aabbcc0909.xyz Open in urlscan Pro
95.85.73.245 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://aabbcc0909.xyz/
Submission: On May 19 via automatic, source phishtank (May 19th 2022, 1:14:11 am UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 95.85.73.245, located in Central, Hong Kong and belongs to GHOST, LU. The main domain is aabbcc0909.xyz.
TLS certificate: Issued by R3 on May 18th 2022. Valid for: 3 months.

This is the only time aabbcc0909.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
8	95.85.73.245 95.85.73.245	202422 (GHOST) (GHOST)
1	40.85.113.106 40.85.113.106	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
9	2

8 95.85.73.245 (Central, Hong Kong)

ASN202422 (GHOST, LU)
PTR: heykong005.example.com

aabbcc0909.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.85.113.106 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

pv.sohu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	aabbcc0909.xyz aabbcc0909.xyz	1 MB
1	sohu.com pv.sohu.com — Cisco Umbrella Rank: 19504	236 B
9	2

	Domain	Requested by
8	aabbcc0909.xyz	aabbcc0909.xyz
1	pv.sohu.com	aabbcc0909.xyz
9	2

This site contains no links.

Subject Issuer	Validity	Valid
aabbcc0909.xyz R3	`2022-05-18` - `2022-08-16`	3 months	crt.sh
www.sohu.com Secure Site CA G2	`2021-08-09` - `2022-09-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://aabbcc0909.xyz/
Frame ID: 40BECA7165C52313C6CCF5A77047D4C8
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PayPal

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1151 kB
Transfer

4522 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response aabbcc0909.xyz/	727 B 1015 B	845ms 278ms	Document text/html	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Full URL https://aabbcc0909.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `d42012c7e412c8ce71cc24ca87004fd4f24a976b8de791cdc5904bc04332851c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS access-control-allow-origin * cache-control max-age=0 no-cache content-length 727 content-type text/html; charset=utf-8 date Thu, 19 May 2022 01:14:04 GMT last-modified Wed, 18 May 2022 05:47:00 GMT server nginx
GET H2	200	app.068ef265af2f69ec1d6046f8360902d4.css aabbcc0909.xyz/static/css/	738 KB 138 KB	286ms 285ms	Stylesheet text/css	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Full URL https://aabbcc0909.xyz/static/css/app.068ef265af2f69ec1d6046f8360902d4.css Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `75f08f024d616d744fcad0f1c0e711bf32bd80c259b5a48895ebf62e5672f99c` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:05 GMT content-encoding gzip last-modified Wed, 18 May 2022 05:47:00 GMT server nginx vary Accept-Encoding access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=43200 x-cache MISS access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With expires Thu, 19 May 2022 13:14:05 GMT
GET H2	200	manifest.3ad1d5771e9b13dbdad2.js Show response aabbcc0909.xyz/static/js/	800 B 1 KB	287ms 286ms	Script application/javascript	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Full URL https://aabbcc0909.xyz/static/js/manifest.3ad1d5771e9b13dbdad2.js Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:05 GMT last-modified Wed, 18 May 2022 05:47:00 GMT server nginx access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=43200 x-cache MISS access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With content-length 800 expires Thu, 19 May 2022 13:14:05 GMT
GET H2	200	vendor.1335c66d67a2d991e3dd.js Show response aabbcc0909.xyz/static/js/	4 MB 900 KB	560ms 560ms	Script application/javascript	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Full URL https://aabbcc0909.xyz/static/js/vendor.1335c66d67a2d991e3dd.js Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `8d4e8460a070d9e6b9a4cc78092b8b8bfd08fc2552d7ee6c8aff3d0d7aedbb88` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:05 GMT content-encoding gzip last-modified Wed, 18 May 2022 05:47:00 GMT server nginx vary Accept-Encoding access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=43200 x-cache MISS access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With expires Thu, 19 May 2022 13:14:05 GMT
GET H2	200	app.951c0f8e70e0a15f1331.js Show response aabbcc0909.xyz/static/js/	106 KB 38 KB	560ms 560ms	Script application/javascript	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Full URL https://aabbcc0909.xyz/static/js/app.951c0f8e70e0a15f1331.js Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `484aebc150dd927248478b8ed2710bf6ebc472e79a7d2a4ad122b97ebbba4ff8` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:05 GMT content-encoding gzip last-modified Wed, 18 May 2022 05:47:00 GMT server nginx vary Accept-Encoding access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=43200 x-cache MISS access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With expires Thu, 19 May 2022 13:14:05 GMT
GET H2	200	cityjson Show response pv.sohu.com/	76 B 236 B	2406ms 282ms	Script text/json	40.85.113.106 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://pv.sohu.com/cityjson?ie=utf-8 Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 40.85.113.106 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.0.15 / Resource Hash `ce4618180d12a47279d55de3d32ec37ff564ef7736cbf94ffd13dcf3c927d068` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:07 GMT fss-proxy Powered by 7345503.12785001.8591282, Powered by 4347954.4610108.7765046 server nginx/1.0.15 content-length 76 content-type text/json; charset=utf-8
GET H2	200	getiplang Show response aabbcc0909.xyz/auth/	85 B 322 B	725ms 725ms	XHR application/json	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Full URL https://aabbcc0909.xyz/auth/getiplang Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/static/js/vendor.1335c66d67a2d991e3dd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `d2fcd67dbaa2863c2cca15b08f4dc100d8f325519c64b16806e3ac8799e0456c` Request headers Accept application/json, text/plain, / Referer https://aabbcc0909.xyz/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:07 GMT server nginx access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin * cache-control no-cache access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With content-length 85
GET H2	200	momgram.png aabbcc0909.xyz/static/assets/img/	2 KB 2 KB	281ms 281ms	Image image/png	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Show image Full URL https://aabbcc0909.xyz/static/assets/img/momgram.png Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/static/css/app.068ef265af2f69ec1d6046f8360902d4.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/static/css/app.068ef265af2f69ec1d6046f8360902d4.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:07 GMT last-modified Wed, 18 May 2022 05:47:00 GMT server nginx access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=43200 x-cache MISS access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With content-length 1768 expires Thu, 19 May 2022 13:14:07 GMT
GET H2	200	sprite_countries_flag4.d3682f0.png aabbcc0909.xyz/static/img/	71 KB 71 KB	279ms 278ms	Image image/png	95.85.73.245 GHOST
General Check archive.org Show headers Download Go to Show image Full URL https://aabbcc0909.xyz/static/img/sprite_countries_flag4.d3682f0.png Requested by Host: aabbcc0909.xyz URL: https://aabbcc0909.xyz/static/css/app.068ef265af2f69ec1d6046f8360902d4.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.245 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS heykong005.example.com Software nginx / Resource Hash `9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550` Request headers accept-language de-DE,de;q=0.9 Referer https://aabbcc0909.xyz/static/css/app.068ef265af2f69ec1d6046f8360902d4.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Thu, 19 May 2022 01:14:07 GMT last-modified Wed, 18 May 2022 05:47:00 GMT server nginx access-control-allow-methods PUT,POST,GET,DELETE,OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=43200 x-cache MISS access-control-allow-headers Content-Type,Content-Length,Authorization,Accept,X-Requested-With content-length 72320 expires Thu, 19 May 2022 13:14:07 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aabbcc0909.xyz
pv.sohu.com
40.85.113.106
95.85.73.245
484aebc150dd927248478b8ed2710bf6ebc472e79a7d2a4ad122b97ebbba4ff8
75f08f024d616d744fcad0f1c0e711bf32bd80c259b5a48895ebf62e5672f99c
8d4e8460a070d9e6b9a4cc78092b8b8bfd08fc2552d7ee6c8aff3d0d7aedbb88
9c14b809ca4d5de12a569239d46ab8ef5f7ac1b3804c9801583cbafb66d3e550
b3f1bf1d5e25838bcad8535a2b700486644f4ea888e46c77d3e82783cb9da1b4
ce4618180d12a47279d55de3d32ec37ff564ef7736cbf94ffd13dcf3c927d068
d2fcd67dbaa2863c2cca15b08f4dc100d8f325519c64b16806e3ac8799e0456c
d42012c7e412c8ce71cc24ca87004fd4f24a976b8de791cdc5904bc04332851c
fcdf3becb34727e89ae7395ac70df92e4537639ae903784e201f479dd70f3ef0

aabbcc0909.xyz Open in urlscan Pro 95.85.73.245 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1151 kBTransfer

4522 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

aabbcc0909.xyz Open in urlscan Pro
95.85.73.245 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1151 kB
Transfer

4522 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!