urlscan.io logo urlscan.io
SecurityTrails logo

account.tuwstmj.cn Open in urlscan Pro
34.146.165.119  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://account.applesign.net/jp.php
Effective URL: https://account.tuwstmj.cn/a/settings/approval/setup/register
Submission: On October 24 via manual from PH — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 34.146.165.119, located in Tokyo, Japan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is account.tuwstmj.cn.
TLS certificate: Issued by R3 on October 23rd 2022. Valid for: 3 months.
This is the only time account.tuwstmj.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 5 34.146.165.119 396982 (GOOGLE-CL...)
4 34.146.220.148 396982 (GOOGLE-CL...)
8 2
Apex Domain
Subdomains		 Transfer
4 annazoon.cn
annazoon.cn
13 KB
4 applesign.net
account.applesign.net
19 KB
1 tuwstmj.cn
account.tuwstmj.cn
1021 B
8 3
Domain Requested by
4 annazoon.cn account.tuwstmj.cn
4 account.applesign.net 1 redirects account.applesign.net
1 account.tuwstmj.cn account.applesign.net
8 3

This site contains no links.

Subject Issuer Validity Valid
www.stkoydk.cn
R3		 2022-10-23 -
2023-01-21		 3 months crt.sh
www.tuwstmj.cn
R3		 2022-10-23 -
2023-01-21		 3 months crt.sh
www.annazoon.cn
R3		 2022-10-17 -
2023-01-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://account.tuwstmj.cn/a/settings/approval/setup/register
Frame ID: BF5558B07226B41ECD6A2EA038270913
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

  1. https://account.applesign.net/jp.php Page URL
  2. https://account.applesign.net/index.php?t=d57f5f0e41af6fee18c84d121ad2c6ea72633c723c9d9db709986f7b07bbfc2b HTTP 302
    https://account.tuwstmj.cn/a/settings/approval/setup/register Page URL

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

33 kB
Transfer

57 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://account.applesign.net/jp.php Page URL
  2. https://account.applesign.net/index.php?t=d57f5f0e41af6fee18c84d121ad2c6ea72633c723c9d9db709986f7b07bbfc2b HTTP 302
    https://account.tuwstmj.cn/a/settings/approval/setup/register Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
jp.php
account.applesign.net/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://account.applesign.net/jp.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.165.119 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
119.165.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
29abf0d5d3f09d7b24ff0fb1cff877be72a842b8acb39fbe9e8451899badd447
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 24 Oct 2022 06:00:25 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
loading.gif
account.applesign.net/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://account.applesign.net/loading.gif
Requested by
Host: account.applesign.net
URL: https://account.applesign.net/jp.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.165.119 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
119.165.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
7af9039026d259aa4649a5b1f3d6dadce932241441a7cd899db50e72283197e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://account.applesign.net/jp.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 06:00:25 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 04 Oct 2022 23:20:27 GMT
server
nginx
etag
"633cbfbb-3be3"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
15331
expires
Wed, 23 Nov 2022 06:00:25 GMT
vendor.23238u92u82.js
account.applesign.net/vendor/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://account.applesign.net/vendor/vendor.23238u92u82.js
Requested by
Host: account.applesign.net
URL: https://account.applesign.net/jp.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.165.119 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
119.165.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://account.applesign.net/jp.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 06:00:25 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Mon, 05 Apr 2021 18:24:52 GMT
server
nginx
etag
W/"606b55f4-1375"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Mon, 24 Oct 2022 18:00:25 GMT
Primary Request register
account.tuwstmj.cn/a/settings/approval/setup/
Redirect Chain
  • https://account.applesign.net/index.php?t=d57f5f0e41af6fee18c84d121ad2c6ea72633c723c9d9db709986f7b07bbfc2b
  • https://account.tuwstmj.cn/a/settings/approval/setup/register
914 B
1021 B 		Document
General
Check archive.org
Download Go to
Full URL
https://account.tuwstmj.cn/a/settings/approval/setup/register
Requested by
Host: account.applesign.net
URL: https://account.applesign.net/jp.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.165.119 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
119.165.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
3288ddccaa2046d2ae455e1878bbde0f226692fd1cddf2513d3148d21c6cd8fc

Request headers

Referer
https://account.applesign.net/jp.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

content-type
text/html
date
Mon, 24 Oct 2022 06:00:25 GMT
server
nginx
vary
Accept-Encoding
x-debug-message
A statie file vas served

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset=UTF-8
date
Mon, 24 Oct 2022 06:00:25 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://account.tuwstmj.cn/a/settings/approval/setup/register
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
axios.min.js
annazoon.cn/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://annazoon.cn/axios.min.js
Requested by
Host: account.tuwstmj.cn
URL: https://account.tuwstmj.cn/a/settings/approval/setup/register
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.220.148 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
148.220.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
119bc058d4479c6d89cf0e1dbfca26b759b54a47e0d963d3b8423b5dcb3d55b3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://account.tuwstmj.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 06:00:25 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 05 Oct 2022 18:28:07 GMT
server
nginx
etag
W/"633dccb7-356a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Mon, 24 Oct 2022 18:00:25 GMT
getup1ewrs12.js
annazoon.cn/ 		1 KB
576 B 		Script
General
Check archive.org
Download Go to
Full URL
https://annazoon.cn/getup1ewrs12.js
Requested by
Host: account.tuwstmj.cn
URL: https://account.tuwstmj.cn/a/settings/approval/setup/register
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.220.148 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
148.220.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
6fddbc1223d54af48222653a152867d38a8f8628ec172d40f6063e38378d5cd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://account.tuwstmj.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 06:00:25 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 05 Oct 2022 18:29:07 GMT
server
nginx
etag
W/"633dccf3-42a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Mon, 24 Oct 2022 18:00:25 GMT
getcooua221248eer3.js
annazoon.cn/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://annazoon.cn/getcooua221248eer3.js
Requested by
Host: account.tuwstmj.cn
URL: https://account.tuwstmj.cn/a/settings/approval/setup/register
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.220.148 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
148.220.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
5a759e9be0ece23bd88c160710ad235e6c9712066802c213f6ed341401b95906
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://account.tuwstmj.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 06:00:25 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 05 Oct 2022 18:29:22 GMT
server
nginx
etag
W/"633dcd02-3d0f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Mon, 24 Oct 2022 18:00:25 GMT
getcooua221248eer4.js
annazoon.cn/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://annazoon.cn/getcooua221248eer4.js
Requested by
Host: account.tuwstmj.cn
URL: https://account.tuwstmj.cn/a/settings/approval/setup/register
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.146.220.148 Tokyo, Japan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
148.220.146.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
534eab60383447b5e1b57cb34c0d404ea8669edc54728f651c5332a01b8ed98c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://account.tuwstmj.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Mon, 24 Oct 2022 06:00:25 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 05 Oct 2022 18:28:07 GMT
server
nginx
etag
W/"633dccb7-13c8"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Mon, 24 Oct 2022 18:00:25 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| axios function| hqt function| hqp undefined| img6 undefined| dc undefined| formData string| yz undefined| img string| title undefined| ctime undefined| code function| HOTP object| sjcl function| n

3 Cookies

Domain/Path Name / Value
account.applesign.net/ Name: PHPSESSID
Value: raa24s8un3hvhbavn0c6dtvlf3
.account.applesign.net/ Name: 62345ba76168db0033ce8ae6a90ce5a762956614
Value: nwcMGFHjQc7nDOZDxhWlbg%3D%3D
.account.applesign.net/ Name: _amkc
Value: 59729017-47b9-46eb-8457-f2df80b5241e

1 Console Messages

Source Level URL
Text
network error URL: https://account.tuwstmj.cn/a/settings/approval/setup/register
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000