mediawiki.institutfrancais.jp Open in urlscan Pro
139.162.90.30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mediawiki.institutfrancais.jp/vendor/home/
Submission: On September 14 via api (September 14th 2022, 3:49:59 pm UTC) from US — Scanned from JP

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 139.162.90.30, located in Tokyo, Japan and belongs to LINODE-AP Linode, LLC, US. The main domain is mediawiki.institutfrancais.jp.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 27th 2022. Valid for: 3 months.

This is the only time mediawiki.institutfrancais.jp was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	139.162.90.30 139.162.90.30	63949 (LINODE-AP...) (LINODE-AP Linode)
4	2600:140b:1a0... 2600:140b:1a00:3a2::523	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	117.18.232.200 117.18.232.200	15133 (EDGECAST) (EDGECAST)
5	23.2.134.163 23.2.134.163	16625 (AKAMAI-AS) (AKAMAI-AS)
11	5

1 139.162.90.30 (Tokyo, Japan)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: polyvalent2.akbsystems.jp

mediawiki.institutfrancais.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:140b:1a00:3a2::523 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

res.cloudinary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 117.18.232.200 (Australia)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.2.134.163 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-2-134-163.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	aexp-static.com www.aexp-static.com — Cisco Umbrella Rank: 18357	294 KB
4	cloudinary.com res.cloudinary.com — Cisco Umbrella Rank: 3896	129 KB
1	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 2747	31 KB
1	institutfrancais.jp mediawiki.institutfrancais.jp	51 KB
11	4

	Domain	Requested by
5	www.aexp-static.com	res.cloudinary.com
4	res.cloudinary.com	mediawiki.institutfrancais.jp res.cloudinary.com
1	ajax.aspnetcdn.com	mediawiki.institutfrancais.jp
1	mediawiki.institutfrancais.jp
11	4

This site contains no links.

Subject Issuer	Validity	Valid
mediawiki.institutfrancais.jp cPanel, Inc. Certification Authority	`2022-06-27` - `2022-09-25`	3 months	crt.sh
*.cloudinary.com Go Daddy Secure Certificate Authority - G2	`2022-01-10` - `2022-12-20`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2022-07-11` - `2023-07-11`	a year	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2022-05-16` - `2023-05-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mediawiki.institutfrancais.jp/vendor/home/
Frame ID: C4B4A7B15AC85D48B58D86E60933F9EF
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In| American Express

Detected technologies

Amex Express Checkout (Payment processors) Expand

Overall confidence: 100%
Detected patterns

aexp-static\.com

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

505 kB
Transfer

1156 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
mediawiki.institutfrancais.jp/vendor/home/ 50 KB
51 KB 38ms
4ms Document
text/html 139.162.90.30
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://mediawiki.institutfrancais.jp/vendor/home/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 139.162.90.30 Tokyo, Japan, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: polyvalent2.akbsystems.jp
Software: Apache /
Resource Hash: 918680c781433b33300d38b791a36e37835a95435ea63c7549c48063f85dc7f6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 51617
Content-Type: text/html
Date: Wed, 14 Sep 2022 15:49:54 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Wed, 14 Sep 2022 14:24:11 GMT
Server: Apache

GET
H2 200 dls_dcv5up.css
res.cloudinary.com/dwpwiydgc/raw/upload/v1605901006/ 395 KB
42 KB 33ms
6ms Stylesheet
text/css 2600:140b:1a00:3a2::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901006/dls_dcv5up.css

Requested by

Host: mediawiki.institutfrancais.jp
URL: https://mediawiki.institutfrancais.jp/vendor/home/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2600:140b:1a00:3a2::523 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

b73e78d39762572c05c0f4fea00f57d703dba65f6744514ef7a8e029318684ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://mediawiki.institutfrancais.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
content-encoding: br
last-modified: Fri, 20 Nov 2020 19:36:47 GMT
server: Cloudinary
etag: W/"3277c98bd56b2229a7bedbca692319f6"
strict-transport-security: max-age=604800
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error
cache-control: public, no-transform, immutable, max-age=2592000
server-timing: akam;dur=3;start=2022-09-14T15:49:54.719Z;desc=hit,rtt;dur=1
accept-ranges: bytes
timing-allow-origin: *
content-length: 42367

GET
H2 200 font_cwhs2t.css
res.cloudinary.com/dwpwiydgc/raw/upload/v1605901073/ 212 KB
19 KB 38ms
11ms Stylesheet
text/css 2600:140b:1a00:3a2::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901073/font_cwhs2t.css

Requested by

Host: mediawiki.institutfrancais.jp
URL: https://mediawiki.institutfrancais.jp/vendor/home/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2600:140b:1a00:3a2::523 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

996e3f0f97560275527906b77b77ea592f06b410225d40ae7880a3caef3466ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://mediawiki.institutfrancais.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
content-encoding: br
last-modified: Fri, 20 Nov 2020 19:37:54 GMT
server: Cloudinary
etag: W/"f69de86bfa9309d89f121c432bf6d7d8"
strict-transport-security: max-age=604800
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error
cache-control: public, no-transform, immutable, max-age=2592000
server-timing: akam;dur=3;start=2022-09-14T15:49:54.725Z;desc=hit,rtt;dur=1
accept-ranges: bytes
timing-allow-origin: *
content-length: 18749

GET
H2 200 fonts_n74ldn.css
res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/ 104 KB
68 KB 41ms
15ms Stylesheet
text/css 2600:140b:1a00:3a2::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/fonts_n74ldn.css

Requested by

Host: mediawiki.institutfrancais.jp
URL: https://mediawiki.institutfrancais.jp/vendor/home/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2600:140b:1a00:3a2::523 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

08ed7823c2cdb7b89093fa8c4fd9eee8c66da6a72be66d31fac37e690f2531a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://mediawiki.institutfrancais.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
content-encoding: br
last-modified: Fri, 20 Nov 2020 19:38:06 GMT
server: Cloudinary
etag: W/"f7dc03eeb24e17a07d46e5dc9311475e"
strict-transport-security: max-age=604800
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error
cache-control: public, no-transform, immutable, max-age=2592000
server-timing: akam;dur=3;start=2022-09-14T15:49:54.729Z;desc=hit,rtt;dur=1
accept-ranges: bytes
timing-allow-origin: *
content-length: 69575

GET
H2 200 jquery-3.5.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 87 KB
31 KB 23ms
5ms Script
application/javascript 117.18.232.200
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.5.1.min.js

Requested by

Host: mediawiki.institutfrancais.jp
URL: https://mediawiki.institutfrancais.jp/vendor/home/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

117.18.232.200 , Australia, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (tka/8918) /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://mediawiki.institutfrancais.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4054862
x-cache: HIT
content-length: 30976
x-xss-protection: 1; mode=block
last-modified: Tue, 11 Aug 2020 16:38:03 GMT
server: ECAcc (tka/8918)
etag: "80e72fc8fd6fd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc69234936c0df004440641a5df9ee1e3c3532df5780984f0f636e85e8788519

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56b8e90244c34621e294d3357edfef9a1467e501773ed21b25dc6367ab3d7803

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.aexp-static.com/nav/ngn/fonts/ 36 KB
37 KB 32ms
7ms Font
font/woff 23.2.134.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
Requested by: Host: res.cloudinary.com
URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901006/dls_dcv5up.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.134.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-134-163.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

Request headers

Referer: https://res.cloudinary.com/
Origin: https://mediawiki.institutfrancais.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-9121"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37153
expires: Fri, 08 Jan 2021 21:09:55 GMT

GET
H2 200 Roboto-Regular.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/ 75 KB
76 KB 33ms
14ms Font
font/woff 23.2.134.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Regular.woff
Requested by: Host: res.cloudinary.com
URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901073/font_cwhs2t.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.134.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-134-163.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7ef974010abfe71fb92dc3f53e3948e1e544cf6821bf9802ea0bf35fa8fe5af6

Request headers

Referer: https://res.cloudinary.com/
Origin: https://mediawiki.institutfrancais.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "1dc09d84-12bf8"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 76792
expires: Mon, 11 Jan 2021 01:48:26 GMT

GET
H2 200 Roboto-Medium.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/ 71 KB
72 KB 36ms
23ms Font
font/woff 23.2.134.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Medium.woff
Requested by: Host: res.cloudinary.com
URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901073/font_cwhs2t.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.134.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-134-163.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d5d7822393d3103ec421f72f09c7f7c78948c68da112031c0afd1c0b0da92c08

Request headers

Referer: https://res.cloudinary.com/
Origin: https://mediawiki.institutfrancais.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "1dc09d84-11cfc"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 72956
expires: Fri, 08 Jan 2021 18:54:32 GMT

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd019a6147dd61d8a25b62afee3861027b5267ddd8d9d25d60bcfc4ddc4ed875

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 316 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: acddc65fd3cdc9eecc019e24154e3199b6cc918d0c4f5baea10a7d170a431859

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 644 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aceafc4f408e21149b229fc07eb7735b8aea8b3e93a421bbe6eefe54b96f208d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 764 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 984 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1ee2c9edcb3f450400bfae23a95a9f819e3802f6becc00698d657e9781a4dee

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 404 amex-fuid-sprite.png
res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/ 0
403 B 7ms
7ms Image
image/gif 2600:140b:1a00:3a2::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/amex-fuid-sprite.png

Requested by

Host: res.cloudinary.com
URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/fonts_n74ldn.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2600:140b:1a00:3a2::523 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/fonts_n74ldn.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
server: Cloudinary
x-cld-error: Resource not found - amex-fuid-sprite.png
strict-transport-security: max-age=604800
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error
cache-control: private, no-transform, max-age=0, no-cache
content-transfer-encoding: binary
content-disposition: inline
server-timing: akam;dur=4;start=2022-09-14T15:49:54.790Z;desc=hit,rtt;dur=1
accept-ranges: bytes
timing-allow-origin: *
content-length: 0
x-request-id: b9a6e81b464dee3a011f30b39fe5926d

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
www.aexp-static.com/nav/ngn/fonts/ 37 KB
38 KB 31ms
30ms Font
font/woff 23.2.134.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
Requested by: Host: res.cloudinary.com
URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901006/dls_dcv5up.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.134.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-134-163.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c

Request headers

Referer: https://res.cloudinary.com/
Origin: https://mediawiki.institutfrancais.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-943d"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37949
expires: Fri, 27 Nov 2020 03:31:12 GMT

GET
H2 200 Roboto-Light.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/ 72 KB
72 KB 29ms
29ms Font
font/woff 23.2.134.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/fonts/Roboto-Light.woff
Requested by: Host: res.cloudinary.com
URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901073/font_cwhs2t.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.134.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-134-163.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e9f9fab2d479b79aca1d3d3bf0a9fc36131752869363180bef040905a008cc1b

Request headers

Referer: https://res.cloudinary.com/
Origin: https://mediawiki.institutfrancais.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 14 Sep 2022 15:49:54 GMT
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "1dc09d84-11f84"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 73604
expires: Fri, 08 Jan 2021 11:17:05 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://res.cloudinary.com/dwpwiydgc/raw/upload/v1605901085/amex-fuid-sprite.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
mediawiki.institutfrancais.jp
res.cloudinary.com
www.aexp-static.com
117.18.232.200
139.162.90.30
23.2.134.163
2600:140b:1a00:3a2::523
028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab
08ed7823c2cdb7b89093fa8c4fd9eee8c66da6a72be66d31fac37e690f2531a9
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c
56b8e90244c34621e294d3357edfef9a1467e501773ed21b25dc6367ab3d7803
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
7ef974010abfe71fb92dc3f53e3948e1e544cf6821bf9802ea0bf35fa8fe5af6
918680c781433b33300d38b791a36e37835a95435ea63c7549c48063f85dc7f6
996e3f0f97560275527906b77b77ea592f06b410225d40ae7880a3caef3466ff
acddc65fd3cdc9eecc019e24154e3199b6cc918d0c4f5baea10a7d170a431859
aceafc4f408e21149b229fc07eb7735b8aea8b3e93a421bbe6eefe54b96f208d
b1ee2c9edcb3f450400bfae23a95a9f819e3802f6becc00698d657e9781a4dee
b73e78d39762572c05c0f4fea00f57d703dba65f6744514ef7a8e029318684ef
bd019a6147dd61d8a25b62afee3861027b5267ddd8d9d25d60bcfc4ddc4ed875
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9
d5d7822393d3103ec421f72f09c7f7c78948c68da112031c0afd1c0b0da92c08
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9f9fab2d479b79aca1d3d3bf0a9fc36131752869363180bef040905a008cc1b
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc69234936c0df004440641a5df9ee1e3c3532df5780984f0f636e85e8788519

mediawiki.institutfrancais.jp Open in urlscan Pro 139.162.90.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

505 kBTransfer

1156 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

mediawiki.institutfrancais.jp Open in urlscan Pro
139.162.90.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

505 kB
Transfer

1156 kB
Size

0
Cookies

11 HTTP transactions
13 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!