urlscan.io logo urlscan.io
SecurityTrails logo

www2.etc-meissai.jp.sdqm888.cn Open in urlscan Pro
155.94.151.102  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www2.etc-meissai.jp.sdqm888.cn/
Effective URL: https://www2.etc-meissai.jp.sdqm888.cn/login.php
Submission Tags: phishing etc service Search All
Submission: On June 03 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 155.94.151.102, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is www2.etc-meissai.jp.sdqm888.cn.
TLS certificate: Issued by R3 on June 3rd 2023. Valid for: 3 months.
This is the only time www2.etc-meissai.jp.sdqm888.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ETC (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 4 155.94.151.102 8100 (ASN-QUADR...)
1 35.241.110.144 396982 (GOOGLE-CL...)
4 3
Apex Domain
Subdomains		 Transfer
4 sdqm888.cn
www2.etc-meissai.jp.sdqm888.cn
23 KB
1 aini1314.shop
www.aini1314.shop
356 B
4 2
Domain Requested by
4 www2.etc-meissai.jp.sdqm888.cn 1 redirects www2.etc-meissai.jp.sdqm888.cn
1 www.aini1314.shop www2.etc-meissai.jp.sdqm888.cn
4 2

This site contains no links.

Subject Issuer Validity Valid
www2.etc-meissai.jp.uiu7.cn
R3		 2023-06-03 -
2023-09-01		 3 months crt.sh
www.aini1314.shop
R3		 2023-05-28 -
2023-08-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www2.etc-meissai.jp.sdqm888.cn/login.php
Frame ID: DF94D8F517D34BD23F42BD3D32F8D080
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ＥＴＣ利用照会サービス

Page URL History Show full URLs

  1. http://www2.etc-meissai.jp.sdqm888.cn/ HTTP 301
    https://www2.etc-meissai.jp.sdqm888.cn/ Page URL
  2. https://www2.etc-meissai.jp.sdqm888.cn/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

23 kB
Transfer

82 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www2.etc-meissai.jp.sdqm888.cn/ HTTP 301
    https://www2.etc-meissai.jp.sdqm888.cn/ Page URL
  2. https://www2.etc-meissai.jp.sdqm888.cn/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www2.etc-meissai.jp.sdqm888.cn/ HTTP 301
  • https://www2.etc-meissai.jp.sdqm888.cn/

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
www2.etc-meissai.jp.sdqm888.cn/
Redirect Chain
  • http://www2.etc-meissai.jp.sdqm888.cn/
  • https://www2.etc-meissai.jp.sdqm888.cn/
1 KB
771 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www2.etc-meissai.jp.sdqm888.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
155.94.151.102 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
155.94.151.102.static.quadranet.com
Software
Apache /
Resource Hash
5e086339f3e0d737cc01cba44929bbbbd363ce087c7814c8974254055318342c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
633
content-type
text/html
date
Sat, 03 Jun 2023 23:33:50 GMT
etag
"552-5e92a1df44800-gzip"
last-modified
Wed, 21 Sep 2022 06:33:04 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

Connection
close
Content-Length
327
Content-Type
text/html; charset=iso-8859-1
Date
Sat, 03 Jun 2023 23:33:49 GMT
Location
https://www2.etc-meissai.jp.sdqm888.cn/
Server
Apache
axios.min.js
www2.etc-meissai.jp.sdqm888.cn/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www2.etc-meissai.jp.sdqm888.cn/js/axios.min.js
Requested by
Host: www2.etc-meissai.jp.sdqm888.cn
URL: https://www2.etc-meissai.jp.sdqm888.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
155.94.151.102 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
155.94.151.102.static.quadranet.com
Software
Apache /
Resource Hash
aed6ac78b8249a9c7cff0030f3b921ee9f771cb1684164f3e679e1023a4d5c69

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www2.etc-meissai.jp.sdqm888.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date
Sat, 03 Jun 2023 23:33:50 GMT
content-encoding
gzip
last-modified
Mon, 07 Mar 2022 07:56:02 GMT
server
Apache
etag
"45b3-5d99c32164880-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
6101
jump.php
www.aini1314.shop/api/ 		5 B
356 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.aini1314.shop/api/jump.php
Requested by
Host: www2.etc-meissai.jp.sdqm888.cn
URL: https://www2.etc-meissai.jp.sdqm888.cn/js/axios.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.241.110.144 Central, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
144.110.241.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
application/json, text/plain, */*
Referer
https://www2.etc-meissai.jp.sdqm888.cn/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 03 Jun 2023 23:33:51 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
server
nginx
vary
Accept-Encoding
access-control-allow-methods
*
content-type
text/html;charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
access-control-allow-credentials
true
expires
Thu, 19 Nov 1981 08:52:00 GMT
Primary Request login.php
www2.etc-meissai.jp.sdqm888.cn/ 		54 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www2.etc-meissai.jp.sdqm888.cn/login.php
Requested by
Host: www2.etc-meissai.jp.sdqm888.cn
URL: https://www2.etc-meissai.jp.sdqm888.cn/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
155.94.151.102 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
155.94.151.102.static.quadranet.com
Software
Apache /
Resource Hash
ecdd26499dae030ead6129ecf3c030c3ce608424174091fe8cac8b5b5775b5cf

Request headers

Referer
https://www2.etc-meissai.jp.sdqm888.cn/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

content-encoding
gzip
content-length
15912
content-type
text/html; charset=UTF-8
date
Sat, 03 Jun 2023 23:33:51 GMT
server
Apache
vary
Accept-Encoding
truncated
/ 		392 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
905b6bc56ec1c7edbc015eb6f4649e68c14bfef0eb61774bc8d3f550c1ff7e25

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		904 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2e84793231dc8da5ea4ed016e36dc88e4081bb9b8605eacd820446d68f7f09be

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1020 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7d1c425ab87390fa62f0b924e95453ba0c95e4a40a724eca66a1bca47178680b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
706aad4ccfa4f04be2b24b09d832c00391612ae50fd44ee76e819b70c9f4d973

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fd7d935b2e3b5498bb28e02eedab29aeb8bfa537f988aceb123b36858a6410e7

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		77 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6744a2726319c32bba421c71be01f818dcd09a2b13cb6520d2fdb8cf434d23d3

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		86 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b1d0d74215b647aa49e8c25740777357376247016351b0d928c8f5ee52935ee

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cc933147666fff38f99511731cc9d54578e387d41d82fedbc6e11635435cffad

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		223 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e9f21dccc13ca0678430dd66bb38410b00cacfec4fe4de8cdafc0f688906ca2f

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		378 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
06799e7e4eb5d4da14e1c007241a54d2f429a26a8c19ad91877531792eecd551

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e583ca603117253a6d29f22c361e59525f9e08d5cace74730fd7c468794d211b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ETC (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| savepage_ShadowLoader

1 Cookies

Domain/Path Name / Value
www2.etc-meissai.jp.sdqm888.cn/ Name: isuser
Value: true