auth.www.iberlibro.com
Open in
urlscan Pro
52.95.116.214
Malicious Activity!
Public Scan
Effective URL: https://auth.www.iberlibro.com/ap/signin?openid.pape.max_auth_age=899&openid.return_to=https%3A%2F%2Fwww.iberlibro.com%2Fservle...
Submission: On December 29 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon on March 16th 2021. Valid for: a year.
This is the only time auth.www.iberlibro.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2.16.107.152 2.16.107.152 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 2 | 13.225.73.121 13.225.73.121 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 52.95.116.214 52.95.116.214 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 2a04:4e42:200... 2a04:4e42:200::272 | 54113 (FASTLY) (FASTLY) | |
2 | 52.214.204.190 52.214.204.190 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.225.73.123 13.225.73.123 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:21f... 2600:9000:21f3:6400:3:12d0:8d40:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:21f... 2600:9000:21f3:fc00:a:132:4500:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 209.54.180.46 209.54.180.46 | 16509 (AMAZON-02) (AMAZON-02) | |
22 | 7 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-107-152.deploy.static.akamaitechnologies.com
click.sender.abebooks.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-121.fra2.r.cloudfront.net
www.iberlibro.com |
ASN54113 (FASTLY, US)
images-eu.ssl-images-amazon.com | |
images-na.ssl-images-amazon.com | |
m.media-amazon.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-204-190.eu-west-1.compute.amazonaws.com
fls-eu.amazon.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-123.fra2.r.cloudfront.net
static.siege-amazon.com |
ASN16509 (AMAZON-02, US)
d35uxhjf90umnp.cloudfront.net |
ASN16509 (AMAZON-02, US)
static.prod.abebookscdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
ssl-images-amazon.com
images-eu.ssl-images-amazon.com images-na.ssl-images-amazon.com |
358 KB |
4 |
iberlibro.com
2 redirects
www.iberlibro.com auth.www.iberlibro.com |
92 KB |
3 |
amazon.com
fls-eu.amazon.com unagi.amazon.com |
704 B |
2 |
media-amazon.com
m.media-amazon.com |
28 KB |
1 |
abebookscdn.com
static.prod.abebookscdn.com |
2 KB |
1 |
cloudfront.net
d35uxhjf90umnp.cloudfront.net |
12 KB |
1 |
siege-amazon.com
static.siege-amazon.com |
1 KB |
1 |
abebooks.com
1 redirects
click.sender.abebooks.com |
393 B |
22 | 8 |
Domain | Requested by | |
---|---|---|
11 | images-eu.ssl-images-amazon.com |
auth.www.iberlibro.com
|
2 | m.media-amazon.com |
auth.www.iberlibro.com
images-eu.ssl-images-amazon.com |
2 | fls-eu.amazon.com |
auth.www.iberlibro.com
|
2 | auth.www.iberlibro.com | |
2 | www.iberlibro.com | 2 redirects |
1 | unagi.amazon.com |
auth.www.iberlibro.com
|
1 | static.prod.abebookscdn.com |
images-eu.ssl-images-amazon.com
|
1 | d35uxhjf90umnp.cloudfront.net |
images-eu.ssl-images-amazon.com
|
1 | static.siege-amazon.com |
auth.www.iberlibro.com
|
1 | images-na.ssl-images-amazon.com |
auth.www.iberlibro.com
|
1 | click.sender.abebooks.com | 1 redirects |
22 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.iberlibro.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
auth.www.abebooks.co.uk Amazon |
2021-03-16 - 2022-03-03 |
a year | crt.sh |
images-na.ssl-images-amazon.com DigiCert Global CA G2 |
2021-08-09 - 2022-07-24 |
a year | crt.sh |
fls-eu.amazon.com Amazon |
2021-07-01 - 2022-06-08 |
a year | crt.sh |
static.siege-amazon.com Amazon |
2021-04-22 - 2022-05-21 |
a year | crt.sh |
*.cloudfront.net Amazon |
2021-03-19 - 2022-03-17 |
a year | crt.sh |
static.prod.abebookscdn.com Amazon |
2021-10-07 - 2022-11-04 |
a year | crt.sh |
unagi-na.amazon.com Amazon |
2021-05-11 - 2022-04-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://auth.www.iberlibro.com/ap/signin?openid.pape.max_auth_age=899&openid.return_to=https%3A%2F%2Fwww.iberlibro.com%2Fservlet%2FSignInCompletion%3Fgoto%3DMembersMainMenu&openid.identity=http%3A%2F%2Fwww.amazon.com%2Fap%2Fspecs%2Fauth%2Fconfirm_credentials&openid.assoc_handle=abe_site_es&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.claimed_id=http%3A%2F%2Fwww.amazon.com%2Fap%2Fspecs%2Fauth%2Fconfirm_credentials&pageId=abe_site_es&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Frame ID: E5822A53FB90B6753169C7D69ABA3F14
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Iniciar sesión en IberLibroPage URL History Show full URLs
-
http://click.sender.abebooks.com/?qs=17a46220cfe101b4b48a094999437bc9bf149bbe9e118400f2b925879f3c02d4b9b15164...
HTTP 302
https://www.iberlibro.com/servlet/MembersMenuPL?cm_mmc=nl-_-nl-_-E211229-ASP-lowaspBYTRADE-_-f-account HTTP 302
https://www.iberlibro.com/servlet/SignOnPL?msg=Por%20favor%20inicie%20sesi%F3n%20con%20su%20cuenta%20o... HTTP 302
https://auth.www.iberlibro.com/ap/signin?openid.pape.max_auth_age=899&openid.return_to=https%3A%2F%2Fwww.ib... Page URL
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Condiciones generales de uso
Search URL Search Domain Scan URL
Title: PolÃtica de privacidad
Search URL Search Domain Scan URL
Title: Aviso de Cookies
Search URL Search Domain Scan URL
Title: Publicidad basada en los intereses del usuario
Search URL Search Domain Scan URL
Title: Cookies y publicidad en Internet
Search URL Search Domain Scan URL
Title: Ayuda
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://click.sender.abebooks.com/?qs=17a46220cfe101b4b48a094999437bc9bf149bbe9e118400f2b925879f3c02d4b9b15164fd0025250cda118d70d94ec798ac388a8da5d702
HTTP 302
https://www.iberlibro.com/servlet/MembersMenuPL?cm_mmc=nl-_-nl-_-E211229-ASP-lowaspBYTRADE-_-f-account HTTP 302
https://www.iberlibro.com/servlet/SignOnPL?msg=Por%20favor%20inicie%20sesi%F3n%20con%20su%20cuenta%20o%20cree%20una%20para%20continuar.&cm_mmc=nl-_-nl-_-E211229-ASP-lowaspBYTRADE-_-f-account&goto=MembersMainMenu HTTP 302
https://auth.www.iberlibro.com/ap/signin?openid.pape.max_auth_age=899&openid.return_to=https%3A%2F%2Fwww.iberlibro.com%2Fservlet%2FSignInCompletion%3Fgoto%3DMembersMainMenu&openid.identity=http%3A%2F%2Fwww.amazon.com%2Fap%2Fspecs%2Fauth%2Fconfirm_credentials&openid.assoc_handle=abe_site_es&openid.mode=checkid_setup&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.claimed_id=http%3A%2F%2Fwww.amazon.com%2Fap%2Fspecs%2Fauth%2Fconfirm_credentials&pageId=abe_site_es&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
signin
auth.www.iberlibro.com/ap/ Redirect Chain
|
89 KB 91 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
710n0lLTKdL.css
images-eu.ssl-images-amazon.com/images/I/ |
129 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
01SdjaY0ZsL._RC%7C31jdWD+JB+L.css,41O23DtqM3L.css_.css
images-eu.ssl-images-amazon.com/images/I/ |
36 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
113GJdhRnnL.css
images-eu.ssl-images-amazon.com/images/I/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
A8VYC9F95IK3X:258-3280752-3906131:AHKWXJ3JWQAGKWSNVPT6$uedata=s:%2Fap%2Fuedata%3Fstaticb%26id%3DAHKWXJ3JWQAGKWSNVPT6:0
fls-eu.amazon.com/1/batch/1/OP/ |
43 B 150 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iberlibro-logo._CB451365245_.png
images-na.ssl-images-amazon.com/images/G/01/abebooks/site/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AuthenticationPortalSigninEU.js
static.siege-amazon.com/prod/profiles/ |
2 KB 1 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61XKxrBtDVL._RC%7C11Y+5x+kkTL.js,01rpauTep4L.js,71SOr1XqDeL.js_.js
images-eu.ssl-images-amazon.com/images/I/ |
309 KB 96 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
21G215oqvfL._RC%7C21OJDARBhQL.js,218GJg15I8L.js,31lucpmF4CL.js,2119M3Ks9rL.js,51AjK+mcqiL.js_.js
images-eu.ssl-images-amazon.com/images/I/ |
88 KB 25 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
01wGDSlxwdL.js
images-eu.ssl-images-amazon.com/images/I/ |
521 B 667 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
31nXJjJD6wL.js
images-eu.ssl-images-amazon.com/images/I/ |
15 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
81gLkT0N6tL.js
images-eu.ssl-images-amazon.com/images/I/ |
324 KB 94 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
31jdfgcsPAL.js
images-eu.ssl-images-amazon.com/images/I/ |
14 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
71QCGnDPPDL.js
images-eu.ssl-images-amazon.com/images/I/ |
253 KB 66 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
71SLENeYBFL.js
images-eu.ssl-images-amazon.com/images/I/ |
137 KB 37 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
showads.v2.js
m.media-amazon.com/images/G/01/csm/ |
23 B 374 B |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mPGmT0r6IeTyIee.png
m.media-amazon.com/images/S/sash/ |
27 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
d35uxhjf90umnp.cloudfront.net/ |
37 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authportal.js
static.prod.abebookscdn.com/cdn/es/scripts/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
uedata
auth.www.iberlibro.com/ap/ |
0 390 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
A8VYC9F95IK3X:258-3280752-3906131:AHKWXJ3JWQAGKWSNVPT6$uedata=s:%2Fap%2Fuedata%3Fld%26v%3D0.220956.0%26id%3DAHKWXJ3JWQAGKWSNVPT6%26sw%3D1600%26sh%3D1200%26vw%3D1600%26vh%3D1200%26m%3D1%26sc%3DAHKWX...
fls-eu.amazon.com/1/batch/1/OP/ |
43 B 149 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
com.amazon.csm.csa.prod
unagi.amazon.com/1/events/ |
2 B 405 B |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)75 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| ue_t0 object| ue_csm number| ue_hob string| ue_id string| ue_url number| ue_navtiming string| ue_mid string| ue_sid string| ue_sn string| ue_furl string| ue_surl number| ue_int number| ue_fcsn number| ue_urt string| ue_rpl_ns number| ue_ddq string| ue_fpf number| ue_sbuimp number| ue_ibft number| ue_fnt number| ue_swi function| ue_viz number| ue_hoe number| ue_ihb object| ue number| ueinit function| uei function| ueh function| ues function| uet function| uex function| onLd function| onLdEnd function| onUl function| onstop number| aPageStart number| ue_ihe function| csa object| amzn function| cf object| metadataList object| input object| authenticationFormList number| index object| fwcimCmd function| submitForm function| getClientContext function| getEmailAddress function| isTestEmailPattern object| ue_mbl string| ue_pty string| ue_spty number| ue_adb number| ue_adb_rtla number| ue_wtc_c string| ue_aa_a number| ue_ibe function| _uess number| ue_fadb function| ue_isAdb object| ue_utils number| ue_unrt number| ue_adb_chk object| regeneratorRuntime object| SiegeCrypto function| setImmediate function| clearImmediate number| __fwcimLoaded object| fwcim object| acic object| jQuery16409576886347130844 boolean| isMobileAuthPortal boolean| loginWithOTPState object| pie object| ue_ext4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.iberlibro.com/ | Name: ql-session-id Value: 540-8859050-6127739 |
|
.www.iberlibro.com/ | Name: session-id Value: 258-3280752-3906131 |
|
.www.iberlibro.com/ | Name: session-id-time Value: 2271517649l |
|
auth.www.iberlibro.com/ | Name: csm-hit Value: tb:s-AHKWXJ3JWQAGKWSNVPT6|1640797649667&t:1640797649743&adb:adblk_no |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.www.iberlibro.com
click.sender.abebooks.com
d35uxhjf90umnp.cloudfront.net
fls-eu.amazon.com
images-eu.ssl-images-amazon.com
images-na.ssl-images-amazon.com
m.media-amazon.com
static.prod.abebookscdn.com
static.siege-amazon.com
unagi.amazon.com
www.iberlibro.com
13.225.73.121
13.225.73.123
2.16.107.152
209.54.180.46
2600:9000:21f3:6400:3:12d0:8d40:21
2600:9000:21f3:fc00:a:132:4500:93a1
2a04:4e42:200::272
52.214.204.190
52.95.116.214
03df4b1eb51514b0831e59135d6877b01e86d499fea1d25746b4da389f393628
2e5c4e5dd76d19bd957864a5485880b7dd5381be31835dc30dbb276d82652a89
432dff2bd6f663c6151a5947fa318a46463085d4f6e40761450e8b38fd0fe938
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4eec99f8bc39e1ce3d98d48d6bc74ed0828817626fdb538aa6392aac8106d17d
6267b22c78747f8db9476b502c900e874aebf89e1c658b5b3282f4c01f7a54c2
6290c1f45a2ab04fb0c62dbaaf0b4794667ed61b5f05a5a437965f35d4f7e884
686bad9ed0ebf2f7cdbf20a0dbcfeb109f45b626bb09d7fe4937c9b23a07113c
6e6b02c79ac305af5124e8ec5304affce3339512534e3e981d7ddee83a57c503
88ea58255d4cd82340f7acaabe0e6a99f195a4dc2ca6ef56ec503d03b331bee5
96077807e83234205ec39bccf8453347a37f0151b37c02f7d7de8e28564ab1a7
a3a64aea2e96ec58a163ddb8d4cf86cf236178ed2d225b8f44154bc1b010ddce
af68840db51453387cdc847039e2c9c5d47ac68d07105717f91a596f5bbff970
b232a1cead6d7bee0de39227a5916ea82058f6395748737517ca67127deb43e4
ba49da01868602a45c431e69b0fdbc1a9dde1c9437c009463ae0262f882cf50f
c346da122dd183c13c705b1e91a219c81b0004d44e4b080e16176decffdac3eb
d0b04c3918041da7c4f694a519406b0cadefdca7c55e71874ed810544b32afe0
db4d3cd1946ece76102ec050a49bb876ba5d996eaed9d240b6923a113dcaf623
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea6aa6ebfd074dc6b90854b90a42bf4e155d3b90cff65f48412a70ef646e9a79