h5.mufgstdwgo.cc
Open in
urlscan Pro
20.187.99.215
Malicious Activity!
Public Scan
Submission Tags: krdtest
Submission: On February 18 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on February 16th 2022. Valid for: 3 months.
This is the only time h5.mufgstdwgo.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
18 | 20.187.99.215 20.187.99.215 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 47.97.3.34 47.97.3.34 | 37963 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.) | |
19 | 3 |
ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN)
cdn.dcloud.net.cn |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
mufgstdwgo.cc
h5.mufgstdwgo.cc |
3 MB |
1 |
dcloud.net.cn
cdn.dcloud.net.cn — Cisco Umbrella Rank: 130453 |
546 B |
19 | 2 |
Domain | Requested by | |
---|---|---|
18 | h5.mufgstdwgo.cc |
h5.mufgstdwgo.cc
|
1 | cdn.dcloud.net.cn |
h5.mufgstdwgo.cc
|
19 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
h5.mufgstdwgo.cc ZeroSSL RSA Domain Secure Site CA |
2022-02-16 - 2022-05-17 |
3 months | crt.sh |
*.dcloud.net.cn RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2020-08-17 - 2022-08-18 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://h5.mufgstdwgo.cc/
Frame ID: C981C774C2302CFBA98B8C28A7EEF23E
Requests: 23 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
h5.mufgstdwgo.cc/ |
908 B 886 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.f4fc78fe.css
h5.mufgstdwgo.cc/static/ |
93 KB 93 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.02deacfc.js
h5.mufgstdwgo.cc/static/js/ |
2 MB 2 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.0971f6e1.js
h5.mufgstdwgo.cc/static/js/ |
565 KB 566 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
identify
h5.mufgstdwgo.cc/api/common/ |
32 B 371 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages-assets-accounts-accounts~pages-assets-addCard-addCard~pages-assets-addWallet-addWallet~pages-a~cf2e5d41.8cd29ef0.js
h5.mufgstdwgo.cc/static/js/ |
59 KB 59 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages-assets-addCard-addCard~pages-assets-addWallet-addWallet~pages-assets-rechargeWallet-rechargeWa~4087a6db.3220a0ab.js
h5.mufgstdwgo.cc/static/js/ |
13 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages-normal-login-login~pages-normal-register-register~pages-normal-resetPassword-resetPassword.0567fcac.js
h5.mufgstdwgo.cc/static/js/ |
15 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages-normal-login-login.53888524.js
h5.mufgstdwgo.cc/static/js/ |
44 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_home_selected.png
h5.mufgstdwgo.cc/static/img/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_market_normal.png
h5.mufgstdwgo.cc/static/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_trade_normal.png
h5.mufgstdwgo.cc/static/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_lever_normal.png
h5.mufgstdwgo.cc/static/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_assets_normal.png
h5.mufgstdwgo.cc/static/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
config
h5.mufgstdwgo.cc/api/common/ |
32 B 371 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
585 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
748 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
866 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
config
h5.mufgstdwgo.cc/api/common/ |
32 B 371 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
config
h5.mufgstdwgo.cc/api/common/ |
32 B 371 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shadow-grey.png
cdn.dcloud.net.cn/img/ |
136 B 546 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
config
h5.mufgstdwgo.cc/api/common/ |
32 B 371 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone boolean| coverSupport object| webpackJsonp object| regeneratorRuntime object| __uniConfig object| __uniRoutes function| UniApp object| UniViewJSBridge object| UniServiceJSBridge object| uni object| wx function| getApp function| getCurrentPages0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.dcloud.net.cn
h5.mufgstdwgo.cc
20.187.99.215
47.97.3.34
0123acb9fe5abd43751e4f0fc23f4b6b5519ab79403b96de9d32da856c50a1b4
0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3
15ed040cead5b78fbe6ba92bf4469ba3cd9f7bbe57053f2561fc9a9f6e00279e
1aac5ebe3cf5bc1ab57f731c5f171fea1aaa10442c5bc2fdeead7e456131ac2a
281debe228e680ea01cac114069ac4a61a8572d3d0dbdca0164eb7027e1bf7cc
34c8e03dc35e982d36a14b45562a599564838c0a54fa94d47492db5cb480b976
49830a54167b6122c52f3de3666b7dbec064df94fd787b62a100e25b79c66241
5242f17cd766b13c1db2ea60bc7fdc9e54f4fd0cea03f0818f57a773f63acb88
7240d4bf5644bc622b3ca0427b8ca148c4578d5f0060eb3837cf0793cda59385
8d02357c0ad26df9d4a57e62f386f3744f81428c4ed68f3c4e8d55f36ce98694
8fbd38f81c9598c49bc600a5dc087da7b52b8d0c9b9771cca9a76c8684d1f168
9c2399cf2a6f7b9dfe2811d40f0d069952a154f920b9d046e4841652b5a27c59
a9a37f5b7bdb8e3ccfd24a9129cecbe4584924229a21cf2fc728b4365ae3e9e6
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f
ae0bf155e05bd66da8a07e7b34999af585fb59e2f60682250a934abc6efdf0f0
c2add3b8f06fcb4d80280d180fe0167de70dd7566dc04893cb191eba2c0a5f0f
e95d032674244f8e1faf2b6c8b82a5e186ab076c2f2f4ca8d55c774552fbf45a
ecbcb84cc9e4536be5b1186c356cfe3220f1cdad37c3259a43ef970cdd27b386
ee367e858ee4124d6e258c80abf34ff11fcec78d407c0653237a3e9b4347af2d