jquery.min.js Show response secure-servintl3-amz0n.com/assets/js/	85 KB 31 KB	972ms 970ms	Script application/javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-servintl3-amz0n.com/assets/js/jquery.min.js Requested by Host: secure-servintl3-amz0n.com URL: https://secure-servintl3-amz0n.com/?b3076a246304acdbb779d28c91cf0070c2cc7ba8=15c2f6f9416d00cec8b4f729460293c0&p=signin&country=ID&lang=en&verify=a2ce17fb9ed0b7190c308eb892822344fc482789 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure-servintl3-amz0n.com/?b3076a246304acdbb779d28c91cf0070c2cc7ba8=15c2f6f9416d00cec8b4f729460293c0&p=signin&country=ID&lang=en&verify=a2ce17fb9ed0b7190c308eb892822344fc482789 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 10 Aug 2023 19:01:37 GMT content-encoding br cf-cache-status MISS last-modified Fri, 10 Dec 2021 17:22:46 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fd9GtYUa9bRIcdOk1rUETgEPaVeiPUSqmEL%2FjWcmzD098VGWmXb5W5OHAz6IoQnje5z8k2P3TEwaO1Y0QWMsdLPt%2BAzqJPqJEp8IMDPPqhrhXRrrdQmlj9gUuZ5aaKmoB0Sov5pc6YQ2Yfq6iQmEqql%2BJ4Y9%2F%2FwD7Q%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 7f4a7d094b051ca7-AMS alt-svc h3=":443"; ma=86400
GET H2	200	main.css secure-servintl3-amz0n.com/assets/css/	173 KB 30 KB	1140ms 1140ms	Stylesheet text/css	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-servintl3-amz0n.com/assets/css/main.css Requested by Host: secure-servintl3-amz0n.com URL: https://secure-servintl3-amz0n.com/?b3076a246304acdbb779d28c91cf0070c2cc7ba8=15c2f6f9416d00cec8b4f729460293c0&p=signin&country=ID&lang=en&verify=a2ce17fb9ed0b7190c308eb892822344fc482789 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure-servintl3-amz0n.com/?b3076a246304acdbb779d28c91cf0070c2cc7ba8=15c2f6f9416d00cec8b4f729460293c0&p=signin&country=ID&lang=en&verify=a2ce17fb9ed0b7190c308eb892822344fc482789 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Thu, 10 Aug 2023 19:01:37 GMT content-encoding br cf-cache-status MISS last-modified Wed, 03 Jun 2020 15:08:28 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=17puzwe%2B8zgQF1DIHO0SK9FGu9ilK4v3Qc9R0A9DSAfAbuu2WCCIp8%2B6%2BA96WyXkWxc3klrommy3zh8DEgtQiepOwCtts1wcsA5N5rdY8rPB03kQVwZAMQt0Ae9jFx3P5faRKBl99Fo12PlW5OfYWd7BsVxmPYh6sA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 7f4a7d094b071ca7-AMS alt-svc h3=":443"; ma=86400
GET H2	200	AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png m.media-amazon.com/images/G/01/AUIClients/	27 KB 28 KB	165ms 38ms	Image image/png	2600:9000:236e:a000:1d:d7f6:39d2:2dc1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png Requested by Host: secure-servintl3-amz0n.com URL: https://secure-servintl3-amz0n.com/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:236e:a000:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers accept-language nl-NL,nl;q=0.9 Referer https://secure-servintl3-amz0n.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Fri, 14 Jul 2023 03:25:21 GMT via 1.1 df3b3b9f4fa0f79195c56a91cf242364.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P1 age 2388977 edge-cache-tag x-cache-574,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 x-cache Hit from cloudfront x-nginx-cache-status HIT content-length 27972 surrogate-key x-cache-574 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013 last-modified Fri, 22 Sep 2017 00:23:19 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 1f910cc9-e527-4a0f-b2ac-4f8fc1d773f9 accept-ranges bytes timing-allow-origin https://www.amazon.com x-amz-cf-id __ezNs3xz2ZqWG5fn0kFexHxRDTl2z0WRPejk0gcSheBg17L6j5OWg== expires Wed, 01 Jul 2043 06:56:33 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secure-servintl3-amz0n.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: b79b42d45a67654506f1310df7e6227d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.media-amazon.com
secure-servintl3-amz0n.com
2600:9000:236e:a000:1d:d7f6:39d2:2dc1
2a06:98c1:3120::3
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19
c9b34e5df20e5f5a79bf7fed8ba63051aa3daf4d4d0a5491ce6207c0d446cb39

secure-servintl3-amz0n.com Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

92 kBTransfer

299 kBSize

1 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

secure-servintl3-amz0n.com Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

92 kB
Transfer

299 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!