mail.bnu.edu.cn
Open in
urlscan Pro
114.255.220.46
Malicious Activity!
Public Scan
Effective URL: https://mail.bnu.edu.cn/
Submission: On March 15 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by GeoTrust CN RSA CA G1 on May 20th 2020. Valid for: 2 years.
This is the only time mail.bnu.edu.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic China (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 13 | 114.255.220.46 114.255.220.46 | 4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network) | |
19 | 3.65.106.51 3.65.106.51 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 18.159.198.32 18.159.198.32 | 16509 (AMAZON-02) (AMAZON-02) | |
32 | 3 |
ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
mail.bnu.edu.cn | |
weixin.bnu.edu.cn |
ASN16509 (AMAZON-02, US)
PTR: mail-aws10651.qiye.163.com
mimghz.qiye.163.com | |
mimg.qiye.163.com | |
mailhz.qiye.163.com |
ASN16509 (AMAZON-02, US)
PTR: mail-aws19832.qiye.163.com
mail.qiye.163.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
163.com
mimghz.qiye.163.com mimg.qiye.163.com — Cisco Umbrella Rank: 846239 mail.qiye.163.com — Cisco Umbrella Rank: 373057 mailhz.qiye.163.com — Cisco Umbrella Rank: 387166 |
216 KB |
13 |
bnu.edu.cn
1 redirects
mail.bnu.edu.cn weixin.bnu.edu.cn |
192 KB |
32 | 2 |
Domain | Requested by | |
---|---|---|
13 | mimghz.qiye.163.com |
mail.bnu.edu.cn
|
11 | weixin.bnu.edu.cn |
mail.bnu.edu.cn
weixin.bnu.edu.cn |
5 | mimg.qiye.163.com |
mail.bnu.edu.cn
weixin.bnu.edu.cn |
2 | mail.bnu.edu.cn | 1 redirects |
1 | mailhz.qiye.163.com |
mail.bnu.edu.cn
|
1 | mail.qiye.163.com |
mail.bnu.edu.cn
|
32 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
mimg.qiye.163.com |
qiye.163.com |
u.163.com |
info.bnu.edu.cn |
onewechat.bnu.edu.cn |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bnu.edu.cn GeoTrust CN RSA CA G1 |
2020-05-20 - 2022-06-17 |
2 years | crt.sh |
*.qiye.163.com GeoTrust RSA CN CA G2 |
2022-01-24 - 2023-02-22 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://mail.bnu.edu.cn/
Frame ID: C856C48BA3AC10DEAD24FBDC2288F3D9
Requests: 24 HTTP requests in this frame
Frame:
https://weixin.bnu.edu.cn/scan/qrconnect.php?appid=1&scope=snsapi_login&redirect_uri=login.php&state=login&login_type=jssdk&style=white
Frame ID: C60BA095D1EFAC8BD20D4CE2B65503C8
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
北京师范大学-学生邮件系统Page URL History Show full URLs
-
http://mail.bnu.edu.cn/
HTTP 302
https://mail.bnu.edu.cn/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: 帮助
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Android版
Search URL Search Domain Scan URL
Title: iPhone版
Search URL Search Domain Scan URL
Title: 北京师范大学信息网络中心
Search URL Search Domain Scan URL
Title: 在线服务-微信号: bnu5880
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mail.bnu.edu.cn/
HTTP 302
https://mail.bnu.edu.cn/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
mail.bnu.edu.cn/ Redirect Chain
|
12 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
global.css
weixin.bnu.edu.cn/img/ |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
user.css
mimghz.qiye.163.com/o/domain/201410101500/index/css/ |
480 B 787 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
mimghz.qiye.163.com/o/domain/201410101500/index/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wxLogin.js
weixin.bnu.edu.cn/scan/js/ |
466 B 691 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
help.gif
mimg.qiye.163.com/xm/qiye/index_res/img/ |
340 B 640 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
check.jpg
weixin.bnu.edu.cn/img/ |
62 KB 62 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginjs.jsp
mail.qiye.163.com/js/ |
8 B 216 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
91 KB 33 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-migrate.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lang_en.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
142 B 465 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select_network.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_util.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select_banner.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
1 KB 920 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
reset_pwd.js
mimghz.qiye.163.com/o/domain/201410101500/index/js/ |
274 B 597 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
mimg.qiye.163.com/p/vip/bnu/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qrconnect.php
weixin.bnu.edu.cn/scan/ Frame C60B |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginFormBg.png
mimghz.qiye.163.com/o/domain/201410101500/index/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_cn_noqiye.png
mimg.qiye.163.com/o/domain/201410101500/index/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bgx.gif
mimg.qiye.163.com/xm/qiye/login/img/ |
87 B 386 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.gif
mimg.qiye.163.com/xm/qiye/login/img/ |
12 KB 13 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ic_android.png
mimghz.qiye.163.com/o/domain/201410101500/index/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ic_apple.png
mimghz.qiye.163.com/o/domain/201410101500/index/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ic_qr.png
mimghz.qiye.163.com/o/domain/201410101500/index/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
impowerApp.css
weixin.bnu.edu.cn/scan/css/ Frame C60B |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min29f55f.js
weixin.bnu.edu.cn/scan/js/ Frame C60B |
94 KB 94 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
weixin.jpg
weixin.bnu.edu.cn/scan/images/ Frame C60B |
20 KB 21 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr_code.php
weixin.bnu.edu.cn/scan/ Frame C60B |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xss209118.js
weixin.bnu.edu.cn/scan/js/ Frame C60B |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1418716006968.jpg
mailhz.qiye.163.com/qiyeimage/bg/163_bnu_edu_cn/ |
125 KB 126 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
connect.php
weixin.bnu.edu.cn/scan/ Frame C60B |
40 B 161 B |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
connect.php
weixin.bnu.edu.cn/scan/ Frame C60B |
40 B 161 B |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic China (Online)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| structuredClone object| oncontextlost object| oncontextrestored function| WxLogin object| obj boolean| isDefaultBg string| currentBanner string| currentStyle string| addresses string| errMsg string| domainType function| $ function| jQuery object| message function| cookie object| msgMap function| showTips string| defaultClass boolean| isClassDefault string| code string| hl function| getHl function| getId function| getParam function| getMsg function| setMsgpid function| showError function| setMsg function| frmvalidator function| DrawImage function| getQueryString function| change_lang object| lang object| account0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.bnu.edu.cn
mail.qiye.163.com
mailhz.qiye.163.com
mimg.qiye.163.com
mimghz.qiye.163.com
weixin.bnu.edu.cn
114.255.220.46
18.159.198.32
3.65.106.51
000114f7ef19aac009b411eff3232439da5e89a7476248a8813b94e9c4cd7bc1
09e7fb9326ea92a21d2e4703ed5274db3e63652e90892761ae12e82ffc33eb66
107416dc26178927aa5471bf3553aff8290382a8e4595f9c7b4485ac0baffa9a
141b58cb7e74292ea741acf5ed637e70275f3a490911b1deb668f95334542c26
184b5de5e97b40d8e839c08f8483df8c92980aff5f08338b734332ebb5887ae6
1d0079f5df84d17d531ba2b3341e9cbbc0932a1ad166d53ece312f9595089b12
240b309438f2475b6cc0b0b199c1a9f90fe73abde88a7f43bf6edfc47b17552f
24c9d8fc2cbd626ca71944b6c5dd185b26a46fd0e21573a6169e5be698939d3f
36f9e4b3b0c4582de7977d738cff340dae36a90547316bfdc24f5ab48686f72b
3c05867b606044a8970e33ab8e1d33fdf104aa9f65386062b4cac28a0b0cae90
44ed03668b2e7924e52d736b5c3484f2a58a1d9f75497f38a44ce569cc86c402
4bf9c5a80e4c4796d1a4c78b1071337e76664ade80cd0088b8c0c64df0208c69
54fdcb30f8d40ec4b1d3cf31eb64f76642655824532e2950b63312b4284bfa2a
57f37271dc71a424614a1b51d7c9c95bc5d81ccc40588afb31f54689b46f8715
59a86e14120c8aaa43d1cf768d891f7c145aaab7e7c6bf7079e14f14281db4bf
5b0d636409535a0782b115ee964778780ac74e49e515a507f15c2a42687db678
6130a160661b818996501172df484ca373cca1c1d28e3118c7482f2e2c2b6d3e
6d07059e25046229222cad7a08f338645bd84e7cb378ed5243572d480f431ff6
779e426ad9ad5e6088d81a17882986966ab91b8b9d9942bd23b133b38225b29f
79488488398f5f5aed236dd6e9f914599370d04dfe70fda61b8c83bf739b1088
7cd412719e91b7682028160adf230ca7d829884055a18aa5b14b0c49c93ecd92
7d5b42bea987af8072c6b301ebeab5a77cae5c1aff9df8ef6be45940d55379a8
8f5351bde2ad00b44bf0284c64a95d990304a7bbdd4e4980e502684dd89de215
aa41c1850a185eec48e1d91f3e79e897bd07d85b0b15cd50efa9df0b4fa8153d
b4ba915eb6fe3d719751660ce714a7fe25d4ea99c640d44035e1c80164cfead0
bd2f6db916e3180bdaefe9c1489787f98cf87719849b124734ca67cb61bfae8b
c2aae1c3586e85b196e4e6f4bfc93f6f0eed5f747faf1a29435b8d9da69aaddb
c43d937b6bcc5e987560e032ca03151cabd187980e8b77c225a889b84d2fac9e
ce32707c0d679b8ed56b5dc8c498e1b1667e5b1905b8aeff42151e3f6667d73d
f62a777eec8cc1e11ec1d0f681b707d43b87129af5a160ecd858f829db5478a4
fc76073a1b1cc76051d08c31f2ab65f1da65446891a76dc1a8a8bc5ac0e30356