urlscan.io logo urlscan.io
SecurityTrails logo

m.login-amazn.ath.cx Open in urlscan Pro
139.162.185.93  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://m.login-amazn.ath.cx/m/secure/xf/page/Login/login.php
Submission: On December 24 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 139.162.185.93, located in Frankfurt am Main, Germany and belongs to AKAMAI-AP Akamai Technologies, Inc., SG. The main domain is m.login-amazn.ath.cx.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 23rd 2022. Valid for: 3 months.
This is the only time m.login-amazn.ath.cx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 139.162.185.93 63949 (AKAMAI-AP...)
4 2600:9000:206... 16509 (AMAZON-02)
5 2
Apex Domain
Subdomains		 Transfer
4 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 774
119 KB
1 ath.cx
m.login-amazn.ath.cx
25 KB
5 2
Domain Requested by
4 images-na.ssl-images-amazon.com m.login-amazn.ath.cx
images-na.ssl-images-amazon.com
1 m.login-amazn.ath.cx
5 2

This site contains no links.

Subject Issuer Validity Valid
m.login-amazn.ath.cx
cPanel, Inc. Certification Authority		 2022-12-23 -
2023-03-23		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2022-10-26 -
2023-10-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://m.login-amazn.ath.cx/m/secure/xf/page/Login/login.php
Frame ID: 8E4934A84404D2278AD91E1B9CC83B61
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

144 kB
Transfer

441 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
m.login-amazn.ath.cx/m/secure/xf/page/Login/ 		25 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://m.login-amazn.ath.cx/m/secure/xf/page/Login/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
139.162.185.93 Frankfurt am Main, Germany, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG),
Reverse DNS
139-162-185-93.ip.linodeusercontent.com
Software
Apache /
Resource Hash
fba97d894beb7b2ff66ae90ffae37e19bb6ab4740c4dc9a478760de2a5859212

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sat, 24 Dec 2022 13:18:21 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		113 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
Requested by
Host: m.login-amazn.ath.cx
URL: https://m.login-amazn.ath.cx/m/secure/xf/page/Login/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:d000:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
02f9e4f6271092d6fa6ac1854427e1ab744a58b9b7f58a02afe29f81a914baec

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://m.login-amazn.ath.cx/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 12:23:35 GMT
content-encoding
br
via
1.1 e39402e2cf62b31f7774452c905f38f2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
4236886
edge-cache-tag
x-cache-724,/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4
x-cache
Hit from cloudfront
x-nginx-cache-status
MISS
surrogate-key
x-cache-724 /images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4
last-modified
Fri, 05 Feb 2016 03:02:58 GMT
server
Server
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
c5341358-fa5c-4fd3-94da-901fc483b266
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
0UuCgNZ5zqg1sHqJLmKXNI3pKXdtzaIINTBY23bLcBGWVvsrwHDEDA==
expires
Fri, 31 Oct 2042 12:23:35 GMT
AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		256 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js
Requested by
Host: m.login-amazn.ath.cx
URL: https://m.login-amazn.ath.cx/m/secure/xf/page/Login/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:d000:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
16aecd5524ada4c6ff3326d33ac9e3af9cfa3c1ec117de4e0f19966bf0af4b1a

Request headers

Referer
https://m.login-amazn.ath.cx/
Origin
https://m.login-amazn.ath.cx
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 06:32:23 GMT
content-encoding
br
via
1.1 14b10bd09a0531ef477d0a404ca26900.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
2270758
edge-cache-tag
x-cache-600,/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736
x-cache
Hit from cloudfront
x-nginx-cache-status
MISS
surrogate-key
x-cache-600 /images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736
last-modified
Wed, 03 Feb 2016 20:16:14 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
dbcd2e9c-38b6-4f6e-890c-430f2f696712
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
CGR1gSBkeLQsXOPe5pseZ-ypNWF4jA6qAVncbKiemdRsnhE4DuZ5Vg==
expires
Sun, 23 Nov 2042 06:32:23 GMT
AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js
Requested by
Host: m.login-amazn.ath.cx
URL: https://m.login-amazn.ath.cx/m/secure/xf/page/Login/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:d000:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
7d7566ca5de5262510d5409e340be9ab6f1e5f9730bda17a2ca1538442c01928

Request headers

Referer
https://m.login-amazn.ath.cx/
Origin
https://m.login-amazn.ath.cx
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 08:10:42 GMT
content-encoding
gzip
via
1.1 14b10bd09a0531ef477d0a404ca26900.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
1746459
edge-cache-tag
x-cache-162,/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f
x-cache
Hit from cloudfront
x-nginx-cache-status
MISS
surrogate-key
x-cache-162 /images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f
last-modified
Sat, 26 Mar 2016 01:05:52 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
5e2cd744-9c33-4b1e-a263-28a73eabdbab
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
HgWgcRG25-faRPulGd1mHmopQg2ek9ndCoc6cMI3VJlRabPAbKoBhg==
expires
Sat, 29 Nov 2042 08:10:42 GMT
AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css#AUIClients/AmazonUI.fr.rendering_engine-not-trident.secure.min
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:d000:1d:d7f6:39d2:2dc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
84ea8004fab8c9fd2911393bcc36020df3ba4f83e2762425fbe0e79653a8b3f2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 13 Nov 2022 10:11:13 GMT
via
1.1 e39402e2cf62b31f7774452c905f38f2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
3553628
edge-cache-tag
x-cache-775,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d
x-cache
Hit from cloudfront
x-nginx-cache-status
HIT
content-length
24594
surrogate-key
x-cache-775 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d
last-modified
Tue, 20 Oct 2015 02:26:17 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
910ebd23-10f3-4af1-a849-8d4ebf427851
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
13yj5XHj3igH0Es9NE-TQKF29-ndtUXdSASSReYvsKksfrlk-5dAww==
expires
Fri, 07 Nov 2042 09:53:39 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange number| ue_t0 undefined| cel_widgets object| amzn function| cf object| jQuery164028728984289723547

0 Cookies