ts3.nfpuka.top
Open in
urlscan Pro
192.161.165.250
Malicious Activity!
Public Scan
Submitted URL: https://ts3.nfpuka.top/
Effective URL: https://ts3.nfpuka.top/webapp/index.php?ToTP01020101Action.do
Submission Tags: phishing toyota finance Search All
Submission: On July 21 via api from JP — Scanned from JP
Effective URL: https://ts3.nfpuka.top/webapp/index.php?ToTP01020101Action.do
Submission Tags: phishing toyota finance Search All
Submission: On July 21 via api from JP — Scanned from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 192.161.165.250, located in
Los Angeles, United States and
belongs to ASN-QUADRANET-GLOBAL, US.
The main domain is ts3.nfpuka.top.
TLS certificate: Issued by R3 on July 21st 2022. Valid for: 3 months.
This is the only time ts3.nfpuka.top was scanned on urlscan.io!
TLS certificate: Issued by R3 on July 21st 2022. Valid for: 3 months.
This is the only time ts3.nfpuka.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TS Cubic Card (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 13 | 192.161.165.250 192.161.165.250 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
| 12 | 1 |
13
192.161.165.250
(Los Angeles, United States)
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: unassigned.quadranet.com
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: unassigned.quadranet.com
| ts3.nfpuka.top |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
nfpuka.top
1 redirects
ts3.nfpuka.top |
26 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 13 | ts3.nfpuka.top |
1 redirects
ts3.nfpuka.top
|
| 12 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| tscubic.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ts3.nfpuka.top R3 |
2022-07-21 - 2022-10-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ts3.nfpuka.top/webapp/index.php?ToTP01020101Action.do
Frame ID: 36D88C5AE8FC12BE4A91C44BAD8CF544
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
MY TS3ログイン｜TS CUBIC カードPage URL History Show full URLs
-
https://ts3.nfpuka.top/
HTTP 302
https://ts3.nfpuka.top/webapp/index.php?ToTP01020101Action.do Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://tscubic.com/
Title: TS CUBIC CARD | ティーエス キュービック
Title: TS CUBIC CARD | ティーエス キュービック
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ts3.nfpuka.top/
HTTP 302
https://ts3.nfpuka.top/webapp/index.php?ToTP01020101Action.do Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
ts3.nfpuka.top/webapp/ Redirect Chain
|
10 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reset.css
ts3.nfpuka.top/css/ |
1 KB 721 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.css
ts3.nfpuka.top/css/ |
30 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common_sp.css
ts3.nfpuka.top/css/ |
38 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login_mem.css
ts3.nfpuka.top/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-id.css
ts3.nfpuka.top/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_myts3.gif
ts3.nfpuka.top/css/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_body.png
ts3.nfpuka.top/login/img_first/ |
261 B 261 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_header.gif
ts3.nfpuka.top/css/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
arrow01.gif
ts3.nfpuka.top/img/common/ |
261 B 261 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ico_blank_login.png
ts3.nfpuka.top/css/ |
273 B 352 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sp_btn_totop.png
ts3.nfpuka.top/css/ |
261 B 261 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TS Cubic Card (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ts3.nfpuka.top
192.161.165.250
4947daa3395c022c65c3e8a68cabbf38c7454c05b315d4ee21a90b83f9257968
4b636eb7f96462dc9b2066c2ee710e2a10b6fe7de1273dba5112fe8586c33645
51fa64ab2eee16fb95f2679f974b58948b7f94c61b05e4ce90909bdbd209d62d
5e93e3871e70f8cc64ebc3dc7f9ac3eaa3499339758e14213813970094b36420
7ad4b62a35b8f95ccf16bf0c0082b873dff669b98011e96f081e7c7f5b0b0e89
94fd5f15b2378cec483518b5fe927e34e3eede66237518377cea50582e5fa28d
a19f56e2cc27302be4bea8080c7b18c6ac6294adab9317d1089b47f7907cf8c7
a7a0d73aa10ca16a64cb0ef454242715a94fb466dd5c2e7bba7ebe5904cd8c13
b98dd7cbb7be0c5c4959a3fdf9c8c53aa2e126343b496a1e65caed21de1970dc
ce78f70ba931906cd46ab4d4c8a7f6580931d6bdbf7a8a5170d7097a1a2590f0