![](/screenshots/3d1aa0dd-8449-440b-b10a-061d17bf8e08.png)
bk.mufgg.ip.zchaoyun.net.cn
Open in
urlscan Pro
100.42.64.87
Malicious Activity!
Public Scan
Submission Tags: krdtest
Submission: On November 14 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on November 13th 2021. Valid for: 3 months.
This is the only time bk.mufgg.ip.zchaoyun.net.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: SMBC (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 100.42.64.87 100.42.64.87 | 35916 (MULTA-ASN1) (MULTA-ASN1) | |
12 | 1 |
ASN35916 (MULTA-ASN1, US)
PTR: 87-64-42-100-dedicated.multacom.com
bk.mufgg.ip.zchaoyun.net.cn |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
zchaoyun.net.cn
bk.mufgg.ip.zchaoyun.net.cn |
127 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
12 | bk.mufgg.ip.zchaoyun.net.cn |
bk.mufgg.ip.zchaoyun.net.cn
|
12 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
smbcc.co.jjp.edenproductions.net R3 |
2021-11-13 - 2022-02-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bk.mufgg.ip.zchaoyun.net.cn/
Frame ID: 458DA18ED4172E8A9C72F7235E4E30AD
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bk.mufgg.ip.zchaoyun.net.cn/ |
527 B 680 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.28ae9aea.css
bk.mufgg.ip.zchaoyun.net.cn/css/ |
230 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime.706dc4e7.js
bk.mufgg.ip.zchaoyun.net.cn/js/ |
1 KB 969 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.d2f202e3.js
bk.mufgg.ip.zchaoyun.net.cn/js/ |
142 KB 56 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.3fef9f6e.js
bk.mufgg.ip.zchaoyun.net.cn/js/ |
54 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
jump.php
bk.mufgg.ip.zchaoyun.net.cn/api/ |
2 B 371 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api_session.php
bk.mufgg.ip.zchaoyun.net.cn/api/ |
79 B 401 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_smbc_01.jpg
bk.mufgg.ip.zchaoyun.net.cn/appimg/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_06.svg
bk.mufgg.ip.zchaoyun.net.cn/appimg/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jian.png
bk.mufgg.ip.zchaoyun.net.cn/appimg/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wens.svg
bk.mufgg.ip.zchaoyun.net.cn/appimg/ |
526 B 682 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wn.svg
bk.mufgg.ip.zchaoyun.net.cn/appimg/ |
914 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: SMBC (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| webpackJsonp object| __core-js_shared__ object| core string| type1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bk.mufgg.ip.zchaoyun.net.cn/ | Name: PHPSESSID Value: 0t118dfdmobcn0r3t17jn8aa15 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bk.mufgg.ip.zchaoyun.net.cn
100.42.64.87
20540e0e3298f8a73bc997d2895ad49d0e50008a680a5176c3ee498b9e29ff0d
34e169addd9fe376397a67c36c8444a443f8f91acc728727863d8082bcf3b5b5
4a4d612690b81c73b7e5b1b268bed2399d3d467afc42400a17340fbdf26edc73
53bd7d553126ab0099e139d5eae6b850fbbcbcbdb2fbb582dcb8570a2cba5541
6bd298af3a58263b7f307c721069ff7a94f653f036eec771559994c00d2056a6
794a8451958635ae295689499311a6208eff440ace9b1118ea4b7555b672aa85
82561c4d954eeb9c40332de1983bfea2771fbc87ce29094355a3d50fa6f308ed
886a4a9ebb0c7fb1cc5299704235a1a9efdc00a05fd8b6927cbb5a59825a778c
ab9f1c5cebe7a862c4f119a4eeabb1c317bb8588c5058693f5d367f77d365594
d8463bd3ba4b10e5916f65fa7b0c1f9f91f67ca40cc25b48810fb2f5a3340488
e208b3c301aa4d97bc0edbb7fb9bc9cad74dc3e6910c2f262ac7c18b03af6b25
fe6087d46d69df81084ced7fdc06ccc9685e04f27421c20ac2b9060eaa0f8104