URL: https://88yh628.com/
Submission: On March 06 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 164.155.129.72, located in Chicago, United States and belongs to PEG-SV, US. The main domain is 88yh628.com.
TLS certificate: Issued by R3 on March 3rd 2024. Valid for: 3 months.
This is the only time 88yh628.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: National Tax Agency Japan (Government)

Domain & IP information

IP Address AS Autonomous System
10 164.155.129.72 54600 (PEG-SV)
1 2600:9000:223... 16509 (AMAZON-02)
12 3
Apex Domain
Subdomains
Transfer
10 88yh628.com
88yh628.com
651 KB
1 nta.go.jp
www.nta.go.jp
35 KB
0 Failed
function sub() { [native code] }. Failed
12 3
Domain Requested by
10 88yh628.com 88yh628.com
1 www.nta.go.jp 88yh628.com
0 localhost Failed 88yh628.com
12 3

This site contains no links.

Subject Issuer Validity Valid
88yh628.com
R3
2024-03-03 -
2024-06-01
3 months crt.sh
www.nta.go.jp
GlobalSign RSA OV SSL CA 2018
2023-03-28 -
2024-04-28
a year crt.sh

This page contains 1 frames:

Frame: http://localhost/
Frame ID: 1B14E30721F977F9D1B0923712970E5A
Requests: 14 HTTP requests in this frame

Screenshot


Page Statistics

12
Requests

92 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

686 kB
Transfer

685 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
88yh628.com/
445 B
576 B
Document
General
Full URL
https://88yh628.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
2ac393984efc23de8995240f8af7c35fe838530be54df18ca8671e3be1fa3671

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
445
content-type
text/html
date
Wed, 06 Mar 2024 17:26:48 GMT
etag
W/"445-1709459564779"
last-modified
Sun, 03 Mar 2024 09:52:44 GMT
server
Apache
vary
Accept-Encoding
chunk-vendors.1e021234.js
88yh628.com/static/js/
173 KB
175 KB
Script
General
Full URL
https://88yh628.com/static/js/chunk-vendors.1e021234.js
Requested by
Host: 88yh628.com
URL: https://88yh628.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
de8db2dcd14ab18d3ea6e0a23c9d9fe1f96d7c7a825d7f486f1feaa747832bd5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:48 GMT
last-modified
Sun, 03 Mar 2024 09:52:53 GMT
server
Apache
etag
W/"177520-1709459573788"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
177520
app.22ec2b5c.js
88yh628.com/static/js/
5 KB
5 KB
Script
General
Full URL
https://88yh628.com/static/js/app.22ec2b5c.js
Requested by
Host: 88yh628.com
URL: https://88yh628.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
11c95af08363636b17706ab5c34ca85040b66d1e0281eedd6f6b70e5027caaa0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:48 GMT
last-modified
Sun, 03 Mar 2024 09:52:53 GMT
server
Apache
etag
W/"5507-1709459573400"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
5507
498.1d5c722f.js
88yh628.com/static/js/
105 KB
105 KB
Script
General
Full URL
https://88yh628.com/static/js/498.1d5c722f.js
Requested by
Host: 88yh628.com
URL: https://88yh628.com/static/js/app.22ec2b5c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
a78cbbe0e3dfb0d9228b14262c1433ea5c96ca7b8f39ba8414ec68a8a4a39cfb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
last-modified
Sun, 03 Mar 2024 09:52:52 GMT
server
Apache
etag
W/"107008-1709459572454"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
107008
327.be3488dd.js
88yh628.com/static/js/
34 KB
35 KB
Script
General
Full URL
https://88yh628.com/static/js/327.be3488dd.js
Requested by
Host: 88yh628.com
URL: https://88yh628.com/static/js/app.22ec2b5c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
db128c2be46af018b217047aeec2289ddd520bffc67e1c72e1e41d98487fafa1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
last-modified
Sun, 03 Mar 2024 09:52:51 GMT
server
Apache
etag
W/"35163-1709459571457"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
35163
269.061847c4.css
88yh628.com/static/css/
4 KB
5 KB
Stylesheet
General
Full URL
https://88yh628.com/static/css/269.061847c4.css
Requested by
Host: 88yh628.com
URL: https://88yh628.com/static/js/app.22ec2b5c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
0c1b1c1de7a40d97b3b50a57f60b24f13baf1da94ff20d00b187c482d471413f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
last-modified
Sun, 03 Mar 2024 09:52:45 GMT
server
Apache
etag
W/"4549-1709459565093"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
4549
269.69457140.js
88yh628.com/static/js/
6 KB
6 KB
Script
General
Full URL
https://88yh628.com/static/js/269.69457140.js
Requested by
Host: 88yh628.com
URL: https://88yh628.com/static/js/app.22ec2b5c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
a76b0d1e48fa59cccdf370dc3e09cc502d9bfcaa384a2963c63d20fb6bca82b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
last-modified
Sun, 03 Mar 2024 09:52:50 GMT
server
Apache
etag
W/"6025-1709459570833"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
6025
pageServlet
88yh628.com/api/
2 B
97 B
XHR
General
Full URL
https://88yh628.com/api/pageServlet?pageid=0
Requested by
Host: 88yh628.com
URL: https://88yh628.com/static/js/327.be3488dd.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Accept
application/json, text/plain, */*
Referer
https://88yh628.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
server
Apache
content-length
2
content-type
text/html;charset=UTF-8
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bf1532dfb899554f52b0a98c2870c9a6f19e6abaf74288c6de321813fed91666

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
image/png
banner.d26188eb.png
88yh628.com/static/img/
216 KB
217 KB
Image
General
Full URL
https://88yh628.com/static/img/banner.d26188eb.png
Requested by
Host: 88yh628.com
URL: https://88yh628.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
2fe3b5cadeb4ad9fec7ee39d1f2170c6bb656436597087aa9a582713e53bed75

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
last-modified
Sun, 03 Mar 2024 09:52:48 GMT
server
Apache
accept-ranges
bytes
etag
W/"220877-1709459568499"
content-length
220877
content-type
image/png
index.8f077469.png
88yh628.com/static/img/
102 KB
102 KB
Image
General
Full URL
https://88yh628.com/static/img/index.8f077469.png
Requested by
Host: 88yh628.com
URL: https://88yh628.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
164.155.129.72 Chicago, United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software
Apache /
Resource Hash
c0315642042bbc5f62714e1bf1ee5df4fd567a38745af3c67ff09b025a56efbb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:49 GMT
last-modified
Sun, 03 Mar 2024 09:52:49 GMT
server
Apache
accept-ranges
bytes
etag
W/"104029-1709459569539"
content-length
104029
content-type
image/png
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5aa0964ac2cb5cbb5823d166f55495ac12747f3fbf2b56f7d290ac161eb2aead

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
image/png
headerbackground.jpg
www.nta.go.jp/template/img/template/
35 KB
35 KB
Image
General
Full URL
https://www.nta.go.jp/template/img/template/headerbackground.jpg
Requested by
Host: 88yh628.com
URL: https://88yh628.com/static/css/269.061847c4.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:e200:5:58c5:3300:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
d299b3eea8c890a7c5160a9633470c8973b6bfb19cdd4ccd38e3b78a2558a545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://88yh628.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 17:26:48 GMT
via
1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA56-P3
age
176
x-cache
Hit from cloudfront
content-length
35682
x-xss-protection
1; mode=block
last-modified
Mon, 06 Feb 2023 01:00:37 GMT
server
Apache
etag
"8b62-5f3fd8f2a16e8"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/jpeg
accept-ranges
bytes
x-amz-cf-id
-VHLONPNV6pUnpN8vv2AllWFIqtLacMXrL1scLpvm-l8-iHrtHEOsA==
/
localhost/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
localhost
URL
http://localhost/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: National Tax Agency Japan (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
88yh628.com/ Name: JSESSIONID
Value: 932DB6751A982BB073C364369994E6F9