urlscan.io logo urlscan.io
SecurityTrails logo

amazon04security.duckdns.org Open in urlscan Pro
44.203.96.154  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://amazon04security.duckdns.org/
Submission Tags: @phishunt_io
Submission: On July 10 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 44.203.96.154, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is amazon04security.duckdns.org.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 10th 2022. Valid for: 3 months.
This is the only time amazon04security.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 44.203.96.154 14618 (AMAZON-AES)
3 2600:9000:206... 16509 (AMAZON-02)
4 2
Apex Domain
Subdomains		 Transfer
2 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 789
30 KB
1 media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 505
28 KB
1 duckdns.org
amazon04security.duckdns.org
8 KB
4 3
Domain Requested by
2 images-na.ssl-images-amazon.com amazon04security.duckdns.org
1 m.media-amazon.com images-na.ssl-images-amazon.com
1 amazon04security.duckdns.org
4 3

This site contains no links.

Subject Issuer Validity Valid
amazon04security.duckdns.org
cPanel, Inc. Certification Authority		 2022-07-10 -
2022-10-08		 3 months crt.sh
Images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2022-02-01 -
2023-01-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://amazon04security.duckdns.org/
Frame ID: F39A589876137B6E08C8D8356583B35F
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon Sign-In

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

66 kB
Transfer

204 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
amazon04security.duckdns.org/ 		8 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://amazon04security.duckdns.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
44.203.96.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-203-96-154.compute-1.amazonaws.com
Software
Apache /
Resource Hash
adbfc67f931c4b2a120ead9de1b5e016f401c4a374d995f0a072219798cc5296

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sun, 10 Jul 2022 23:36:51 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css
images-na.ssl-images-amazon.com/images/I/ 		133 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI
Requested by
Host: amazon04security.duckdns.org
URL: https://amazon04security.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
65e3ba66df0c9c45a17ac62283069d21d5e4a473d649a1d574a562a44f9a09c3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://amazon04security.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 15:37:21 GMT
content-encoding
gzip
age
4036477
edge-cache-tag
x-cache-090,/images/I/61A6IErPNXL
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
access-control-allow-origin
*
surrogate-key
x-cache-090 /images/I/61A6IErPNXL
last-modified
Wed, 06 Jan 2021 02:50:26 GMT
server
Server
content-type
text/css; charset=UTF-8
via
1.1 673c96d1f19de21216629aa48d90ac92.cloudfront.net (CloudFront)
cache-control
max-age=630720000,public
x-amz-ir-id
044a0b45-6651-45e6-bbfe-d4da4a9afdd7
x-amz-cf-pop
FRA56-C1
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-edge-origin-shield-bytes
22987
x-amz-cf-id
FKTs5NJXQ2Y_Nl8asx2QH8ip1FOvE9mHr92JbXg2bVgC_lrAuyRkRg==
expires
Sat, 17 May 2042 07:01:41 GMT
01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41CoXfMtudL.css_.css
images-na.ssl-images-amazon.com/images/I/ 		36 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/I/01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41CoXfMtudL.css_.css?AUIClients/AuthenticationPortalAssets
Requested by
Host: amazon04security.duckdns.org
URL: https://amazon04security.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
d677760fa69d216fe4dafd1a4548587e1b482f74b34f08e57085796d2187fd3d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://amazon04security.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 25 May 2022 10:15:18 GMT
content-encoding
gzip
age
4022494
edge-cache-tag
x-cache-914,/images/I/01SdjaY0ZsL
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
server-timing
cdn-cache-hit,cdn-pop;desc="FRA56-C1",cdn-rid;desc="n6v7aDMu1U1l9V0_PTWkj9j2H8S9TXr3ykdUYtqgZ7d1SXV9ecfUJg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=1
access-control-allow-origin
*
surrogate-key
x-cache-914 /images/I/01SdjaY0ZsL
last-modified
Sat, 30 May 2015 02:58:48 GMT
server
Server
content-type
text/css
via
1.1 673c96d1f19de21216629aa48d90ac92.cloudfront.net (CloudFront)
cache-control
max-age=630720000,public
x-amz-ir-id
0a539e9b-be57-47ad-b4d5-0c2a720f87ab
x-amz-cf-pop
FRA56-C1
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
n6v7aDMu1U1l9V0_PTWkj9j2H8S9TXr3ykdUYtqgZ7d1SXV9ecfUJg==
expires
Tue, 20 May 2042 09:22:23 GMT
mPGmT0r6IeTyIee.png
m.media-amazon.com/images/S/sash/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.media-amazon.com/images/S/sash/mPGmT0r6IeTyIee.png
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/I/61A6IErPNXL._RC%7C11Fd9tJOdtL.css,11tfezETfFL.css,31Q3id-QR0L.css,31U9HrBLKmL.css_.css?AUIClients/AmazonUI#us.not-trident
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8e00:1d:d7f6:39d0:c781 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://images-na.ssl-images-amazon.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 28 May 2022 08:58:54 GMT
via
1.1 673c96d1f19de21216629aa48d90ac92.cloudfront.net (CloudFront)
age
3767878
edge-cache-tag
x-cache-721,/images/S/sash/mPGmT0r6IeTyIee
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
content-length
27972
surrogate-key
x-cache-721 /images/S/sash/mPGmT0r6IeTyIee
last-modified
Tue, 17 Nov 2020 23:31:33 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
57452487-45b7-492c-bf50-4e71f1e0b101
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
timing-allow-origin
https://www.amazon.in, https://www.amazon.com
x-amz-cf-id
LybI1_BqpGYP8Pph_n-SN3Z2SE5igA95jnnpOw2HwcIX5aE6K2Lhkw==
expires
Tue, 20 May 2042 05:48:02 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation number| ue_t0

0 Cookies