www.womtvbvr.xyz Open in urlscan Pro
47.251.57.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.womtvbvr.xyz/dWQG
Effective URL:
https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dn...
Submission Tags: @ecarlesi threat phishing amazon Search All
Submission: On December 05 via api (December 5th 2023, 5:32:42 pm UTC) from IT — Scanned from IT

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 47.251.57.156, located in Santa Clara, United States and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is www.womtvbvr.xyz.
TLS certificate: Issued by R3 on December 5th 2023. Valid for: 3 months.

This is the only time www.womtvbvr.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	47.251.57.156 47.251.57.156	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1	3.222.236.147 3.222.236.147	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:20b... 2600:9000:20b4:6200:1d:d7f6:39d3:7a61	16509 (AMAZON-02) (AMAZON-02)
10	5

7 47.251.57.156 (Santa Clara, United States) 1 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

www.womtvbvr.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images-na.womtvbvr.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.222.236.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-236-147.compute-1.amazonaws.com

fls-na.amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20b4:6200:1d:d7f6:39d3:7a61 (United States)

ASN16509 (AMAZON-02, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	womtvbvr.xyz 1 redirects www.womtvbvr.xyz images-na.womtvbvr.xyz	194 KB
1	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 726	17 KB
1	amazon.com fls-na.amazon.com — Cisco Umbrella Rank: 955	150 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 340	31 KB
10	4

	Domain	Requested by
5	images-na.womtvbvr.xyz	www.womtvbvr.xyz images-na.womtvbvr.xyz
2	www.womtvbvr.xyz	1 redirects
1	images-na.ssl-images-amazon.com	images-na.womtvbvr.xyz
1	fls-na.amazon.com	www.womtvbvr.xyz
1	ajax.googleapis.com	www.womtvbvr.xyz
10	5

This site contains no links.

Subject Issuer	Validity	Valid
womtvbvr.xyz R3	`2023-12-05` - `2024-03-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
fls-na.amazon.com Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2023-08-09` - `2024-07-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Frame ID: 715D5846D6D029D5344E291B6710D861
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon.com

Page URL History Show full URLs

https://www.womtvbvr.xyz/dWQG HTTP 302
https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amaz... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

241 kB
Transfer

293 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.womtvbvr.xyz/dWQG HTTP 302
https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request signin Show response
www.womtvbvr.xyz/ap/
Redirect Chain

https://www.womtvbvr.xyz/dWQG
https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fident...

8 KB
9 KB

1780ms
1780ms

Document
text/html

47.251.57.156
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 47.251.57.156 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Server /
Resource Hash: 72bd79d553f02b174b7eb174e67ee5ad4e9a87364a84808ede83df25c09a4225

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Alt-Svc: h3=":443"; ma=86400
Connection: close
Content-Type: text/html
Date: Tue, 05 Dec 2023 17:32:33 GMT
P3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
Server: Server
Transfer-Encoding: chunked
Vary: Content-Type,Accept-Encoding,User-Agent
Via: 1.1 8895861a0024c7dc7c7ff4c21c4701fe.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FMSLNV3a0Q6ASXD--U9MkXDyRIovTveQ7UCfI3mrL5gSpLuGhMqdmA==
X-Amz-Cf-Pop: ATL59-P3
X-Amz-Rid: YWFQP4KPABHH4K56YDKC
X-Cache: Miss from cloudfront

Redirect headers

Connection: close
Content-Type: text/html
Location: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Transfer-Encoding: chunked

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 421ms
166ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: www.womtvbvr.xyz
URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 16:17:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Dec 2024 16:17:19 GMT

GET
H/1.1 200
OK AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css
images-na.womtvbvr.xyz/images/G/01/AUIClients/ 165 KB
166 KB 2588ms
1215ms Stylesheet
text/css 47.251.57.156
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://images-na.womtvbvr.xyz/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css
Requested by: Host: www.womtvbvr.xyz
URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 47.251.57.156 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Server /
Resource Hash: 5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Sun, 13 Aug 2023 06:52:09 GMT
Via: 1.1 80fd1da85988dd3d2efdca9dd797ce8a.cloudfront.net (CloudFront)
Age: 9888025
X-Amz-Cf-Pop: ATL58-P2
Transfer-Encoding: chunked
Edge-Cache-Tag: x-cache-109,/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min
X-Cache: Hit from cloudfront
X-Nginx-Cache-Status: HIT
Connection: close
Server-Timing: provider;desc="cf"
Surrogate-Key: x-cache-109 /images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min
Last-Modified: Wed, 17 Jul 2013 22:49:32 GMT
Server: Server
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=630720000,public
X-Amz-Ir-Id: 3c9c4e67-95da-41df-8807-d86cc280dae9
Timing-Allow-Origin: https://www.amazon.com
X-Amz-Cf-Id: zLQfIIDHZWRewF-zmGQDfZ0HXtfOAShUA1OEqTAFYHlG1NiPnbsptA==
Expires: Fri, 07 Aug 2043 07:46:12 GMT

GET
H/1.1 200
OK Captcha_mxetifatvl.jpg
images-na.womtvbvr.xyz/captcha/derqnxxq/ 6 KB
6 KB 2586ms
1191ms Image
image/jpeg 47.251.57.156
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-na.womtvbvr.xyz/captcha/derqnxxq/Captcha_mxetifatvl.jpg
Requested by: Host: www.womtvbvr.xyz
URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 47.251.57.156 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Server /
Resource Hash: 96fd6addc5b1a781de53092cc128b417a7a7eb6ebd47beaf948ee992d1176b36

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Fri, 01 Dec 2023 13:07:29 GMT
Via: 1.1 493e292caca329a2b20dbbc4e33d60f2.cloudfront.net (CloudFront)
Age: 20707
X-Amz-Cf-Pop: ATL58-P2
Transfer-Encoding: chunked
Edge-Cache-Tag: x-cache-475,/captcha/derqnxxq/Captcha_mxetifatvl
X-Cache: Hit from cloudfront
X-Nginx-Cache-Status: HIT
Connection: close
Server-Timing: provider;desc="cf"
Surrogate-Key: x-cache-475 /captcha/derqnxxq/Captcha_mxetifatvl
Last-Modified: Wed, 08 Feb 2012 17:13:28 GMT
Server: Server
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
X-Amz-Ir-Id: 977cb53b-836e-428d-80be-af86f212541d
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.amazon.com
X-Amz-Cf-Id: LWBOcKvkab34t8IqGabxtnn56wUDDDtcS0METwUZVwXziE1dMyi0NQ==

GET
H2 200 requestId=YWFQP4KPABHH4K56YDKC&js=1
fls-na.amazon.com/1/oc-csi/1/OP/ 43 B
150 B 649ms
214ms Image
image/gif 3.222.236.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fls-na.amazon.com/1/oc-csi/1/OP/requestId=YWFQP4KPABHH4K56YDKC&js=1
Requested by: Host: www.womtvbvr.xyz
URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.236.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-236-147.compute-1.amazonaws.com
Software: /
Resource Hash: a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 17:32:38 GMT
x-amzn-requestid: a1ce45fa-a2ff-490b-9869-a4f8fe2ce017
content-length: 43
content-type: image/gif

GET
H/1.1 200
OK csm-captcha-instrumentation.min.js Show response
images-na.womtvbvr.xyz/images/G/01/csminstrumentation/ 2 KB
2 KB 1745ms
1110ms Script
application/x-javascript 47.251.57.156
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://images-na.womtvbvr.xyz/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js
Requested by: Host: www.womtvbvr.xyz
URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 47.251.57.156 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: /
Resource Hash: 29bf77e369998be7540fb4e3394888fa2c0d45155da3f3dabd73be75030c4fa6

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 17:32:38 GMT
Age: 7119
Transfer-Encoding: chunked
X-Cache: HIT from fastly, HIT from fastly
X-Nginx-Cache-Status: HIT
Connection: close
Server-Timing: provider;desc="fy"
X-Served-By: cache-iad-kcgs7200088-IAD, cache-fty13722-FTY
Last-Modified: Mon, 12 Oct 2015 09:22:39 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400,public
X-Amz-Ir-Id: 809342e8-4eac-47c8-8a5e-506838c87625
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.amazon.com
Expires: Thu, 16 Nov 2023 10:02:59 GMT

GET
H/1.1 200
OK rd-script-6d68177fa6061598e9509dc4b5bdd08d.js Show response
images-na.womtvbvr.xyz/images/G/01/csminstrumentation/ 2 KB
2 KB 1765ms
1058ms Script
application/x-javascript 47.251.57.156
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://images-na.womtvbvr.xyz/images/G/01/csminstrumentation/rd-script-6d68177fa6061598e9509dc4b5bdd08d.js
Requested by: Host: www.womtvbvr.xyz
URL: https://www.womtvbvr.xyz/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 47.251.57.156 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: /
Resource Hash: 0a7e3153f44d0e51c73dad9fa3034a14446bedbafc38e477915382dd02269123

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 17:32:38 GMT
Age: 31095
Transfer-Encoding: chunked
X-Cache: HIT from fastly, HIT from fastly
X-Nginx-Cache-Status: HIT
Connection: close
Server-Timing: provider;desc="fy"
Response-Handler: root
X-Served-By: cache-iad-kcgs7200080-IAD, cache-fty13723-FTY
Last-Modified: Fri, 20 Mar 2020 12:31:03 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400,public
X-Amz-Ir-Id: 5af01de3-b2f7-48a4-8f3b-9b00a026b09c
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.amazon.com
Expires: Wed, 30 Aug 2023 19:14:05 GMT

GET
H2 200 aui_sprite_0007-1x._V383827579_.png
images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/ 17 KB
17 KB 617ms
208ms Image
image/png 2600:9000:20b4:6200:1d:d7f6:39d3:7a61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-na.ssl-images-amazon.com/images/G/01/amazonui/sprites/aui_sprite_0007-1x._V383827579_.png
Requested by: Host: images-na.womtvbvr.xyz
URL: https://images-na.womtvbvr.xyz/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1cc02ce238101.secure.min._V1_.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20b4:6200:1d:d7f6:39d3:7a61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://images-na.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 15:11:09 GMT
via: 1.1 2837e32f921e7e7517dd6f5461c37dfa.cloudfront.net (CloudFront)
age: 11845289
x-amz-cf-pop: AMS58-P4
edge-cache-tag: x-cache-846,/images/G/01/amazonui/sprites/aui_sprite_0007-1x
x-nginx-cache-status: HIT
x-cache: Hit from cloudfront
server-timing: provider;desc="cf"
content-length: 16972
surrogate-key: x-cache-846 /images/G/01/amazonui/sprites/aui_sprite_0007-1x
last-modified: Wed, 15 May 2013 01:55:34 GMT
server: Server
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=630720000,public
x-amz-ir-id: 6eef3435-ceab-4342-9443-c088d5a6e681
accept-ranges: bytes
timing-allow-origin: https://www.amazon.com
x-amz-cf-id: U-HDg2znB_lSJ4etp99kGi62mkkxawxTS_keezMMDaQuQec8S_d22A==
expires: Sat, 04 Jul 2043 01:09:17 GMT

GET
H/1.1 200
OK ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js Show response
images-na.womtvbvr.xyz/images/G/01/csminstrumentation/ 7 KB
8 KB 1660ms
966ms Script
application/x-javascript 47.251.57.156
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://images-na.womtvbvr.xyz/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1e5ee15c61a1._V313498596_.js
Requested by: Host: images-na.womtvbvr.xyz
URL: https://images-na.womtvbvr.xyz/images/G/01/csminstrumentation/csm-captcha-instrumentation.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 47.251.57.156 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: /
Resource Hash: 40e9efcdd991f9b5752e16768a19a6dbfa0b52b1e85663aba319f8da6095dcb0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.womtvbvr.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 17:32:40 GMT
Age: 1846243
Transfer-Encoding: chunked
X-Cache: HIT from fastly, HIT from fastly
X-Nginx-Cache-Status: HIT
Connection: close
Server-Timing: provider;desc="fy"
X-Served-By: cache-iad-kcgs7200026-IAD, cache-fty13729-FTY
Last-Modified: Wed, 26 Aug 2015 14:52:49 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=630720000,public
X-Amz-Ir-Id: d63c7cbd-d056-4672-947d-633fb99bb390
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.amazon.com
Expires: Fri, 25 Sep 2043 06:43:55 GMT

GET ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js
images-na.womtvbvr.xyz/images/G/01/AUIClients/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: images-na.womtvbvr.xyz
URL: https://images-na.womtvbvr.xyz/images/G/01/AUIClients/ClientSideMetricsAUIJavascript-51171fbdd28e1a7a61e922e8f0272af8bc74d37b.secure.variant-desktop-session-snapshot-keypress.min._V2_.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.womtvbvr.xyz/	1970-01-20 16:43:21	Name: Tzyw Value: 1631953cad65d31c144cb31ba1079c97ddc2a1ad39d66aaf9441bf7671e6e86e
			www.womtvbvr.xyz/	1970-01-20 17:22:44	Name: csm-sid Value: 091-5361695-7007225

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fls-na.amazon.com
images-na.ssl-images-amazon.com
images-na.womtvbvr.xyz
www.womtvbvr.xyz
images-na.womtvbvr.xyz
2600:9000:20b4:6200:1d:d7f6:39d3:7a61
2a00:1450:4001:811::200a
3.222.236.147
47.251.57.156
0a7e3153f44d0e51c73dad9fa3034a14446bedbafc38e477915382dd02269123
29bf77e369998be7540fb4e3394888fa2c0d45155da3f3dabd73be75030c4fa6
40e9efcdd991f9b5752e16768a19a6dbfa0b52b1e85663aba319f8da6095dcb0
49ff798368f6e4367d03a44af687d47609ca4608d02b1a099281f88c910cf1aa
5ab7636e9f2e3ad10acc3d81e7ef8bf615504699d42034c041ff9e7c93f178bb
72bd79d553f02b174b7eb174e67ee5ad4e9a87364a84808ede83df25c09a4225
96fd6addc5b1a781de53092cc128b417a7a7eb6ebd47beaf948ee992d1176b36
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

www.womtvbvr.xyz Open in urlscan Pro 47.251.57.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

241 kBTransfer

293 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

26 JavaScript Global Variables

2 Cookies

Indicators

www.womtvbvr.xyz Open in urlscan Pro
47.251.57.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

241 kB
Transfer

293 kB
Size

2
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!