www.p2.kenzoken.com Open in urlscan Pro
104.161.23.18  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response www.p2.kenzoken.com/	6 KB 3 KB	610ms 428ms	Document text/html	104.161.23.18 IOFLOOD
General Check archive.org Show headers Download Go to Full URL http://www.p2.kenzoken.com/ Protocol HTTP/1.1 Server 104.161.23.18 Phoenix, United States, ASN53755 (IOFLOOD, US), Reverse DNS corporate.vip2.noc401.com Software LiteSpeed / PHP/7.2.34 Resource Hash 31ee6c92b3d0820e352b79c431f7df828550f2e2da21870a5ce268ba3f033291 Request headers Host www.p2.kenzoken.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive X-Powered-By PHP/7.2.34 Cache-Control no-cache, private Content-Type text/html; charset=UTF-8 Set-Cookie XSRF-TOKEN=eyJpdiI6IjVCRlJUQUtCaXlUc1M1T3JINndOVnc9PSIsInZhbHVlIjoiUmtnZ2dxR3VZOUJcL2pOSGZlQ2RudkhVTG5PUFM0YmpGVE5pTlBuc1hkbHpjejVTY2R6bExhUXF1TmhMR3A3SzgiLCJtYWMiOiI3OWI3MmQ0YjMyY2Q3ZDRkMzE5NTQwZTU5NzA1MmYwODIzNWU0OWZkYTJkMTgxYTEzNWJjODkyZGNhMjIyZmNjIn0%3D; expires=Sun, 25-Oct-2020 02:04:42 GMT; Max-Age=7200; path=/ laravel_session=eyJpdiI6ImlOb0VDMHlwZGxiNExHOEJiSThZOFE9PSIsInZhbHVlIjoiK2FFdG9YWUZwTGUxYjU0TkFEXC8yU0JSOFhzbTZ3czZoellQNXZXRjVVYXdZZ09LUVZLTUhcL3BIeHpDUXBkUFdOIiwibWFjIjoiNzQ5NWZhNzFjNjYzZjI2ZjVmMmQyMjljZDdiMzMyM2M5Y2NiYTBlMDc1YmFiNjQzZGRhNGUwNTQyMTZjMThlOSJ9; expires=Sun, 25-Oct-2020 02:04:42 GMT; Max-Age=7200; path=/; httponly Content-Length 2094 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Sun, 25 Oct 2020 00:04:42 GMT Server LiteSpeed
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/	118 KB 20 KB	33ms 9ms	Stylesheet text/css	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 25 Oct 2020 00:04:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:34:07 GMT status 200 etag "1544639647" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 19747
GET H2	200	css fonts.googleapis.com/	4 KB 689 B	22ms 19ms	Stylesheet text/css	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Nunito:200,600 Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 935ad255ea264af7312f898f6d9c991a2ca89139c4e664e13304394a21e1be23 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 25 Oct 2020 00:04:42 GMT server ESF date Sun, 25 Oct 2020 00:04:42 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 25 Oct 2020 00:04:42 GMT
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/	82 KB 26 KB	13ms 11ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5 Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 25 Oct 2020 00:04:42 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 272992 x-via cfworker/kv status 200 content-length 26646 cf-request-id 05feab67d600000605710e6000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare etag "5eb03ec4-1499c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1DUzAF%2FJ36tLHIkKGmWGGyRr3w8nJAbRUH7bUGbbqEF0AnOd2XxZuic%2FtgOekfWnCNcVJerAjYWN%2F8BYM25KNFeHgS%2FxFEFl%2B04jUc8B5Reyitcz4xklVJDnybzXncEQ%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes cf-ray 5e77ae862c220605-FRA expires Fri, 15 Oct 2021 00:04:42 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/	36 KB 10 KB	33ms 10ms	Script text/javascript	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 25 Oct 2020 00:04:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:33:51 GMT status 200 etag "1544639631" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 9764
GET H/1.1	200 OK	pp.png www.p2.kenzoken.com/public/img/	6 KB 6 KB	196ms 167ms	Image image/png	104.161.23.18 IOFLOOD
General Check archive.org Show headers Download Go to Show image Full URL http://www.p2.kenzoken.com/public/img/pp.png Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol HTTP/1.1 Server 104.161.23.18 Phoenix, United States, ASN53755 (IOFLOOD, US), Reverse DNS corporate.vip2.noc401.com Software LiteSpeed / Resource Hash c7d397672ea7ed3c32a686032e91454a478aecbaad31993df15584d6080f10c3 Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 25 Oct 2020 00:04:42 GMT Last-Modified Fri, 22 May 2020 17:35:58 GMT Server LiteSpeed Vary User-Agent Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 5705 Expires Sun, 01 Nov 2020 00:04:42 GMT
GET H/1.1	200 OK	parsley.js Show response parsleyjs.org/dist/	93 KB 24 KB	164ms 127ms	Script application/javascript	185.199.108.153 FASTLY
General Check archive.org Show headers Download Go to Full URL http://parsleyjs.org/dist/parsley.js Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol HTTP/1.1 Server 185.199.108.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash be43eddbeae875bbc9b68f4a6a95de3fad6798b733dd55f2cdc2bf81a5a33848 Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-Fastly-Request-ID ebecfefd58294929474cdabc39ab0d74f7ce7c98 Date Sun, 25 Oct 2020 00:04:42 GMT Content-Encoding gzip Age 0 X-Cache HIT Connection keep-alive Content-Length 24185 X-Served-By cache-hhn4067-HHN Access-Control-Allow-Origin * Last-Modified Mon, 01 Jun 2020 06:27:26 GMT Server GitHub.com X-GitHub-Request-Id 5410:F96D:531EC78:581A1C0:5F9494FA X-Timer S1603584283.677888,VS0,VE100 ETag W/"5ed49fce-1730b" Vary Accept-Encoding Content-Type application/javascript; charset=utf-8 Via 1.1 varnish Expires Sat, 24 Oct 2020 21:04:17 GMT Cache-Control max-age=600 Accept-Ranges bytes X-Proxy-Cache HIT X-Cache-Hits 1
GET H/1.1	200 OK	fr.js Show response parsleyjs.org/dist/i18n/	1 KB 1 KB	186ms 135ms	Script application/javascript	185.199.108.153 FASTLY
General Check archive.org Show headers Download Go to Full URL http://parsleyjs.org/dist/i18n/fr.js Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol HTTP/1.1 Server 185.199.108.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash 753697b112e342eeb2e099fde0a75425a8ad77cf2d72902033e052d18bd51ca2 Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-Fastly-Request-ID 6221ffecf6394e70a1548037dc593aa6177c3b1b Date Sun, 25 Oct 2020 00:04:42 GMT Content-Encoding gzip Age 0 X-Cache MISS Connection keep-alive Content-Length 517 X-Served-By cache-hhn4023-HHN Access-Control-Allow-Origin * Last-Modified Mon, 01 Jun 2020 06:27:26 GMT Server GitHub.com X-GitHub-Request-Id 6894:F969:2D5A3CD:30348C5:5F94C11A X-Timer S1603584283.725499,VS0,VE98 ETag W/"5ed49fce-596" Vary Accept-Encoding Content-Type application/javascript; charset=utf-8 Via 1.1 varnish Expires Sun, 25 Oct 2020 00:14:42 GMT Cache-Control max-age=600 Accept-Ranges bytes X-Proxy-Cache MISS X-Cache-Hits 0
GET H2	200	libphonenumber-js.min.js Show response catamphetamine.github.io/libphonenumber-js/	135 KB 37 KB	167ms 41ms	Script application/javascript	185.199.108.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://catamphetamine.github.io/libphonenumber-js/libphonenumber-js.min.js Requested by Host: www.p2.kenzoken.com URL: http://www.p2.kenzoken.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.199.108.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash 016d367c1d57f0f67921da8769b3633fdfdc13ebe9baf4adb492add32c88ee32 Request headers Referer http://www.p2.kenzoken.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-fastly-request-id ea0b01e509b09d07fcd4b740fa47e5d592a0650d date Sun, 25 Oct 2020 00:04:42 GMT content-encoding gzip age 158 x-cache HIT status 200 content-length 37145 x-served-by cache-hhn4082-HHN access-control-allow-origin * last-modified Tue, 18 Feb 2020 11:59:07 GMT server GitHub.com x-github-request-id 3C70:DA1E:2A40534:2CEB30E:5F93992E x-timer S1603584283.826834,VS0,VE1 etag W/"5e4bd18b-21df3" vary Accept-Encoding content-type application/javascript; charset=utf-8 via 1.1 varnish expires Sat, 24 Oct 2020 03:12:06 GMT cache-control max-age=600 accept-ranges bytes x-proxy-cache MISS x-cache-hits 1
GET H2	200	XRXW3I6Li01BKofA6sKUYevIWzgPDA.woff2 fonts.gstatic.com/s/nunito/v14/	14 KB 14 KB	18ms 10ms	Font font/woff2	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/nunito/v14/XRXW3I6Li01BKofA6sKUYevIWzgPDA.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Nunito:200,600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 751133359630858ac3454825f72b1fa6ea1aafddadb444c074e518995ec3bf57 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://www.p2.kenzoken.com Referer https://fonts.googleapis.com/css?family=Nunito:200,600 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 11:20:56 GMT x-content-type-options nosniff last-modified Thu, 10 Sep 2020 17:05:26 GMT server sffe age 305026 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13988 x-xss-protection 0 expires Thu, 21 Oct 2021 11:20:56 GMT
GET H3-Q050	200	XRXW3I6Li01BKofA-seUYevIWzgPDA.woff2 fonts.gstatic.com/s/nunito/v14/	13 KB 14 KB	25ms 11ms	Font font/woff2	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/nunito/v14/XRXW3I6Li01BKofA-seUYevIWzgPDA.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Nunito:200,600 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3f3a9ecd3b58eb26cce570f9bd3530be1181763b1c823a04f756da3ed8153e43 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://www.p2.kenzoken.com Referer https://fonts.googleapis.com/css?family=Nunito:200,600 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 11:23:12 GMT x-content-type-options nosniff last-modified Thu, 10 Sep 2020 17:04:29 GMT server sffe age 304890 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13756 x-xss-protection 0 expires Thu, 21 Oct 2021 11:23:12 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery object| ParsleyConfig object| ParsleyExtend object| psly object| Parsley object| ParsleyUtils object| ParsleyValidator object| ParsleyUI string| inputEventPatched object| parsley object| libphonenumber

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

catamphetamine.github.io
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
parsleyjs.org
www.p2.kenzoken.com
104.161.23.18
185.199.108.153
2001:4de0:ac19::1:b:2b
2606:4700::6810:135e
2a00:1450:4001:801::200a
2a00:1450:4001:808::2003
2a00:1450:4001:81f::2003
016d367c1d57f0f67921da8769b3633fdfdc13ebe9baf4adb492add32c88ee32
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
31ee6c92b3d0820e352b79c431f7df828550f2e2da21870a5ce268ba3f033291
3f3a9ecd3b58eb26cce570f9bd3530be1181763b1c823a04f756da3ed8153e43
751133359630858ac3454825f72b1fa6ea1aafddadb444c074e518995ec3bf57
753697b112e342eeb2e099fde0a75425a8ad77cf2d72902033e052d18bd51ca2
935ad255ea264af7312f898f6d9c991a2ca89139c4e664e13304394a21e1be23
be43eddbeae875bbc9b68f4a6a95de3fad6798b733dd55f2cdc2bf81a5a33848
c7d397672ea7ed3c32a686032e91454a478aecbaad31993df15584d6080f10c3
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c