![](/screenshots/1695dd49-ca4f-4573-bdc6-89adc5cc3866.png)
manyusoku.news.futoka.jp
Open in
urlscan Pro
103.244.44.13
Malicious Activity!
Public Scan
Effective URL: https://manyusoku.news.futoka.jp/auth/login.php?cmd=login_submit&id=c0241030ff9bb6ee9af37eec86dc2d5dc0241030ff9bb6ee9af37eec86dc2...
Submission Tags: phishing malicious Search All
Submission: On November 12 via api from JP
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 19th 2019. Valid for: 3 months.
This is the only time manyusoku.news.futoka.jp was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 15 | 103.244.44.13 103.244.44.13 | 2514 (INFOSPHER...) (INFOSPHERE NTT PC Communications) | |
1 | 54.148.84.95 54.148.84.95 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 2 | 192.186.220.3 192.186.220.3 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
16 | 3 |
ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP)
PTR: 005.futoka.jp
manyusoku.news.futoka.jp |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
www.sitepoint.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-192-186-220-3.ip.secureserver.net
csscheckbox.com | |
www.csscheckbox.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
futoka.jp
1 redirects
manyusoku.news.futoka.jp |
553 KB |
2 |
csscheckbox.com
1 redirects
csscheckbox.com www.csscheckbox.com |
1008 B |
1 |
sitepoint.com
www.sitepoint.com |
|
16 | 3 |
Domain | Requested by | |
---|---|---|
15 | manyusoku.news.futoka.jp |
1 redirects
manyusoku.news.futoka.jp
|
1 | www.csscheckbox.com |
manyusoku.news.futoka.jp
|
1 | csscheckbox.com | 1 redirects |
1 | www.sitepoint.com |
manyusoku.news.futoka.jp
|
16 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
manyusoku.news.futoka.jp cPanel, Inc. Certification Authority |
2019-09-19 - 2019-12-18 |
3 months | crt.sh |
www.sitepoint.com Let's Encrypt Authority X3 |
2019-10-28 - 2020-01-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://manyusoku.news.futoka.jp/auth/login.php?cmd=login_submit&id=c0241030ff9bb6ee9af37eec86dc2d5dc0241030ff9bb6ee9af37eec86dc2d5d&session=c0241030ff9bb6ee9af37eec86dc2d5dc0241030ff9bb6ee9af37eec86dc2d5d
Frame ID: FECD9E1F479918D482A1CDA8D1D26091
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/1695dd49-ca4f-4573-bdc6-89adc5cc3866.png)
Page URL History Show full URLs
-
https://manyusoku.news.futoka.jp/auth/
HTTP 302
https://manyusoku.news.futoka.jp/auth/login.php?cmd=login_submit&id=c0241030ff9bb6ee9af37eec86dc2d5dc0241030f... Page URL
Detected technologies
![](/vendor/wappa/icons/OpenSSL.png)
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://manyusoku.news.futoka.jp/auth/
HTTP 302
https://manyusoku.news.futoka.jp/auth/login.php?cmd=login_submit&id=c0241030ff9bb6ee9af37eec86dc2d5dc0241030ff9bb6ee9af37eec86dc2d5d&session=c0241030ff9bb6ee9af37eec86dc2d5dc0241030ff9bb6ee9af37eec86dc2d5d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 14- http://csscheckbox.com/checkboxes/u/csscheckbox_59786bddc23cad2c757a3a1253557d6a.png HTTP 301
- http://www.csscheckbox.com/checkboxes/u/csscheckbox_59786bddc23cad2c757a3a1253557d6a.png
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
manyusoku.news.futoka.jp/auth/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s1.png
manyusoku.news.futoka.jp/auth/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s2.png
manyusoku.news.futoka.jp/auth/images/ |
117 KB 118 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s3.png
manyusoku.news.futoka.jp/auth/images/ |
46 KB 46 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s4.png
manyusoku.news.futoka.jp/auth/images/ |
51 KB 51 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s5.png
manyusoku.news.futoka.jp/auth/images/ |
87 KB 88 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s6.png
manyusoku.news.futoka.jp/auth/images/ |
91 KB 91 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s7.png
manyusoku.news.futoka.jp/auth/images/ |
104 KB 104 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s9.png
manyusoku.news.futoka.jp/auth/images/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s10.png
manyusoku.news.futoka.jp/auth/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s8.png
manyusoku.news.futoka.jp/auth/images/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s11.png
manyusoku.news.futoka.jp/auth/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s12.png
manyusoku.news.futoka.jp/auth/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ssign.png
manyusoku.news.futoka.jp/auth/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csscheckbox_59786bddc23cad2c757a3a1253557d6a.png
www.csscheckbox.com/checkboxes/u/ Redirect Chain
|
414 B 708 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
csscheckbox.com
manyusoku.news.futoka.jp
www.csscheckbox.com
www.sitepoint.com
103.244.44.13
192.186.220.3
54.148.84.95
168969c96985978ea4c4e0f2d4e2bf5360c7307292d5ea67daad3f0c7ed5926c
16b30cc2727a8c55cbdd235e1ddb6d9c82d10006d23a559773c436f1d2d8c89d
2d427932f1759e3193304445e06dcb2eaeee85d72c12abebf57112a8004dc996
328191bcebe5298abc3e83461d1d44537731937f11b20adb0f807423c3fb5b4a
345b9b682be6afcba2e541ccfbc3535f3b00c75a25ee46e2368965d65ab055d6
66e256f4189e29b9f280c78929a1c8a35a936e6701dc9009481ceada01b1c920
b6d8322863b69e90640e146f542fc462a3a5a9a897809094c89d4b13317ddbee
cbb5371de2941f4aa122bc08105d59d9b4e5da97a94fe23e94c1b9dad8d11ffe
d79bb18bd471735211098117d4c753fceb9f0df6e01d005e7e6eebc53318fd12
e9455be55ab6a3daedb67efb4973b1d656a39c730900d6a04127a66054c27d13
ead6f1e57e9c12440150f50340503eb6068628a6ddb0e60ccb71c535ac736e0b
efd8c502f6361b3fd41b7d0128b88d4a12776a593c15010a3ae3dca578153386
f49796ca5ef26b7ef24ba6eaa17967c1d538b781b74c6c0c49873b974673072c
f8c7d76f80241b65e44c31c88eee03270d3d36c4ad44e7ce0523715ef4c9efe1
feab33dff58bb4967fd845bfa06975428d170abcda6d30602b62a6012003c485