a29h.interturku.space
Open in
urlscan Pro
118.107.60.213
Malicious Activity!
Public Scan
Submission: On September 13 via manual from JP — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 28th 2021. Valid for: 3 months.
This is the only time a29h.interturku.space was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online) Amazon Japan (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 118.107.60.213 118.107.60.213 | 64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN) | |
2 | 118.107.60.198 118.107.60.198 | 64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN) | |
11 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
interturku.space
a29h.interturku.space |
91 KB |
2 |
dazzyowndays.space
cssaug15.dazzyowndays.space |
674 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
9 | a29h.interturku.space |
a29h.interturku.space
|
2 | cssaug15.dazzyowndays.space |
a29h.interturku.space
cssaug15.dazzyowndays.space |
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
a29h.helsinkikotka.space R3 |
2021-08-28 - 2021-11-26 |
3 months | crt.sh |
cssaug15.dazzyowndays.space R3 |
2021-08-15 - 2021-11-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://a29h.interturku.space/?vcode=fEvyFNLXwNPTNAl5J6EajM2m61xpothOyAdId8g3jmeOIHxVeUT2jwiZ2PMzKxi2vzFMHAr%2BG/IRFDik1kV3%2BkWzF9/gDvgrIch93NHg3THS86qB%2BfeMwcomsa4WnPtkPMP7HFTKRAwcBpn0sOAQOFwj4IZPY489fb5f8HN%2BIenHxHqcXhcnFaSQADjr3/pnQWJDQMFhigcxafIoe7mweZMhyOLjtSIq8NmXNxQtH9VUvVF2aReEcDnBNjUlU10bgpxGcltcxLePZFHxzw/TBuTC6T8HinZqZq7sU5hgFvYvqH%2BdOY2pz0IoNdnb%2Bh0WeYXUa4lIRS2n6/EKKCw0Vg%3D%3D&channel=A0913
Frame ID: 3C52E44437535D86D9C8C511578C8226
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
a29h.interturku.space/ |
651 B 567 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.eaffd353a8e12f370ec5d983ec6abc29.css
cssaug15.dazzyowndays.space/ |
4 MB 648 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
manifest.c3644e336e39fd9f8f08.js
a29h.interturku.space/static/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.02a064e12a7c1a3e4e66.js
a29h.interturku.space/static/js/ |
237 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.c86076d554df9de5efc8.js
a29h.interturku.space/static/js/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.6fdb3e4ee72e699face9.js
a29h.interturku.space/static/js/ |
806 B 608 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jump.php
a29h.interturku.space/api/ |
2 B 54 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.c8da06cc3a8abad83749.js
a29h.interturku.space/static/js/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api_session.php
a29h.interturku.space/api/ |
0 109 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.6a23b50.png
cssaug15.dazzyowndays.space/static/img/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
15.fcf3ce25d0dd39427e04.js
a29h.interturku.space/static/js/ |
505 B 417 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online) Amazon Japan (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
a29h.interturku.space/ | Name: PHPSESSID Value: ejsu0h89eavc84el5r1kh3k6gr |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a29h.interturku.space
cssaug15.dazzyowndays.space
118.107.60.198
118.107.60.213
0839056d5de01ad37e515dc3d71e7c09212deb102f36d048efd2b9e315327a06
10c7b55d11bab4bd813c3fc1977e7ef0856e15550638db06d25a37d95ec8ed41
72307c583a59952b6da19211c8e5e6d63586dfef6a766c61f453c7593a149a8f
7ba7a0f5a64ae1faafc32f3ecb6f8607ea92c42e05c62c3b6957df18da2c15b7
828ed066ddc1c4638d2f543a0716751f9377afec68b1450fc388ad2dd8be23f2
9e34e34df7aa538e76dfff0ff85326974e3c88fc83650e2ad2f9060553cbc689
a515dcb414d0c44f70cbdc70eb4eceae128f82667a9d143731e3b4f608f3f483
aaefefe514d9b92304fc608f199d04d689594acde0ec6a4b6073e32e6e1eed5d
c0fc872ae71d4c6a96fd5c84a4ac83473259ecfbf04f4708bdcd633bd6c2bf55
d8463bd3ba4b10e5916f65fa7b0c1f9f91f67ca40cc25b48810fb2f5a3340488
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855