amazon-accountactivity.duckdns.org Open in urlscan Pro
143.244.156.225 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://amazon-accountactivity.duckdns.org/
Effective URL:
http://amazon-accountactivity.duckdns.org/login
Submission: On May 14 via api (May 14th 2022, 4:03:09 am UTC) from JP — Scanned from JP

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 143.244.156.225, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is amazon-accountactivity.duckdns.org.

This is the only time amazon-accountactivity.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	143.244.156.225 143.244.156.225	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
5	2a04:4e42::272 2a04:4e42::272	54113 (FASTLY) (FASTLY)
8	2

3 143.244.156.225 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

amazon-accountactivity.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:4e42::272 (United States)

ASN54113 (FASTLY, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 541	60 KB
3	duckdns.org amazon-accountactivity.duckdns.org	77 KB
2	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 804	24 KB
8	3

	Domain	Requested by
3	m.media-amazon.com	images-na.ssl-images-amazon.com
3	amazon-accountactivity.duckdns.org	amazon-accountactivity.duckdns.org
2	images-na.ssl-images-amazon.com	amazon-accountactivity.duckdns.org
8	3

This site contains no links.

Subject Issuer	Validity	Valid
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2021-08-09` - `2022-07-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://amazon-accountactivity.duckdns.org/login
Frame ID: EE45DE306426CE21B13FB9A75E112906
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazonサインイン

Page URL History Show full URLs

http://amazon-accountactivity.duckdns.org/ Page URL
http://amazon-accountactivity.duckdns.org/login Page URL

Page Statistics

8
Requests

63 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

162 kB
Transfer

304 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://amazon-accountactivity.duckdns.org/ Page URL
http://amazon-accountactivity.duckdns.org/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ amazon-accountactivity.duckdns.org/	181 B 562 B	3703ms 3372ms	Document text/html	143.244.156.225 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL http://amazon-accountactivity.duckdns.org/ Protocol HTTP/1.1 Server 143.244.156.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sat, 14 May 2022 04:03:00 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
POST H/1.1	200 OK	Primary Request login Show response amazon-accountactivity.duckdns.org/	73 KB 74 KB	1118ms 1118ms	Document text/html	143.244.156.225 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL http://amazon-accountactivity.duckdns.org/login Protocol HTTP/1.1 Server 143.244.156.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `56103a4cc091ca94becd16437879ccea8c99b8d78c9b2b00244a862f92ac9870` Request headers Content-Type application/x-www-form-urlencoded Origin http://amazon-accountactivity.duckdns.org Referer http://amazon-accountactivity.duckdns.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sat, 14 May 2022 04:03:04 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H2	200	61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css images-na.ssl-images-amazon.com/images/I/	133 KB 19 KB	22ms 2ms	Stylesheet text/css	2a04:4e42::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI Requested by Host: amazon-accountactivity.duckdns.org URL: http://amazon-accountactivity.duckdns.org/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `65e3ba66df0c9c45a17ac62283069d21d5e4a473d649a1d574a562a44f9a09c3` Request headers accept-language jp-JP,jp;q=0.9 Referer http://amazon-accountactivity.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Sat, 14 May 2022 04:03:05 GMT content-encoding br age 3703098 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT server-timing provider;desc="fy" content-length 19104 x-served-by cache-iad-kjyo7100160-IAD, cache-hnd18720-HND last-modified Wed, 06 Jan 2021 02:50:26 GMT vary Accept-Encoding content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 523205e5-5e62-4f5f-8871-d567623f9335 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Sat, 22 Mar 2042 07:01:56 GMT
GET H2	200	01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41DBI6BbFkL.css_.css images-na.ssl-images-amazon.com/images/I/	36 KB 5 KB	23ms 3ms	Stylesheet text/css	2a04:4e42::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41DBI6BbFkL.css_.css?AUIClients/AuthenticationPortalAssets Requested by Host: amazon-accountactivity.duckdns.org URL: http://amazon-accountactivity.duckdns.org/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f` Request headers accept-language jp-JP,jp;q=0.9 Referer http://amazon-accountactivity.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Sat, 14 May 2022 04:03:05 GMT content-encoding br age 771999 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT server-timing provider;desc="fy" content-length 5062 x-served-by cache-iad-kiad7000141-IAD, cache-hnd18720-HND last-modified Sat, 30 May 2015 02:58:48 GMT vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 6d34fc69-82eb-4fbd-a638-ea8e0fc21cb4 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com expires Mon, 28 Apr 2042 07:28:33 GMT
GET H/1.1	200 OK	a.css amazon-accountactivity.duckdns.org/assets/css/	2 KB 3 KB	162ms 161ms	Stylesheet text/css	143.244.156.225 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL http://amazon-accountactivity.duckdns.org/assets/css/a.css Requested by Host: amazon-accountactivity.duckdns.org URL: http://amazon-accountactivity.duckdns.org/login Protocol HTTP/1.1 Server 143.244.156.225 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03` Request headers accept-language jp-JP,jp;q=0.9 Referer http://amazon-accountactivity.duckdns.org/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Sat, 14 May 2022 04:03:05 GMT Last-Modified Wed, 16 Jun 2021 05:04:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2460
GET H2	200	mPGmT0r6IeTyIee.png m.media-amazon.com/images/S/sash/	27 KB 27 KB	5ms 3ms	Image image/png	2a04:4e42::272 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI#us.not-trident Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers accept-language jp-JP,jp;q=0.9 Referer https://images-na.ssl-images-amazon.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers timing-allow-origin https://www.amazon.in, https://www.amazon.com date Sat, 14 May 2022 04:03:05 GMT last-modified Tue, 17 Nov 2020 23:31:33 GMT age 8178932 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT access-control-allow-origin * expires Sat, 01 Feb 2042 13:35:16 GMT cache-control max-age=630720000,public x-amz-ir-id 9754abf1-ef76-44f2-880f-76ab8f029a77 server-timing provider;desc="fy" accept-ranges bytes content-type image/png content-length 27972 x-served-by cache-iad-kcgs7200101-IAD, cache-hnd18720-HND
GET H2	200	pDxWAF1pBB0dzGB.woff2 m.media-amazon.com/images/S/sash/	16 KB 16 KB	18ms 6ms	Font application/font-woff2	2a04:4e42::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2 Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI#us.not-trident Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7` Request headers Referer https://images-na.ssl-images-amazon.com/ Origin http://amazon-accountactivity.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers timing-allow-origin https://www.amazon.in, https://www.amazon.com date Sat, 14 May 2022 04:03:05 GMT last-modified Fri, 30 Oct 2020 21:19:16 GMT age 24956060 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT access-control-allow-origin * expires Thu, 23 May 2041 09:24:39 GMT cache-control max-age=630720000,public x-amz-ir-id c8c3029d-0183-4b9a-bf1a-1c4ccdeee9a1 server-timing provider;desc="fy" accept-ranges bytes content-type application/font-woff2; charset=utf-8 content-length 16616 x-served-by cache-dca17744-DCA, cache-hnd18744-HND
GET H2	200	KFPk-9IF4FqAqY-.woff2 m.media-amazon.com/images/S/sash/	16 KB 16 KB	6ms 5ms	Font application/font-woff2	2a04:4e42::272 FASTLY
General Check archive.org Show headers Download Go to Full URL https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2 Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI#us.not-trident Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::272 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327` Request headers Referer https://images-na.ssl-images-amazon.com/ Origin http://amazon-accountactivity.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers timing-allow-origin https://www.amazon.in, https://www.amazon.com date Sat, 14 May 2022 04:03:05 GMT last-modified Fri, 30 Oct 2020 21:19:26 GMT age 27977331 x-cache HIT from fastly, HIT from fastly x-nginx-cache-status HIT access-control-allow-origin * expires Sun, 19 May 2041 00:38:19 GMT cache-control max-age=630720000,public x-amz-ir-id 514622e5-9c26-4df4-bca6-fd18397f6242 server-timing provider;desc="fy" accept-ranges bytes content-type application/font-woff2; charset=utf-8 content-length 16460 x-served-by cache-dca17776-DCA, cache-hnd18744-HND

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon-accountactivity.duckdns.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: c00a8aed31ca00d89d37d14dac439068

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon-accountactivity.duckdns.org
images-na.ssl-images-amazon.com
m.media-amazon.com
143.244.156.225
2a04:4e42::272
013d1dc68fadda651c773b6deb153e3e8b4dd612fb2af70db48c87af7808d1e7
0eef431cee18b1dc43636dd2a7703b7c0ce9f6bdbad9f280b7313d0ded232327
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
56103a4cc091ca94becd16437879ccea8c99b8d78c9b2b00244a862f92ac9870
65e3ba66df0c9c45a17ac62283069d21d5e4a473d649a1d574a562a44f9a09c3
8ee2d8d8ddba5c2628bbc3e5466c24e9388768b6a37e9dfa2644b4afbab4aa0f
db428c49699fc9794efcb304924aa4eecc499d357e9c2c54f618f9136301aa03

amazon-accountactivity.duckdns.org Open in urlscan Pro 143.244.156.225 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

63 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

162 kBTransfer

304 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

amazon-accountactivity.duckdns.org Open in urlscan Pro
143.244.156.225 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

162 kB
Transfer

304 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!