urlscan.io logo urlscan.io
SecurityTrails logo

uzjgxl.cn Open in urlscan Pro
35.241.86.74  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://etc.cvsauvzo.workers.dev/
Effective URL: https://uzjgxl.cn/login.php
Submission Tags: phishing etc service Search All
Submission: On December 18 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 35.241.86.74, located in Central, Hong Kong and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is uzjgxl.cn.
TLS certificate: Issued by R3 on December 10th 2022. Valid for: 3 months.
This is the only time uzjgxl.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ETC (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 4 35.241.86.74 396982 (GOOGLE-CL...)
1 34.150.46.113 396982 (GOOGLE-CL...)
5 4
Apex Domain
Subdomains		 Transfer
4 uzjgxl.cn
uzjgxl.cn
23 KB
1 aini1314.shop
www.aini1314.shop
355 B
1 workers.dev
etc.cvsauvzo.workers.dev
523 B
5 3
Domain Requested by
4 uzjgxl.cn 1 redirects etc.cvsauvzo.workers.dev
uzjgxl.cn
1 www.aini1314.shop uzjgxl.cn
1 etc.cvsauvzo.workers.dev
5 3

This site contains no links.

Subject Issuer Validity Valid
*.cvsauvzo.workers.dev
E1		 2022-12-18 -
2023-03-18		 3 months crt.sh
uzjgxl.cn
R3		 2022-12-10 -
2023-03-10		 3 months crt.sh
www.aini1314.shop
R3		 2022-11-29 -
2023-02-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://uzjgxl.cn/login.php
Frame ID: A906E469699C76B0D24BB4E611EC1996
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ＥＴＣ利用照会サービス

Page URL History Show full URLs

  1. https://etc.cvsauvzo.workers.dev/ Page URL
  2. http://uzjgxl.cn/ HTTP 301
    https://uzjgxl.cn/ Page URL
  3. https://uzjgxl.cn/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

23 kB
Transfer

82 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://etc.cvsauvzo.workers.dev/ Page URL
  2. http://uzjgxl.cn/ HTTP 301
    https://uzjgxl.cn/ Page URL
  3. https://uzjgxl.cn/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://uzjgxl.cn/ HTTP 301
  • https://uzjgxl.cn/

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
etc.cvsauvzo.workers.dev/ 		56 B
523 B 		Document
General
Check archive.org
Download Go to
Full URL
https://etc.cvsauvzo.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:9557 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray
77ba42837dc6afb8-NRT
content-encoding
br
content-type
text/html;charset=UTF-8
date
Sun, 18 Dec 2022 19:21:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KijSwySNJbtnvOQZfUpRhhGfsrnVg1bSERd7oUsv0003vz5vA7EPSql8Dg34nQjg7xlLXjPVDQYqdEdkeyXc4WjZQUDiEBEVuA0KLwiTrzNel%2BKOxXHOQd3DnDqJoyt9%2FtXMrIa7Kd4yt37kj%2FvBY8t7PSdTB3k%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
/
uzjgxl.cn/
Redirect Chain
  • http://uzjgxl.cn/
  • https://uzjgxl.cn/
1 KB
771 B 		Document
General
Check archive.org
Download Go to
Full URL
https://uzjgxl.cn/
Requested by
Host: etc.cvsauvzo.workers.dev
URL: https://etc.cvsauvzo.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.241.86.74 Central, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
74.86.241.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
5e086339f3e0d737cc01cba44929bbbbd363ce087c7814c8974254055318342c

Request headers

Referer
https://etc.cvsauvzo.workers.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
633
content-type
text/html
date
Sun, 18 Dec 2022 19:21:09 GMT
etag
"552-5e92a1df44800-gzip"
last-modified
Wed, 21 Sep 2022 06:33:04 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

Connection
close
Content-Length
285
Content-Type
text/html; charset=iso-8859-1
Date
Sun, 18 Dec 2022 19:21:08 GMT
Location
https://uzjgxl.cn/
Server
Apache
axios.min.js
uzjgxl.cn/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://uzjgxl.cn/js/axios.min.js
Requested by
Host: uzjgxl.cn
URL: https://uzjgxl.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.241.86.74 Central, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
74.86.241.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
aed6ac78b8249a9c7cff0030f3b921ee9f771cb1684164f3e679e1023a4d5c69

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://uzjgxl.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 18 Dec 2022 19:21:09 GMT
content-encoding
gzip
last-modified
Mon, 07 Mar 2022 07:56:02 GMT
server
Apache
etag
"45b3-5d99c32164880-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
6101
jump.php
www.aini1314.shop/api/ 		5 B
355 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.aini1314.shop/api/jump.php
Requested by
Host: uzjgxl.cn
URL: https://uzjgxl.cn/js/axios.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.150.46.113 Central, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
113.46.150.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
application/json, text/plain, */*
Referer
https://uzjgxl.cn/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 18 Dec 2022 19:21:11 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
server
nginx
vary
Accept-Encoding
access-control-allow-methods
*
content-type
text/html;charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
expires
Thu, 19 Nov 1981 08:52:00 GMT
Primary Request login.php
uzjgxl.cn/ 		54 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://uzjgxl.cn/login.php
Requested by
Host: uzjgxl.cn
URL: https://uzjgxl.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.241.86.74 Central, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
74.86.241.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
ecdd26499dae030ead6129ecf3c030c3ce608424174091fe8cac8b5b5775b5cf

Request headers

Referer
https://uzjgxl.cn/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

content-encoding
gzip
content-length
15912
content-type
text/html; charset=UTF-8
date
Sun, 18 Dec 2022 19:21:11 GMT
server
Apache
vary
Accept-Encoding
truncated
/ 		392 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
905b6bc56ec1c7edbc015eb6f4649e68c14bfef0eb61774bc8d3f550c1ff7e25

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		904 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2e84793231dc8da5ea4ed016e36dc88e4081bb9b8605eacd820446d68f7f09be

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1020 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7d1c425ab87390fa62f0b924e95453ba0c95e4a40a724eca66a1bca47178680b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
706aad4ccfa4f04be2b24b09d832c00391612ae50fd44ee76e819b70c9f4d973

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fd7d935b2e3b5498bb28e02eedab29aeb8bfa537f988aceb123b36858a6410e7

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		77 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6744a2726319c32bba421c71be01f818dcd09a2b13cb6520d2fdb8cf434d23d3

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		86 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b1d0d74215b647aa49e8c25740777357376247016351b0d928c8f5ee52935ee

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cc933147666fff38f99511731cc9d54578e387d41d82fedbc6e11635435cffad

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		223 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e9f21dccc13ca0678430dd66bb38410b00cacfec4fe4de8cdafc0f688906ca2f

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		378 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
06799e7e4eb5d4da14e1c007241a54d2f429a26a8c19ad91877531792eecd551

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e583ca603117253a6d29f22c361e59525f9e08d5cace74730fd7c468794d211b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ETC (Transportation)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| savepage_ShadowLoader

1 Cookies

Domain/Path Name / Value
uzjgxl.cn/ Name: isuser
Value: true