ts3card.chvflvi.cn
Open in
urlscan Pro
104.198.116.158
Malicious Activity!
Public Scan
Submitted URL: http://ts3card.chvflvi.cn/
Effective URL: https://ts3card.chvflvi.cn/webapp/index.php?ToTP01020101Action.do
Submission: On July 23 via api from JP — Scanned from JP
Effective URL: https://ts3card.chvflvi.cn/webapp/index.php?ToTP01020101Action.do
Submission: On July 23 via api from JP — Scanned from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 104.198.116.158, located in
Tokyo, Japan and
belongs to GOOGLE-CLOUD-PLATFORM, US.
The main domain is ts3card.chvflvi.cn.
TLS certificate: Issued by R3 on July 20th 2022. Valid for: 3 months.
This is the only time ts3card.chvflvi.cn was scanned on urlscan.io!
TLS certificate: Issued by R3 on July 20th 2022. Valid for: 3 months.
This is the only time ts3card.chvflvi.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TS Cubic Card (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 14 | 104.198.116.158 104.198.116.158 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 12 | 1 |
14
104.198.116.158
(Tokyo, Japan)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 158.116.198.104.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 158.116.198.104.bc.googleusercontent.com
| ts3card.chvflvi.cn |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
chvflvi.cn
2 redirects
ts3card.chvflvi.cn |
26 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 14 | ts3card.chvflvi.cn |
2 redirects
ts3card.chvflvi.cn
|
| 12 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| tscubic.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ts3card.chvflvi.cn R3 |
2022-07-20 - 2022-10-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ts3card.chvflvi.cn/webapp/index.php?ToTP01020101Action.do
Frame ID: 8909D6970FF9237CC49CDEB8DE11254A
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
MY TS3ログイン｜TS CUBIC カードPage URL History Show full URLs
-
http://ts3card.chvflvi.cn/
HTTP 301
https://ts3card.chvflvi.cn/ HTTP 302
https://ts3card.chvflvi.cn/webapp/index.php?ToTP01020101Action.do Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://tscubic.com/
Title: TS CUBIC CARD | ティーエス キュービック
Title: TS CUBIC CARD | ティーエス キュービック
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ts3card.chvflvi.cn/
HTTP 301
https://ts3card.chvflvi.cn/ HTTP 302
https://ts3card.chvflvi.cn/webapp/index.php?ToTP01020101Action.do Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
ts3card.chvflvi.cn/webapp/ Redirect Chain
|
10 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reset.css
ts3card.chvflvi.cn/css/ |
1 KB 744 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.css
ts3card.chvflvi.cn/css/ |
30 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common_sp.css
ts3card.chvflvi.cn/css/ |
38 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login_mem.css
ts3card.chvflvi.cn/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-id.css
ts3card.chvflvi.cn/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_myts3.gif
ts3card.chvflvi.cn/css/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_body.png
ts3card.chvflvi.cn/login/img_first/ |
265 B 265 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_header.gif
ts3card.chvflvi.cn/css/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
arrow01.gif
ts3card.chvflvi.cn/img/common/ |
265 B 265 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ico_blank_login.png
ts3card.chvflvi.cn/css/ |
273 B 352 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sp_btn_totop.png
ts3card.chvflvi.cn/css/ |
265 B 265 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TS Cubic Card (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ts3card.chvflvi.cn
104.198.116.158
4947daa3395c022c65c3e8a68cabbf38c7454c05b315d4ee21a90b83f9257968
4b636eb7f96462dc9b2066c2ee710e2a10b6fe7de1273dba5112fe8586c33645
51fa64ab2eee16fb95f2679f974b58948b7f94c61b05e4ce90909bdbd209d62d
5e93e3871e70f8cc64ebc3dc7f9ac3eaa3499339758e14213813970094b36420
7ad4b62a35b8f95ccf16bf0c0082b873dff669b98011e96f081e7c7f5b0b0e89
94fd5f15b2378cec483518b5fe927e34e3eede66237518377cea50582e5fa28d
a19f56e2cc27302be4bea8080c7b18c6ac6294adab9317d1089b47f7907cf8c7
a4aa0cc404c788dc792488c265dcf44c56fdd22ea3891053f8a1b9285f1a3c46
a7a0d73aa10ca16a64cb0ef454242715a94fb466dd5c2e7bba7ebe5904cd8c13
b98dd7cbb7be0c5c4959a3fdf9c8c53aa2e126343b496a1e65caed21de1970dc