118.107.43.158 Open in urlscan Pro
118.107.43.158 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://118.107.43.158/
Submission: On December 08 via automatic, source openphish (December 8th 2022, 1:32:01 am UTC) — Scanned from DE

Summary HTTP 10 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 0 domains to perform 10 HTTP transactions. The main IP is 118.107.43.158, located in Singapore and belongs to BCPL-SG BGPNET Global ASN, SG. The main domain is 118.107.43.158.

This is the only time 118.107.43.158 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	118.107.43.158 118.107.43.158		64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN)
10	2

10 118.107.43.158 (Singapore)

ASN64050 (BCPL-SG BGPNET Global ASN, SG)

118.107.43.158	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	0

	Domain	Requested by
10	0

This site contains links to these domains. Also see Links.

Domain
www.amazon.co.jp

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://118.107.43.158/
Frame ID: 75B88021CEED83C2C63A91362A5F9F88
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazonサインイン

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

914 kB
Transfer

4697 kB
Size

2
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.co.jp/ref=ap_frn_logo

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/gp/help/customer/display.html/ref=ap_signin_notification_condition_of_use?ie=UTF8&nodeId=643006
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/gp/help/customer/display.html/ref=ap_signin_notification_privacy_notice?ie=UTF8&nodeId=643000
Title: プライバシー規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=jpflex&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2Fref%3Dnav_em_hd_re_signin&prevRID=95YJHC51TTZ9XPG0XS1H&openid.assoc_handle=jpflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&ref_=nav_em_hd_clc_signin&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: パスワードを忘れた場合

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/gp/help/customer/account-issues/ref=ap_login_with_otp_claim_collection?ie=UTF8
Title: その他のログインに関する問題

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=jpflex&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2Fref%3Dnav_em_hd_re_signin&prevRID=95YJHC51TTZ9XPG0XS1H&openid.assoc_handle=jpflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&ref_=nav_em_hd_clc_signin&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Amazonアカウントを作成

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/gp/help/customer/display.html/ref=ap_desktop_footer_cou?ie=UTF8&nodeId=643006
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/gp/help/customer/display.html/ref=ap_desktop_footer_privacy_notice?ie=UTF8&nodeId=643000
Title: プライバシー規約

Search URL Search Domain Scan URL

URL: https://www.amazon.co.jp/help
Title: ヘルプ

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 118.107.43.158/	592 B 823 B	619ms 310ms	Document text/html	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/ Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `be85666270e0c2d16585cbdd0dd8f133294a7a3b233966e8d088b42268b23d00` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 592 Content-Type text/html Date Thu, 08 Dec 2022 01:31:52 GMT ETag "638ff3cb-250" Last-Modified Wed, 07 Dec 2022 02:00:43 GMT Server nginx
GET H/1.1	200 OK	app.752839d3f58c010ecc04f48dcc063497.css 118.107.43.158/static/css/	4 MB 762 KB	317ms 315ms	Stylesheet text/css	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/static/css/app.752839d3f58c010ecc04f48dcc063497.css Requested by Host: 118.107.43.158 URL: http://118.107.43.158/ Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `e6be99ea2c533ddca872535bb6fbc4d45ad36b5e3f6c24e133bf1e45b003ce26` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:53 GMT Content-Encoding gzip Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag W/"638ff393-420568" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Connection keep-alive
GET H/1.1	200 OK	manifest.dd091f32d078ce1ae228.js Show response 118.107.43.158/static/js/	3 KB 1 KB	330ms 328ms	Script application/javascript	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/static/js/manifest.dd091f32d078ce1ae228.js Requested by Host: 118.107.43.158 URL: http://118.107.43.158/ Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `a5bab864ab0e14481ef4ea552894e4a4b4bc2568ed6d38d0e1ce5b25b065ac24` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:53 GMT Content-Encoding gzip Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag W/"638ff393-aad" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Connection keep-alive
GET H/1.1	200 OK	vendor.8942a87b5a70d06cf6ea.js Show response 118.107.43.158/static/js/	417 KB 116 KB	602ms 301ms	Script application/javascript	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/static/js/vendor.8942a87b5a70d06cf6ea.js Requested by Host: 118.107.43.158 URL: http://118.107.43.158/ Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `8533c320d28d6f1d592e92f214df3c599fbdd08aac941d24ae41fb85a30514c1` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:53 GMT Content-Encoding gzip Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag W/"638ff393-68375" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Connection keep-alive
GET H/1.1	200 OK	app.75f405b5d5d325e145c9.js Show response 118.107.43.158/static/js/	11 KB 3 KB	614ms 313ms	Script application/javascript	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/static/js/app.75f405b5d5d325e145c9.js Requested by Host: 118.107.43.158 URL: http://118.107.43.158/ Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `a62e508cfe383d2bd5bc08b4c5c7859ceb3ea69179515435040b2e0327225868` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:53 GMT Content-Encoding gzip Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag W/"638ff393-2c5f" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Connection keep-alive
GET H/1.1	200 OK	8.67434be2e9f5b166bccc.js Show response 118.107.43.158/static/js/	1 KB 921 B	310ms 310ms	Script application/javascript	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/static/js/8.67434be2e9f5b166bccc.js Requested by Host: 118.107.43.158 URL: http://118.107.43.158/static/js/manifest.dd091f32d078ce1ae228.js Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `683d71199357e8cbf7d0662a210bc1983edea658d45e1198c30c81cf8fea83de` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:57 GMT Content-Encoding gzip Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag W/"638ff393-515" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Connection keep-alive
GET H/1.1	200 OK	jump.php Show response 118.107.43.158/api/	2 B 623 B	815ms 815ms	XHR text/html	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/api/jump.php Requested by Host: 118.107.43.158 URL: http://118.107.43.158/static/js/vendor.8942a87b5a70d06cf6ea.js Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / PHP/5.4.45 Resource Hash `d8463bd3ba4b10e5916f65fa7b0c1f9f91f67ca40cc25b48810fb2f5a3340488` Request headers Accept application/json, text/plain, / Referer http://118.107.43.158/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Pragma no-cache Date Thu, 08 Dec 2022 01:31:57 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/5.4.45 Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/html;charset=utf-8 Access-Control-Allow-Origin * Access-Control-Allow-Methods * Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Access-Control-Allow-Credentials true Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	11.8b1570ce205b9a0d5ecb.js Show response 118.107.43.158/static/js/	10 KB 3 KB	311ms 310ms	Script application/javascript	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/static/js/11.8b1570ce205b9a0d5ecb.js Requested by Host: 118.107.43.158 URL: http://118.107.43.158/static/js/manifest.dd091f32d078ce1ae228.js Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `d6265261c26dfd2ef33b0ab4e87c26ba44fc55553b76c0a95914404ab75a53ce` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:58 GMT Content-Encoding gzip Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag W/"638ff393-279f" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Connection keep-alive
GET H/1.1	200 OK	api_session.php Show response 118.107.43.158/api/	89 B 648 B	320ms 320ms	XHR text/html	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL http://118.107.43.158/api/api_session.php Requested by Host: 118.107.43.158 URL: http://118.107.43.158/static/js/vendor.8942a87b5a70d06cf6ea.js Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / PHP/5.4.45 Resource Hash `65759f3352574f3b4b99f95d046cd34bf563d4f2cffc130ec4678caab8721c6c` Request headers Accept application/json, text/plain, / Referer http://118.107.43.158/ap/signin/openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.co.jp%2F%3Fref_%3Dnav_ya_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=jpflex&openid.mode=checkid_setup&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&1 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Pragma no-cache Date Thu, 08 Dec 2022 01:31:58 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/5.4.45 Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/html;charset=utf-8 Access-Control-Allow-Origin * Access-Control-Allow-Methods POST Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Access-Control-Allow-Credentials true Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.6a23b50.png 118.107.43.158/static/img/	26 KB 26 KB	295ms 295ms	Image image/png	118.107.43.158 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL http://118.107.43.158/static/img/AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.6a23b50.png Requested by Host: 118.107.43.158 URL: http://118.107.43.158/static/css/app.752839d3f58c010ecc04f48dcc063497.css Protocol HTTP/1.1 Server 118.107.43.158 , Singapore, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software nginx / Resource Hash `e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/static/css/app.752839d3f58c010ecc04f48dcc063497.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Date Thu, 08 Dec 2022 01:31:58 GMT Last-Modified Wed, 07 Dec 2022 01:59:47 GMT Server nginx ETag "638ff393-6607" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 26119
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483` Request headers accept-language de-DE,de;q=0.9 Referer http://118.107.43.158/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			118.107.43.158/	1969-12-31 23:59:59	Name: ZDEDebuggerPresent Value: php,phtml,php3
			118.107.43.158/	1969-12-31 23:59:59	Name: PHPSESSID Value: c4j3bbtg6gj24sl4ih9cdqh4l4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

118.107.43.158
65759f3352574f3b4b99f95d046cd34bf563d4f2cffc130ec4678caab8721c6c
683d71199357e8cbf7d0662a210bc1983edea658d45e1198c30c81cf8fea83de
8533c320d28d6f1d592e92f214df3c599fbdd08aac941d24ae41fb85a30514c1
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
a5bab864ab0e14481ef4ea552894e4a4b4bc2568ed6d38d0e1ce5b25b065ac24
a62e508cfe383d2bd5bc08b4c5c7859ceb3ea69179515435040b2e0327225868
be85666270e0c2d16585cbdd0dd8f133294a7a3b233966e8d088b42268b23d00
d6265261c26dfd2ef33b0ab4e87c26ba44fc55553b76c0a95914404ab75a53ce
d8463bd3ba4b10e5916f65fa7b0c1f9f91f67ca40cc25b48810fb2f5a3340488
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e6be99ea2c533ddca872535bb6fbc4d45ad36b5e3f6c24e133bf1e45b003ce26

118.107.43.158 Open in urlscan Pro 118.107.43.158 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

2 IPs

1 Countries

914 kBTransfer

4697 kBSize

2 Cookies

9 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

2 Cookies

Indicators

118.107.43.158 Open in urlscan Pro
118.107.43.158 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

914 kB
Transfer

4697 kB
Size

2
Cookies

10 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!