www.bongshai.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 173.236.34.242, located in Chicago, United States and belongs to SINGLEHOP-LLC - SingleHop LLC, US. The main domain is www.bongshai.com.

This is the only time www.bongshai.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 5	173.236.34.242 173.236.34.242	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	2

5 173.236.34.242 (Chicago, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: chi-node7.websitehostserver.net

www.bongshai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	bongshai.com 1 redirects www.bongshai.com	34 KB
1	sitepoint.com www.sitepoint.com	6 KB
5	2

	Domain	Requested by
5	www.bongshai.com	1 redirects www.bongshai.com
1	www.sitepoint.com	www.bongshai.com
5	2

This site contains no links.

Subject Issuer	Validity	Valid
sitepoint.com SSL.com Premium EV CA	`2018-08-07` - `2019-09-23`	a year	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea
Frame ID: DCB2FB84216E3FB317F9634B7423661E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.bongshai.com/att.online.verification/dashboard/ HTTP 302
http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3... Page URL

Page Statistics

5
Requests

20 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

39 kB
Transfer

49 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.bongshai.com/att.online.verification/dashboard/ HTTP 302
http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.php Show response
www.bongshai.com/att.online.verification/dashboard/
Redirect Chain

http://www.bongshai.com/att.online.verification/dashboard/
http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a0...

2 KB
1 KB

119ms
118ms

Document
text/html

173.236.34.242
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea

Protocol

HTTP/1.1

Server

173.236.34.242 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

chi-node7.websitehostserver.net

Software

/ PHP/7.2.19

Resource Hash

3dcde1ca551d96f752b7d2f5a619c08c9aa1fa0c183c6b9357ffb14c01adeb06

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bongshai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-Powered-By: PHP/7.2.19
Content-Type: text/html; charset=UTF-8
Content-Length: 808
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Mon, 17 Jun 2019 15:01:58 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Connection: Keep-Alive

Redirect headers

X-Powered-By: PHP/7.2.19
location: login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Date: Mon, 17 Jun 2019 15:01:58 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Connection: Keep-Alive

GET
H/1.1 200
OK MaskedPassword.js Show response
www.sitepoint.com/examples/password/MaskedPassword/ 17 KB
6 KB 1003ms
181ms Script
application/javascript 54.148.84.95
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js

Requested by

Host: www.bongshai.com
URL: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-148-84-95.us-west-2.compute.amazonaws.com

Software

Apache/2.2.22 (Debian) /

Resource Hash

2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825

Security Headers

Name	Value
X-Frame-Options	sameorigin

Request headers

Referer: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 17 Jun 2019 13:30:15 GMT
Content-Encoding: gzip
X-Cache-Lookup: HIT from ip-172-31-22-12.us-west-2.compute.internal:3128
Last-Modified: Fri, 15 Oct 2010 00:03:45 GMT
Server: Apache/2.2.22 (Debian)
Age: 5502
X-Frame-Options: sameorigin
ETag: "680936-4208-4929c8f629a40"
Vary: Accept-Encoding
X-Cache: HIT from ip-172-31-22-12.us-west-2.compute.internal
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 5767

GET
H/1.1 200
OK s1.png
www.bongshai.com/att.online.verification/dashboard/image/ 20 KB
20 KB 116ms
109ms Image
image/png 173.236.34.242
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bongshai.com/att.online.verification/dashboard/image/s1.png

Requested by

Host: www.bongshai.com
URL: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea

Protocol

HTTP/1.1

Security

, ,

Server

173.236.34.242 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

chi-node7.websitehostserver.net

Software

/

Resource Hash

17510f0be7d4f9e5909620c2aa791c80ccb9697788575f2474547d8c9d1a44e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 17 Jun 2019 15:01:58 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 08 Feb 2018 00:59:24 GMT
ETag: "05a7ba0ec-0;;;"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=3600, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 19983
Expires: Mon, 24 Jun 2019 15:01:58 GMT

GET
H/1.1 200
OK s2.png
www.bongshai.com/att.online.verification/dashboard/image/ 11 KB
11 KB 227ms
110ms Image
image/png 173.236.34.242
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bongshai.com/att.online.verification/dashboard/image/s2.png

Requested by

Host: www.bongshai.com
URL: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea

Protocol

HTTP/1.1

Security

, ,

Server

173.236.34.242 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

chi-node7.websitehostserver.net

Software

/

Resource Hash

b6dca76ffbf331b4049b70e0c6a940f6c243dee0bb8ce868611df1b835f7e1d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 17 Jun 2019 15:01:58 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 08 Feb 2018 00:49:34 GMT
ETag: "05a7b9e9e-0;;;"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=3600, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 11119
Expires: Mon, 24 Jun 2019 15:01:58 GMT

GET
H/1.1 200
OK s3.png
www.bongshai.com/att.online.verification/dashboard/image/ 586 B
1009 B 111ms
109ms Image
image/png 173.236.34.242
SingleHop LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bongshai.com/att.online.verification/dashboard/image/s3.png

Requested by

Host: www.bongshai.com
URL: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea

Protocol

HTTP/1.1

Security

, ,

Server

173.236.34.242 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

chi-node7.websitehostserver.net

Software

/

Resource Hash

14b18521a1176af0614619940f06b2fdc8c5552a93b927820050c35765912518

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://www.bongshai.com/att.online.verification/dashboard/login.php?cmd=login_submit&id=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea&session=35a01dc130b3e251f346eac37df3dfea35a01dc130b3e251f346eac37df3dfea
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 17 Jun 2019 15:01:58 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 08 Feb 2018 00:49:42 GMT
ETag: "05a7b9ea6-0;;;"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=3600, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 586
Expires: Mon, 24 Jun 2019 15:01:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.bongshai.com
www.sitepoint.com
173.236.34.242
54.148.84.95
14b18521a1176af0614619940f06b2fdc8c5552a93b927820050c35765912518
17510f0be7d4f9e5909620c2aa791c80ccb9697788575f2474547d8c9d1a44e3
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
3dcde1ca551d96f752b7d2f5a619c08c9aa1fa0c183c6b9357ffb14c01adeb06
b6dca76ffbf331b4049b70e0c6a940f6c243dee0bb8ce868611df1b835f7e1d7

www.bongshai.com Open in urlscan Pro 173.236.34.242 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

5 Requests

20 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

39 kBTransfer

49 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.bongshai.com Open in urlscan Pro
173.236.34.242 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

39 kB
Transfer

49 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!