yvniasyfasd.zzux.com Open in urlscan Pro
45.156.27.249 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://white-snow-bcd4.os6h0h6e.workers.dev/
Effective URL:
https://yvniasyfasd.zzux.com/index.php?t=281bcc85e489facdf7de29c788917e509bf445dc1ecdc77322840dd49df8729a
Submission Tags: phishing amazon Search All
Submission: On March 21 via api (March 21st 2023, 11:32:26 pm UTC) from JP — Scanned from JP

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 45.156.27.249, located in Russian Federation and belongs to CLOUDBACKBONE, HK. The main domain is yvniasyfasd.zzux.com.
TLS certificate: Issued by R3 on March 21st 2023. Valid for: 3 months.

This is the only time yvniasyfasd.zzux.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3037::6815:ffb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	45.156.27.249 45.156.27.249	56971 (CLOUDBACK...) (CLOUDBACKBONE)
4	2

1 2606:4700:3037::6815:ffb (United States)

ASN13335 (CLOUDFLARENET, US)

white-snow-bcd4.os6h0h6e.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 45.156.27.249 (Russian Federation)

ASN56971 (CLOUDBACKBONE, HK)

yvniasyfasd.zzux.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	zzux.com yvniasyfasd.zzux.com	3 KB
1	workers.dev white-snow-bcd4.os6h0h6e.workers.dev	544 B
4	2

	Domain	Requested by
3	yvniasyfasd.zzux.com	white-snow-bcd4.os6h0h6e.workers.dev yvniasyfasd.zzux.com
1	white-snow-bcd4.os6h0h6e.workers.dev
4	2

This site contains no links.

Subject Issuer	Validity	Valid
*.os6h0h6e.workers.dev GTS CA 1P5	`2023-03-19` - `2023-06-17`	3 months	crt.sh
pasnfuit.jungleheart.com R3	`2023-03-21` - `2023-06-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://yvniasyfasd.zzux.com/index.php?t=281bcc85e489facdf7de29c788917e509bf445dc1ecdc77322840dd49df8729a
Frame ID: B9151D17EE3527B4B2D07A91BC64CA03
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://white-snow-bcd4.os6h0h6e.workers.dev/ Page URL
https://yvniasyfasd.zzux.com/ Page URL
https://yvniasyfasd.zzux.com/index.php?t=281bcc85e489facdf7de29c788917e509bf445dc1ecdc77322840dd49df8729a Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4 kB
Transfer

6 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://white-snow-bcd4.os6h0h6e.workers.dev/ Page URL
https://yvniasyfasd.zzux.com/ Page URL
https://yvniasyfasd.zzux.com/index.php?t=281bcc85e489facdf7de29c788917e509bf445dc1ecdc77322840dd49df8729a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ white-snow-bcd4.os6h0h6e.workers.dev/	68 B 544 B	553ms 531ms	Document text/html	2606:4700:3037::6815:ffb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://white-snow-bcd4.os6h0h6e.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:ffb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-ray 7ab9fe3cb8d68095-NRT content-encoding br content-type text/html;charset=UTF-8 date Tue, 21 Mar 2023 23:32:16 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yrw3cAGlcI8MoYOE3seazx8ij1gIlm8Lz14g13cijc7x%2Bxy4%2FYdzfmRJvSv4ThfjluXvnKkURfHp4Xb0DxqgYvSLZJZAXe3Pm22xCtm7sS476nsh0oG6c73SGWv6RUXBKTsZArtOaxrnemi8r0tJM7DXJwQ7e%2FB0oX5GS11tx%2B%2B6Iis%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	/ Show response yvniasyfasd.zzux.com/	1 KB 1017 B	1005ms 286ms	Document text/html	45.156.27.249 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://yvniasyfasd.zzux.com/ Requested by Host: white-snow-bcd4.os6h0h6e.workers.dev URL: https://white-snow-bcd4.os6h0h6e.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.156.27.249 , Russian Federation, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software Apache / Resource Hash `6a62062b8ec46c18c707e6436028a998c802cda0caf6896b8f83319ef4c95c5d` Request headers Referer https://white-snow-bcd4.os6h0h6e.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 596 content-type text/html; charset=UTF-8 date Tue, 21 Mar 2023 23:32:16 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding
GET H2	200	vendor.23238u92u82.js Show response yvniasyfasd.zzux.com/vendor/	5 KB 2 KB	282ms 282ms	Script application/javascript	45.156.27.249 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://yvniasyfasd.zzux.com/vendor/vendor.23238u92u82.js Requested by Host: yvniasyfasd.zzux.com URL: https://yvniasyfasd.zzux.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.156.27.249 , Russian Federation, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software Apache / Resource Hash `ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6` Request headers accept-language jp-JP,jp;q=0.9 Referer https://yvniasyfasd.zzux.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Tue, 21 Mar 2023 23:32:17 GMT content-encoding gzip last-modified Wed, 07 Apr 2021 02:24:54 GMT server Apache etag "1375-5bf58a2dd6980-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1907
GET H2	200	Primary Request index.php Show response yvniasyfasd.zzux.com/	3 B 52 B	7626ms 7625ms	Document text/html	45.156.27.249 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://yvniasyfasd.zzux.com/index.php?t=281bcc85e489facdf7de29c788917e509bf445dc1ecdc77322840dd49df8729a Requested by Host: yvniasyfasd.zzux.com URL: https://yvniasyfasd.zzux.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.156.27.249 , Russian Federation, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://yvniasyfasd.zzux.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers content-encoding gzip content-length 23 content-type text/html; charset=UTF-8 date Tue, 21 Mar 2023 23:32:17 GMT server Apache vary Accept-Encoding

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
yvniasyfasd.zzux.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: giqq1nf9n8cvqrvtv4akotogp7
.yvniasyfasd.zzux.com/	1970-01-20 10:30:43	Name: _amkc Value: a469b1a8-6ec1-4b03-be94-aacd328886fe
.yvniasyfasd.zzux.com/	1970-01-20 10:30:43	Name: 62345ba76168db0033ce8ae6a90ce5a762956614 Value: nwcMGFHjQc7nDOZDxhWlbg%3D%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

white-snow-bcd4.os6h0h6e.workers.dev
yvniasyfasd.zzux.com
2606:4700:3037::6815:ffb
45.156.27.249
6a62062b8ec46c18c707e6436028a998c802cda0caf6896b8f83319ef4c95c5d
ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

yvniasyfasd.zzux.com Open in urlscan Pro 45.156.27.249 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

4 kBTransfer

6 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

3 Cookies

Indicators

yvniasyfasd.zzux.com Open in urlscan Pro
45.156.27.249 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

4 kB
Transfer

6 kB
Size

3
Cookies

4 HTTP transactions
0 data transactions