Domain > zhangetn-tea.publisher-portal.cdb.ads.amazon.dev

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2025-08-25	3.171.38.91 (ClassC)
2025-11-15	3.169.173.60 (ClassC)

HTTP/1.1 403 ForbiddenContent-Type: text/htmlContent-Length: 8087Connection: keep-aliveLast-Modified: Wed, 05 Nov 2025 15:53:49 GMTx-amz-server-side-encryption: AES256x-amz-version-id: nzbCZAtqS741efCFIy0MSABZ8L_kLxRmAccept-Ranges: bytesServer: AmazonS3Date: Sat, 15 Nov 2025 02:06:50 GMTETag: 780345729092e738a8264fa1ecec50b3X-Cache: Error from cloudfrontVia: 1.1 6957b6fac4a3f8180355a074ea5833e2.cloudfront.net (CloudFront)X-Amz-Cf-Pop: HIO52-P4X-Amz-Cf-Id: 5luMl11S-0FmJ758iwBh8EwiWDy9t9bruqvQC8GbKnyB5UyyrBkgcwX-XSS-Protection: 1; modeblockX-Frame-Options: SAMEORIGINReferrer-Policy: strict-origin-when-cross-originX-Content-Type-Options: nosniffStrict-Transport-Security: max-age31536000

!DOCTYPE html>html>head>    script typetext/javascript>        function getParameterByName(name, url) {            if (!url) url  window.location.href;            name  name.replace(/\\/g, \\$&);            var regex  new RegExp(?& + name + ((^&#*)|&|#|$)),                results  regex.exec(url);            if (!results) return null;            if (!results2) return ;            return decodeURIComponent(results2.replace(/\+/g,  ));        }        function getValidURL(url) {            try {                return new URL(url);            } catch (e) {                return null;            }        }        /*! js-cookie v3.0.4 | MIT */        ;        (function (global, factory) {          typeof exports  object && typeof module ! undefined ? module.exports  factory() :          typeof define  function && define.amd ? define(factory) :          (global  typeof globalThis ! undefined ? globalThis : global || self, (function () {            var current  global.Cookies;            var exports  global.Cookies  factory();            exports.noConflict  function () { global.Cookies  current; return exports; };          })());        })(this, (function () { use strict;                  /* eslint-disable no-var */          function assign (target) {            for (var i  1; i  arguments.length; i++) {              var source  argumentsi;              for (var key in source) {                targetkey  sourcekey;              }            }            return target          }          /* eslint-enable no-var */                  /* eslint-disable no-var */          var defaultConverter  {            read: function (value) {              if (value0  ) {                value  value.slice(1, -1);              }              return value.replace(/(%\dA-F{2})+/gi, decodeURIComponent)            },            write: function (value) {              return encodeURIComponent(value).replace(                /%(2346BF|3AC-F|40|5BDE|60|7BCD)/g,                decodeURIComponent              )            }          };          /* eslint-enable no-var */                  /* eslint-disable no-var */                  function init (converter, defaultAttributes) {            function set (name, value, attributes) {              if (typeof document  undefined) {                return              }                      attributes  assign({}, defaultAttributes, attributes);                      if (typeof attributes.expires  number) {                attributes.expires  new Date(Date.now() + attributes.expires * 864e5);              }              if (attributes.expires) {                attributes.expires  attributes.expires.toUTCString();              }                      name  encodeURIComponent(name)                .replace(/%(2346B|5E|60|7C)/g, decodeURIComponent)                .replace(/()/g, escape);                      var stringifiedAttributes  ;              for (var attributeName in attributes) {                if (!attributesattributeName) {                  continue                }                        stringifiedAttributes + ;  + attributeName;                        if (attributesattributeName  true) {                  continue                }                        // Considers RFC 6265 section 5.2:                // ...                // 3.  If the remaining unparsed-attributes contains a %x3B (;)                //     character:                // Consume the characters of the unparsed-attributes up to,                // not including, the first %x3B (;) character.                // ...                stringifiedAttributes +  + attributesattributeName.split(;)0;              }                      return (document.cookie                 name +  + converter.write(value, name) + stringifiedAttributes)            }                    function get (name) {              if (typeof document  undefined || (arguments.length && !name)) {                return              }                      // To prevent the for loop in the first place assign an empty array              // in case there are no cookies at all.              var cookies  document.cookie ? document.cookie.split(; ) : ;              var jar  {};              for (var i  0; i  cookies.length; i++) {                var parts  cookiesi.split();                var value  parts.slice(1).join();                        try {                  var found  decodeURIComponent(parts0);                  jarfound  converter.read(value, found);                          if (name  found) {                    break                  }                } catch (e) {}              }                      return name ? jarname : jar            }                    return Object.create(              {                set,                get,                remove: function (name, attributes) {                  set(                    name,                    ,                    assign({}, attributes, {                      expires: -1                    })                  );                },                withAttributes: function (attributes) {                  return init(this.converter, assign({}, this.attributes, attributes))                },                withConverter: function (converter) {                  return init(assign({}, this.converter, converter), this.attributes)                }              },              {                attributes: { value: Object.freeze(defaultAttributes) },                converter: { value: Object.freeze(converter) }              }            )          }                  var api  init(defaultConverter, { path: / });          /* eslint-enable no-var */                  return api;                }));        var policy  getParameterByName(policy);        var kpid  getParameterByName(kpid);        var exp  getParameterByName(exp);        var sig  getParameterByName(sig);        var encodedTargetUrl  getParameterByName(encodedTargetUrl);        var decodedTargetUrl  encodedTargetUrl && decodeURIComponent(encodedTargetUrl);        var validTargetURL  getValidURL(decodedTargetUrl)        var referrer  window.location.href.split(#)0;        var encodedUrl  encodeURIComponent(referrer);        var hash  window.location.hash;        if (policy && kpid && exp && sig) {            var curr_origin  window.location.origin;            Cookies.set(CloudFront-Policy, policy, { secure: true, sameSite: Lax, expires: 1 });            Cookies.set(CloudFront-Key-Pair-Id, kpid, { secure: true, sameSite: Lax, expires: 1 });            Cookies.set(CloudFront-Expiration, exp, { secure: true, sameSite: Lax, expires: 1 });            Cookies.set(CloudFront-Signature, sig, { secure: true, sameSite: Lax, expires: 1 });            if(validTargetURL && curr_origin  validTargetURL.origin) {                window.location.replace(decodedTargetUrl + hash);            } else {                window.location.replace(curr_origin + hash);            }        } else if (Cookies.get(CloudFront-Policy)) {            //Try to re-sign cookies            setTimeout(() > {              window.location.replace(https://cloudfrontsigner.ninjas.security.a2z.com/sign?encodedTargetUrl + encodedUrl + hash);            }, 1000);        } else {            window.location.replace(https://cloudfrontsigner.ninjas.security.a2z.com/sign?encodedTargetUrl + encodedUrl + hash);        }    /script>/head>body>p>Redirecting you for Auth/p>!-- This one should be a Bindle that doesnt exist, and triggers a 400 response from ECS. -->div styledisplay:none idbindlediv>amzn1.bindle.resource.ltykzsbtirtbz7u6izxq/div>div styledisplay:none idsecretArn>/div>/body>/html>

Subdomains

Date	Domain	IP
us-east-1.prod.api.cdb.ads.amazon.dev	2024-07-14	3.163.24.10
eu-west-1.prod.api.cdb.ads.amazon.dev	2023-12-09	99.84.66.32
us-east-1.dev-domchan.visualization.api.cdb.ads.amazon.dev	2024-08-20	44.215.10.128
zhangetn-tea.publisher-portal.cdb.ads.amazon.dev	2025-11-15	3.169.173.60

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > zhangetn-tea.publisher-portal.cdb.ads.amazon.dev

Is this malicious?

DNS Resolutions

Port 80

Port 443

Subdomains