tomizawa.site
Open in
urlscan Pro
157.7.107.253
Malicious Activity!
Public Scan
URL:
https://tomizawa.site/al/portal.php
Submission: On June 15 via manual from JP — Scanned from JP
Submission: On June 15 via manual from JP — Scanned from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 6 HTTP transactions.
The main IP is 157.7.107.253, located in
Fukuoka, Japan and
belongs to INTERQ GMO Internet,Inc, JP.
The main domain is tomizawa.site.
TLS certificate: Issued by R3 on May 4th 2022. Valid for: 3 months.
This is the only time tomizawa.site was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 4th 2022. Valid for: 3 months.
This is the only time tomizawa.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Alibaba (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 157.7.107.253 157.7.107.253 | 7506 (INTERQ GM...) (INTERQ GMO Internet) | |
| 6 | 1 |
6
157.7.107.253
(Fukuoka, Japan)
ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: 157-7-107-253.virt.lolipop.jp
ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: 157-7-107-253.virt.lolipop.jp
| tomizawa.site |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
tomizawa.site
tomizawa.site |
162 KB |
| 6 | 1 |
| Domain | Requested by | |
|---|---|---|
| 6 | tomizawa.site |
tomizawa.site
|
| 6 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| tomizawa.site R3 |
2022-05-04 - 2022-08-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://tomizawa.site/al/portal.php
Frame ID: 26F427F7C4CFBAFBF32D8C816B3C1FE4
Requests: 6 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
portal.php
tomizawa.site/al/ |
3 KB 959 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
header.jpg
tomizawa.site/al/WebFiles/ |
8 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
submit.jpg
tomizawa.site/al/WebFiles/ |
3 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
footer.jpg
tomizawa.site/al/WebFiles/ |
24 KB 20 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
background.jpg
tomizawa.site/al/WebFiles/ |
126 KB 119 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
modal.jpg
tomizawa.site/al/WebFiles/ |
14 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Alibaba (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
tomizawa.site
157.7.107.253
0208a9af7c29aa1946f332a197284a1c2c3cc2add260822b3086aa505e6ef453
7673d891ffe432e9e6c1d7e0b0fdb27819de7557ff02101a1b1c32f4f9397b18
9133cbee972058bda2a5fc10a05e8b064af594e6a3333c6b2b528314b11a2a56
92301636dee36f3817693ca34b9f1da02a7fd9c5211b56004fbcba6136767b3c
b4b865b10556534f13521bc56b52de4a7e3be1caa98794cc34b155b7919ab69d
c581ab691f0f1fdadaab184f434d5a98123e262ef20fa2a86995641aa57151b1