codashhop-uc.zzux.com
Open in
urlscan Pro
209.126.1.27
Malicious Activity!
Public Scan
Submission: On May 27 via automatic, source openphish
Summary
TLS certificate: Issued by R3 on May 9th 2021. Valid for: 3 months.
This is the only time codashhop-uc.zzux.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 209.126.1.27 209.126.1.27 | 40021 (CONTABO) (CONTABO) | |
12 | 101.33.10.112 101.33.10.112 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
3 | 203.205.224.42 203.205.224.42 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
1 | 104.111.239.81 104.111.239.81 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
3 | 150.109.207.121 150.109.207.121 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
5 | 240e:ff:f101:... 240e:ff:f101:10::1a0 | 4816 (CHINANET-...) (CHINANET-IDC-GD China Telecom (Group)) | |
1 | 203.205.137.242 203.205.137.242 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
2 | 129.226.107.210 129.226.107.210 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
1 | 203.205.235.145 203.205.235.145 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
29 | 9 |
ASN40021 (CONTABO, US)
PTR: vmi584832.contaboserver.net
codashhop-uc.zzux.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
cdn.midasbuy.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
www.midasbuy.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
report1.midasbuy.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
3gimg.qq.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
kepler.captcha.qcloud.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
dp.telesafe.qq.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
midasbuy.com
cdn.midasbuy.com www.midasbuy.com report1.midasbuy.com |
4 MB |
7 |
qq.com
aegis.qq.com 3gimg.qq.com dp.telesafe.qq.com |
64 KB |
2 |
qcloud.com
kepler.captcha.qcloud.com |
108 KB |
1 |
gtimg.cn
midas.gtimg.cn |
21 KB |
1 |
zzux.com
codashhop-uc.zzux.com |
36 KB |
29 | 5 |
Domain | Requested by | |
---|---|---|
12 | cdn.midasbuy.com |
codashhop-uc.zzux.com
cdn.midasbuy.com |
5 | aegis.qq.com |
codashhop-uc.zzux.com
|
3 | report1.midasbuy.com |
codashhop-uc.zzux.com
|
3 | www.midasbuy.com |
codashhop-uc.zzux.com
|
2 | kepler.captcha.qcloud.com |
codashhop-uc.zzux.com
|
1 | dp.telesafe.qq.com |
codashhop-uc.zzux.com
|
1 | 3gimg.qq.com |
codashhop-uc.zzux.com
|
1 | midas.gtimg.cn |
codashhop-uc.zzux.com
|
1 | codashhop-uc.zzux.com | |
29 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
codashhop-uc.zzux.com R3 |
2021-05-09 - 2021-08-07 |
3 months | crt.sh |
*.midasbuy.com DigiCert Secure Site CN CA G3 |
2021-04-21 - 2022-05-22 |
a year | crt.sh |
qs.888.qq.com DigiCert SHA2 Secure Server CA |
2020-03-24 - 2021-06-23 |
a year | crt.sh |
aegis.qq.com DigiCert Secure Site CN CA G3 |
2021-03-04 - 2022-04-04 |
a year | crt.sh |
*.cdnsource.sparta.3g.qq.com GlobalSign Organization Validation CA - SHA256 - G2 |
2020-07-31 - 2021-08-01 |
a year | crt.sh |
*.captcha.qcloud.com Secure Site CA G2 |
2020-07-24 - 2021-07-29 |
a year | crt.sh |
*.aug02.sparta.3g.qq.com GlobalSign Organization Validation CA - SHA256 - G2 |
2020-08-20 - 2021-08-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://codashhop-uc.zzux.com/
Frame ID: 7C574F432A8100A103EDDBD866A7EAEC
Requests: 29 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
codashhop-uc.zzux.com/ |
185 KB 36 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-87839280b2.html.css
cdn.midasbuy.com/oversea_web/static/css/ |
236 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
game_recharge_ticket_new-c9585b8432.html.css
cdn.midasbuy.com/oversea_web/static/css/ |
18 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
media-f6bc833bbb.html.css
cdn.midasbuy.com/oversea_web/static/css/ |
122 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
midas-oversea-h5page.js
cdn.midasbuy.com/h5/overseah5/js/ |
58 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
production.midas.runtime.js
cdn.midasbuy.com/oversea_web/static/js/ |
282 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
foXpt24MxhVpLTWmFsULBWJ0hD79nV7v9xWmNlTyU3Bqe4AEdEhMwu9wQOZRznaiasaltyxZa4hdYZdpZTVP_4fNAGKEXIYBcBqHZ0gpIMU~.js
www.midasbuy.com/oversea_web/static/js/x-midas/ |
55 KB 20 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
world.2556fe97306bdec1268d8b8a935b56c5.jpg
midas.gtimg.cn/oversea_web/static/images/flag/ |
21 KB 21 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-logo.png
www.midasbuy.com/oversea_web/static/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
big-new-close-icon.png
www.midasbuy.com/oversea_web/static/images/ |
373 B 649 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header.bbcf2110.js
cdn.midasbuy.com/oversea_web/static/js/ |
55 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guide001.png
cdn.midasbuy.com/images/apps/pubgm/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guide002.png
cdn.midasbuy.com/images/apps/pubgm/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buypage.052bbaf6.js
cdn.midasbuy.com/oversea_web/static/js/ |
152 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log_data.fcg
report1.midasbuy.com/cgi-bin/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-logo-5f404ea479.png
cdn.midasbuy.com/oversea_web/static/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-icon-54d438045f.png
cdn.midasbuy.com/oversea_web/static/images/ |
360 B 639 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-fb-eade39686c.png
cdn.midasbuy.com/oversea_web/static/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
whitelist
aegis.qq.com/aegis/ |
59 B 215 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tfg.v1.0.18.js
3gimg.qq.com/tele_safe/static/tfg/pc/ |
214 KB 63 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tencent-kepler.js
kepler.captcha.qcloud.com/ |
107 KB 108 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log_data.fcg
report1.midasbuy.com/cgi-bin/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
aegis.qq.com/ |
0 75 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
performance
aegis.qq.com/speed/ |
0 89 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
f4
dp.telesafe.qq.com/ |
137 B 238 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
getwt
kepler.captcha.qcloud.com/ |
370 B 618 B |
XHR
text/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log_data.fcg
report1.midasbuy.com/cgi-bin/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
speed
aegis.qq.com/ |
0 89 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
speed
aegis.qq.com/ |
0 89 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)96 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| assetsRetry object| assetsRetryRule object| assetsRetryStatistics object| __PAY_INFO object| __Report_INFO object| defaultDisableGaCountryList boolean| __RTL string| _SHOPCODE object| __showErrorDetail boolean| enable_nopay_contract object| aegis function| Aegis object| midas function| $ function| jQuery function| Swiper function| Vue object| __core-js_shared__ object| core object| report object| fbReport object| _0x3d88 function| _0x306c function| don string| goServerUrl string| goPublicKey object| langResource object| footerLan number| showWelcomeBack object| redPointConfigs object| user string| fbPixelId boolean| jumpHomePage object| bubblePopConfig object| vipcenterConfig object| sdk_rules function| loadJS function| scrollFun function| toggleGa function| gaKey object| __TENCENT_CHAOS_STACK function| xMidas object| WebsiteHosts function| throttle object| GAME_INFO object| MP_INFO object| CHANNEL_INFO object| noComplianceCountryList object| complianceWithBirthCountryList object| complianceWithDataCountryList object| buylimits number| needActiveData number| defaultShowNum boolean| showRedeemChannel boolean| needSupplementaryTerms object| agreementArray object| reglimits object| channelRestore object| images function| setNavPosition function| hideHomeBtn function| tfp number| scrollT1 number| scrollT2 object| scrollTimer function| setPosition function| isScrollEnd function| showClauseBg function| hideClauseBg function| hideTaxPop function| showBirthBox function| hideBirthBox boolean| ga-disable-UA-21773189-2 object| jQuery112403771414062851042 object| fpApp object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| TencentKepler string| ___Kepler_WebTicket1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
codashhop-uc.zzux.com/ | Name: cid Value: ed1ca8ac-92dd-4a84-8510-985bc4fb2959 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
3gimg.qq.com
aegis.qq.com
cdn.midasbuy.com
codashhop-uc.zzux.com
dp.telesafe.qq.com
kepler.captcha.qcloud.com
midas.gtimg.cn
report1.midasbuy.com
www.midasbuy.com
101.33.10.112
104.111.239.81
129.226.107.210
150.109.207.121
203.205.137.242
203.205.224.42
203.205.235.145
209.126.1.27
240e:ff:f101:10::1a0
089878c4af2ccaaa206b2fff070dc068a4f0acdd17ff2de1432bb6463446d8ce
28b3485fc5c3353c25431fa1fef14fdcef2907bd200c4d96f64b3eabeeaa0699
3558f7989f99ee18b24351b0cc217e61d690a384076d2a9b61607c0de34a93ef
3dd04893dcf4fb0b4eabdc3a2d5bec009f6a81d3ee066501ed1cdda9705c9cd8
4bcb452bf07df52c2fbd3f0a65263cd81e544cdc7d19cef7908ecb9428df15fd
528ec4ee6f56ace1dd9c394fa067175b7192828bc3b68e264e7494448f31b27e
607b00f0fd839eb7f8250d7c4d0c0b4a31a08b32b2b8b5cbdd9fe3125b2eb985
6a5fcf92b4c112813ed0cbb4696880e98ad29e02228ed822b73a8b864820e815
8c95b34cf2c0bd6c12a6db6fba1c4d852c7850618bee6147d10b2a3a1b458f19
a406545520016ebc8913e102352c7d11b54e1f543f19c965a943ead3035a5b78
a521b418fd37d48c7a770e7c9438bf56c8a564df2ae8a77c60865f0614361ec7
a5de724ac9bc18976d788831007fed5b0c984cb67b79e52a537549729984d3ee
ad7e01a58105e8ee445f7e2be6d77d2c7403fcfe58991726cfb38e35b48ec77d
b0c0c8ac324db0b13e4f6d479554c1c1e696a9c13015650b587c5c8889895698
b35045677941134c95267b374b2a153f9843260b4768a7472a995566e6d21508
c922214dd2b6560e226d0a36ee21c474d3d4184c7599d1baba67c4c8287af4ef
dc283fe48becaf7a1374e8dc0784dd43d0025c7cac35516b416d6347454d56ec
e3310a8bfa4b3fa798852ef07612cf8cd5336886fd0ca608686fde89c48451aa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb29d9ce7243bd6b0f2e4cb8666f831285696ee23b70de68a72f1c8d73844ef0
fcb4576438361d09632849295af08f3cc448b8e104902ac1303df41a91dd4af1
fea99403dd834e7b61ee51fd481e0d4fcbca047aadd57c15d405513e0b7e8a99