www.user-authorizationxxx8501.bluetrust.mixh.jp Open in urlscan Pro
150.95.54.212 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/
Effective URL:
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/
Submission: On December 21 via automatic, source certstream-suspicious (December 21st 2021, 7:23:02 pm UTC) — Scanned from JP

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 150.95.54.212, located in Japan and belongs to INTERQ GMO Internet,Inc, JP. The main domain is www.user-authorizationxxx8501.bluetrust.mixh.jp.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 21st 2021. Valid for: 3 months.

This is the only time www.user-authorizationxxx8501.bluetrust.mixh.jp was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address		AS Autonomous System
4 18	150.95.54.212 150.95.54.212		7506 (INTERQ GM...) (INTERQ GMO Internet)
14	1

18 150.95.54.212 (Japan) 4 redirects

ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: jp37c.mixhost.jp

www.user-authorizationxxx8501.bluetrust.mixh.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	mixh.jp 4 redirects www.user-authorizationxxx8501.bluetrust.mixh.jp	102 KB
14	1

	Domain	Requested by
18	www.user-authorizationxxx8501.bluetrust.mixh.jp	4 redirects www.user-authorizationxxx8501.bluetrust.mixh.jp
14	1

This site contains no links.

Subject Issuer	Validity	Valid
user-authorizationxxx8501.bluetrust.mixh.jp cPanel, Inc. Certification Authority	`2021-12-21` - `2022-03-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/
Frame ID: EADF7C5C2F91AC13F06D734AB2CF28A1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to your PayPal account

Page URL History Show full URLs

https://www.user-authorizationxxx8501.bluetrust.mixh.jp/ HTTP 302
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount HTTP 301
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/ HTTP 302
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary HTTP 301
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

101 kB
Transfer

222 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.user-authorizationxxx8501.bluetrust.mixh.jp/ HTTP 302
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount HTTP 301
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/ HTTP 302
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary HTTP 301
https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Redirect Chain https://www.user-authorizationxxx8501.bluetrust.mixh.jp/ https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/ https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/	9 KB 5 KB	5ms 4ms	Document text/html	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `edb9f67f83170b6c7b39a6baf52ddf1ff6c0f1c49f20869b4272b1cb493f0878` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Tue, 21 Dec 2021 19:22:58 GMT server LiteSpeed Redirect headers content-type text/html content-length 707 date Tue, 21 Dec 2021 19:22:58 GMT server LiteSpeed location https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H3	200	font-sans.css www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/css/	1 KB 315 B	2ms 2ms	Stylesheet text/css	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/css/font-sans.css Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `6225da29bcb513ec7861eb54e621707ddb6edbd2eba6c3b2f855a4481125977a` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 224 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	template.css www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/css/	8 KB 2 KB	3ms 3ms	Stylesheet text/css	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/css/template.css Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `458227094ab375aef8cd7f82e0a1c5611103465e6d6967b95b94472bcdde15be` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 2179 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	bots.php www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/	19 KB 5 KB	12ms 12ms	Stylesheet text/html	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/bots.php?style_css Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `b88a1bd49aa7d7fb47bd1edd3e155ae6fd3ebbebc2a540d9a502fd38b97a06b1` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br server LiteSpeed vary Accept-Encoding content-type text/html; charset=UTF-8
GET H3	200	jquery.min.js Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/	84 KB 29 KB	4ms 4ms	Script application/javascript	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.min.js Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 29235 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	jstz.min.js Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/	12 KB 4 KB	7ms 6ms	Script application/javascript	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jstz.min.js Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `4061658a40104af6acc8cdca88a582b3460571707b60f862b75d422f3d0fe877` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 3788 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	jquery.mobile.custom.min.js Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/	35 KB 12 KB	7ms 6ms	Script application/javascript	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.mobile.custom.min.js Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `264fe373615bcf15c32ae6df08a6a2bc8a0844b5928af69f9f2967da07e78200` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 12136 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	jquery.browser.min.js Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/	2 KB 778 B	8ms 8ms	Script application/javascript	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.browser.min.js Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `beabd80773a4dc7327ac6864d464aac8c38538a3183d8fb049dbb07472dde32d` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 756 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	login.php Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/	4 KB 3 KB	5ms 4ms	XHR text/html	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/login.php Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `705777fbb663a11cfedccaa0a7d301bd64cf4084f1d4b544e37c1d7245dde809` Request headers Accept text/html, /; q=0.01 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ X-Requested-With XMLHttpRequest Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br server LiteSpeed content-length 2552 vary Accept-Encoding content-type text/html; charset=UTF-8
GET H3	200	script.js Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/	4 KB 1010 B	3ms 3ms	XHR application/javascript	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/script.js?_=1640114578246 Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `2305cd88512a2b34c082fbd6359c9f62e5a9cf6d2fb62f12af34f08ce796ee1e` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ X-Requested-With XMLHttpRequest Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 988 expires Tue, 28 Dec 2021 19:22:58 GMT
POST H3	200	visit.php Show response www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/	0 9 B	9ms 8ms	XHR text/html	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/visit.php Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/ X-Requested-With XMLHttpRequest Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 21 Dec 2021 19:22:58 GMT server LiteSpeed content-length 0 content-type text/html; charset=UTF-8
GET H3	200	logo0.svg www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/img/	5 KB 2 KB	3ms 2ms	Image image/svg+xml	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Show image Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/img/logo0.svg Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/bots.php?style_css Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/bots.php?style_css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT content-encoding br last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes content-length 1794 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	PayPalSansBig-Regular.woff2 www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/font/	38 KB 38 KB	2ms 2ms	Font font/woff2	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/font/PayPalSansBig-Regular.woff2 Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/css/font-sans.css Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `2351bbc39303736cd3a670db10427adc13c256dd6b639f0545bfd104947d3427` Request headers Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/css/font-sans.css Origin https://www.user-authorizationxxx8501.bluetrust.mixh.jp Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed content-type font/woff2 cache-control public, max-age=604800 accept-ranges bytes content-length 39021 expires Tue, 28 Dec 2021 19:22:58 GMT
GET H3	200	error_icon.png www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/img/	809 B 829 B	3ms 2ms	Image image/png	150.95.54.212 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Show image Full URL https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/img/error_icon.png Requested by Host: www.user-authorizationxxx8501.bluetrust.mixh.jp URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/bots.php?style_css Protocol H3 Security QUIC, , AES_128_GCM Server 150.95.54.212 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS jp37c.mixhost.jp Software LiteSpeed / Resource Hash `5789d40d0824ee59ad95601cd34f0fb4d93bdc5a65f5fd93d8ed713373acfb93` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/inc/bots.php?style_css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 21 Dec 2021 19:22:58 GMT last-modified Wed, 09 Aug 2017 09:50:46 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 809 expires Tue, 28 Dec 2021 19:22:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| jstz object| jQBrowser

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.user-authorizationxxx8501.bluetrust.mixh.jp/	1969-12-31 23:59:59	Name: PHPSESSID Value: 311e39daa5aa62bffdb4f85f343698fb

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
deprecation	warning	URL: https://www.user-authorizationxxx8501.bluetrust.mixh.jp/myaccount/summary/js/jquery.min.js(Line 3) Message: Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.user-authorizationxxx8501.bluetrust.mixh.jp
150.95.54.212
2305cd88512a2b34c082fbd6359c9f62e5a9cf6d2fb62f12af34f08ce796ee1e
2351bbc39303736cd3a670db10427adc13c256dd6b639f0545bfd104947d3427
264fe373615bcf15c32ae6df08a6a2bc8a0844b5928af69f9f2967da07e78200
4061658a40104af6acc8cdca88a582b3460571707b60f862b75d422f3d0fe877
458227094ab375aef8cd7f82e0a1c5611103465e6d6967b95b94472bcdde15be
5789d40d0824ee59ad95601cd34f0fb4d93bdc5a65f5fd93d8ed713373acfb93
6225da29bcb513ec7861eb54e621707ddb6edbd2eba6c3b2f855a4481125977a
705777fbb663a11cfedccaa0a7d301bd64cf4084f1d4b544e37c1d7245dde809
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
b88a1bd49aa7d7fb47bd1edd3e155ae6fd3ebbebc2a540d9a502fd38b97a06b1
beabd80773a4dc7327ac6864d464aac8c38538a3183d8fb049dbb07472dde32d
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edb9f67f83170b6c7b39a6baf52ddf1ff6c0f1c49f20869b4272b1cb493f0878

www.user-authorizationxxx8501.bluetrust.mixh.jp Open in urlscan Pro 150.95.54.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

101 kBTransfer

222 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www.user-authorizationxxx8501.bluetrust.mixh.jp Open in urlscan Pro
150.95.54.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

101 kB
Transfer

222 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!