www.saisonruol.com
Open in
urlscan Pro
155.94.179.92
Malicious Activity!
Public Scan
URL:
https://www.saisonruol.com/
Submission: On January 21 via api from JP — Scanned from JP
Submission: On January 21 via api from JP — Scanned from JP
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 15 HTTP transactions.
The main IP is 155.94.179.92, located in
Los Angeles, United States and
belongs to ASN-QUADRANET-GLOBAL, US.
The main domain is www.saisonruol.com.
TLS certificate: Issued by R3 on January 21st 2022. Valid for: 3 months.
This is the only time www.saisonruol.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 21st 2022. Valid for: 3 months.
This is the only time www.saisonruol.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Saison Card (Financial) UC Card (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 155.94.179.92 155.94.179.92 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
| 1 | 218.12.76.151 218.12.76.151 | 4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone) | |
| 1 | 183.131.207.66 183.131.207.66 | 136190 (CHINATELE...) (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA) | |
| 15 | 3 |
13
155.94.179.92
(Los Angeles, United States)
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 155.94.179.92.static.quadranet.com
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 155.94.179.92.static.quadranet.com
| www.saisonruol.com |
1
218.12.76.151
(Baoding, China)
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
| js.users.51.la |
1
183.131.207.66
(China)
ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN)
ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN)
| ia.51.la |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
saisonruol.com
www.saisonruol.com |
288 KB |
| 2 |
51.la
js.users.51.la — Cisco Umbrella Rank: 44479 ia.51.la — Cisco Umbrella Rank: 49534 |
6 KB |
| 15 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | www.saisonruol.com |
www.saisonruol.com
|
| 1 | ia.51.la |
www.saisonruol.com
|
| 1 | js.users.51.la |
www.saisonruol.com
|
| 15 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.saisonruol.com R3 |
2022-01-21 - 2022-04-21 |
3 months | crt.sh |
| *.users.51.la GlobalSign GCC R3 DV TLS CA 2020 |
2020-08-27 - 2022-04-19 |
2 years | crt.sh |
| *.51.la GlobalSign GCC R3 DV TLS CA 2020 |
2020-08-27 - 2022-05-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.saisonruol.com/
Frame ID: 5CB75AB85F9066843E17866D8BB0A2FB
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.saisonruol.com/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.css
www.saisonruol.com/static/css/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
layout.css
www.saisonruol.com/static/css/ |
3 KB 883 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jackIframe.css
www.saisonruol.com/static/css/ |
1 KB 736 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon_saison.jpg
www.saisonruol.com/static/images/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
key_ani.gif
www.saisonruol.com/static/images/ |
177 KB 179 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
190902otukidama_520x230.jpg
www.saisonruol.com/static/images/ |
46 KB 47 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
window_icon.gif
www.saisonruol.com/static/images/ |
86 B 133 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
footer_img.png
www.saisonruol.com/static/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
21141405.js
js.users.51.la/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
base.css
www.saisonruol.com/static/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ie8_btnBG2.png
www.saisonruol.com/static/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ie8_btnBG.png
www.saisonruol.com/static/images/ |
40 KB 40 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
h3.gif
www.saisonruol.com/static/images/ |
120 B 189 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
go1
ia.51.la/ |
0 215 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Saison Card (Financial) UC Card (Financial)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| checkForm3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.saisonruol.com/ | Name: __tins__21141405 Value: %7B%22sid%22%3A%201642775083852%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201642776883852%7D |
|
| www.saisonruol.com/ | Name: __51cke__ Value: |
|
| www.saisonruol.com/ | Name: __51laig__ Value: 1 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ia.51.la
js.users.51.la
www.saisonruol.com
155.94.179.92
183.131.207.66
218.12.76.151
046dae1710bdf2c2a11b49acadad79bafc11b086ed2d79e3c1647f129a8b8ddd
1ed19ea7ee0a908c19890a25bf56f01efe45d145f87e8f7f6964a79b8bbcec0b
3d31581e6848ac89b1524d9e7dfab2fcdfe95aa870a2c1a878811892925f59a1
6dbfe2e8a966ff6518e842a34478a784dec9c08f2062692ae2e68ad9683c8631
75973c5ac18ad0d5511bbda1e1e4a804e939ff2871fb3776d2849455cfb2eb9f
766b9361bba45e02ec03d15b3e2ab80e70525570decb1473dfd6ab8ec49506fe
80efc844c7896eb930fd66d774edb08ff5982c60622a99e6ce553661a8aa929e
8fca1ac0be84adf4e4c152bd6db10305f9af5f7761a41a90cd1d55a18b892221
911ce713372a0044fe4b8a292410cdf85f4c0227a4c4e37facd6bc8a6bf2b2da
91c0c077d5086ad616a7ade895807e9193aa4cdb423098b47e6cd2be92d9f6d4
a348c7a8a94430562064f02f77308e3e8bbaf912420b8cd77ad3956bdfbf7df5
b35649790f19e96b18bf841f6f324d8426c41d2dd75accda0d5f4e0653944028
c3a3bb3c798a2f458710c68b961ea0a25e63e5cf38dbb3f721feaa46fff901c2
d8a6fc069a03cdcb918160c298a79fbb391662f183645c94360af5308b1918ad
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855