asnuasnfmowjmm.com - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3036::681c:11c6, located in United States and belongs to CLOUDFLARENET, US. The main domain is asnuasnfmowjmm.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 1st 2020. Valid for: a year.

This is the only time asnuasnfmowjmm.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercari (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3036::681c:11c6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
7	3

4 2606:4700:3036::681c:11c6 (United States)

ASN13335 (CLOUDFLARENET, US)

asnuasnfmowjmm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

pcweb-assets.mercdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	asnuasnfmowjmm.com asnuasnfmowjmm.com	218 KB
2	mercdn.net pcweb-assets.mercdn.net	3 KB
1	jquery.com code.jquery.com	30 KB
7	3

	Domain	Requested by
4	asnuasnfmowjmm.com	asnuasnfmowjmm.com
2	pcweb-assets.mercdn.net	asnuasnfmowjmm.com
1	code.jquery.com	asnuasnfmowjmm.com
7	3

This site contains links to these domains. Also see Links.

Domain
www.mercari.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-06-01` - `2021-06-01`	a year	crt.sh
*.mercdn.net GlobalSign RSA DV SSL CA 2018	`2020-05-18` - `2021-05-19`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://asnuasnfmowjmm.com/jp/login
Frame ID: 20E68EC78BC6D408B6E617690BA585C3
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

7
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

250 kB
Transfer

582 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mercari.com/jp/

Search URL Search Domain Scan URL

URL: https://www.mercari.com/jp/signup/
Title: 新規会員登録

Search URL Search Domain Scan URL

URL: https://www.mercari.com/jp/password/reset/start/
Title: パスワードをお忘れの方

Search URL Search Domain Scan URL

URL: https://www.mercari.com/jp/privacy/
Title: プライバシーポリシー

Search URL Search Domain Scan URL

URL: https://www.mercari.com/jp/tos/
Title: メルカリ利用規約

Search URL Search Domain Scan URL

URL: https://www.mercari.com/jp/tokutei/
Title: 特定商取引に関する表記

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login Show response
asnuasnfmowjmm.com/jp/ 7 KB
3 KB 682ms
629ms Document
text/html 2606:4700:3036::681c:11c6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://asnuasnfmowjmm.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:11c6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6f60ac24dfdd23c8c45d9acef7183bb4ada3d7dc82f9c261f09621966651f910

Request headers

:method: GET
:authority: asnuasnfmowjmm.com
:scheme: https
:path: /jp/login
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 01 Jun 2020 14:30:04 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d2fdbe3876497fc9eedd76c45cc2ae6871591021804; expires=Wed, 01-Jul-20 14:30:04 GMT; path=/; domain=.asnuasnfmowjmm.com; HttpOnly; SameSite=Lax mercar:sid=s%3Ab324bc0d-cb6d-445d-9004-0034baf60433.eh6uAF%2FYZyFRT1VGf7Jo0V08NX5ZpOPdJkWUno243bY; Path=/; HttpOnly
x-powered-by: Express
cf-cache-status: DYNAMIC
cf-request-id: 0311e331e7000006213d809200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 59c9a1630aa50621-FRA
content-encoding: br

GET
H2 200 app.jp.css
asnuasnfmowjmm.com/jp/assets/css/ 318 KB
46 KB 1320ms
1317ms Stylesheet
text/css 2606:4700:3036::681c:11c6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://asnuasnfmowjmm.com/jp/assets/css/app.jp.css?365456439
Requested by: Host: asnuasnfmowjmm.com
URL: https://asnuasnfmowjmm.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:11c6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6f958c7ffa35885ae373e1e73d9d544638292b82e5db1e776b192aadd3c65f3b

Request headers

Referer: https://asnuasnfmowjmm.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Jun 2020 14:30:05 GMT
content-encoding: br
etag: W/"4f653-1726f1e4d3d"
cf-cache-status: MISS
last-modified: Mon, 01 Jun 2020 09:02:36 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=14400
cf-ray: 59c9a16709f70621-FRA
cf-request-id: 0311e33464000006213d85f200000001

GET
H2 200 logo.svg
pcweb-assets.mercdn.net/assets/img/common/common/ 2 KB
2 KB 685ms
611ms Image
image/svg+xml 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pcweb-assets.mercdn.net/assets/img/common/common/logo.svg?3660596335

Requested by

Host: asnuasnfmowjmm.com
URL: https://asnuasnfmowjmm.com/jp/login

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

f4c823301da0441f633837b7b207f4711269ff5c49e8d82f66df3324031a30cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://asnuasnfmowjmm.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Jun 2020 14:30:05 GMT
content-encoding: gzip
age: 0
x-guploader-uploadid: AAANsUnx5QJU4OksTf0GtXycKp2kgotS2ALelmWavQGBzc-qNP0IYLral5MRtOR-YaKfpY58YGLmYOFFB5jKatByiP8H6pj0Mw
x-cache: MISS
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
strict-transport-security: max-age=31557600
content-length: 1130
via: 1.1 varnish
x-served-by: cache-fra19146-FRA
last-modified: Mon, 01 Jun 2020 07:17:10 GMT
server: UploadServer
etag: "32b3409f3c229490fa74869c35fcfdce"
vary: Origin, Accept-Encoding
x-goog-hash: crc32c=WHnGRw==, md5=MrNAnzwilJD6dIacNfz9zg==
x-goog-generation: 1590995830514891
access-control-allow-origin: *
expires: Tue, 02 Jun 2020 14:30:05 GMT
cache-control: public,max-age=0,s-maxage=86400,no-transform
x-goog-stored-content-length: 1130
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 0

GET
H2 200 logo-gray.svg
pcweb-assets.mercdn.net/assets/img/common/common/ 2 KB
1 KB 965ms
892ms Image
image/svg+xml 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pcweb-assets.mercdn.net/assets/img/common/common/logo-gray.svg?3660596335

Requested by

Host: asnuasnfmowjmm.com
URL: https://asnuasnfmowjmm.com/jp/login

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

0f34f7d169129d40b428ac87ea520dce5c3acafe7d25699aaddf13a3b381d150

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

Referer: https://asnuasnfmowjmm.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Jun 2020 14:30:05 GMT
content-encoding: gzip
age: 0
x-guploader-uploadid: AAANsUktKp9Q5fvyYtcN87fALaLQO-JajMbnneH-spjE3HAm8dq-n9ojtZr979aNKMwBte6ZmE7QyJ2puL1XdJTrQWQ
x-cache: MISS
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
strict-transport-security: max-age=31557600
content-length: 1065
via: 1.1 varnish
x-served-by: cache-fra19146-FRA
last-modified: Mon, 01 Jun 2020 07:17:10 GMT
server: UploadServer
etag: "f3b0814a1e2625c34ec2d54ee2cae1ea"
vary: Origin, Accept-Encoding
x-goog-hash: crc32c=uOCHzQ==, md5=87CBSh4mJcNOwtVO4srh6g==
x-goog-generation: 1590995830575032
access-control-allow-origin: *
expires: Tue, 02 Jun 2020 14:30:05 GMT
cache-control: public,max-age=0,s-maxage=86400,no-transform
x-goog-stored-content-length: 1065
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 0

GET
H/1.1 200
OK jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
30 KB 21ms
7ms Script
application/javascript 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: asnuasnfmowjmm.com
URL: https://asnuasnfmowjmm.com/jp/login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://asnuasnfmowjmm.com/jp/login
Origin: https://asnuasnfmowjmm.com

Response headers

Date: Mon, 01 Jun 2020 14:30:04 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 May 2016 17:24:41 GMT
Server: nginx
ETag: W/"573f4859-14e4a"
Vary: Accept-Encoding
X-HW: 1591021804.dop098.fr8.shc,1591021804.dop098.fr8.t,1591021804.cds130.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 29811

GET
H2 200 SourceSansPro-Regular.ttf.woff2
asnuasnfmowjmm.com/jp/assets/fonts/ 85 KB
85 KB 818ms
817ms Font
application/font-woff2 2606:4700:3036::681c:11c6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://asnuasnfmowjmm.com/jp/assets/fonts/SourceSansPro-Regular.ttf.woff2?37328315
Requested by: Host: asnuasnfmowjmm.com
URL: https://asnuasnfmowjmm.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:11c6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 27c06ca531d01f12d9e28d869000985e4cf84dd0724afe578e942d44f09d19c2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://asnuasnfmowjmm.com/jp/assets/css/app.jp.css?365456439
Origin: https://asnuasnfmowjmm.com

Response headers

date: Mon, 01 Jun 2020 14:30:07 GMT
etag: W/"1533c-1726f1e4d3d"
cf-cache-status: MISS
last-modified: Mon, 01 Jun 2020 09:02:36 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff2
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 59c9a1711ef70621-FRA
content-length: 86844
cf-request-id: 0311e33ab2000006213d904200000001

GET
H2 200 SourceSansPro-Semibold.ttf.woff2
asnuasnfmowjmm.com/jp/assets/fonts/ 84 KB
84 KB 806ms
806ms Font
application/font-woff2 2606:4700:3036::681c:11c6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://asnuasnfmowjmm.com/jp/assets/fonts/SourceSansPro-Semibold.ttf.woff2?37328315
Requested by: Host: asnuasnfmowjmm.com
URL: https://asnuasnfmowjmm.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::681c:11c6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b96f55ccea2c4ad959ca841fa881a893e7df33a2e575d621a81d2f1063b429c4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://asnuasnfmowjmm.com/jp/assets/css/app.jp.css?365456439
Origin: https://asnuasnfmowjmm.com

Response headers

date: Mon, 01 Jun 2020 14:30:07 GMT
etag: W/"150b4-1726f1e4d3d"
cf-cache-status: MISS
last-modified: Mon, 01 Jun 2020 09:02:36 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff2
status: 200
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 59c9a1712f1a0621-FRA
content-length: 86196
cf-request-id: 0311e33ab6000006213d907200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercari (E-commerce)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

asnuasnfmowjmm.com
code.jquery.com
pcweb-assets.mercdn.net
151.101.14.133
2001:4de0:ac19::1:b:2a
2606:4700:3036::681c:11c6
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0f34f7d169129d40b428ac87ea520dce5c3acafe7d25699aaddf13a3b381d150
27c06ca531d01f12d9e28d869000985e4cf84dd0724afe578e942d44f09d19c2
6f60ac24dfdd23c8c45d9acef7183bb4ada3d7dc82f9c261f09621966651f910
6f958c7ffa35885ae373e1e73d9d544638292b82e5db1e776b192aadd3c65f3b
b96f55ccea2c4ad959ca841fa881a893e7df33a2e575d621a81d2f1063b429c4
f4c823301da0441f633837b7b207f4711269ff5c49e8d82f66df3324031a30cc

asnuasnfmowjmm.com Open in urlscan Pro 2606:4700:3036::681c:11c6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

250 kBTransfer

582 kBSize

0 Cookies

6 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

asnuasnfmowjmm.com Open in urlscan Pro
2606:4700:3036::681c:11c6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

250 kB
Transfer

582 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!