xigua.mymallhk.com Open in urlscan Pro
154.39.158.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://xigua.mymallhk.com/public/payview?payid=6
Submission: On August 08 via manual (August 8th 2022, 3:46:34 am UTC) from JP — Scanned from JP

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 23 HTTP transactions. The main IP is 154.39.158.16, located in United States and belongs to HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK. The main domain is xigua.mymallhk.com.
TLS certificate: Issued by R3 on August 7th 2022. Valid for: 3 months.

This is the only time xigua.mymallhk.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Japan Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
17	154.39.158.16 154.39.158.16	139646 (HKMTC-AS-...) (HKMTC-AS-AP HONG KONG Megalayer Technology Co.)
2	35.75.187.174 35.75.187.174	16509 (AMAZON-02) (AMAZON-02)
1	184.26.43.196 184.26.43.196	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2404:6800:400... 2404:6800:4004:827::200a	15169 (GOOGLE) (GOOGLE)
2	2404:6800:400... 2404:6800:4004:823::2003	15169 (GOOGLE) (GOOGLE)
23	5

17 154.39.158.16 (United States)

ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK)

xigua.mymallhk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.75.187.174 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-75-187-174.ap-northeast-1.compute.amazonaws.com

directss.jp-bank.japanpost.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.26.43.196 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-26-43-196.deploy.static.akamaitechnologies.com

direct.jp-bank.japanpost.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:827::200a (Australia)

ASN15169 (GOOGLE, US)

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:823::2003 (Australia)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	mymallhk.com xigua.mymallhk.com	553 KB
3	japanpost.jp directss.jp-bank.japanpost.jp direct.jp-bank.japanpost.jp	65 KB
2	gstatic.com www.gstatic.com	3 KB
1	googleapis.com translate.googleapis.com — Cisco Umbrella Rank: 1094	4 KB
23	4

	Domain	Requested by
17	xigua.mymallhk.com	xigua.mymallhk.com
2	www.gstatic.com	xigua.mymallhk.com translate.googleapis.com
2	directss.jp-bank.japanpost.jp	xigua.mymallhk.com
1	translate.googleapis.com	xigua.mymallhk.com
1	direct.jp-bank.japanpost.jp	xigua.mymallhk.com
23	5

This site contains no links.

Subject Issuer	Validity	Valid
hlgshopping.com R3	`2022-08-07` - `2022-11-05`	3 months	crt.sh
directacct.jp-bank.japanpost.jp DigiCert SHA2 Extended Validation Server CA	`2022-03-16` - `2023-04-16`	a year	crt.sh
direct.jp-bank.japanpost.jp DigiCert SHA2 Extended Validation Server CA	`2021-12-22` - `2022-12-22`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xigua.mymallhk.com/public/payview?payid=6
Frame ID: B51D9630AB593FE93A30186E063A157B
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ゆうちょダイレクト | ログイン

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

23
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

625 kB
Transfer

645 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request payview Show response
xigua.mymallhk.com/public/ 16 KB
5 KB 794ms
71ms Document
text/html 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: c47dd87c37f1a7bbaa65e263df95c797ed700a402420e15481e1fedc21a93b9f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 08 Aug 2022 03:46:28 GMT
environment: Production
isupdateapp: 0
server: nginx
vary: Accept-Encoding
version

GET
H2 200 dgCJbase.css
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/ 161 KB
162 KB 75ms
69ms Stylesheet
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 5475e1da7a34565a6fd843a098a04e798f0294af6b9a32d5c4873f28a75e8949

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf2493e"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 165054
expires: Mon, 08 Aug 2022 15:46:28 GMT

GET
H2 200 jquery.js Show response
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/ 90 KB
91 KB 283ms
277ms Script
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/jquery.js?rv=22051
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf1a455"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 92629
expires: Mon, 08 Aug 2022 15:46:28 GMT

GET
H2 200 mjl.js Show response
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/ 37 KB
38 KB 281ms
275ms Script
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/mjl.js?rv=22051
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 949aa792fb750d68fb3f22d1d5da01cbb279b120c0fbfa0d73bdd023f3ee82dd

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf0583f"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 38335
expires: Mon, 08 Aug 2022 15:46:28 GMT

GET
H2 200 heightLine.js Show response
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/ 4 KB
4 KB 281ms
276ms Script
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/heightLine.js?rv=22051
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 687a7cfdd4e43597c21ef511d6c819835c6dc8c96f7e5f95697d07749b766e82

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf0c258"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 4056
expires: Mon, 08 Aug 2022 15:46:28 GMT

GET
H2 200 run.js Show response
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/ 74 KB
74 KB 282ms
278ms Script
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/run.js?rv=22051
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 4587eec8d58127936d597afb167c9a38a889389b4c58a3d64e16e9f18a95d83e

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf1e51d"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 75933
expires: Mon, 08 Aug 2022 15:46:28 GMT

GET
H2 200 dgbjRequestControllerP01.js Show response
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/ 18 KB
18 KB 282ms
279ms Script
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/js/dgbjRequestControllerP01.js?rv=22051
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 217f54c50b9a1420f613a11a8b69af9917cb2a46850c7aa8f4ee61e58c53a5b8

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf08a52"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 18386
expires: Mon, 08 Aug 2022 15:46:28 GMT

GET
H2 200 rh.js Show response
directss.jp-bank.japanpost.jp/js/ 32 KB
32 KB 43ms
12ms Script
application/javascript 35.75.187.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://directss.jp-bank.japanpost.jp/js/rh.js?ver=21&rev=84202222

Requested by

Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.75.187.174 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-75-187-174.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

d81e2d60f465cb0f6c5c0580ae1ddec4462536b0df5292a42297a0813a1a3eb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:28 GMT
x-content-type-options: nosniff
status: 200 OK
x-frame-options: ALLOWALL
access-control-allow-methods: GET, POST
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
access-control-allow-headers: X-Requested-With, Content-Type, x-phishwall-guid, x-phishwall-client, x-phishwall-version
content-length: 32692

GET
H2 404 4fb56839
direct.jp-bank.japanpost.jp/akam/13/ 0
0 28ms
13ms Script
text/html 184.26.43.196
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://direct.jp-bank.japanpost.jp/akam/13/4fb56839

Requested by

Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.26.43.196 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-26-43-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
content-length: 9
strict-transport-security: max-age=31536000
akamai: 184.26.43.196
content-type: text/html

GET
H2 200 translateelement.css
translate.googleapis.com/translate_static/css/ 18 KB
4 KB 49ms
3ms Stylesheet
text/css 2404:6800:4004:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/translate_static/css/translateelement.css

Requested by

Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:827::200a , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:26:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1187
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3130
x-xss-protection: 0
last-modified: Wed, 24 Feb 2021 19:45:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 08 Aug 2022 04:26:41 GMT

GET
H2 200 DFCJheader_img_01.jpg
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/ 34 KB
34 KB 77ms
76ms Image
image/jpeg 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/DFCJheader_img_01.jpg
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 22deb3c288aa42cc50140d782d5f4f7d1619857a9df25db9cf925b6fdb30f8db

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
last-modified: Fri, 05 Aug 2022 15:40:24 GMT
server: nginx
etag: "1d8a8e1ad89e3ae"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 34734
expires: Mon, 08 Aug 2022 15:46:29 GMT

GET
H2 200 DFCJdirect_img_01.jpg
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/ 25 KB
25 KB 220ms
218ms Image
image/jpeg 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/DFCJdirect_img_01.jpg
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: b4ff878c5eb95950a30cbb613830ff9bb4842bdd7762b822a9f4591cb2dc64eb

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
last-modified: Fri, 05 Aug 2022 15:40:24 GMT
server: nginx
etag: "1d8a8e1ad89065f"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 25183
expires: Mon, 08 Aug 2022 15:46:29 GMT

GET
H2 200 phissingmail.png
xigua.mymallhk.com/bank/jp-bank/pages/cmsimage/42/files/Image/ 49 KB
49 KB 222ms
220ms Image
image/png 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/cmsimage/42/files/Image/phissingmail.png
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: bdd8000d37fa4698590e721db10f65f8a2d435cded92f56323fd9e354bf17619

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
last-modified: Fri, 05 Aug 2022 15:40:23 GMT
server: nginx
etag: "1d8a8e1acf009d0"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 50256
expires: Mon, 08 Aug 2022 15:46:29 GMT

GET
H2 200 DFCJfooter_img_01.jpg
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/ 24 KB
25 KB 354ms
353ms Image
image/jpeg 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/DFCJfooter_img_01.jpg
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 6a3a7e7dacffe678071af680dacaa04449dcfadfb7c885010f1631c80cffe61f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
last-modified: Fri, 05 Aug 2022 15:40:24 GMT
server: nginx
etag: "1d8a8e1ad89058b"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 24971
expires: Mon, 08 Aug 2022 15:46:29 GMT

GET
H2 200 DFCJfooter_img_02.jpg
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/ 28 KB
28 KB 422ms
421ms Image
image/jpeg 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/shared/DFCJfooter_img_02.jpg
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: c22cc6ac9b1c3975b4a0a40d5176fb4e7f76d27530834366711e122a8ac351af

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
last-modified: Fri, 05 Aug 2022 15:40:24 GMT
server: nginx
etag: "1d8a8e1ad890a5c"
x-cache: MISS
environment: Production
cache-control: max-age=43200
accept-ranges: bytes
content-length: 28252
expires: Mon, 08 Aug 2022 15:46:29 GMT

GET
H2 404 jS0dzano
xigua.mymallhk.com/UZQ-yzEwmTDL5A9Azw/iitOpLk4/WHN7XGwC/Bgh/ 0
0 78ms
78ms Script
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xigua.mymallhk.com/UZQ-yzEwmTDL5A9Azw/iitOpLk4/WHN7XGwC/Bgh/jS0dzano
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/public/payview?payid=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
environment: Production
server: nginx
content-length: 0

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/1x/ 846 B
1 KB 75ms
19ms Image
image/png 2404:6800:4004:823::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/1x/translate_24dp.png

Requested by

Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sun, 07 Aug 2022 04:17:00 GMT
x-content-type-options: nosniff
age: 84569
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 846
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 07 Aug 2023 04:17:00 GMT

GET
H2 200 rh.js Show response
directss.jp-bank.japanpost.jp/js/ 32 KB
32 KB 13ms
13ms Script
application/javascript 35.75.187.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://directss.jp-bank.japanpost.jp/js/rh.js?ver=21&rev=8820223

Requested by

Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/public/payview?payid=6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.75.187.174 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-75-187-174.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

4ed664b26296b3e8262c745402778ef4723a9584ea05af1f6466c8253c18efd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
x-content-type-options: nosniff
status: 200 OK
x-frame-options: ALLOWALL
access-control-allow-methods: GET, POST
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
access-control-allow-headers: X-Requested-With, Content-Type, x-phishwall-guid, x-phishwall-client, x-phishwall-version
content-length: 32695

GET
H2 404 DFCJicon_05.gif
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/ 0
61 B 422ms
421ms Image
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_05.gif
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
environment: Production
server: nginx
content-length: 0

GET
H2 404 DFCJicon_04.gif
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/ 0
61 B 372ms
372ms Image
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_04.gif
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
environment: Production
server: nginx
content-length: 0

GET
H2 404 DFCJicon_01.gif
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/ 0
61 B 372ms
371ms Image
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_01.gif
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
environment: Production
server: nginx
content-length: 0

GET
H2 404 DFCJicon_window01.gif
xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/ 0
61 B 372ms
371ms Image
text/plain 154.39.158.16
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_window01.gif
Requested by: Host: xigua.mymallhk.com
URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.39.158.16 , United States, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/css/dgCJbase.css?rv=22051
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 03:46:29 GMT
environment: Production
server: nginx
content-length: 0

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 13ms
13ms Image
image/png 2404:6800:4004:823::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: translate.googleapis.com
URL: https://translate.googleapis.com/translate_static/css/translateelement.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://translate.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 16:54:52 GMT
x-content-type-options: nosniff
age: 125497
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1842
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 06 Aug 2023 16:54:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Japan Post (Transportation)

86 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://direct.jp-bank.japanpost.jp/akam/13/4fb56839 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xigua.mymallhk.com/UZQ-yzEwmTDL5A9Azw/iitOpLk4/WHN7XGwC/Bgh/jS0dzano Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_05.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_04.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_01.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xigua.mymallhk.com/bank/jp-bank/pages/sp/etc/img/icon/DFCJicon_window01.gif Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

direct.jp-bank.japanpost.jp
directss.jp-bank.japanpost.jp
translate.googleapis.com
www.gstatic.com
xigua.mymallhk.com
154.39.158.16
184.26.43.196
2404:6800:4004:823::2003
2404:6800:4004:827::200a
35.75.187.174
217f54c50b9a1420f613a11a8b69af9917cb2a46850c7aa8f4ee61e58c53a5b8
22deb3c288aa42cc50140d782d5f4f7d1619857a9df25db9cf925b6fdb30f8db
4587eec8d58127936d597afb167c9a38a889389b4c58a3d64e16e9f18a95d83e
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4ed664b26296b3e8262c745402778ef4723a9584ea05af1f6466c8253c18efd6
5475e1da7a34565a6fd843a098a04e798f0294af6b9a32d5c4873f28a75e8949
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed
687a7cfdd4e43597c21ef511d6c819835c6dc8c96f7e5f95697d07749b766e82
6a3a7e7dacffe678071af680dacaa04449dcfadfb7c885010f1631c80cffe61f
949aa792fb750d68fb3f22d1d5da01cbb279b120c0fbfa0d73bdd023f3ee82dd
b4ff878c5eb95950a30cbb613830ff9bb4842bdd7762b822a9f4591cb2dc64eb
bdd8000d37fa4698590e721db10f65f8a2d435cded92f56323fd9e354bf17619
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c22cc6ac9b1c3975b4a0a40d5176fb4e7f76d27530834366711e122a8ac351af
c47dd87c37f1a7bbaa65e263df95c797ed700a402420e15481e1fedc21a93b9f
d81e2d60f465cb0f6c5c0580ae1ddec4462536b0df5292a42297a0813a1a3eb1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

xigua.mymallhk.com Open in urlscan Pro 154.39.158.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

23 Requests

100 %HTTPS

40 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

625 kBTransfer

645 kBSize

0 Cookies

0 Outgoing links

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

86 JavaScript Global Variables

0 Cookies

6 Console Messages

Indicators

xigua.mymallhk.com Open in urlscan Pro
154.39.158.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

625 kB
Transfer

645 kB
Size

0
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!