znh.com.tw
Open in
urlscan Pro
198.55.121.100
Malicious Activity!
Public Scan
URL:
https://znh.com.tw/aaav/dhl/source/index.php?email=sara.rosa@gruposantander.com
Submission: On August 23 via automatic, source openphish — Scanned from DE
Submission: On August 23 via automatic, source openphish — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 5 HTTP transactions.
The main IP is 198.55.121.100, located in
Los Angeles, United States and
belongs to ASN-QUADRANET-GLOBAL, US.
The main domain is znh.com.tw.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 5th 2022. Valid for: 3 months.
This is the only time znh.com.tw was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 5th 2022. Valid for: 3 months.
This is the only time znh.com.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 198.55.121.100 198.55.121.100 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
| 5 | 1 |
5
198.55.121.100
(Los Angeles, United States)
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: ur17.cx901.com
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: ur17.cx901.com
| znh.com.tw |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
znh.com.tw
znh.com.tw |
90 KB |
| 5 | 1 |
| Domain | Requested by | |
|---|---|---|
| 5 | znh.com.tw |
znh.com.tw
|
| 5 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| znh.com.tw cPanel, Inc. Certification Authority |
2022-06-05 - 2022-09-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://znh.com.tw/aaav/dhl/source/index.php?email=sara.rosa@gruposantander.com
Frame ID: 4BA212828119C9E6EC8086084F131082
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
znh.com.tw/aaav/dhl/source/ |
16 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
znh.com.tw/aaav/dhl/source/includes/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ship.jpg
znh.com.tw/aaav/dhl/source/includes/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
appstore.png
znh.com.tw/aaav/dhl/source/includes/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
playstore.png
znh.com.tw/aaav/dhl/source/includes/ |
31 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| display_c function| display_ct0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
znh.com.tw
198.55.121.100
40c89d450d0390f973038c9946484b56597f02061a950becf7f4de4b63286d27
53248ecd77159b04fe218d1494e5a2291d4f0450a944ba11dc03f66d3e741eba
67d682d81d9a94b841c452d747949044bbfe732946de341e607b16d83014b46f
9aa978dfd721f1fc2026c631ecbd1fa9de6bb07959284095e81f51bbf13a67c5
c05c548ad361b62c3e135cacb650ecb4d0be9d21b2efa0d69c5814c53fbbc6f6