urlscan.io logo urlscan.io
SecurityTrails logo

exwuyqjkpx.tk Open in urlscan Pro
50.115.172.113  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://exwuyqjkpx.tk/
Effective URL: https://exwuyqjkpx.tk/
Submission: On December 14 via manual from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 50.115.172.113, located in United States and belongs to VIRP, US. The main domain is exwuyqjkpx.tk.
TLS certificate: Issued by R3 on December 10th 2021. Valid for: 3 months.
This is the only time exwuyqjkpx.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: au ID (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 8 50.115.172.113 32875 (VIRP)
8 2
Apex Domain
Subdomains		 Transfer
8 exwuyqjkpx.tk
exwuyqjkpx.tk
91 KB
0 51.la Failed
js.users.51.la Failed
8 2
Domain Requested by
8 exwuyqjkpx.tk 1 redirects exwuyqjkpx.tk
0 js.users.51.la Failed exwuyqjkpx.tk
8 2

This site contains no links.

Subject Issuer Validity Valid
byjsrwelnn.tk
R3		 2021-12-10 -
2022-03-10		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://exwuyqjkpx.tk/
Frame ID: F6CE368D94F205989A0480DA3D169752
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://exwuyqjkpx.tk/ HTTP 301
    https://exwuyqjkpx.tk/ Page URL

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

90 kB
Transfer

192 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://exwuyqjkpx.tk/ HTTP 301
    https://exwuyqjkpx.tk/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
exwuyqjkpx.tk/
Redirect Chain
  • http://exwuyqjkpx.tk/
  • https://exwuyqjkpx.tk/
9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
b57ef745d3913c8c4ba61da62c2c6979c3bdea61bfba6e76f0a20f1afe9032c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Accept-Language
jp-JP,jp;q=0.9

Response headers

server
nginx
date
Tue, 14 Dec 2021 02:58:31 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
strict-transport-security
max-age=31536000
content-encoding
gzip

Redirect headers

Server
nginx
Date
Tue, 14 Dec 2021 02:58:30 GMT
Content-Type
text/html
Content-Length
162
Connection
keep-alive
Location
https://exwuyqjkpx.tk/
Strict-Transport-Security
max-age=31536000
idk.css
exwuyqjkpx.tk/static/haucvv/ 		43 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://exwuyqjkpx.tk/static/haucvv/idk.css
Requested by
Host: exwuyqjkpx.tk
URL: https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
6e24853bd77e76a9aa22a6862ba42237a971dfd53c2d8a7fb9c82e6090961465
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://exwuyqjkpx.tk/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 14 Dec 2021 02:58:31 GMT
content-encoding
gzip
last-modified
Fri, 29 Oct 2021 03:00:24 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
expires
Thu, 13 Jan 2022 02:58:31 GMT
checkboxRadio.css
exwuyqjkpx.tk/static/haucvv/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://exwuyqjkpx.tk/static/haucvv/checkboxRadio.css
Requested by
Host: exwuyqjkpx.tk
URL: https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
3161eb2799583d9009881d3d9e669044f2afc39ad040db4ab4b8254a03e6fe6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://exwuyqjkpx.tk/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 14 Dec 2021 02:58:31 GMT
content-encoding
gzip
last-modified
Fri, 29 Oct 2021 03:00:24 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
expires
Thu, 13 Jan 2022 02:58:31 GMT
jquery-1.9.1.min.js
exwuyqjkpx.tk/static/hau/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://exwuyqjkpx.tk/static/hau/jquery-1.9.1.min.js
Requested by
Host: exwuyqjkpx.tk
URL: https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://exwuyqjkpx.tk/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 14 Dec 2021 02:58:31 GMT
content-encoding
gzip
last-modified
Tue, 24 Jul 2018 07:09:50 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
expires
Thu, 13 Jan 2022 02:58:31 GMT
jquery.mloading.js
exwuyqjkpx.tk/static/hau/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://exwuyqjkpx.tk/static/hau/jquery.mloading.js
Requested by
Host: exwuyqjkpx.tk
URL: https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
379db2eeb17a70eb688d5fb5d77e77620d208b9627ea95b3905cf2afdf56c1cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://exwuyqjkpx.tk/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 14 Dec 2021 02:58:31 GMT
content-encoding
gzip
last-modified
Tue, 24 Jul 2018 07:09:50 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
expires
Thu, 13 Jan 2022 02:58:31 GMT
jquery.cookie.js
exwuyqjkpx.tk/static/hau/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://exwuyqjkpx.tk/static/hau/jquery.cookie.js
Requested by
Host: exwuyqjkpx.tk
URL: https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://exwuyqjkpx.tk/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 14 Dec 2021 02:58:31 GMT
content-encoding
gzip
last-modified
Tue, 24 Jul 2018 07:09:50 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
expires
Thu, 13 Jan 2022 02:58:31 GMT
21226333.js
js.users.51.la/ 		0
0
au_id.jpg
exwuyqjkpx.tk/static/haucvv/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://exwuyqjkpx.tk/static/haucvv/au_id.jpg
Requested by
Host: exwuyqjkpx.tk
URL: https://exwuyqjkpx.tk/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.115.172.113 , United States, ASN32875 (VIRP, US),
Reverse DNS
Software
nginx /
Resource Hash
1ec5abc3e4e21e84224089afccec3c1677323ec02fe04f2bbf6083a9b9d3fc2d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://exwuyqjkpx.tk/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 14 Dec 2021 02:58:31 GMT
last-modified
Fri, 29 Oct 2021 03:00:24 GMT
server
nginx
strict-transport-security
max-age=31536000
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
34778
expires
Thu, 13 Jan 2022 02:58:31 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
js.users.51.la
URL
https://js.users.51.la/21226333.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: au ID (Telecommunication)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
exwuyqjkpx.tk/ Name: sessionid
Value: 69aafa2b24b60f7290f89e3eba04873c

2 Console Messages

Source Level URL
Text
network error URL: https://js.users.51.la/21226333.js
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
security warning URL: https://exwuyqjkpx.tk/(Line 57)
Message:
Mixed Content: The page at 'https://exwuyqjkpx.tk/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://aupay.auoneauidshenad.ga/pc/index2.php'. This endpoint should be made available over a secure connection.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000