Scan report · 19 days agoPublic

vnatf.gmy59.com

47.245.4.14AS45102 · US

Submittedhttps://vnatf.gmy59.com/

Landed onhttps://www.amazon.co.jp/· 1 redirect

Suspicious: the page presents itself as Amazon and wears the brand's name in a host the brand does not own (amazon.co.jp)

Engine tags

Verdict

3 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 4.1 s · 412 requests

01 · Visitor opensvnatf.gmy59.com

02 · Redirected · 1 hopwww.amazon.co.jp

03 · Page shown

Amazon.co.jp | Books, Apparel, Electronics, Groceries & morestyled as Amazon · high

04 · OutcomeCredential phishingA login page wearing a brand it does not own.

Dangerous — confirmed threat

Automated

It presents itself as Amazon while being hosted somewhere Amazon does not own. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

a07718f7-01b5-4855-a8c2-5155fb8077bd.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 317ce49b49cb29da0d77a69f85d6de9bffb05f8939884c9b14d73bcf059c5de1

SupportingBrand impersonation detected

Amazon · high

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteHigh confidence: the host wears the brand's name and the brand does not own it.

InfoCross-domain scripts injected at runtime

13 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 47.245.4.14ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN · AS45102US
TLS: CN=YE2, O=Let's Encrypt, C=US · expires Dec 11, 2026
Redirects: 1 hop · / → /

WHOIS

Registrar: Vantage of Convergence (Chengdu) Technology Co., Ltd.
Created: Nov 18, 2025
Expires: Nov 18, 2026
Nameservers: drew.ns.cloudflare.commartha.ns.cloudflare.com

26 malicious25 suspicious

Hashes & fingerprints

Page Hasha987e9d58467bd99ddfb40d6f6bdc520f404c32550833bfd422a2cd6019614e4 Favicon Hash5866636f18764cd66366ae6eb682e972b4eae1771512cd76b304b6dd3c0f1d2d DOM Hasha6ec67d813be02a18e29ee96999bbeccae21d709986387ebb00ce9a781ff87f2 Screenshot pHashf21f8dc4a53352a3 JARM40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintB2FB73FED91D508A280CD51C9ED800943F0C089B Cert IssuerCN=YE2, O=Let's Encrypt, C=US

Page capture

Live

Title “Amazon.co.jp | Books, Apparel, Electronics, Groceries & more” · brand shown: Amazon (high)

Visit Site

Engines

7 · time to verdict