xlgnr.wishuiuck.net
Open in
urlscan Pro
54.228.153.41
Malicious Activity!
Public Scan
Effective URL: https://xlgnr.wishuiuck.net/c/da57dc555e50572d?s1=22545&s2=100778&j1=1&j3=1
Submission: On September 17 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 30th 2021. Valid for: 3 months.
This is the only time xlgnr.wishuiuck.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 185.50.25.57 185.50.25.57 | 198610 (BEGET-AS) (BEGET-AS) | |
3 | 54.228.153.41 54.228.153.41 | 16509 (AMAZON-02) (AMAZON-02) | |
9 | 2.16.186.80 2.16.186.80 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 142.250.184.234 142.250.184.234 | 15169 (GOOGLE) (GOOGLE) | |
2 | 142.250.185.99 142.250.185.99 | 15169 (GOOGLE) (GOOGLE) | |
2 | 142.250.184.195 142.250.184.195 | 15169 (GOOGLE) (GOOGLE) | |
18 | 6 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-228-153-41.eu-west-1.compute.amazonaws.com
xlgnr.wishuiuck.net |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-80.deploy.static.akamaitechnologies.com
cdn-bimi.akamaized.net |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net
fonts.gstatic.com |
ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net
www.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
akamaized.net
cdn-bimi.akamaized.net |
531 KB |
4 |
gstatic.com
fonts.gstatic.com www.gstatic.com |
50 KB |
3 |
wishuiuck.net
xlgnr.wishuiuck.net |
10 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
damlasu.site
damlasu.site |
572 B |
18 | 5 |
Domain | Requested by | |
---|---|---|
9 | cdn-bimi.akamaized.net |
xlgnr.wishuiuck.net
|
3 | xlgnr.wishuiuck.net |
xlgnr.wishuiuck.net
|
2 | www.gstatic.com |
xlgnr.wishuiuck.net
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
cdn-bimi.akamaized.net
|
1 | damlasu.site | |
18 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
cdn-bimi.akamaized.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wishuiuck.net R3 |
2021-06-30 - 2021-09-28 |
3 months | crt.sh |
a248.e.akamai.net DigiCert SHA2 Secure Server CA |
2021-07-15 - 2022-07-20 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-08-30 - 2021-11-22 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-08-30 - 2021-11-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://xlgnr.wishuiuck.net/c/da57dc555e50572d?s1=22545&s2=100778&j1=1&j3=1
Frame ID: 11D54D377D40D88BED0189CD31FBB705
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://damlasu.site/ Page URL
- https://xlgnr.wishuiuck.net/c/da57dc555e50572d?s1=22545&s2=100778&j1=1&j3=1 Page URL
Detected technologies
Firebase (Databases) ExpandDetected patterns
- /firebasejs/([\d.]+)/firebase
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://damlasu.site/ Page URL
- https://xlgnr.wishuiuck.net/c/da57dc555e50572d?s1=22545&s2=100778&j1=1&j3=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
damlasu.site/ |
438 B 572 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
da57dc555e50572d
xlgnr.wishuiuck.net/c/ |
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
cdn-bimi.akamaized.net/landings/211547/1622623286/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
cdn-bimi.akamaized.net/landings/211547/1622623286/js/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
cdn-bimi.akamaized.net/landings/211547/1622623286/js/ |
13 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translates.js
cdn-bimi.akamaized.net/landings/211547/1622623286/js/ |
27 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
cdn-bimi.akamaized.net/landings/211547/1622623286/images/ |
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-white.png
cdn-bimi.akamaized.net/landings/211547/1622623286/images/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
m1.jpg
cdn-bimi.akamaized.net/landings/211547/1622623286/images/ |
86 KB 86 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
subscriber.js
xlgnr.wishuiuck.net/js/pushjs/1.0.0/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
firebase-app.js
www.gstatic.com/firebasejs/5.0.2/ |
25 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
firebase-messaging.js
www.gstatic.com/firebasejs/5.0.2/ |
35 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utils.js
xlgnr.wishuiuck.net/js/pushjs/1.0.0/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
d1.jpg
cdn-bimi.akamaized.net/landings/211547/1622623286/images/ |
203 KB 203 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
d2.jpg
cdn-bimi.akamaized.net/landings/211547/1622623286/images/ |
145 KB 145 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| imibb number| chromeVersion object| _push object| _rup function| $ function| jQuery function| detect_language boolean| exit object| _pcq boolean| showDebug string| partyId string| uiServerUrl string| apiServerUrl string| swScope string| customWorkerJS object| pushConfig object| messaging object| indexedDBConfig object| indexedDBFCMConfig object| pushLoopDomains object| messageBody function| logger function| loadScriptAsync object| scriptLoaded function| defaultIfEmpty function| notBlank function| resolveCid function| parseURL function| getSubdomain function| setCookie function| getCookie function| replaceUrl function| generateUUID function| getUrlParams function| getBrowserInfo function| getLanguage function| getResolution function| getDeviceType function| getSystemInfo function| sendConversion function| isWrongBrowser function| closePopup object| core object| __core-js_shared__ object| firebase5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
xlgnr.wishuiuck.net/ | Name: unique_49415 Value: unique_49415 |
|
xlgnr.wishuiuck.net/ | Name: unique_id Value: 614415fa000ddc51 |
|
xlgnr.wishuiuck.net/ | Name: unique_id2 Value: 614415fa000f0c26 |
|
xlgnr.wishuiuck.net/ | Name: ref_token Value: 22545 |
|
xlgnr.wishuiuck.net/ | Name: 614415fa000f0c26_sl Value: [211547] |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-bimi.akamaized.net
damlasu.site
fonts.googleapis.com
fonts.gstatic.com
www.gstatic.com
xlgnr.wishuiuck.net
142.250.184.195
142.250.184.234
142.250.185.99
185.50.25.57
2.16.186.80
54.228.153.41
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
15c9bd66992ef54979c981763cae280f28b6845520020ed38b5ab5f3f70f7931
1d4ad487984a8f689c904f3c2532f034b03d361c081dae581752cdc20d983037
2687886ca805aee509c40e57448d1a2245f36a590213b3d0d3ebc27df6e5c964
3c335bea807a9d42e628520bede0e2c0252fb27d03e06e631508e7cb4b8d0208
41a5e34d6777a471d63211252ce51555815b728949dc81cec01414f4ffdb98eb
4569845f7c550a55311814032e88541bd3b4a055ec3894e9cf58c4fff1be91d9
556c578740d6d11052dd02a11f01551acd2bd70ce2c9d9fd3c5f76789038e258
6897046033e890fabb5af28b460972f5dd0a0a39a95e61262d8a8f2179ed005e
6e0b5adda82026fe34985683cb286b2acb2d3244f82725d67ca851293843bb24
7afbc6f7cb728a9b4dfd7791a8207c60bdd255ea2f00ba12880bee15f7fbdff0
89885a82304dd3cfe000c2eaa2835fe208e421b34933c6941370191d787a7751
939919488f3ad816cb78b5d032ae673c1c02c88b238cfdb6e1328cd5d04d7947
b000ea0d660798898743cec29e88ca7b6223b78b6e122fbccf6454517f3b260a
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d185adddc27891ed64e11749791b503dfdf3953d0ee8d96711307b76f98796e0
dba890b21c3a53afde1368643dcc506e8813ac2f341f0f8ed295743599e00851