ts3card.x90qiu8.cn
Open in
urlscan Pro
35.189.150.41
Malicious Activity!
Public Scan
URL:
https://ts3card.x90qiu8.cn/webapp/index.php?ToTP01020101Action.do
Submission: On July 29 via automatic, source phishtank — Scanned from JP
Submission: On July 29 via automatic, source phishtank — Scanned from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 35.189.150.41, located in
Tokyo, Japan and
belongs to GOOGLE-CLOUD-PLATFORM, US.
The main domain is ts3card.x90qiu8.cn.
TLS certificate: Issued by R3 on July 28th 2022. Valid for: 3 months.
This is the only time ts3card.x90qiu8.cn was scanned on urlscan.io!
TLS certificate: Issued by R3 on July 28th 2022. Valid for: 3 months.
This is the only time ts3card.x90qiu8.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TS Cubic Card (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 35.189.150.41 35.189.150.41 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 12 | 1 |
12
35.189.150.41
(Tokyo, Japan)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 41.150.189.35.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 41.150.189.35.bc.googleusercontent.com
| ts3card.x90qiu8.cn |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
x90qiu8.cn
ts3card.x90qiu8.cn |
26 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 12 | ts3card.x90qiu8.cn |
ts3card.x90qiu8.cn
|
| 12 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| tscubic.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ts3card.x90qiu8.cn R3 |
2022-07-28 - 2022-10-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ts3card.x90qiu8.cn/webapp/index.php?ToTP01020101Action.do
Frame ID: 98699E45914D85D186F7B87291C62BA6
Requests: 12 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: https://tscubic.com/
Title: TS CUBIC CARD | ティーエス キュービック
Title: TS CUBIC CARD | ティーエス キュービック
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
ts3card.x90qiu8.cn/webapp/ |
10 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reset.css
ts3card.x90qiu8.cn/css/ |
1 KB 744 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.css
ts3card.x90qiu8.cn/css/ |
30 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common_sp.css
ts3card.x90qiu8.cn/css/ |
38 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login_mem.css
ts3card.x90qiu8.cn/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-id.css
ts3card.x90qiu8.cn/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_myts3.gif
ts3card.x90qiu8.cn/css/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_body.png
ts3card.x90qiu8.cn/login/img_first/ |
265 B 265 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_header.gif
ts3card.x90qiu8.cn/css/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
arrow01.gif
ts3card.x90qiu8.cn/img/common/ |
265 B 265 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ico_blank_login.png
ts3card.x90qiu8.cn/css/ |
273 B 352 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sp_btn_totop.png
ts3card.x90qiu8.cn/css/ |
265 B 265 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TS Cubic Card (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ts3card.x90qiu8.cn
35.189.150.41
4947daa3395c022c65c3e8a68cabbf38c7454c05b315d4ee21a90b83f9257968
4b636eb7f96462dc9b2066c2ee710e2a10b6fe7de1273dba5112fe8586c33645
51fa64ab2eee16fb95f2679f974b58948b7f94c61b05e4ce90909bdbd209d62d
5e93e3871e70f8cc64ebc3dc7f9ac3eaa3499339758e14213813970094b36420
7ad4b62a35b8f95ccf16bf0c0082b873dff669b98011e96f081e7c7f5b0b0e89
94fd5f15b2378cec483518b5fe927e34e3eede66237518377cea50582e5fa28d
a19f56e2cc27302be4bea8080c7b18c6ac6294adab9317d1089b47f7907cf8c7
a7a0d73aa10ca16a64cb0ef454242715a94fb466dd5c2e7bba7ebe5904cd8c13
b98dd7cbb7be0c5c4959a3fdf9c8c53aa2e126343b496a1e65caed21de1970dc
ccad27c37363e85058ff0b957ed17c5aa83a0565b018a9e24deef0acdf569feb