sswud42.imxz.download Open in urlscan Pro
2606:4700:3035::6815:3aed  Malicious Activity! Public Scan

Submitted URL: https://im2025.download/
Effective URL: https://sswud42.imxz.download/down/TpOvkCA
Submission: On January 14 via api from US — Scanned from US

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3035::6815:3aed, located in United States and belongs to CLOUDFLARENET, US. The main domain is sswud42.imxz.download.
TLS certificate: Issued by GTS CA 1P5 on December 19th 2023. Valid for: 3 months.
This is the only time sswud42.imxz.download was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: imToken (Crypto)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 3 2606:4700:303... 13335 (CLOUDFLAR...)
6 94.103.5.216 25820 (IT7NET)
8 2
Apex Domain
Subdomains
Transfer
6 tokena-imapp.com
st.tokena-imapp.com
138 KB
3 imxz.download
sswud42.imxz.download
3 KB
1 im2025.download
im2025.download
589 B
8 3
Domain Requested by
6 st.tokena-imapp.com sswud42.imxz.download
3 sswud42.imxz.download 1 redirects
1 im2025.download 1 redirects
8 3

This site contains no links.

Subject Issuer Validity Valid
imxz.download
GTS CA 1P5
2023-12-19 -
2024-03-18
3 months crt.sh
*.tokena-imapp.com
R3
2023-12-26 -
2024-03-25
3 months crt.sh

This page contains 1 frames:

Primary Page: https://sswud42.imxz.download/down/TpOvkCA
Frame ID: A8ECC57606F4E503E0996137ED2E0E1C
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

imToken 官网|以太坊和比特币区块链钱包

Page URL History Show full URLs

  1. https://im2025.download/ HTTP 301
    https://sswud42.imxz.download/down HTTP 301
    https://sswud42.imxz.download/down/ Page URL
  2. https://sswud42.imxz.download/down/TpOvkCA Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

141 kB
Transfer

458 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://im2025.download/ HTTP 301
    https://sswud42.imxz.download/down HTTP 301
    https://sswud42.imxz.download/down/ Page URL
  2. https://sswud42.imxz.download/down/TpOvkCA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://im2025.download/ HTTP 301
  • https://sswud42.imxz.download/down HTTP 301
  • https://sswud42.imxz.download/down/

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
sswud42.imxz.download/down/
Redirect Chain
  • https://im2025.download/
  • https://sswud42.imxz.download/down
  • https://sswud42.imxz.download/down/
57 B
360 B
Document
General
Full URL
https://sswud42.imxz.download/down/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3aed , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2d8fc05af9cd81d7cbfdf1f69a2cd414035e6cc887372b74fa3325614d2684b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
8452c5f02945370e-MIA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sun, 14 Jan 2024 03:25:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IKM06%2F23X8sPlbB8a9l0KNLmmB9Pdtq7pgkrj1qPTVTKUTOCeipUPZIgKIP2rSorKeSueezkx5bho3Lz5nv4kC%2FWPSDtkdcMoZ5BA6YO%2FnzclDnPco3Vhly1GrIpWKrytt1X45un4W6T1oVOLFfnYQ7r6QY%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
8452c5ed0e2a370e-MIA
content-type
text/html; charset=utf-8
date
Sun, 14 Jan 2024 03:25:41 GMT
location
/down/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=55GMngHk4bObtti6ZR02%2B4ew%2FZsXRPvaQmfGJ4fQ92l6e7Bx8PhEefn66w%2BY3ZGfW89DoTHeXJWQLmzbjJDtQs4t7VonlBo6ZHqkWNITvSCtKLNZbTwzzgV3Ki9aNvT8RFe1xBp4EAsY%2BzDYrctoq%2BlXbMg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
Primary Request TpOvkCA
sswud42.imxz.download/down/
6 KB
2 KB
Document
General
Full URL
https://sswud42.imxz.download/down/TpOvkCA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:3aed , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d99efee15426a374d581da3a48f42c64370b8bbc05e3d80a9c174a599a1d0cad

Request headers

Referer
https://sswud42.imxz.download/down/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
8452c5f209d68dd9-MIA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sun, 14 Jan 2024 03:25:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pe%2FxngAMEmFezscprfZmNIpaeikom4MruEyGvNZa%2FcZbOJ4BionMOEUfCg7zjUPX3AE5yERYjlIkDzLOhQsmCSl6ia4c90fJyg7U63K6JtPDAFmfhMTbYtXOW6%2FCAy25eQAEOLTNyxPNOKi%2FbC%2F8Bt5bkeE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
jquery.min.js
st.tokena-imapp.com/imTokenCommon/
85 KB
33 KB
Script
General
Full URL
https://st.tokena-imapp.com/imTokenCommon/jquery.min.js
Requested by
Host: sswud42.imxz.download
URL: https://sswud42.imxz.download/down/TpOvkCA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.103.5.216 Hong Kong, Hong Kong, ASN25820 (IT7NET, CA),
Reverse DNS
94.103.5.216.16clouds.com
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sswud42.imxz.download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 03:25:43 GMT
content-encoding
gzip
last-modified
Mon, 06 Dec 2021 19:24:54 GMT
server
nginx
vary
Accept-Encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=43200
expires
Sun, 14 Jan 2024 15:25:43 GMT
0b502bd7632b779787e7571ed7da626349d4848b_CSS.b97c0dd0.chunk.css
st.tokena-imapp.com/imTokenCommon/
234 KB
38 KB
Stylesheet
General
Full URL
https://st.tokena-imapp.com/imTokenCommon/0b502bd7632b779787e7571ed7da626349d4848b_CSS.b97c0dd0.chunk.css
Requested by
Host: sswud42.imxz.download
URL: https://sswud42.imxz.download/down/TpOvkCA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.103.5.216 Hong Kong, Hong Kong, ASN25820 (IT7NET, CA),
Reverse DNS
94.103.5.216.16clouds.com
Software
nginx /
Resource Hash
e757e495b4fea4cedf8962ae92bf79b4af5fcfc935290e6cd5fccda20f402234

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sswud42.imxz.download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 03:25:43 GMT
content-encoding
gzip
last-modified
Wed, 28 Dec 2022 07:59:32 GMT
server
nginx
vary
Accept-Encoding
x-cache
MISS
content-type
text/css; charset=utf-8
cache-control
max-age=43200
expires
Sun, 14 Jan 2024 15:25:43 GMT
484c840239a025432effd6ecc373d498fa764368_CSS.4e604f4b.chunk.css
st.tokena-imapp.com/imTokenCommon/
79 KB
12 KB
Stylesheet
General
Full URL
https://st.tokena-imapp.com/imTokenCommon/484c840239a025432effd6ecc373d498fa764368_CSS.4e604f4b.chunk.css
Requested by
Host: sswud42.imxz.download
URL: https://sswud42.imxz.download/down/TpOvkCA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.103.5.216 Hong Kong, Hong Kong, ASN25820 (IT7NET, CA),
Reverse DNS
94.103.5.216.16clouds.com
Software
nginx /
Resource Hash
ac35043f4c19bd76511cb7553a66eeff8f21e4d0c6e518bedbbf3b270b6826e2

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sswud42.imxz.download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 03:25:43 GMT
content-encoding
gzip
last-modified
Wed, 21 Dec 2022 06:12:30 GMT
server
nginx
vary
Accept-Encoding
x-cache
MISS
content-type
text/css; charset=utf-8
cache-control
max-age=43200
expires
Sun, 14 Jan 2024 15:25:43 GMT
imTokenLogo.svg
st.tokena-imapp.com/imTokenCommon/
9 KB
9 KB
Image
General
Full URL
https://st.tokena-imapp.com/imTokenCommon/imTokenLogo.svg
Requested by
Host: sswud42.imxz.download
URL: https://sswud42.imxz.download/down/TpOvkCA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.103.5.216 Hong Kong, Hong Kong, ASN25820 (IT7NET, CA),
Reverse DNS
94.103.5.216.16clouds.com
Software
nginx /
Resource Hash
017a2546180fc0544fa71508481ca4bd46287a0c79eed70321b6e3ac09d2f491

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sswud42.imxz.download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 03:25:43 GMT
cache-control
no-cache
last-modified
Wed, 21 Dec 2022 06:12:30 GMT
server
nginx
accept-ranges
bytes
content-length
9277
content-type
image/svg+xml
alarm.svg
st.tokena-imapp.com/imTokenCommon/
533 B
668 B
Image
General
Full URL
https://st.tokena-imapp.com/imTokenCommon/alarm.svg
Requested by
Host: sswud42.imxz.download
URL: https://sswud42.imxz.download/down/TpOvkCA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.103.5.216 Hong Kong, Hong Kong, ASN25820 (IT7NET, CA),
Reverse DNS
94.103.5.216.16clouds.com
Software
nginx /
Resource Hash
7c9ca78247b00b98096dc68fc15527fa07e332c5c87c7834e1511786a490af68

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sswud42.imxz.download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 03:25:43 GMT
cache-control
no-cache
last-modified
Wed, 21 Dec 2022 06:12:30 GMT
server
nginx
accept-ranges
bytes
content-length
533
content-type
image/svg+xml
banner.png
st.tokena-imapp.com/imTokenCommon/
45 KB
45 KB
Image
General
Full URL
https://st.tokena-imapp.com/imTokenCommon/banner.png
Requested by
Host: sswud42.imxz.download
URL: https://sswud42.imxz.download/down/TpOvkCA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.103.5.216 Hong Kong, Hong Kong, ASN25820 (IT7NET, CA),
Reverse DNS
94.103.5.216.16clouds.com
Software
nginx /
Resource Hash
e075e1cdad6e176e330ac0f927da14388ba5ad54cc0888b39dd54051b9987e61

Request headers

accept-language
en-US,en;q=0.9
Referer
https://sswud42.imxz.download/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 03:25:43 GMT
last-modified
Wed, 21 Dec 2022 06:12:30 GMT
server
nginx
x-cache
MISS
content-type
image/png
cache-control
max-age=43200
accept-ranges
bytes
content-length
46178
expires
Sun, 14 Jan 2024 15:25:43 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: imToken (Crypto)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| domain string| appstore_url number| device

1 Cookies

Domain/Path Name / Value
.im2025.download/ Name: PHPSESSID
Value: 5d54de03-b248-39ec-5a51-8084c79368a4