nijurabeddoshop.online Open in urlscan Pro
24.199.114.39 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://nijurabeddoshop.online/
Submission Tags: tweet @ecarlesi #phishing #hostinger Search All
Submission: On January 23 via api (January 23rd 2023, 6:36:54 am UTC) from FI — Scanned from FI

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 24.199.114.39, located in United States and belongs to DIGITALOCEAN-ASN, US. The main domain is nijurabeddoshop.online.
TLS certificate: Issued by R3 on January 22nd 2023. Valid for: 3 months.

This is the only time nijurabeddoshop.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
8	24.199.114.39 24.199.114.39	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	2600:9000:20e... 2600:9000:20eb:cc00:18:6c16:27c0:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
2	34.107.203.234 34.107.203.234	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
21	5

8 24.199.114.39 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)

nijurabeddoshop.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:20eb:cc00:18:6c16:27c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

tools.luckyorange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.203.234 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.203.107.34.bc.googleusercontent.com

settings.luckyorange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	nijurabeddoshop.online nijurabeddoshop.online	270 KB
6	gstatic.com fonts.gstatic.com	48 KB
5	luckyorange.com tools.luckyorange.com — Cisco Umbrella Rank: 12932 settings.luckyorange.com — Cisco Umbrella Rank: 13165	87 KB
21	3

	Domain	Requested by
8	nijurabeddoshop.online	nijurabeddoshop.online
6	fonts.gstatic.com	nijurabeddoshop.online
3	tools.luckyorange.com	nijurabeddoshop.online tools.luckyorange.com
2	settings.luckyorange.com	tools.luckyorange.com
21	4

This site contains no links.

Subject Issuer	Validity	Valid
nijurabeddoshop.online R3	`2023-01-22` - `2023-04-22`	3 months	crt.sh
luckyorange.com Amazon	`2022-12-18` - `2024-01-16`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
settings.luckyorange.com R3	`2022-12-30` - `2023-03-30`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://nijurabeddoshop.online/
Frame ID: ACBE1E1B644ADAC59322C2FC4B59B32A
Requests: 15 HTTP requests in this frame

Frame: https://nijurabeddoshop.online/iframe.html
Frame ID: E3374A8CDB8EA20968D97B0582C70CB0
Requests: 2 HTTP requests in this frame

Frame: https://tools.luckyorange.com/core/core.js?v=f24356e
Frame ID: C06699216B0E6F5C0721225B891A1E22
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

xxdef

Page Statistics

21
Requests

90 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

405 kB
Transfer

965 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
nijurabeddoshop.online/ 340 KB
68 KB 806ms
389ms Document
text/html 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PHP/8.0.27 PleskLin
Resource Hash: fbbaf48099014106dd516acb165d8dc3cee75d729cf6a1de8eee3399283dfda5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 23 Jan 2023 06:36:48 GMT
server: nginx
x-powered-by: PHP/8.0.27 PleskLin

GET
H2 200 lo.js Show response
tools.luckyorange.com/core/ 11 KB
5 KB 199ms
56ms Script
application/javascript 2600:9000:20eb:cc00:18:6c16:27c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tools.luckyorange.com/core/lo.js?site-id=d1c3c9c1
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:cc00:18:6c16:27c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: da34f6296bcad0af467d8776d377de8dabe85d985dcf5a11507a4439d6bbb571

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://nijurabeddoshop.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 05:58:43 GMT
content-encoding: gzip
via: 1.1 1ac3fd533bf6be1b511077f8b8e23bfc.cloudfront.net (CloudFront)
last-modified: Mon, 10 Oct 2022 21:25:15 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
age: 2287
etag: "48be70be7c53713f09434cac27c37598"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
content-length: 4300
x-amz-cf-id: jjIxW15VxO4nAb9yz8Rs8E5PDBnISTk_KYg-jOsMKPoN6EhbbKhJbA==

GET
H2 200 fuji.jpg
nijurabeddoshop.online/img/ 2 KB
2 KB 359ms
356ms Image
image/jpeg 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nijurabeddoshop.online/img/fuji.jpg
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: f70249b342aecd9e3d2367aea39df606e92562f9d7945ad8849b36cd3e3a85a1

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://nijurabeddoshop.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
last-modified: Sun, 22 Jan 2023 22:19:45 GMT
server: nginx
etag: "63cdb681-7d4"
x-powered-by: PleskLin
content-type: image/jpeg
accept-ranges: bytes
content-length: 2004

GET
H2 200 kane.webp
nijurabeddoshop.online/img/ 25 KB
25 KB 357ms
355ms Image
image/webp 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nijurabeddoshop.online/img/kane.webp
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: f719b24d27c3528bf9cd86a72132614f08975366b3c3131293ef535299e07266

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://nijurabeddoshop.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
last-modified: Sun, 22 Jan 2023 22:19:45 GMT
server: nginx
etag: "63cdb681-6440"
x-powered-by: PleskLin
content-type: image/webp
accept-ranges: bytes
content-length: 25664

GET
H2 200 takibi.webp
nijurabeddoshop.online/img/ 82 KB
82 KB 208ms
206ms Image
image/webp 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nijurabeddoshop.online/img/takibi.webp
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 6fed270b46551fd04f21707e65d374aa21d9a42acced080b0d5b53967293f6f3

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://nijurabeddoshop.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
last-modified: Sun, 22 Jan 2023 22:19:49 GMT
server: nginx
etag: "63cdb685-148d0"
x-powered-by: PleskLin
content-type: image/webp
accept-ranges: bytes
content-length: 84176

GET
H2 200 kyoto.webp
nijurabeddoshop.online/img/ 83 KB
83 KB 358ms
357ms Image
image/webp 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nijurabeddoshop.online/img/kyoto.webp
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 7d75e2349fe27deabefe4a9cf94c8216a51f52db66ba5179e20f875cd5b04d54

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://nijurabeddoshop.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
last-modified: Sun, 22 Jan 2023 22:19:47 GMT
server: nginx
etag: "63cdb683-14b96"
x-powered-by: PleskLin
content-type: image/webp
accept-ranges: bytes
content-length: 84886

GET
H2 200 pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 215ms
62ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2

Requested by

Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 20 Jan 2023 15:34:40 GMT
x-content-type-options: nosniff
age: 226929
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7748
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:21:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Jan 2024 15:34:40 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 222ms
67ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 19 Jan 2023 07:19:38 GMT
x-content-type-options: nosniff
age: 343031
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Jan 2024 07:19:38 GMT

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 229ms
76ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 19 Jan 2023 22:20:50 GMT
x-content-type-options: nosniff
age: 288959
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Jan 2024 22:20:50 GMT

GET
H2 200 d1c3c9c1 Show response
settings.luckyorange.com/ 4 KB
2 KB 165ms
163ms Fetch
application/json 34.107.203.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://settings.luckyorange.com/d1c3c9c1
Requested by: Host: tools.luckyorange.com
URL: https://tools.luckyorange.com/core/lo.js?site-id=d1c3c9c1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.203.107.34.bc.googleusercontent.com
Software: /
Resource Hash: 8cf9b3af44d4662361a4c1b702050470eb6db627ff09ebc487037dd65f34eaef

Request headers

Referer: https://nijurabeddoshop.online/
accept-language: fi-FI,fi;q=0.9
x-lucky-uid: undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
x-lucky-referrer

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
content-encoding: gzip
via: 1.1 google
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nijurabeddoshop.online
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 d1c3c9c1
settings.luckyorange.com/ Frame 0
0 249ms
161ms Preflight 34.107.203.234
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://settings.luckyorange.com/d1c3c9c1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 234.203.107.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-lucky-referrer,x-lucky-uid
Access-Control-Request-Method: GET
Origin: https://nijurabeddoshop.online
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Access-Control-Allow-Origin,Authorization,Content-Type,X-Lucky-Uid,X-Lucky-Site-Id,X-Lucky-Impersonate,X-Lucky-Session-Id,X-Lucky-Referrer
access-control-allow-methods: POST,GET,PUT,PATCH,DELETE,OPTIONS
access-control-allow-origin: https://nijurabeddoshop.online
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Jan 2023 06:36:49 GMT
via: 1.1 google

GET
H2 200 iframe.html Show response
nijurabeddoshop.online/ Frame E337 1 KB
687 B 341ms
340ms Document
text/html 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://nijurabeddoshop.online/iframe.html
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3

Request headers

Referer: https://nijurabeddoshop.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

content-encoding: br
content-type: text/html
date: Mon, 23 Jan 2023 06:36:49 GMT
etag: W/"63cdb679-4d2"
last-modified: Sun, 22 Jan 2023 22:19:37 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 206 takashi.mp3
nijurabeddoshop.online/img/ 79 KB
0 327ms
327ms Media
audio/mpeg 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://nijurabeddoshop.online/img/takashi.mp3
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash

Request headers

Referer: https://nijurabeddoshop.online/
Accept-Encoding: identity;q=1, *;q=0
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
last-modified: Sun, 22 Jan 2023 22:19:48 GMT
server: nginx
etag: "63cdb684-13c20"
x-powered-by: PleskLin
content-type: audio/mpeg
Content-Range: bytes 0-80927/80928
Content-Length: 80928

GET
H2 206 yaketsuku.mp3
nijurabeddoshop.online/img/ 8 KB
8 KB 326ms
326ms Media
audio/mpeg 24.199.114.39
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://nijurabeddoshop.online/img/yaketsuku.mp3
Requested by: Host: nijurabeddoshop.online
URL: https://nijurabeddoshop.online/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 24.199.114.39 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Request headers

Referer: https://nijurabeddoshop.online/
Accept-Encoding: identity;q=1, *;q=0
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 23 Jan 2023 06:36:49 GMT
last-modified: Sun, 22 Jan 2023 22:19:49 GMT
server: nginx
etag: "63cdb685-20d5"
x-powered-by: PleskLin
content-type: audio/mpeg
Content-Range: bytes 0-8404/8405
Content-Length: 8405

GET
H2 200 core.js Show response
tools.luckyorange.com/core/ Frame C066 204 KB
62 KB 176ms
61ms Script
application/javascript 2600:9000:20eb:cc00:18:6c16:27c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tools.luckyorange.com/core/core.js?v=f24356e
Requested by: Host: tools.luckyorange.com
URL: https://tools.luckyorange.com/core/lo.js?site-id=d1c3c9c1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:cc00:18:6c16:27c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c8d2428b732257acc3e5ab95325516b2e6d806cc267cc4f40bca979faf87c43a

Request headers

Referer
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 23:46:28 GMT
content-encoding: gzip
via: 1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 24622
x-cache: Hit from cloudfront
content-length: 63361
last-modified: Mon, 10 Oct 2022 21:25:15 GMT
server: AmazonS3
etag: "f73bf53f98fbf3e47bb206770ebfc7c0"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: c8LESyFLyLDgBlJ1sl5KD8-VrSuj41nYHdj7AbuEOjXu3AGjA1CHAw==

GET
H2 200 frame.js Show response
tools.luckyorange.com/core/ Frame E337 57 KB
18 KB 61ms
61ms Script
application/javascript 2600:9000:20eb:cc00:18:6c16:27c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tools.luckyorange.com/core/frame.js?v=f24356e
Requested by: Host: tools.luckyorange.com
URL: https://tools.luckyorange.com/core/core.js?v=f24356e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:cc00:18:6c16:27c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 97a16a4d21e33a2883561ff1ad5f5fd38a7aa3cfc799096b2ef469c5ecb7afbf

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 06:24:35 GMT
content-encoding: gzip
via: 1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 735
x-cache: Hit from cloudfront
content-length: 18348
last-modified: Mon, 10 Oct 2022 21:25:15 GMT
server: AmazonS3
etag: "5858602d3a4fb0a423f394ff64ba08da"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: z8fBoBthDfdkizFoLcsIQ-6kz_SrTopY_f9eEkz4ONMcuBcOCvJMEg==

GET
BLOB 200
OK 6bef36c6-7a85-495f-813f-9fe25c6e82eb
https://nijurabeddoshop.online/ Frame C066 0
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://nijurabeddoshop.online/6bef36c6-7a85-495f-813f-9fe25c6e82eb
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fi-FI,fi;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Length: 0
Content-Type

GET
BLOB 200
OK 74fbe15d-664d-48fb-b1ac-bd08e2f249d7
https://nijurabeddoshop.online/ Frame C066 22 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://nijurabeddoshop.online/74fbe15d-664d-48fb-b1ac-bd08e2f249d7
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: facdb180b697f86f717823c9b0690f55f4792754d6df3bfe356624240d9a0253

Request headers

accept-language: fi-FI,fi;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Length: 22873
Content-Type

GET
H2 200 pxiByp8kv8JHgFVrLDD4Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 63ms
61ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDD4Z1xlFQ.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60bf0aba6526436f3930c58c12047687fbb6bff4dd180cce4613458ed3439ea2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 06:16:48 GMT
x-content-type-options: nosniff
age: 87602
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7824
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:52:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 22 Jan 2024 06:16:48 GMT

GET
H3 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 62ms
62ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 15:59:12 GMT
x-content-type-options: nosniff
age: 571058
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8000
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:59:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Jan 2024 15:59:12 GMT

GET
H3 200 pxiGyp8kv8JHgFVrJJLucHtA.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 63ms
62ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiGyp8kv8JHgFVrJJLucHtA.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nijurabeddoshop.online/
Origin: https://nijurabeddoshop.online
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 15:21:01 GMT
x-content-type-options: nosniff
age: 486950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8668
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:07:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Jan 2024 15:21:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.nijurabeddoshop.online/	1970-01-20 18:43:35	Name: lo-uid Value: d1c3c9c1-1674455809524-a597bcc6f900866a
			.nijurabeddoshop.online/	1970-01-20 18:43:35	Name: lo-visits Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
nijurabeddoshop.online
settings.luckyorange.com
tools.luckyorange.com
24.199.114.39
2600:9000:20eb:cc00:18:6c16:27c0:93a1
2a00:1450:400d:80a::2003
34.107.203.234
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
60bf0aba6526436f3930c58c12047687fbb6bff4dd180cce4613458ed3439ea2
6fed270b46551fd04f21707e65d374aa21d9a42acced080b0d5b53967293f6f3
7d75e2349fe27deabefe4a9cf94c8216a51f52db66ba5179e20f875cd5b04d54
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8cf9b3af44d4662361a4c1b702050470eb6db627ff09ebc487037dd65f34eaef
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
97a16a4d21e33a2883561ff1ad5f5fd38a7aa3cfc799096b2ef469c5ecb7afbf
c8d2428b732257acc3e5ab95325516b2e6d806cc267cc4f40bca979faf87c43a
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
da34f6296bcad0af467d8776d377de8dabe85d985dcf5a11507a4439d6bbb571
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f70249b342aecd9e3d2367aea39df606e92562f9d7945ad8849b36cd3e3a85a1
f719b24d27c3528bf9cd86a72132614f08975366b3c3131293ef535299e07266
facdb180b697f86f717823c9b0690f55f4792754d6df3bfe356624240d9a0253
fbbaf48099014106dd516acb165d8dc3cee75d729cf6a1de8eee3399283dfda5

nijurabeddoshop.online Open in urlscan Pro 24.199.114.39 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

21 Requests

90 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

405 kBTransfer

965 kBSize

2 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

2 Cookies

Indicators

nijurabeddoshop.online Open in urlscan Pro
24.199.114.39 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

90 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

405 kB
Transfer

965 kB
Size

2
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!