www.kanghutrob.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 93.90.145.103, located in Sweden and belongs to NET-CRYSTONE-STHLM, SE. The main domain is www.kanghutrob.com.

This is the only time www.kanghutrob.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 7	93.90.145.103 93.90.145.103		35041 (NET-CRYST...) (NET-CRYSTONE-STHLM)
6	1

7 93.90.145.103 (Sweden) 1 redirects

ASN35041 (NET-CRYSTONE-STHLM, SE)
PTR: apache-03.crystone.se

www.kanghutrob.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	kanghutrob.com 1 redirects www.kanghutrob.com	133 KB
6	1

	Domain	Requested by
7	www.kanghutrob.com	1 redirects www.kanghutrob.com
6	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb
Frame ID: 9151.1
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index HTTP 301
http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ Page URL
http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

133 kB
Transfer

132 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index HTTP 301
http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ Page URL
http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index HTTP 301
http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ Redirect Chain http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/	470 B 477 B	46ms 46ms	Document text/html	93.90.145.103 NET-CRYSTONE-STHLM
General Check archive.org Show headers Download Go to Full URL http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ Protocol HTTP/1.1 Server 93.90.145.103 , Sweden, ASN35041 (NET-CRYSTONE-STHLM, SE), Reverse DNS apache-03.crystone.se Software Apache / PHP/5.6.30 Resource Hash `cbfa63fd386053cda998e5d48140909231f785bd381b13b52e5c6c691bb46a6c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sat, 09 Sep 2017 10:16:28 GMT Server Apache X-Powered-By PHP/5.6.30 Transfer-Encoding chunked X-Statsd-Stat request.dynamic.package.standard Content-Type text/html; charset=UTF-8 Connection Keep-Alive Pool-Info /Common/cry-apache-03 10.160.43.3 80 Keep-Alive timeout=5, max=199 Redirect headers Date Sat, 09 Sep 2017 10:16:28 GMT Server Apache Content-Type text/html; charset=iso-8859-1 Location http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ Connection Keep-Alive Pool-Info /Common/cry-apache-03 10.160.43.3 80 Content-Length 280 Keep-Alive timeout=5, max=200
GET H/1.1	200 OK	Primary Request index.php Show response www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/	27 KB 27 KB	45ms 44ms	Document text/html	93.90.145.103 NET-CRYSTONE-STHLM
General Check archive.org Show headers Download Go to Full URL http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb Requested by Host: www.kanghutrob.com URL: http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ Protocol HTTP/1.1 Server 93.90.145.103 , Sweden, ASN35041 (NET-CRYSTONE-STHLM, SE), Reverse DNS apache-03.crystone.se Software Apache / PHP/5.6.30 Resource Hash `ce5c3e1e373400970ee5a938f6d9771cb4b82d0fa517185b8acdaa91759f82d8` Request headers Upgrade-Insecure-Requests 1 Referer http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sat, 09 Sep 2017 10:16:28 GMT Server Apache X-Powered-By PHP/5.6.30 Transfer-Encoding chunked X-Statsd-Stat request.dynamic.package.standard Content-Type text/html; charset=UTF-8 Connection Keep-Alive Pool-Info /Common/cry-apache-03 10.160.43.3 80 Keep-Alive timeout=5, max=198
GET H/1.1	200 OK	ap-flex-reduced-nav._3C8_.css www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/	17 KB 17 KB	44ms 44ms	Stylesheet text/css	93.90.145.103 NET-CRYSTONE-STHLM
General Check archive.org Show headers Download Go to Full URL http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/ap-flex-reduced-nav._3C8_.css Requested by Host: www.kanghutrob.com URL: http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb Protocol HTTP/1.1 Server 93.90.145.103 , Sweden, ASN35041 (NET-CRYSTONE-STHLM, SE), Reverse DNS apache-03.crystone.se Software Apache / Resource Hash `e33ac4019b289b4d96cae7be435a0559517521c803895907915d60dcce1005e5` Request headers Referer http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sat, 09 Sep 2017 10:16:28 GMT Last-Modified Sat, 09 Sep 2017 04:40:22 GMT Server Apache ETag "101806c-431e-558ba4a9ae1e2" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Pool-Info /Common/cry-apache-03 10.160.43.3 80 Content-Length 17182 Keep-Alive timeout=5, max=197
GET H/1.1	200 OK	ap-flex-reduced-nav-2.0._V393733149_.js Show response www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/	84 KB 84 KB	73ms 42ms	Script text/javascript	93.90.145.103 NET-CRYSTONE-STHLM
General Check archive.org Show headers Download Go to Full URL http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/ap-flex-reduced-nav-2.0._V393733149_.js Requested by Host: www.kanghutrob.com URL: http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb Protocol HTTP/1.1 Server 93.90.145.103 , Sweden, ASN35041 (NET-CRYSTONE-STHLM, SE), Reverse DNS apache-03.crystone.se Software Apache / Resource Hash `5afdf0029fa176fe1121265a778bb6ec0d95c675e6638b3503d3bb5d91ad435a` Request headers Referer http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sat, 09 Sep 2017 10:16:28 GMT Last-Modified Sat, 09 Sep 2017 04:40:22 GMT Server Apache ETag "1017e78-15197-558ba4aa37a54" Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Pool-Info /Common/cry-apache-03 10.160.43.3 80 Content-Length 86423 Keep-Alive timeout=5, max=200
GET H/1.1	200 OK	sign-in-secure._V192194766_.gif www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/	3 KB 3 KB	43ms 42ms	Image image/gif	93.90.145.103 NET-CRYSTONE-STHLM
General Check archive.org Show headers Download Go to Show image Full URL http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/sign-in-secure._V192194766_.gif Requested by Host: www.kanghutrob.com URL: http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb Protocol HTTP/1.1 Server 93.90.145.103 , Sweden, ASN35041 (NET-CRYSTONE-STHLM, SE), Reverse DNS apache-03.crystone.se Software Apache / Resource Hash `605f462159b4e3b5352c949d60bf5c3bc109f79d3507f07e9e9b9275c53e2532` Request headers Referer http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sat, 09 Sep 2017 10:16:29 GMT Last-Modified Sat, 09 Sep 2017 04:40:23 GMT Server Apache ETag "1017e54-b48-558ba4aa48d10" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Pool-Info /Common/cry-apache-03 10.160.43.3 80 Content-Length 2888 Keep-Alive timeout=5, max=196
GET H/1.1	200 OK	amazon_logo_no-org_mid._V153387053_.png www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/	1 KB 1 KB	75ms 43ms	Image image/png	93.90.145.103 NET-CRYSTONE-STHLM
General Check archive.org Show headers Download Go to Show image Full URL http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/content/amazon_logo_no-org_mid._V153387053_.png Requested by Host: www.kanghutrob.com URL: http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb Protocol HTTP/1.1 Server 93.90.145.103 , Sweden, ASN35041 (NET-CRYSTONE-STHLM, SE), Reverse DNS apache-03.crystone.se Software Apache / Resource Hash `765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80` Request headers Referer http://www.kanghutrob.com/amzaon/e610769c861e75a9ffe2f60a1dcd3232/index/web/index.php?cmd=5885d80a13c0db1f22d2300ef60a67593b79a4d03747447e6b625328d36121a15aeb2d15ca06a5daaeb6e83b786f5adb5aeb2d15ca06a5daaeb6e83b786f5adb User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sat, 09 Sep 2017 10:16:29 GMT Last-Modified Sat, 09 Sep 2017 04:40:22 GMT Server Apache ETag "101808b-5d3-558ba4a995614" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Pool-Info /Common/cry-apache-03 10.160.43.3 80 Content-Length 1491 Keep-Alive timeout=5, max=200

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.kanghutrob.com
93.90.145.103
5afdf0029fa176fe1121265a778bb6ec0d95c675e6638b3503d3bb5d91ad435a
605f462159b4e3b5352c949d60bf5c3bc109f79d3507f07e9e9b9275c53e2532
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
cbfa63fd386053cda998e5d48140909231f785bd381b13b52e5c6c691bb46a6c
ce5c3e1e373400970ee5a938f6d9771cb4b82d0fa517185b8acdaa91759f82d8
e33ac4019b289b4d96cae7be435a0559517521c803895907915d60dcce1005e5

www.kanghutrob.com Open in urlscan Pro 93.90.145.103 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

133 kBTransfer

132 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.kanghutrob.com Open in urlscan Pro
93.90.145.103 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

133 kB
Transfer

132 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!