houdawater.com - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 103.140.239.214, located in Hong Kong and belongs to UFO-AS-AP UFO Network Limited, HK. The main domain is houdawater.com.
TLS certificate: Issued by R3 on June 22nd 2023. Valid for: 3 months.

This is the only time houdawater.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	103.140.239.214 103.140.239.214	139293 (UFO-AS-AP...) (UFO-AS-AP UFO Network Limited)
5	182.22.31.124 182.22.31.124	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
6	2

1 103.140.239.214 (Hong Kong)

ASN139293 (UFO-AS-AP UFO Network Limited, HK)

houdawater.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 182.22.31.124 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	yimg.jp s.yimg.jp — Cisco Umbrella Rank: 8305	17 KB
1	houdawater.com houdawater.com	4 KB
6	2

	Domain	Requested by
5	s.yimg.jp	houdawater.com s.yimg.jp
1	houdawater.com
6	2

This site contains links to these domains. Also see Links.

Domain
www.yahoo.co.jp

Subject Issuer	Validity	Valid
houdawater.com R3	`2023-06-22` - `2023-09-20`	3 months	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2023-04-12` - `2024-05-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://houdawater.com/mblogin.php
Frame ID: E1ACA4D1A77D92762417082463027F49
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ログイン - Yahoo! JAPAN

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

21 kB
Transfer

61 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.yahoo.co.jp/
Title: Yahoo! JAPAN

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request mblogin.php Show response
houdawater.com/ 16 KB
4 KB 1972ms
1238ms Document
text/html 103.140.239.214
UFO-AS-AP UFO Net...

General

Check archive.org

Show headers Download Go to

Full URL

https://houdawater.com/mblogin.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

103.140.239.214 , Hong Kong, ASN139293 (UFO-AS-AP UFO Network Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

9785a1bd178cd789fe36a1f006ffe5727c04c9adcddabf37a2ed3f693b387b4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: *
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Mon, 26 Jun 2023 05:23:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 login-min.css
s.yimg.jp/images/login/sp/css/login/3.5.7/ 37 KB
9 KB 1037ms
277ms Stylesheet
text/css 182.22.31.124
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
Requested by: Host: houdawater.com
URL: https://houdawater.com/mblogin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.31.124 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 989c61ddad78e4812ae5c49c1d1b97c3d4a4188c256fd867afbfb4ea86a2f820

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://houdawater.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 26 Jun 2023 05:23:14 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:32:34 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 0
vary: Accept-Encoding
content-type: text/css
x-z-chihaya: r=1
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 8593

GET
H2 200 items08-min.css
s.yimg.jp/images/login/sp/css/theme/1.2.1/ 690 B
762 B 1040ms
280ms Stylesheet
text/css 182.22.31.124
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/login/sp/css/theme/1.2.1/items08-min.css
Requested by: Host: houdawater.com
URL: https://houdawater.com/mblogin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.31.124 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 6c8f83a3cb3e8105f61230d06cc1f03553a37a8c66c0d0305c38fa94af4e9ec9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://houdawater.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 26 Jun 2023 05:23:14 GMT
last-modified: Tue, 25 Jan 2022 16:32:35 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 0
content-type: text/css
x-z-chihaya: r=1
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
accept-ranges: bytes
content-length: 690

GET
H2 200 mail144.png
s.yimg.jp/images/mail/appicon/ 3 KB
3 KB 1056ms
297ms Image
image/png 182.22.31.124
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/mail/appicon/mail144.png
Requested by: Host: houdawater.com
URL: https://houdawater.com/mblogin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.31.124 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 5fc1c33a80df575fc437542bdb8fbc2916a42b0a238e1d5dae2d442a02324f50

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://houdawater.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 26 Jun 2023 05:23:14 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:33:13 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 0
vary: Accept-Encoding
content-type: image/png
x-z-chihaya: r=1
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 3242

GET
H2 200 yj_r_34_2x.png
s.yimg.jp/c/logo/f/2.0/ 3 KB
3 KB 251ms
251ms Image
image/png 182.22.31.124
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/c/logo/f/2.0/yj_r_34_2x.png
Requested by: Host: s.yimg.jp
URL: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.31.124 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 26 Jun 2023 05:13:22 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 00:33:06 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 592
vary: Accept-Encoding
content-type: image/png
x-z-chihaya: r=1
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 3332

GET
H2 200 ico_palette.png
s.yimg.jp/images/login/sp/img/theme/1.3.0/ 512 B
604 B 251ms
251ms Image
image/png 182.22.31.124
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/login/sp/img/theme/1.3.0/ico_palette.png
Requested by: Host: s.yimg.jp
URL: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.31.124 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 9bdc87263763478099797018ae7f0ea332b466a7324bb67a08f83090856d5fb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 26 Jun 2023 05:21:17 GMT
last-modified: Tue, 25 Jan 2022 16:32:38 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 117
content-type: image/png
x-z-chihaya: r=1
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
accept-ranges: bytes
content-length: 512

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo Japan (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| varify

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			houdawater.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: la3d9ao4ulcnq3vp3edqj8sgms

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

houdawater.com
s.yimg.jp
103.140.239.214
182.22.31.124
479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b
5fc1c33a80df575fc437542bdb8fbc2916a42b0a238e1d5dae2d442a02324f50
6c8f83a3cb3e8105f61230d06cc1f03553a37a8c66c0d0305c38fa94af4e9ec9
9785a1bd178cd789fe36a1f006ffe5727c04c9adcddabf37a2ed3f693b387b4d
989c61ddad78e4812ae5c49c1d1b97c3d4a4188c256fd867afbfb4ea86a2f820
9bdc87263763478099797018ae7f0ea332b466a7324bb67a08f83090856d5fb1

houdawater.com Open in urlscan Pro 103.140.239.214 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

21 kBTransfer

61 kBSize

1 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

houdawater.com Open in urlscan Pro
103.140.239.214 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

21 kB
Transfer

61 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!