ideal-auto.uz Open in urlscan Pro
185.211.129.122 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/
Submission: On October 20 via automatic, source openphish (October 20th 2021, 1:02:38 am UTC) — Scanned from DE

Summary HTTP 1 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 185.211.129.122, located in Uzbekistan and belongs to AS-TNET, UZ. The main domain is ideal-auto.uz.

This is the only time ideal-auto.uz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Shopify (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 2	185.211.129.122 185.211.129.122		205640 (AS-TNET) (AS-TNET)
1	2

2 185.211.129.122 (Uzbekistan) 1 redirects

ASN205640 (AS-TNET, UZ)
PTR: mail.agat.uz

ideal-auto.uz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ideal-auto.uz 1 redirects ideal-auto.uz	2 MB
1	1

	Domain	Requested by
2	ideal-auto.uz	1 redirects
1	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 3 frames:

Primary Page: http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/
Frame ID: DA7042A117592EB6D22F82DB5F8F1EE5
Requests: 2 HTTP requests in this frame

Frame: data://truncated
Frame ID: EA967A1E58FF1B93AF0A00E694D8AEBA
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 9830B02C6CC618AC8D8ACD62BEEA8DEA
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Shopify

Page URL History Show full URLs

http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572 HTTP 301
http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/ Page URL

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1714 kB
Transfer

2849 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572 HTTP 301
http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/ Redirect Chain http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572 http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/	3 MB 2 MB	138ms 137ms	Document text/html	185.211.129.122 AS-TNET
General Check archive.org Show headers Download Go to Full URL http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/ Protocol HTTP/1.1 Server 185.211.129.122 , Uzbekistan, ASN205640 (AS-TNET, UZ), Reverse DNS mail.agat.uz Software nginx / Resource Hash `340ac1d78eb052b6a9d954353e7dc837fe15d0291cf9c1ef8b703e261cdffbec` Request headers Host ideal-auto.uz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Wed, 20 Oct 2021 01:02:32 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Vary Accept-Encoding Content-Encoding gzip Redirect headers Server nginx Date Wed, 20 Oct 2021 01:02:32 GMT Content-Type text/html; charset=iso-8859-1 Content-Length 281 Connection keep-alive Keep-Alive timeout=60 Location http://ideal-auto.uz/homee/Fox-C/store/verification/4B9BNB0065MA9E9EB572/
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated / Frame EA96	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 9830	28 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0950ebbb85047865197a52ed753af27e7e98b94f14ec8b3c62ab28b69cbb5c92` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated / Frame 9830	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 9830	600 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 9830	530 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 9830	665 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Shopify (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ideal-auto.uz
185.211.129.122
0950ebbb85047865197a52ed753af27e7e98b94f14ec8b3c62ab28b69cbb5c92
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7
31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8
340ac1d78eb052b6a9d954353e7dc837fe15d0291cf9c1ef8b703e261cdffbec
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

ideal-auto.uz Open in urlscan Pro 185.211.129.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1714 kBTransfer

2849 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

ideal-auto.uz Open in urlscan Pro
185.211.129.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1714 kB
Transfer

2849 kB
Size

0
Cookies

1 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!