signr1yedp6jo1.duckdns.org
Open in
urlscan Pro
192.227.153.75
Malicious Activity!
Public Scan
Effective URL: https://signr1yedp6jo1.duckdns.org/ap/signin?eventid=2ec89974e5240b30749023ef7443544c
Submission: On June 11 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R11 on June 11th 2024. Valid for: 3 months.
This is the only time signr1yedp6jo1.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon Japan (Online) Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 13.33.187.51 13.33.187.51 | 16509 (AMAZON-02) (AMAZON-02) | |
1 5 | 192.227.153.75 192.227.153.75 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
1 | 2a02:26f0:e30... 2a02:26f0:e300::5f64:9240 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 2a04:4e42:600... 2a04:4e42:600::272 | 54113 (FASTLY) (FASTLY) | |
8 | 3 |
ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-51.fra60.r.cloudfront.net
qrco.de |
ASN36352 (AS-COLOCROSSING, US)
PTR: 192-227-153-75-host.colocrossing.com
signr1yedp6jo1.duckdns.org |
ASN20940 (AKAMAI-ASN1, NL)
images-na.ssl-images-amazon.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
duckdns.org
1 redirects
signr1yedp6jo1.duckdns.org |
39 KB |
3 |
media-amazon.com
m.media-amazon.com — Cisco Umbrella Rank: 445 |
94 KB |
2 |
qrco.de
2 redirects
qrco.de — Cisco Umbrella Rank: 94595 |
884 B |
1 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 882 |
93 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
5 | signr1yedp6jo1.duckdns.org |
1 redirects
signr1yedp6jo1.duckdns.org
|
3 | m.media-amazon.com |
signr1yedp6jo1.duckdns.org
|
2 | qrco.de | 2 redirects |
1 | images-na.ssl-images-amazon.com |
signr1yedp6jo1.duckdns.org
|
8 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webdisk.signr1yedp6jo1.duckdns.org R11 |
2024-06-11 - 2024-09-09 |
3 months | crt.sh |
m.media-amazon.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-08-29 - 2024-08-28 |
a year | crt.sh |
images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2024-03-18 - 2025-03-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://signr1yedp6jo1.duckdns.org/ap/signin?eventid=2ec89974e5240b30749023ef7443544c
Frame ID: 3AD2ED24E0D12B59F72775F060C1C086
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Amazon Sign-InPage URL History Show full URLs
-
http://qrco.de/bf8nsz
HTTP 307
https://qrco.de/bf8nsz HTTP 302
https://signr1yedp6jo1.duckdns.org/?gh7 HTTP 307
http://qrco.de/bf8nsz HTTP 302
https://signr1yedp6jo1.duckdns.org/?gh7 HTTP 302
https://signr1yedp6jo1.duckdns.org/ap/signin?eventid=2ec89974e5240b30749023ef7443544c Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://qrco.de/bf8nsz
HTTP 307
https://qrco.de/bf8nsz HTTP 302
https://signr1yedp6jo1.duckdns.org/?gh7 HTTP 307
http://qrco.de/bf8nsz HTTP 302
https://signr1yedp6jo1.duckdns.org/?gh7 HTTP 302
https://signr1yedp6jo1.duckdns.org/ap/signin?eventid=2ec89974e5240b30749023ef7443544c Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
signin
signr1yedp6jo1.duckdns.org/ap/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pc1.css
signr1yedp6jo1.duckdns.org/Resources/Assets/css/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pc1.js
signr1yedp6jo1.duckdns.org/Resources/Assets/js/ |
14 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61-6nKPKyWL._RC%7C11Y+5x+kkTL.js,51KMV3Cz2XL.js,31x4ENTlVIL.js,31f4+QIEeqL.js,01N6xzIJxbL.js,518BI433aLL.js,01rpauTep4L.js,31QZSjMuoeL.js,61ofwvddDeL.js,01KsMxlPtzL.js_.js
images-na.ssl-images-amazon.com/images/I/ |
309 KB 93 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BgnVchebDR5Ds4h.png
m.media-amazon.com/images/S/sash/ |
60 KB 61 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pDxWAF1pBB0dzGB.woff2
m.media-amazon.com/images/S/sash/ |
16 KB 16 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFPk-9IF4FqAqY-.woff2
m.media-amazon.com/images/S/sash/ |
16 KB 17 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fav.png
signr1yedp6jo1.duckdns.org/Resources/Assets/img/ |
4 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon Japan (Online) Amazon (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| jQuery1640649968239768321 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
signr1yedp6jo1.duckdns.org/ | Name: PHPSESSID Value: 6eca2018c4b502fd38837428b7f264f4 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
images-na.ssl-images-amazon.com
m.media-amazon.com
qrco.de
signr1yedp6jo1.duckdns.org
13.33.187.51
192.227.153.75
2a02:26f0:e300::5f64:9240
2a04:4e42:600::272
173f45ef1baf7322f3c8158003bf3f1bdb4ce6033426333d09e1cedcdf50b7f0
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
512aeeb05776eb3c904600e0e3f7fb30c511841c12764b54af96319ce8e925a4
bb945e85dc510f875d62672bdc14d6cde043a0a8bfd3e35a44c4455e372041d1
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
e900470f72fe43136df67b8fd87a8422a6d7f0f98332bd3907f901aac2cc4d5c
f1981b49d0cbcfd0a653ebe4aaa9f4180e04c93016de2426b9a8325b9d282380