secu-mail.y.user.l.p369192.myauth-verify.com
Open in
urlscan Pro
111.90.142.92
Malicious Activity!
Public Scan
Effective URL: https://secu-mail.y.user.l.p369192.myauth-verify.com/
Submission: On June 26 via manual from JP
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on June 26th 2019. Valid for: 3 months.
This is the only time secu-mail.y.user.l.p369192.myauth-verify.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo Japan (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 13 | 111.90.142.92 111.90.142.92 | 45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd) | |
12 | 1 |
ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: beaver2.steeldns.com
secu-mail.y.user.l.p369192.myauth-verify.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
myauth-verify.com
1 redirects
secu-mail.y.user.l.p369192.myauth-verify.com |
160 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
13 | secu-mail.y.user.l.p369192.myauth-verify.com |
1 redirects
secu-mail.y.user.l.p369192.myauth-verify.com
|
12 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
secu-mail.y.user.l.p369192.myauth-verify.com Let's Encrypt Authority X3 |
2019-06-26 - 2019-09-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://secu-mail.y.user.l.p369192.myauth-verify.com/
Frame ID: 73E99B28D521061B1C2BF4890E00992A
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://secu-mail.y.user.l.p369192.myauth-verify.com/
HTTP 301
https://secu-mail.y.user.l.p369192.myauth-verify.com/ Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://secu-mail.y.user.l.p369192.myauth-verify.com/
HTTP 301
https://secu-mail.y.user.l.p369192.myauth-verify.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
secu-mail.y.user.l.p369192.myauth-verify.com/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.css
secu-mail.y.user.l.p369192.myauth-verify.com/uy/ |
39 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rsa.js
secu-mail.y.user.l.p369192.myauth-verify.com/uy/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.js
secu-mail.y.user.l.p369192.myauth-verify.com/uy/ |
94 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.js
secu-mail.y.user.l.p369192.myauth-verify.com/uy/ |
11 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.js
secu-mail.y.user.l.p369192.myauth-verify.com/uy/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.css
secu-mail.y.user.l.p369192.myauth-verify.com/uy/ |
798 B 389 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a.png
secu-mail.y.user.l.p369192.myauth-verify.com/by/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.png
secu-mail.y.user.l.p369192.myauth-verify.com/by/ |
164 B 205 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
background.jpg
secu-mail.y.user.l.p369192.myauth-verify.com/by/ |
106 KB 106 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b.gif
secu-mail.y.user.l.p369192.myauth-verify.com/by/ |
43 B 114 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mathlet.php
secu-mail.y.user.l.p369192.myauth-verify.com/ |
1 B 43 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo Japan (Online)76 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| BigInt object| onselectstart object| onselectionchange function| queueMicrotask string| addr_m string| uAgent object| mobilePhones function| RSAKeyPair function| twoDigit function| encryptedString function| decryptedString function| BarrettMu function| BarrettMu_modulo function| BarrettMu_multiplyMod function| BarrettMu_powMod number| biRadixBase number| biRadixBits number| bitsPerDigit number| biRadix number| biHalfRadix number| biRadixSquared number| maxDigitVal number| maxInteger number| maxDigits object| ZERO_ARRAY object| bigZero object| bigOne function| setMaxDigits number| dpl10 object| lr10 function| biFromDecimal function| biCopy function| biFromNumber function| reverseStr object| hexatrigesimalToChar function| biToString function| biToDecimal object| hexToChar function| digitToHex function| biToHex function| charToHex function| hexToDigit function| biFromHex function| biFromString function| biDump function| biAdd function| biSubtract function| biHighIndex function| biNumBits function| biMultiply function| biMultiplyDigit function| arrayCopy object| highBitMasks function| biShiftLeft object| lowBitMasks function| biShiftRight function| biMultiplyByRadixPower function| biDivideByRadixPower function| biModuloByRadixPower function| biCompare function| biDivideModulo function| biDivide function| biModulo function| biMultiplyMod function| biPow function| biPowMod function| $ function| jQuery function| showHint string| addr function| cmdEncrypt function| goMain object| key function| bodyLoad function| goClose object| result0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secu-mail.y.user.l.p369192.myauth-verify.com
111.90.142.92
1f19d9b979d33abc721fa7241518f28f936301003f539d71706b11de3fd053fb
479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b
55cbee339f7a1257aa27607d63e24ba0339590353da50721c4e5e57ca2151186
55d5606a8631de366f430f1b90f5bff2fe9f125963a8a24dd4c7711e6ad7e7b1
601c2723d4e2716eca5fff5158baed0288557f2cf620d95c70714603b2ec18a7
84f0aaec50e8bd7196b03c4a61f84cc0b39afab41bdd7e63c10e3a745df5f099
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
99226be14f24c6c0eb25ae44905ae1464c4a9b507da5fbbd2fdd3f236594b555
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c47fdeb57097d1710ca161ee6502e35545eec2e91c03d37d9db8fcb8d02795cd
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855