singin.cr.rnufg.jp.tokydt.cn
Open in
urlscan Pro
204.44.68.164
Malicious Activity!
Public Scan
Submission: On May 25 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on May 24th 2022. Valid for: 3 months.
This is the only time singin.cr.rnufg.jp.tokydt.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: MUFG (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 204.44.68.164 204.44.68.164 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
5 | 2 |
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.68.164.static.quadranet.com
singin.cr.rnufg.jp.tokydt.cn |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
tokydt.cn
singin.cr.rnufg.jp.tokydt.cn |
508 KB |
5 | 1 |
Domain | Requested by | |
---|---|---|
5 | singin.cr.rnufg.jp.tokydt.cn |
singin.cr.rnufg.jp.tokydt.cn
|
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
singin.cr.rnufg.jp.wti0qt1kh.cn R3 |
2022-05-24 - 2022-08-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://singin.cr.rnufg.jp.tokydt.cn/newsplus/cardBrand0013/lid/news_ja/index
Frame ID: D73573C16DCD5BFA1D2B57194845AFF5
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index
singin.cr.rnufg.jp.tokydt.cn/newsplus/cardBrand0013/lid/news_ja/ |
564 B 462 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.0.65508701022767221653410800215.css
singin.cr.rnufg.jp.tokydt.cn/static/css/ |
2 MB 378 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1653410800215.0.098329443184525631653410800215.js
singin.cr.rnufg.jp.tokydt.cn/static/js/ |
238 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.0.098329443184525631653410800215.js
singin.cr.rnufg.jp.tokydt.cn/static/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.0.61286541169754231653410800215.js
singin.cr.rnufg.jp.tokydt.cn/static/js/ |
71 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: MUFG (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
singin.cr.rnufg.jp.tokydt.cn
204.44.68.164
159b4da7e1be69f72f4801a1287af455735447c28810185429bc0c76aba5d315
2cabbccc3abc56ba8fcea48e3cf4b167617de9647cb4d28ace844fc4ebfebbff
312b9fa9a58397fe88dd293b3287c3ef83b91c3233ca941aa9d0e2d600fb6a33
32f130f5fa6c1621ff325fbddb92709681cb0f96237cf078360c8d2a906e092a
38eba71c37e843e74fff964854c4238f80d0fb9298420d2a6d8bad7dbcd34f72
39528e1be8c50f74c353e5779b1f466ee58d1c5ce7443077630355e1578e1764
4b7b355ee3b6bf3009342b7219968c23a164f01e10eb3d7f02e57360a09679ac
71762a828a162bf8f9dbd227b9522161b4c083f9d2bd193c1013104440d80661
7cdfb3c9638d76088f839359838c8e866fd157949b39966fa8843c8fe0b09a9d
8fbe7f781ca130b05f7b27bd0c4563c9976739a1541aa0e453207e8ec764afec
9a577180d63af91b2384c9209e114325399e7877159eb06cfaeb8e3ac16d87f9
b768935f52cf68fde3ed1e5c9d497c747e6425deb4035a697f8ce276753b3962
d98ae7399e0928efa6cdf55572104362747c3a71a84ef62a594999a7241c2359
e35a2ef4a53b81daf35cd980bd377ca19ce87b2afe14870c3ce9ff6e0d6c0ea0
e49fa26ee4876e79e8c467cd465ea52c16976a5b5d48eb0debd21f9ca0e20f4f