xn--cck9fnc.jp - urlscan.io

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 5 HTTP transactions. The main IP is 157.112.189.52, located in Japan and belongs to XSERVER Xserver Inc., JP. The main domain is xn--cck9fnc.jp.

This is the only time xn--cck9fnc.jp was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	157.112.189.52 157.112.189.52	131965 (XSERVER X...) (XSERVER Xserver Inc.)
1	23.44.51.219 23.44.51.219	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	142.250.199.106 142.250.199.106	15169 (GOOGLE) (GOOGLE)
1 2	72.15.149.131 72.15.149.131	20161 (TRGO) (TRGO)
1	172.217.174.99 172.217.174.99	15169 (GOOGLE) (GOOGLE)
5	5

1 157.112.189.52 (Japan)

ASN131965 (XSERVER Xserver Inc., JP)
PTR: sv1051.xserver.jp

xn--cck9fnc.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.44.51.219 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-51-219.deploy.static.akamaitechnologies.com

i.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.199.106 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt13s52-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.15.149.131 (Canada) 1 redirects

ASN20161 (TRGO, CA)
PTR: node3.hosting.ca

ultracosmetics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.174.99 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s28-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ultracosmetics.com 1 redirects ultracosmetics.com	224 B
1	gstatic.com fonts.gstatic.com	12 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 43	1008 B
1	pinimg.com i.pinimg.com — Cisco Umbrella Rank: 1633	609 KB
1	xn--cck9fnc.jp xn--cck9fnc.jp	2 KB
5	5

	Domain	Requested by
2	ultracosmetics.com	1 redirects xn--cck9fnc.jp
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	xn--cck9fnc.jp
1	i.pinimg.com	xn--cck9fnc.jp
1	xn--cck9fnc.jp
5	5

This site contains no links.

Subject Issuer	Validity	Valid
i2.pinimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-05-14`	10 months	crt.sh

This page contains 1 frames:

Primary Page: http://xn--cck9fnc.jp/freedom.php
Frame ID: 7B8D2B65964160EAF3BE1A5196AC1040
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HACKED by /Rayzky_ - IndonesianPride

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

5
Requests

20 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

624 kB
Transfer

621 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://ultracosmetics.com/www.madleets.com/elhacker.cur HTTP 301
https://ultracosmetics.com/www.madleets.com/elhacker.cur

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request freedom.php Show response
xn--cck9fnc.jp/ 2 KB
2 KB 4232ms
4192ms Document
text/html 157.112.189.52
XSERVER Xserver Inc.

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--cck9fnc.jp/freedom.php
Protocol: HTTP/1.1
Server: 157.112.189.52 , Japan, ASN131965 (XSERVER Xserver Inc., JP),
Reverse DNS: sv1051.xserver.jp
Software: nginx /
Resource Hash: 7be25b78f5f10a0f3570ac7aad395fa0b91b30093727baafaeba048d0a815c33

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 16 Feb 2023 01:26:43 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Encoding-Over-Network: gzip

GET
H2 200 1a64b6478237b189d0eef10ff5f2a412.gif
i.pinimg.com/originals/1a/64/b6/ 607 KB
609 KB 916ms
155ms Image
image/gif 23.44.51.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.pinimg.com/originals/1a/64/b6/1a64b6478237b189d0eef10ff5f2a412.gif
Requested by: Host: xn--cck9fnc.jp
URL: http://xn--cck9fnc.jp/freedom.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.51.219 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-51-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 68b6316ce0b66dfafd3c7ad34df2cc79245b2d665f95ad96ccfd38447c358836

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://xn--cck9fnc.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-cdn: akamai
akamai-grn: 0.d7332c17.1676510806.8126fa1
etag: "b71b7a249b739a1e57a7324820f660c7"
vary: Origin
content-type: image/gif
cache-control: immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 621950

GET
H/1.1 200
OK css
fonts.googleapis.com/ 365 B
1008 B 597ms
282ms Stylesheet
text/css 142.250.199.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Iceland

Requested by

Host: xn--cck9fnc.jp
URL: http://xn--cck9fnc.jp/freedom.php

Protocol

HTTP/1.1

Server

142.250.199.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt13s52-in-f10.1e100.net

Software

ESF /

Resource Hash

294444de25a3e4855778411057e5abe1cdf94271df695313ca369c82d16bcb5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://xn--cck9fnc.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Thu, 16 Feb 2023 01:26:45 GMT
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
X-Content-Encoding-Over-Network: gzip
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Last-Modified: Thu, 16 Feb 2023 01:26:45 GMT
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Thu, 16 Feb 2023 01:26:45 GMT

GET
H2

404

elhacker.cur
ultracosmetics.com/www.madleets.com/
Redirect Chain

http://ultracosmetics.com/www.madleets.com/elhacker.cur
https://ultracosmetics.com/www.madleets.com/elhacker.cur

0
0

698ms
265ms

Image
text/html

72.15.149.131
TRGO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ultracosmetics.com/www.madleets.com/elhacker.cur
Requested by: Host: xn--cck9fnc.jp
URL: http://xn--cck9fnc.jp/freedom.php
Protocol: H2
Server: 72.15.149.131 , Canada, ASN20161 (TRGO, CA),
Reverse DNS: node3.hosting.ca
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://xn--cck9fnc.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Redirect headers

Location: https://ultracosmetics.com/www.madleets.com/elhacker.cur
Date: Thu, 16 Feb 2023 01:26:46 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H/1.1 200
OK rax9HiuFsdMNOnWPaKtMAQ.woff2
fonts.gstatic.com/s/iceland/v16/ 11 KB
12 KB 731ms
417ms Font
font/woff2 172.217.174.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/iceland/v16/rax9HiuFsdMNOnWPaKtMAQ.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Iceland

Protocol

HTTP/1.1

Server

172.217.174.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s28-in-f3.1e100.net

Software

sffe /

Resource Hash

d07a894337a83ac4df03d593c8fe94197a4e73f8b27c10229fd00d816d58e1c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://xn--cck9fnc.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Thu, 16 Feb 2023 00:52:23 GMT
X-Content-Type-Options: nosniff
Age: 2063
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 11576
X-XSS-Protection: 0
Last-Modified: Tue, 26 Apr 2022 15:47:43 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Fri, 16 Feb 2024 00:52:23 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ultracosmetics.com/www.madleets.com/elhacker.cur Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
i.pinimg.com
ultracosmetics.com
xn--cck9fnc.jp
142.250.199.106
157.112.189.52
172.217.174.99
23.44.51.219
72.15.149.131
294444de25a3e4855778411057e5abe1cdf94271df695313ca369c82d16bcb5b
68b6316ce0b66dfafd3c7ad34df2cc79245b2d665f95ad96ccfd38447c358836
7be25b78f5f10a0f3570ac7aad395fa0b91b30093727baafaeba048d0a815c33
d07a894337a83ac4df03d593c8fe94197a4e73f8b27c10229fd00d816d58e1c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

xn--cck9fnc.jp Open in urlscan Pro Puny アマン.jp IDN 157.112.189.52 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

20 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

624 kBTransfer

621 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

xn--cck9fnc.jp Open in urlscan Pro Puny
アマン.jp IDN
157.112.189.52 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

624 kB
Transfer

621 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions