amazon-order-cancellation.com

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 62.204.41.173, located in Russian Federation and belongs to HORIZONMSK-AS, RU. The main domain is amazon-order-cancellation.com.

This is the only time amazon-order-cancellation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	62.204.41.173 62.204.41.173	59425 (HORIZONMS...) (HORIZONMSK-AS)
4	2600:9000:231... 2600:9000:2315:f600:1d:d7f6:39d0:c781	16509 (AMAZON-02) (AMAZON-02)
6	2

2 62.204.41.173 (Russian Federation)

ASN59425 (HORIZONMSK-AS, RU)

amazon-order-cancellation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2315:f600:1d:d7f6:39d0:c781 (United States)

ASN16509 (AMAZON-02, US)

images-na.ssl-images-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ssl-images-amazon.com images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 870	31 KB
2	amazon-order-cancellation.com amazon-order-cancellation.com	7 KB
1	media-amazon.com m.media-amazon.com — Cisco Umbrella Rank: 590	28 KB
6	3

	Domain	Requested by
3	images-na.ssl-images-amazon.com	amazon-order-cancellation.com
2	amazon-order-cancellation.com	amazon-order-cancellation.com
1	m.media-amazon.com	images-na.ssl-images-amazon.com
6	3

This site contains links to these domains. Also see Links.

Domain
www.amazon.com
www.amazon.ca

Subject Issuer	Validity	Valid
Images-na.ssl-images-amazon.com DigiCert Global CA G2	`2022-02-01` - `2023-01-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2F%3F_encoding%3DUTF8%26ref_%3Dnav_newcust&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=caflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&
Frame ID: ECEA3126D7E43D0337E72B399C14C402
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign In

Page URL History Show full URLs

http://amazon-order-cancellation.com/ Page URL
http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amaz... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

67 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

66 kB
Transfer

212 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=508088
Title: Conditions of Use

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_signin_notification_privacy_notice?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.ca/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=caflex&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2Fyour-account%3Fref_%3Dnav_signin&prevRID=8RMQF9FSNSD4F785GY0B&openid.assoc_handle=caflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot Password

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=EGQYNCR0HVEBPNWJPBPK&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Create your Amazon account

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=468496
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gp/help/customer/display.html
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://amazon-order-cancellation.com/ Page URL
http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2F%3F_encoding%3DUTF8%26ref_%3Dnav_newcust&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=caflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ amazon-order-cancellation.com/	471 B 507 B	1000ms 56ms	Document text/html	62.204.41.173 HORIZONMSK-AS
General Check archive.org Show headers Download Go to Full URL http://amazon-order-cancellation.com/ Protocol HTTP/1.1 Server 62.204.41.173 , Russian Federation, ASN59425 (HORIZONMSK-AS, RU), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 11 Apr 2022 21:51:05 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	Primary Request login.php Show response amazon-order-cancellation.com/	13 KB 7 KB	52ms 52ms	Document text/html	62.204.41.173 HORIZONMSK-AS
General Check archive.org Show headers Download Go to Full URL http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2F%3F_encoding%3DUTF8%26ref_%3Dnav_newcust&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=caflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Requested by Host: amazon-order-cancellation.com URL: http://amazon-order-cancellation.com/ Protocol HTTP/1.1 Server 62.204.41.173 , Russian Federation, ASN59425 (HORIZONMSK-AS, RU), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash `6ff3a79993f0655a3ab687e1ed7bdc3fda3c32d1af7ec94604a0687a190bd8ce` Request headers Referer http://amazon-order-cancellation.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 11 Apr 2022 21:51:05 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css images-na.ssl-images-amazon.com/images/I/	133 KB 22 KB	76ms 9ms	Stylesheet text/css	2600:9000:2315:f600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI Requested by Host: amazon-order-cancellation.com URL: http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2F%3F_encoding%3DUTF8%26ref_%3Dnav_newcust&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=caflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2315:f600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `65e3ba66df0c9c45a17ac62283069d21d5e4a473d649a1d574a562a44f9a09c3` Request headers accept-language de-DE,de;q=0.9 Referer http://amazon-order-cancellation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Wed, 09 Jun 2021 15:37:21 GMT content-encoding gzip age 26460824 edge-cache-tag x-cache-090,/images/I/61A6IErPNXL x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-090 /images/I/61A6IErPNXL last-modified Wed, 06 Jan 2021 02:50:26 GMT server Server content-type text/css; charset=UTF-8 via 1.1 e60c6ee10489538b535a3fc65e54d028.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id 044a0b45-6651-45e6-bbfe-d4da4a9afdd7 x-amz-cf-pop DUS51-P2 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-edge-origin-shield-bytes 22987 x-amz-cf-id LaZa98USgZlCHxxqL_47kgdALmqd7k3X9id3wwf6A6RFvR1OQizsnw== expires Mon, 03 Jun 2041 10:09:46 GMT
GET H2	200	01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41O23DtqM3L.css_.css images-na.ssl-images-amazon.com/images/I/	36 KB 7 KB	78ms 11ms	Stylesheet text/css	2600:9000:2315:f600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41O23DtqM3L.css_.css?AUIClients/AuthenticationPortalAssets Requested by Host: amazon-order-cancellation.com URL: http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2F%3F_encoding%3DUTF8%26ref_%3Dnav_newcust&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=caflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2315:f600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `ba49da01868602a45c431e69b0fdbc1a9dde1c9437c009463ae0262f882cf50f` Request headers accept-language de-DE,de;q=0.9 Referer http://amazon-order-cancellation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Mon, 08 Nov 2021 23:42:24 GMT content-encoding gzip age 13298921 edge-cache-tag x-cache-884,/images/I/01SdjaY0ZsL x-nginx-cache-status MISS x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-884 /images/I/01SdjaY0ZsL last-modified Sat, 30 May 2015 02:58:48 GMT server Server content-type text/css via 1.1 e60c6ee10489538b535a3fc65e54d028.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id cc42b235-71f8-4c35-9f26-cebb277fa6f7 x-amz-cf-pop DUS51-P2 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id uz157LFIeBQyU8WP8_ZbU0px5eTXxqJO2dh7NLe6KdMvPUfYt2iKNQ== expires Sun, 03 Nov 2041 23:42:24 GMT
GET H2	200	113GJdhRnnL.css images-na.ssl-images-amazon.com/images/I/	2 KB 1 KB	77ms 11ms	Stylesheet text/css	2600:9000:2315:f600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://images-na.ssl-images-amazon.com/images/I/113GJdhRnnL.css?AUIClients/CVFAssets Requested by Host: amazon-order-cancellation.com URL: http://amazon-order-cancellation.com/login.php?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.ca%2F%3F_encoding%3DUTF8%26ref_%3Dnav_newcust&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=caflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0& Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2315:f600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `686bad9ed0ebf2f7cdbf20a0dbcfeb109f45b626bb09d7fe4937c9b23a07113c` Request headers accept-language de-DE,de;q=0.9 Referer http://amazon-order-cancellation.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Fri, 21 Jan 2022 18:47:25 GMT content-encoding gzip age 6923020 edge-cache-tag x-cache-353,/images/I/113GJdhRnnL x-nginx-cache-status HIT x-cache Hit from cloudfront access-control-allow-origin * surrogate-key x-cache-353 /images/I/113GJdhRnnL last-modified Mon, 29 Nov 2021 02:31:57 GMT server Server content-type text/css; charset=UTF-8 via 1.1 e60c6ee10489538b535a3fc65e54d028.cloudfront.net (CloudFront) cache-control max-age=630720000,public x-amz-ir-id c8827185-59ba-4372-9b21-6f5d7a0fa2f7 x-amz-cf-pop DUS51-P2 timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id wcsQI_WvyMgW51FMZkXKuWHDF6ktUr_jUWyfUZzC5v042FuzQlLSog== expires Tue, 14 Jan 2042 07:42:29 GMT
GET H2	200	mPGmT0r6IeTyIee.png m.media-amazon.com/images/S/sash/	27 KB 28 KB	17ms 9ms	Image image/png	2600:9000:2315:f600:1d:d7f6:39d0:c781 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png Requested by Host: images-na.ssl-images-amazon.com URL: https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI#us.not-trident Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2315:f600:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Server / Resource Hash `437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5` Request headers accept-language de-DE,de;q=0.9 Referer https://images-na.ssl-images-amazon.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 21 Sep 2021 22:15:55 GMT via 1.1 e60c6ee10489538b535a3fc65e54d028.cloudfront.net (CloudFront) age 17451310 edge-cache-tag x-cache-991,/images/S/sash/mPGmT0r6IeTyIee x-nginx-cache-status HIT x-cache Hit from cloudfront content-length 27972 surrogate-key x-cache-991 /images/S/sash/mPGmT0r6IeTyIee last-modified Tue, 17 Nov 2020 23:31:33 GMT server Server content-type image/png access-control-allow-origin * cache-control max-age=630720000,public x-amz-ir-id 30d9575f-9b98-45af-971e-3a5fea6d6278 x-amz-cf-pop DUS51-P2 accept-ranges bytes timing-allow-origin https://www.amazon.in, https://www.amazon.com x-amz-cf-id HtWvCSGQxYDfWrZ-UO6TBOGPFJD3QQN3iRVPRoKTzu22or5ZZSfANg== expires Sun, 08 Sep 2041 16:02:30 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon-order-cancellation.com
images-na.ssl-images-amazon.com
m.media-amazon.com
2600:9000:2315:f600:1d:d7f6:39d0:c781
62.204.41.173
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
65e3ba66df0c9c45a17ac62283069d21d5e4a473d649a1d574a562a44f9a09c3
686bad9ed0ebf2f7cdbf20a0dbcfeb109f45b626bb09d7fe4937c9b23a07113c
6ff3a79993f0655a3ab687e1ed7bdc3fda3c32d1af7ec94604a0687a190bd8ce
ba49da01868602a45c431e69b0fdbc1a9dde1c9437c009463ae0262f882cf50f

amazon-order-cancellation.com Open in urlscan Pro 62.204.41.173 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

67 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

66 kBTransfer

212 kBSize

0 Cookies

6 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

amazon-order-cancellation.com Open in urlscan Pro
62.204.41.173 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

66 kB
Transfer

212 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!