ideal-auto.uz Open in urlscan Pro
185.211.129.122 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://url4793.store-shopify.com/ls/click?upn=VmUzxmnyBUTGTlxaTpbI85MItIlDA-2B0104cgVdcAPI0VAaYbeQqoiFEM6WXONr506e0EDFxefYEOBeqc-...
Effective URL:
http://ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/index.php?country.x=US-United%20States&lang....
Submission: On October 19 via manual (October 19th 2021, 10:30:08 am UTC) from CA — Scanned from DE

Summary HTTP 1 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 1 HTTP transactions. The main IP is 185.211.129.122, located in Uzbekistan and belongs to AS-TNET, UZ. The main domain is ideal-auto.uz.

This is the only time ideal-auto.uz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Shopify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.118.83 167.89.118.83	11377 (SENDGRID) (SENDGRID)
1 2	185.211.129.122 185.211.129.122	205640 (AS-TNET) (AS-TNET)
1	2

1 167.89.118.83 (United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789118x83.outbound-mail.sendgrid.net

url4793.store-shopify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.211.129.122 (Uzbekistan) 1 redirects

ASN205640 (AS-TNET, UZ)
PTR: mail.agat.uz

ideal-auto.uz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ideal-auto.uz 1 redirects ideal-auto.uz	2 MB
1	store-shopify.com 1 redirects url4793.store-shopify.com	242 B
1	2

	Domain	Requested by
2	ideal-auto.uz	1 redirects
1	url4793.store-shopify.com	1 redirects
1	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 3 frames:

Primary Page: http://ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/index.php?country.x=US-United%20States&lang.x=en
Frame ID: 1252DEF43C79AFF8A38207968B9034C0
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: 5C2C5FCF31311272C5820E090235E4EB
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 5C4D8A074F51B866F118E146079A1DC7
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Shopify

Page URL History Show full URLs

http://url4793.store-shopify.com/ls/click?upn=VmUzxmnyBUTGTlxaTpbI85MItIlDA-2B0104cgVdcAPI0VAaYbeQqoiFEM6WXON... HTTP 302
http://ideal-auto.uz/homee/Fox-C/store/ HTTP 302
http://ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/index.php?country.x=US-U... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1714 kB
Transfer

2849 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://url4793.store-shopify.com/ls/click?upn=VmUzxmnyBUTGTlxaTpbI85MItIlDA-2B0104cgVdcAPI0VAaYbeQqoiFEM6WXONr506e0EDFxefYEOBeqc-2B2SOYw-3D-3D5Aeq_SXRgCguBqAt9Fk4SL6HML-2B8OoruJBKF-2F5KRDv-2FgJm49cLEtOQHP-2BJcwk3xzWZoTQqiN4kLXRnr30CN3fpul7iG71QQipV-2FFmSxPw8-2F2Nwphftf31z6PQBJ8-2FzGRrBwXLkDbkjtsqPdnwXapTdfqWJnu0WDzI99A7VKu7urlitXgy7HQCEBKMVsr-2FFwkslkECa-2BRFhN58VBs7hVgK1OhlXhG2B-2BrbAFr1RvDMJpqvWXZ0VGU6-2BxzqjDkR-2FUu21jQnF-2BwWGjXsIb1jgkGn6s5soqhrhz1xpGJ3x1NMzuPHgmq-2F25BEOYgHLsj0NcHXrwUcTRM3cl-2FPSUwa6F0cy8Q0BxgEr9CmPyRggV-2B0i8XV96Ob3iN2mMKVqvjSkHTKlopC HTTP 302
http://ideal-auto.uz/homee/Fox-C/store/ HTTP 302
http://ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/index.php?country.x=US-United%20States&lang.x=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/ Redirect Chain http://url4793.store-shopify.com/ls/click?upn=VmUzxmnyBUTGTlxaTpbI85MItIlDA-2B0104cgVdcAPI0VAaYbeQqoiFEM6WXONr506e0EDFxefYEOBeqc-2B2SOYw-3D-3D5Aeq_SXRgCguBqAt9Fk4SL6HML-2B8OoruJBKF-2F5KRDv-2FgJm49c... http://ideal-auto.uz/homee/Fox-C/store/ http://ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/index.php?country.x=US-United%20States&lang.x=en	3 MB 2 MB	175ms 175ms	Document text/html	185.211.129.122 AS-TNET
General Check archive.org Show headers Download Go to Full URL http://ideal-auto.uz/homee/Fox-C/store/verification/CC873CABA7CM3D73A614/index.php?country.x=US-United%20States&lang.x=en Protocol HTTP/1.1 Server 185.211.129.122 , Uzbekistan, ASN205640 (AS-TNET, UZ), Reverse DNS mail.agat.uz Software nginx / Resource Hash `340ac1d78eb052b6a9d954353e7dc837fe15d0291cf9c1ef8b703e261cdffbec` Request headers Host ideal-auto.uz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Cookie PHPSESSID=utl17u7348uf7sq65ngd45hv01 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Tue, 19 Oct 2021 10:30:02 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Vary Accept-Encoding Content-Encoding gzip Redirect headers Server nginx Date Tue, 19 Oct 2021 10:30:02 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive Keep-Alive timeout=60 Set-Cookie PHPSESSID=utl17u7348uf7sq65ngd45hv01; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache location ./verification/CC873CABA7CM3D73A614/index.php?country.x=US-United States&lang.x=en
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated / Frame 5C2C	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 5C4D	28 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0950ebbb85047865197a52ed753af27e7e98b94f14ec8b3c62ab28b69cbb5c92` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated / Frame 5C4D	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 5C4D	600 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 5C4D	530 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 5C4D	665 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Shopify (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ideal-auto.uz/	1969-12-31 23:59:59	Name: PHPSESSID Value: utl17u7348uf7sq65ngd45hv01

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ideal-auto.uz
url4793.store-shopify.com
167.89.118.83
185.211.129.122
0950ebbb85047865197a52ed753af27e7e98b94f14ec8b3c62ab28b69cbb5c92
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7
31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8
340ac1d78eb052b6a9d954353e7dc837fe15d0291cf9c1ef8b703e261cdffbec
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

ideal-auto.uz Open in urlscan Pro 185.211.129.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1714 kBTransfer

2849 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

ideal-auto.uz Open in urlscan Pro
185.211.129.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1714 kB
Transfer

2849 kB
Size

1
Cookies

1 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!