bongshai.com
Open in
urlscan Pro
173.236.34.242
Malicious Activity!
Public Scan
URL:
http://bongshai.com/att.online.verification/dashboard/post.php
Submission: On November 20 via manual from US
Submission: On November 20 via manual from US
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 173.236.34.242, located in
Chicago, United States and
belongs to SINGLEHOP-LLC - SingleHop LLC, US.
The main domain is bongshai.com.
This is the only time bongshai.com was scanned on urlscan.io!
This is the only time bongshai.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 173.236.34.242 173.236.34.242 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC) | |
| 1 | 54.148.84.95 54.148.84.95 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 12 | 2 |
11
173.236.34.242
(Chicago, United States)
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: chi-node7.websitehostserver.net
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: chi-node7.websitehostserver.net
| bongshai.com |
1
54.148.84.95
(Boardman, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
| www.sitepoint.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
bongshai.com
bongshai.com |
140 KB |
| 1 |
sitepoint.com
www.sitepoint.com |
6 KB |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | bongshai.com |
bongshai.com
|
| 1 | www.sitepoint.com |
bongshai.com
|
| 12 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sitepoint.com SSL.com Premium EV CA |
2018-08-07 - 2019-09-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://bongshai.com/att.online.verification/dashboard/post.php
Frame ID: 3881331E81AD484FB4574D9F8A33CE49
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
post.php
bongshai.com/att.online.verification/dashboard/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v1.png
bongshai.com/att.online.verification/dashboard/image/ |
90 KB 90 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v2.png
bongshai.com/att.online.verification/dashboard/image/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v3.png
bongshai.com/att.online.verification/dashboard/image/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v4.png
bongshai.com/att.online.verification/dashboard/image/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v5.png
bongshai.com/att.online.verification/dashboard/image/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v7.png
bongshai.com/att.online.verification/dashboard/image/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v8.png
bongshai.com/att.online.verification/dashboard/image/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
v9.png
bongshai.com/att.online.verification/dashboard/image/ |
14 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
do.png
bongshai.com/att.online.verification/dashboard/image/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
do1.png
bongshai.com/att.online.verification/dashboard/image/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| MaskedPassword function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bongshai.com
www.sitepoint.com
173.236.34.242
54.148.84.95
029151d674cfef2f1e73db203f93a5c8eb15c173eb71cbbc1a7b9a3859962df3
25527dd99cc7c8990876eacb52311cd479c1f58c1a2f102eaecac240e36da4b3
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
2fe7d697215160e6b9cd4de25cbf13e178497842d1c1f80688100d3a9885c204
74da95a7b668c5903b50342c0b57c5004b28dafc15de59b7a35c077268b1e4ea
7876400a741f856d80c8505028719a34a8714836a07b3b2ee2f4f847400dbbe3
8258b50915fa3147f1e0bd0aacc2c346e3d085a988eea1dd000818d94d589c4a
936fb9c0702d993f381e23e2e5a8c6bb22a74f502a0dfa2d72e24dd7136ff34c
9d8dce572fb18400e5193f2e152efc1b3dc2cc70c158e5a5a615a80e389f1cc6
a4b42e5b247df1414f9c6d3fe0ff37c68fddac88da479330c213ca988a32a3ac
c51533201ef4f744e718573c3553adbf39ff87fd0c482f255d6da095e65c51a3
eb0bfb52a4133d76d99b1279ba108f8792b106414a64f69ef28aef718270a71e