www.login.kddii-au.com.eftjiou.cn

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 173.254.231.97, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is www.login.kddii-au.com.eftjiou.cn.
TLS certificate: Issued by R3 on March 12th 2022. Valid for: 3 months.

This is the only time www.login.kddii-au.com.eftjiou.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address		AS Autonomous System
5	173.254.231.97 173.254.231.97		8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
5	1

5 173.254.231.97 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)

www.login.kddii-au.com.eftjiou.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	eftjiou.cn www.login.kddii-au.com.eftjiou.cn	86 KB
5	1

	Domain	Requested by
5	www.login.kddii-au.com.eftjiou.cn	www.login.kddii-au.com.eftjiou.cn
5	1

This site contains no links.

Subject Issuer	Validity	Valid
www.amazon.co.jploginvcxdfs8ds.gjpxxiu.cn R3	`2022-03-12` - `2022-06-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.login.kddii-au.com.eftjiou.cn/
Frame ID: 977461CD2079E6CA7906D791C845158D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

86 kB
Transfer

1207 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.login.kddii-au.com.eftjiou.cn/	546 B 456 B	956ms 233ms	Document text/html	173.254.231.97 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://www.login.kddii-au.com.eftjiou.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.231.97 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS Software Apache / Resource Hash `8eda57e28213521c8ba51dc26def50db16af5c140cc5f824dcb4930fa5bc0d06` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers date Sat, 12 Mar 2022 20:52:38 GMT server Apache last-modified Sat, 19 Jun 2021 23:23:08 GMT etag "222-5c526b912cf00-gzip" accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 320 content-type text/html
GET H2	200	app.6d2caa6cca41ac53624199ae78e34326.css www.login.kddii-au.com.eftjiou.cn/static/css/	964 KB 0	18420ms 18419ms	Stylesheet text/css	173.254.231.97 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://www.login.kddii-au.com.eftjiou.cn/static/css/app.6d2caa6cca41ac53624199ae78e34326.css Requested by Host: www.login.kddii-au.com.eftjiou.cn URL: https://www.login.kddii-au.com.eftjiou.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.231.97 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS Software Apache / Resource Hash Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.login.kddii-au.com.eftjiou.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Sat, 12 Mar 2022 20:52:38 GMT content-encoding gzip last-modified Sat, 19 Jun 2021 23:23:08 GMT server Apache etag "420568-5c526b912cf00-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes
GET H2	200	manifest.32fe08875ed3ca164371.js Show response www.login.kddii-au.com.eftjiou.cn/static/js/	2 KB 1 KB	293ms 292ms	Script application/javascript	173.254.231.97 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://www.login.kddii-au.com.eftjiou.cn/static/js/manifest.32fe08875ed3ca164371.js Requested by Host: www.login.kddii-au.com.eftjiou.cn URL: https://www.login.kddii-au.com.eftjiou.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.231.97 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS Software Apache / Resource Hash `f2b7bb90aa441ccaf5349c683f499dbeff828944bd7351dcab8928e75058aada` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.login.kddii-au.com.eftjiou.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Sat, 12 Mar 2022 20:52:38 GMT content-encoding gzip last-modified Sat, 19 Jun 2021 23:23:08 GMT server Apache etag "6f8-5c526b912cf00-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1049
GET H2	200	vendor.8942a87b5a70d06cf6ea.js Show response www.login.kddii-au.com.eftjiou.cn/static/js/	233 KB 82 KB	13958ms 13957ms	Script application/javascript	173.254.231.97 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://www.login.kddii-au.com.eftjiou.cn/static/js/vendor.8942a87b5a70d06cf6ea.js Requested by Host: www.login.kddii-au.com.eftjiou.cn URL: https://www.login.kddii-au.com.eftjiou.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.231.97 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS Software Apache / Resource Hash `1f940df454ae24dce204417bc1652b54a5928fa332ae82c5a54c61d894fd8fec` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.login.kddii-au.com.eftjiou.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Sat, 12 Mar 2022 20:52:38 GMT content-encoding gzip last-modified Sat, 19 Jun 2021 23:23:08 GMT server Apache etag "3a533-5c526b912cf00-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	app.11d26497eb1356c36e30.js Show response www.login.kddii-au.com.eftjiou.cn/static/js/	7 KB 2 KB	294ms 293ms	Script application/javascript	173.254.231.97 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://www.login.kddii-au.com.eftjiou.cn/static/js/app.11d26497eb1356c36e30.js Requested by Host: www.login.kddii-au.com.eftjiou.cn URL: https://www.login.kddii-au.com.eftjiou.cn/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.231.97 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS Software Apache / Resource Hash `7b2dfdedde733db3cdfa710a97a591de27aedbf20c9be7f2e80bd22b70f14b48` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://www.login.kddii-au.com.eftjiou.cn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Sat, 12 Mar 2022 20:52:38 GMT content-encoding gzip last-modified Sat, 19 Jun 2021 23:23:08 GMT server Apache etag "1dc8-5c526b912cf00-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1945

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.login.kddii-au.com.eftjiou.cn
173.254.231.97
1f940df454ae24dce204417bc1652b54a5928fa332ae82c5a54c61d894fd8fec
7b2dfdedde733db3cdfa710a97a591de27aedbf20c9be7f2e80bd22b70f14b48
8eda57e28213521c8ba51dc26def50db16af5c140cc5f824dcb4930fa5bc0d06
f2b7bb90aa441ccaf5349c683f499dbeff828944bd7351dcab8928e75058aada

www.login.kddii-au.com.eftjiou.cn Open in urlscan Pro 173.254.231.97 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

86 kBTransfer

1207 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

www.login.kddii-au.com.eftjiou.cn Open in urlscan Pro
173.254.231.97 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

86 kB
Transfer

1207 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!