genkaistudio.com
Open in
urlscan Pro
186.64.114.35
Malicious Activity!
Public Scan
Effective URL: https://genkaistudio.com/sof/080291/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ada39479a2a95a89670029001...
Submission: On April 07 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on February 12th 2020. Valid for: 3 months.
This is the only time genkaistudio.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 50.87.253.86 50.87.253.86 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 1 | 107.154.147.186 107.154.147.186 | 19551 (INCAPSULA) (INCAPSULA) | |
2 4 | 186.64.114.35 186.64.114.35 | 52368 (ZAM LTDA.) (ZAM LTDA.) | |
1 | 2606:4700::68... 2606:4700::6810:85e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
4 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box2173.bluehost.com
office365i.ls-supply.com |
ASN19551 (INCAPSULA, US)
PTR: 107.154.147.186.ip.incapdns.net
ls-supply.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
genkaistudio.com
2 redirects
genkaistudio.com |
363 KB |
2 |
ls-supply.com
2 redirects
office365i.ls-supply.com ls-supply.com |
541 B |
1 |
jsonip.com
jsonip.com |
453 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
73 KB |
4 | 4 |
Domain | Requested by | |
---|---|---|
4 | genkaistudio.com | 2 redirects |
1 | jsonip.com |
cdnjs.cloudflare.com
|
1 | cdnjs.cloudflare.com |
genkaistudio.com
|
1 | ls-supply.com | 1 redirects |
1 | office365i.ls-supply.com | 1 redirects |
4 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
genkaistudio.com Let's Encrypt Authority X3 |
2020-02-12 - 2020-05-12 |
3 months | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
jsonip.com Let's Encrypt Authority X3 |
2020-02-29 - 2020-05-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://genkaistudio.com/sof/080291/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ada39479a2a95a896700290010483deb8b1ca2bd80d667a7732d9fb0a100
Frame ID: ADD1520C5C784347FB32CCEB2536B501
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://office365i.ls-supply.com/
HTTP 302
https://ls-supply.com/office365i/rdr.php HTTP 302
https://genkaistudio.com/sof/080291 HTTP 301
https://genkaistudio.com/sof/080291/ HTTP 303
https://genkaistudio.com/sof/080291/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ad... Page URL
- https://genkaistudio.com/sof/080291/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ada39... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://office365i.ls-supply.com/
HTTP 302
https://ls-supply.com/office365i/rdr.php HTTP 302
https://genkaistudio.com/sof/080291 HTTP 301
https://genkaistudio.com/sof/080291/ HTTP 303
https://genkaistudio.com/sof/080291/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ada39479a2a95a896700290010483deb8b1ca2bd80d667a7732d9fb0a100 Page URL
- https://genkaistudio.com/sof/080291/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ada39479a2a95a896700290010483deb8b1ca2bd80d667a7732d9fb0a100 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://office365i.ls-supply.com/ HTTP 302
- https://ls-supply.com/office365i/rdr.php HTTP 302
- https://genkaistudio.com/sof/080291 HTTP 301
- https://genkaistudio.com/sof/080291/ HTTP 303
- https://genkaistudio.com/sof/080291/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=aca2499555b9ada39479a2a95a896700290010483deb8b1ca2bd80d667a7732d9fb0a100
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
r.php
genkaistudio.com/sof/080291/ Redirect Chain
|
222 B 288 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
genkaistudio.com/sof/080291/s/ |
542 KB 362 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ |
257 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
383 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
jsonip.com/ |
152 B 453 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| getIPAddress string| x1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
genkaistudio.com/sof/080291/s | Name: ip11 Value: 2a01:4f8:192:5414::2 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
genkaistudio.com
jsonip.com
ls-supply.com
office365i.ls-supply.com
107.154.147.186
186.64.114.35
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6810:85e5
50.87.253.86
137605959b3b7946b3362f2543081f645ffdf32bcbbfc97a4f87b39c956fdf67
2918395939325d79668cd303728f2a7501c7a5946e9db4a1e0305243aea79dda
8c9cd82212b6101b6a0ada2374b27864cf87eb2a614ff5113d49d686950699f9
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
a2521c1b5ff460f6ceb494242c145b3a609425b3101ec342e4344487ad14317c
c2614b3f1e25f0b1acdb40f77eb1ec504bcfb74b79b98efc7e9b8011a8ee3f9b
fdfbbe3d7e1212050979262f0f79eb76ae4b27e46fc1592514c8ad7b4877b968