www.n7t6frtgeg.com Open in urlscan Pro
103.138.82.61  Malicious Activity! Public Scan

Submitted URL: https://www.n7t6frtgeg.com/
Effective URL: https://www.n7t6frtgeg.com/login.php
Submission: On June 27 via manual from JP — Scanned from JP

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 103.138.82.61, located in Seoul, Korea, Republic Of and belongs to NTTE-AS Ntte Global Network Brand Name, HK. The main domain is www.n7t6frtgeg.com.
TLS certificate: Issued by R3 on June 22nd 2023. Valid for: 3 months.
This is the only time www.n7t6frtgeg.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

IP Address AS Autonomous System
1 13 103.138.82.61 9232 (NTTE-AS N...)
2 42.236.73.40 4837 (CHINA169-...)
1 42.236.73.38 4837 (CHINA169-...)
15 3
Apex Domain
Subdomains
Transfer
13 n7t6frtgeg.com
www.n7t6frtgeg.com
60 KB
3 51.la
js.users.51.la — Cisco Umbrella Rank: 65007
ia.51.la — Cisco Umbrella Rank: 60441
3 KB
15 2
Domain Requested by
13 www.n7t6frtgeg.com 1 redirects www.n7t6frtgeg.com
2 js.users.51.la www.n7t6frtgeg.com
1 ia.51.la www.n7t6frtgeg.com
15 3

This site contains no links.

Subject Issuer Validity Valid
www.n7t6frtgeg.com
R3
2023-06-22 -
2023-09-20
3 months crt.sh
*.users.51.la
GlobalSign GCC R3 DV TLS CA 2020
2023-04-14 -
2024-05-15
a year crt.sh
*.51.la
GlobalSign GCC R3 DV TLS CA 2020
2023-04-20 -
2024-05-21
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.n7t6frtgeg.com/login.php
Frame ID: 73B511299BC48B39E7A5DC2B53100FDE
Requests: 15 HTTP requests in this frame

Screenshot

Page Title

マイアカウントにログイン - クレジットカードはアメリカン・エキスプレス

Page URL History Show full URLs

  1. https://www.n7t6frtgeg.com/ HTTP 302
    https://www.n7t6frtgeg.com/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

62 kB
Transfer

125 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.n7t6frtgeg.com/ HTTP 302
    https://www.n7t6frtgeg.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
www.n7t6frtgeg.com/
Redirect Chain
  • https://www.n7t6frtgeg.com/
  • https://www.n7t6frtgeg.com/login.php
12 KB
4 KB
Document
General
Full URL
https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
74823bd41351b4f660095460982848323d6f3714b8da97bdb8aabaab3e090ee6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
jp-jp,jp;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 27 Jun 2023 08:42:10 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset=UTF-8
date
Tue, 27 Jun 2023 08:42:09 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
./login.php
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
21518747.js
js.users.51.la/
5 KB
3 KB
Script
General
Full URL
https://js.users.51.la/21518747.js
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
42.236.73.40 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
hn.kd.ny.adsl
Software
openresty /
Resource Hash
bea336e6024cbf4ce6de76a04e9fb223b91e75701fa25047a04d32695692a440

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 08:42:17 GMT
Content-Encoding
gzip
Server
openresty
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
21520195.js
js.users.51.la/
0
0
Script
General
Full URL
https://js.users.51.la/21520195.js
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
42.236.73.40 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
hn.kd.ny.adsl
Software
openresty /
Resource Hash

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 08:42:17 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
application/javascript; charset=utf-8
logo.svg
www.n7t6frtgeg.com/img/
2 KB
2 KB
Image
General
Full URL
https://www.n7t6frtgeg.com/img/logo.svg
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
fc69234936c0df004440641a5df9ee1e3c3532df5780984f0f636e85e8788519
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:31 GMT
server
nginx
etag
"63aa6f47-66e"
content-type
image/svg+xml
accept-ranges
bytes
content-length
1646
app.jpg
www.n7t6frtgeg.com/img/
12 KB
12 KB
Image
General
Full URL
https://www.n7t6frtgeg.com/img/app.jpg
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
759b1da080b03f5104dc5bf2fc7cbe688fc10846ffdeb78c406db3df62b18f0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:30 GMT
server
nginx
etag
"63aa6f46-2f1c"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
12060
expires
Thu, 27 Jul 2023 08:42:10 GMT
you-3.svg
www.n7t6frtgeg.com/img/
501 B
658 B
Image
General
Full URL
https://www.n7t6frtgeg.com/img/you-3.svg
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
c49443900f5e18fe3c2b337135235268d622d011aac9f29ca04d4da34703090f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:32 GMT
server
nginx
etag
"63aa6f48-1f5"
content-type
image/svg+xml
accept-ranges
bytes
content-length
501
logo2.svg
www.n7t6frtgeg.com/img/
2 KB
2 KB
Image
General
Full URL
https://www.n7t6frtgeg.com/img/logo2.svg
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:31 GMT
server
nginx
etag
"63aa6f47-693"
content-type
image/svg+xml
accept-ranges
bytes
content-length
1683
icon.svg
www.n7t6frtgeg.com/img/
235 B
391 B
Image
General
Full URL
https://www.n7t6frtgeg.com/img/icon.svg
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
e4e37395882770684d811919d658a61f587c2caa7f7984f01d4e6f1cceea1052
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:30 GMT
server
nginx
etag
"63aa6f46-eb"
content-type
image/svg+xml
accept-ranges
bytes
content-length
235
x1.png
www.n7t6frtgeg.com/img/
644 B
850 B
Image
General
Full URL
https://www.n7t6frtgeg.com/img/x1.png
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:31 GMT
server
nginx
etag
"63aa6f47-284"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
644
expires
Thu, 27 Jul 2023 08:42:10 GMT
x2.png
www.n7t6frtgeg.com/img/
984 B
1 KB
Image
General
Full URL
https://www.n7t6frtgeg.com/img/x2.png
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:31 GMT
server
nginx
etag
"63aa6f47-3d8"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
984
expires
Thu, 27 Jul 2023 08:42:10 GMT
x3.png
www.n7t6frtgeg.com/img/
1 KB
1 KB
Image
General
Full URL
https://www.n7t6frtgeg.com/img/x3.png
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 27 Dec 2022 04:06:31 GMT
server
nginx
etag
"63aa6f47-425"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1061
expires
Thu, 27 Jul 2023 08:42:10 GMT
jquery.min.js
www.n7t6frtgeg.com/js/
90 KB
36 KB
Script
General
Full URL
https://www.n7t6frtgeg.com/js/jquery.min.js
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash
20638e363fcc5152155f24b281303e17da62da62d24ef5dcf863b184d9a25734
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sun, 05 Jun 2022 11:41:08 GMT
server
nginx
etag
W/"629c9654-169d9"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Tue, 27 Jun 2023 20:42:10 GMT
go1
ia.51.la/
0
73 B
Image
General
Full URL
https://ia.51.la/go1?id=21518747&rt=1687855337869&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1687855337869&tt=&kw=&cu=https%253A%252F%252Fwww.n7t6frtgeg.com%252Flogin.php&pu=
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
42.236.73.38 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
hn.kd.ny.adsl
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
jp-jp,jp;q=0.9
Referer
https://www.n7t6frtgeg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 08:40:24 GMT
Content-Length
0
Roboto-Light.ttf
www.n7t6frtgeg.com/fonts/
0
0
Font
General
Full URL
https://www.n7t6frtgeg.com/fonts/Roboto-Light.ttf
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://www.n7t6frtgeg.com/login.php
Origin
https://www.n7t6frtgeg.com
accept-language
jp-jp,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
server
nginx
content-length
548
content-type
text/html
Roboto-Medium.ttf
www.n7t6frtgeg.com/fonts/
0
0
Font
General
Full URL
https://www.n7t6frtgeg.com/fonts/Roboto-Medium.ttf
Requested by
Host: www.n7t6frtgeg.com
URL: https://www.n7t6frtgeg.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.138.82.61 Seoul, Korea, Republic Of, ASN9232 (NTTE-AS Ntte Global Network Brand Name, HK),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://www.n7t6frtgeg.com/login.php
Origin
https://www.n7t6frtgeg.com
accept-language
jp-jp,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 08:42:10 GMT
server
nginx
content-length
548
content-type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery

4 Cookies

Domain/Path Name / Value
www.n7t6frtgeg.com/ Name: PHPSESSID
Value: dgf56vbattb0gubgfme5vfor2p
www.n7t6frtgeg.com/ Name: __tins__21518747
Value: %7B%22sid%22%3A%201687855337869%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201687857137869%7D
www.n7t6frtgeg.com/ Name: __51cke__
Value:
www.n7t6frtgeg.com/ Name: __51laig__
Value: 1

3 Console Messages

Source Level URL
Text
network error URL: https://js.users.51.la/21520195.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
network error URL: https://www.n7t6frtgeg.com/fonts/Roboto-Light.ttf
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.n7t6frtgeg.com/fonts/Roboto-Medium.ttf
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000