Submitted URL: https://www.taurusoil.com/233844041292
Effective URL: https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Submission: On June 23 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 49.212.180.78, located in Japan and belongs to SAKURA-C SAKURA Internet Inc., JP. The main domain is sr-mahoroba.jp.
TLS certificate: Issued by JPRS Domain Validation Authority - G4 on June 29th 2022. Valid for: a year.
This is the only time sr-mahoroba.jp was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 197.255.32.252 37480 (Cobranet)
3 11 49.212.180.78 9371 (SAKURA-C ...)
8 1
Apex Domain
Subdomains
Transfer
11 sr-mahoroba.jp
sr-mahoroba.jp
532 KB
1 taurusoil.com
www.taurusoil.com
239 B
8 2
Domain Requested by
11 sr-mahoroba.jp 3 redirects sr-mahoroba.jp
1 www.taurusoil.com 1 redirects
8 2

This site contains no links.

Subject Issuer Validity Valid
sr-mahoroba.jp
JPRS Domain Validation Authority - G4
2022-06-29 -
2023-06-30
a year crt.sh

This page contains 1 frames:

Primary Page: https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Frame ID: 9E889074B2CA97EDB7C7D7B93DF7E2AC
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Postbank Banking & Brokeragepb-logo

Page URL History Show full URLs

  1. https://www.taurusoil.com/233844041292 HTTP 302
    https://sr-mahoroba.jp/uprh/ HTTP 302
    https://sr-mahoroba.jp/uprh/de?b238c053385538cb7d14e09adaf2c82a HTTP 301
    https://sr-mahoroba.jp/uprh/de/?b238c053385538cb7d14e09adaf2c82a HTTP 302
    https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

531 kB
Transfer

1290 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.taurusoil.com/233844041292 HTTP 302
    https://sr-mahoroba.jp/uprh/ HTTP 302
    https://sr-mahoroba.jp/uprh/de?b238c053385538cb7d14e09adaf2c82a HTTP 301
    https://sr-mahoroba.jp/uprh/de/?b238c053385538cb7d14e09adaf2c82a HTTP 302
    https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request indx.aspx.php
sr-mahoroba.jp/uprh/de/
Redirect Chain
  • https://www.taurusoil.com/233844041292
  • https://sr-mahoroba.jp/uprh/
  • https://sr-mahoroba.jp/uprh/de?b238c053385538cb7d14e09adaf2c82a
  • https://sr-mahoroba.jp/uprh/de/?b238c053385538cb7d14e09adaf2c82a
  • https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
665 KB
159 KB
Document
General
Full URL
https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx / PHP/7.4.33
Resource Hash
cba03a3300b5c5f86d5b0dba08ae5f2fc867431eb69cc756c5134e0cdb5a14f3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 23 Jun 2023 13:30:36 GMT
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff
x-powered-by
PHP/7.4.33
x-xss-protection
1; mode=block

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 23 Jun 2023 13:30:36 GMT
location
./indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
server
nginx
x-content-type-options
nosniff
x-powered-by
PHP/7.4.33
x-xss-protection
1; mode=block
styles.107d2563449b3205.css
sr-mahoroba.jp/uprh/de/index_fichiers/
282 KB
43 KB
Stylesheet
General
Full URL
https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
5b99ec6d3dc75815a3417b1f669055f076587d2d1a43e320d31435b5105efb5e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 05:09:27 GMT
server
nginx
etag
"46783-5fec5014aa297-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=604800
accept-ranges
bytes
content-length
43755
x-xss-protection
1; mode=block
expires
Fri, 30 Jun 2023 13:30:37 GMT
everything-you-need-to-know.png
sr-mahoroba.jp/uprh/de/index_fichiers/
42 KB
35 KB
Image
General
Full URL
https://sr-mahoroba.jp/uprh/de/index_fichiers/everything-you-need-to-know.png
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
40988765b5729bf021191fda5e3243ceb16158a6a3f388e81a4904fe94f8257c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 05:09:27 GMT
server
nginx
etag
"a76e-5fec5014a9e6d-gzip"
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
35970
x-xss-protection
1; mode=block
expires
Sun, 23 Jul 2023 13:30:38 GMT
pbbg.94a99b13acbdc92b.jpg
sr-mahoroba.jp/uprh/de/
243 KB
240 KB
Image
General
Full URL
https://sr-mahoroba.jp/uprh/de/pbbg.94a99b13acbdc92b.jpg
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 05:09:27 GMT
server
nginx
etag
"3cbb5-5fec5014c06bb-gzip"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
x-xss-protection
1; mode=block
expires
Sun, 23 Jul 2023 13:30:38 GMT
pb-logo-with-title-no-subline.e1d194a4d3600cb0.svg
sr-mahoroba.jp/uprh/de/
7 KB
3 KB
Image
General
Full URL
https://sr-mahoroba.jp/uprh/de/pb-logo-with-title-no-subline.e1d194a4d3600cb0.svg
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
00c9eff1b8047f294849530c6a5c9bb88c10578470ae1d673ea7238279643ec5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sr-mahoroba.jp/uprh/de/indx.aspx.php?5400faa4a2da9fc76de0c2b4cac099fa
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 05:09:27 GMT
server
nginx
etag
"1bfb-5fec5014c051d-gzip"
vary
Accept-Encoding
content-type
image/svg+xml
accept-ranges
bytes
content-length
2474
x-xss-protection
1; mode=block
pb-logo-splash.e83ae1f69ca2f23d.svg
sr-mahoroba.jp/uprh/de/index_fichiers/
196 B
196 B
Image
General
Full URL
https://sr-mahoroba.jp/uprh/de/index_fichiers/pb-logo-splash.e83ae1f69ca2f23d.svg
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:38 GMT
server
nginx
content-length
196
content-type
text/html; charset=iso-8859-1
FrutigerLTW05-65Bold.a18adccbfba3032a.woff2
sr-mahoroba.jp/uprh/de/index_fichiers/
25 KB
26 KB
Font
General
Full URL
https://sr-mahoroba.jp/uprh/de/index_fichiers/FrutigerLTW05-65Bold.a18adccbfba3032a.woff2
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
Origin
https://sr-mahoroba.jp
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 05:09:27 GMT
server
nginx
etag
"6598-5fec5014aa101-gzip"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
content-length
26031
x-xss-protection
1; mode=block
FrutigerLTW05-55Roman.cc9768c5af9adc84.woff2
sr-mahoroba.jp/uprh/de/index_fichiers/
25 KB
25 KB
Font
General
Full URL
https://sr-mahoroba.jp/uprh/de/index_fichiers/FrutigerLTW05-55Roman.cc9768c5af9adc84.woff2
Requested by
Host: sr-mahoroba.jp
URL: https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
49.212.180.78 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
www2668.sakura.ne.jp
Software
nginx /
Resource Hash
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sr-mahoroba.jp/uprh/de/index_fichiers/styles.107d2563449b3205.css
Origin
https://sr-mahoroba.jp
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 23 Jun 2023 13:30:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Jun 2023 05:09:27 GMT
server
nginx
etag
"64a4-5fec5014a9fde-gzip"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
content-length
25787
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

1 Cookies

Domain/Path Name / Value
sr-mahoroba.jp/ Name: PHPSESSID
Value: 651e4d9cf680a32f1ccf5c5bc25bd0ca

1 Console Messages

Source Level URL
Text
network error URL: https://sr-mahoroba.jp/uprh/de/index_fichiers/pb-logo-splash.e83ae1f69ca2f23d.svg
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block