b2v6i9a.shop
Open in
urlscan Pro
20.243.215.213
Malicious Activity!
Public Scan
Effective URL: https://b2v6i9a.shop/ap/?sessionid=b3b3819a1cdd082e72827e40bb0957bd
Submission: On July 22 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 15th 2023. Valid for: 3 months.
This is the only time b2v6i9a.shop was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 136.143.187.52 136.143.187.52 | 2639 (ZOHO-AS) (ZOHO-AS) | |
3 | 20.210.108.78 20.210.108.78 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 2 | 20.243.215.213 20.243.215.213 | () () | |
4 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
n5e1smu.xyz
n5e1smu.xyz |
25 KB |
2 |
b2v6i9a.shop
1 redirects
b2v6i9a.shop |
422 B |
1 |
zurl.co
1 redirects
zurl.co — Cisco Umbrella Rank: 870844 |
827 B |
4 | 3 |
Domain | Requested by | |
---|---|---|
3 | n5e1smu.xyz |
n5e1smu.xyz
|
2 | b2v6i9a.shop |
1 redirects
n5e1smu.xyz
|
1 | zurl.co | 1 redirects |
4 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
n5e1smu.xyz cPanel, Inc. Certification Authority |
2023-07-07 - 2023-10-05 |
3 months | crt.sh |
b2v6i9a.shop cPanel, Inc. Certification Authority |
2023-07-15 - 2023-10-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://b2v6i9a.shop/ap/?sessionid=b3b3819a1cdd082e72827e40bb0957bd
Frame ID: 139BCCFC8006E32D64647FEB74075EBE
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://zurl.co/V986
HTTP 302
https://n5e1smu.xyz/AT6EVG?lGPKKpXjch Page URL
-
https://b2v6i9a.shop/?5ign1n
HTTP 302
https://b2v6i9a.shop/ap/?sessionid=b3b3819a1cdd082e72827e40bb0957bd Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://zurl.co/V986
HTTP 302
https://n5e1smu.xyz/AT6EVG?lGPKKpXjch Page URL
-
https://b2v6i9a.shop/?5ign1n
HTTP 302
https://b2v6i9a.shop/ap/?sessionid=b3b3819a1cdd082e72827e40bb0957bd Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://zurl.co/V986 HTTP 302
- https://n5e1smu.xyz/AT6EVG?lGPKKpXjch
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
AT6EVG
n5e1smu.xyz/ Redirect Chain
|
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hea2.js
n5e1smu.xyz/lib/js/ |
20 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rjs.json
n5e1smu.xyz/rsc/ |
13 B 207 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
b2v6i9a.shop/ap/ Redirect Chain
|
480 B 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
zurl.co/ | Name: 3b88102d5d Value: 7e96c77a4e6988d9f0244b2fa4fe1289 |
|
zurl.co/ | Name: z_frscus Value: 66371a1c-4057-4699-8558-b8283fa6dbaa |
|
zurl.co/ | Name: _zcsr_tmp Value: 66371a1c-4057-4699-8558-b8283fa6dbaa |
|
.zurl.co/ | Name: zsmurl Value: ZFS5ZPVv0GlbZmyvszsfE72Q8rMJVjE7PxmV2kj4MrVLFhldCG |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b2v6i9a.shop
n5e1smu.xyz
zurl.co
136.143.187.52
20.210.108.78
20.243.215.213
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
a93532f52ace6e52e54a145c7030986d88af0bcc243093aa1c3dbfeda916ee1e