gilbertdigital.net - urlscan.io

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 192.185.56.46, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is gilbertdigital.net.

This is the only time gilbertdigital.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: EMS China (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 3	192.185.56.46 192.185.56.46	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2a02:26f0:10:... 2a02:26f0:10:296::2a3d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	211.156.201.16 211.156.201.16	24430 (CNNIC-CHI...) (CNNIC-CHINAPOST-AP CHINA STATE POST BUREAU)
2	2606:4700:303... 2606:4700:3030::681b:86b7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	4

3 192.185.56.46 (Houston, United States) 2 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-56-46.unifiedlayer.com

gilbertdigital.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10:296::2a3d (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

main.cdn.merchant.wish.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 211.156.201.16 (China)

ASN24430 (CNNIC-CHINAPOST-AP CHINA STATE POST BUREAU, CN)

www.ems.com.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3030::681b:86b7 (United States)

ASN13335 (CLOUDFLARENET, US)

ahmak.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	gilbertdigital.net 2 redirects gilbertdigital.net	3 KB
2	ahmak.net ahmak.net
1	ems.com.cn www.ems.com.cn	38 KB
1	wish.com main.cdn.merchant.wish.com
5	4

	Domain	Requested by
3	gilbertdigital.net	2 redirects
2	ahmak.net	gilbertdigital.net
1	www.ems.com.cn	gilbertdigital.net
1	main.cdn.merchant.wish.com	gilbertdigital.net
5	4

This site contains links to these domains. Also see Links.

Domain
www.cnpl.com.cn
www.spb.gov.cn
www.11183.com.cn

Subject Issuer	Validity	Valid
main.cdn.wish.com DigiCert SHA2 Extended Validation Server CA	`2020-01-27` - `2022-04-27`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://gilbertdigital.net/wp-wap/config/emss.php
Frame ID: D40C5D4410715FF39FBAF3ADAFDEE7B9
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

中国邮政速递物流

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

20 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

41 kB
Transfer

44 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.cnpl.com.cn/

Search URL Search Domain Scan URL

URL: http://www.spb.gov.cn/kdy/

Search URL Search Domain Scan URL

URL: http://www.11183.com.cn/ec-web/register/register_toIndex.action
Title: 客户服务

Search URL Search Domain Scan URL

URL: http://www.11183.com.cn/ec-web/
Title: 网上下单

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://gilbertdigital.net/wp-wap/config/images/405.jpg HTTP 301
http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg

Request Chain 3

http://gilbertdigital.net/wp-wap/config/images/transparentbg.gif HTTP 301
http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request emss.php Show response gilbertdigital.net/wp-wap/config/	6 KB 3 KB	526ms 371ms	Document text/html	192.185.56.46 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 192.185.56.46 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-56-46.unifiedlayer.com Software Apache / Resource Hash `168a949e7fa588ebcda8f4410bf225ae6ac6b55d8fbbe03185527e51f509ec37` Request headers Host gilbertdigital.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 17 Jul 2020 07:45:06 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip Content-Length 2610 Keep-Alive timeout=5, max=75 Content-Type text/html
GET H2	403	ems_large.png main.cdn.merchant.wish.com/d8f2f62fff68/img/erp_logos/	0 0	332ms 213ms	Image application/xml	2a02:26f0:10:296::2a3d AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://main.cdn.merchant.wish.com/d8f2f62fff68/img/erp_logos/ems_large.png Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10:296::2a3d , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * access-control-max-age 3000 access-control-allow-methods GET
GET H/1.1	200 OK	index_finalV10_64_20131126.png www.ems.com.cn/images/	38 KB 38 KB	700ms 355ms	Image image/png	211.156.201.16 CNNIC-CHINAPOST-A...
General Check archive.org Show headers Download Go to Show image Full URL http://www.ems.com.cn/images/index_finalV10_64_20131126.png Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 211.156.201.16 , China, ASN24430 (CNNIC-CHINAPOST-AP CHINA STATE POST BUREAU, CN), Reverse DNS Software / Resource Hash `49544b5aff247030a45c92522a4e72bb8b614361bb03dcb9c6815433d8399feb` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 17 Jul 2020 07:31:41 GMT Last-Modified Tue, 31 Mar 2020 11:55:42 GMT Accept-Ranges bytes Content-Length 38854
GET H/1.1	404 Not Found	405.jpg ahmak.net/istanbul/ankara-escort//wp-wap/config/images/ Redirect Chain http://gilbertdigital.net/wp-wap/config/images/405.jpg http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg	0 0	56ms 30ms	Image text/html	2606:4700:3030::681b:86b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 2606:4700:3030::681b:86b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers Location http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg Date Fri, 17 Jul 2020 07:45:06 GMT Server Apache Connection close X-Powered-By PHP/5.4.45 Content-Length 0 Content-Type text/html
GET H/1.1	404 Not Found	transparentbg.gif ahmak.net/istanbul/ankara-escort//wp-wap/config/images/ Redirect Chain http://gilbertdigital.net/wp-wap/config/images/transparentbg.gif http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif	0 0	21ms 21ms	Image text/html	2606:4700:3030::681b:86b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 2606:4700:3030::681b:86b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers Date Fri, 17 Jul 2020 07:45:15 GMT Server Apache X-Powered-By PHP/5.4.45 Upgrade h2,h2c Location http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif Connection Upgrade, Keep-Alive Content-Type text/html Keep-Alive timeout=5, max=75 Content-Length 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: EMS China (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| reloadcode

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ahmak.net
gilbertdigital.net
main.cdn.merchant.wish.com
www.ems.com.cn
192.185.56.46
211.156.201.16
2606:4700:3030::681b:86b7
2a02:26f0:10:296::2a3d
168a949e7fa588ebcda8f4410bf225ae6ac6b55d8fbbe03185527e51f509ec37
49544b5aff247030a45c92522a4e72bb8b614361bb03dcb9c6815433d8399feb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

gilbertdigital.net Open in urlscan Pro 192.185.56.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

20 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

41 kBTransfer

44 kBSize

0 Cookies

4 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

gilbertdigital.net Open in urlscan Pro
192.185.56.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

41 kB
Transfer

44 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!