Submitted URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye
Effective URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Submission: On January 01 via automatic, source openphish

Summary

This website contacted 6 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 192.185.183.65, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is my3ddreams.com.
This is the only time my3ddreams.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online) Generic China (Online)

Domain & IP information

IP Address AS Autonomous System
2 3 192.185.183.65 46606 (UNIFIEDLA...)
2 220.194.24.216 4808 (CHINA169-...)
3 103.129.252.34 137263 (NETEASE-A...)
1 123.126.97.210 4808 (CHINA169-...)
1 223.252.195.133 45062 (NETEASE-A...)
4 123.58.177.239 45062 (NETEASE-A...)
12 6
Domain Requested by
4 mimghz.qiye.163.com my3ddreams.com
3 mimg.127.net my3ddreams.com
3 my3ddreams.com 2 redirects
1 analytics.163.com my3ddreams.com
1 ssl.mail.163.com my3ddreams.com
1 mail.qiye.163.com my3ddreams.com
1 mimg.qiye.163.com my3ddreams.com
12 7
Subject Issuer Validity Valid
*.qiye.163.com
GeoTrust CN RSA CA G1
2020-01-20 -
2022-02-19
2 years crt.sh
mimg.127.net
GeoTrust CN RSA CA G1
2019-07-11 -
2021-09-08
2 years crt.sh
ssl.mail.163.com
GeoTrust CN RSA CA G1
2020-01-07 -
2022-03-05
2 years crt.sh
*.163.com
GeoTrust CN RSA CA G1
2020-02-12 -
2022-04-10
2 years crt.sh

This page contains 1 frames:

Primary Page: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Frame ID: AE459AE6F8BF021FB0271F4F3B315748
Requests: 12 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye HTTP 301
    http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ HTTP 302
    http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

12
Requests

83 %
HTTPS

0 %
IPv6

3
Domains

7
Subdomains

6
IPs

3
Countries

59 kB
Transfer

90 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye HTTP 301
    http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ HTTP 302
    http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request ii.php
my3ddreams.com/comm/Yhatspokfun/neteaseqiye/
Redirect Chain
  • http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye
  • http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/
  • http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
29 KB
9 KB
Document
General
Full URL
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Server
192.185.183.65 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
furryfriendspetcologne.com
Software
Apache /
Resource Hash
24206933e5d2a0e696622323807fca96a6bebed0f40c575fe055ccd23d8c0384

Request headers

Host
my3ddreams.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:08 GMT
Server
Apache
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
8992
Keep-Alive
timeout=5, max=73
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Fri, 01 Jan 2021 01:05:07 GMT
Server
Apache
Location
ii.php?email=&domain=
Content-Length
0
Keep-Alive
timeout=5, max=74
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
logo.gif
mimg.qiye.163.com/o/public/
3 KB
3 KB
Image
General
Full URL
https://mimg.qiye.163.com/o/public/logo.gif
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
220.194.24.216 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx /
Resource Hash
ed6dbc8fab5b63d6df0b079b70fc95459214b77dc174a05f0ea97d6a5fdc131c

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Thu, 18 Oct 2012 06:21:43 GMT
Server
nginx
ETag
"507f9ff7-ca0"
X-Cache
HIT from cnc ntes_qiye
Content-Type
image/gif
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3232
Expires
Thu, 26 Apr 2029 10:08:33 GMT
getqrcode.do
mail.qiye.163.com/mailapp/commonweb/qrcode/
8 KB
8 KB
Image
General
Full URL
https://mail.qiye.163.com/mailapp/commonweb/qrcode/getqrcode.do?w=130&h=130
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
220.194.24.216 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx /
Resource Hash
902871e441bf910119311ff4142c453d0a9ab33b420abd0e5e58e183110d322c

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Server
nginx
Connection
keep-alive
Content-Type
image/jpeg
Content-Length
8026
X-Cache
from cnc ntes_qiye
P3P
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
netease_logo.gif
mimg.127.net/logo/
1 KB
1 KB
Image
General
Full URL
https://mimg.127.net/logo/netease_logo.gif
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 01 Jan 2021 01:05:09 GMT
last-modified
Wed, 01 Dec 2010 02:06:41 GMT
server
nginx
etag
"4cf5adb1-4ec"
x-cache
HIT from HKGM
content-type
image/gif
cache-control
max-age=3600
accept-ranges
bytes
content-length
1260
expires
Fri, 01 Jan 2021 01:11:49 GMT
knet.png
mimg.127.net/logo/
5 KB
5 KB
Image
General
Full URL
https://mimg.127.net/logo/knet.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 01 Jan 2021 01:05:09 GMT
last-modified
Wed, 16 May 2012 09:47:58 GMT
server
nginx
etag
"4fb377ce-1203"
x-cache
HIT from HKGM
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
content-length
4611
expires
Fri, 01 Jan 2021 01:21:55 GMT
year.js
mimg.127.net/copyright/
23 B
364 B
Script
General
Full URL
http://mimg.127.net/copyright/year.js
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
b7d3c2e78895ed6048d40b23537f1d008f0f169de24ec0745765b7e3765c0069

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Thu, 31 Dec 2020 10:43:14 GMT
Server
nginx
ETag
"5fedab42-17"
X-Cache
HIT from HKGM
Content-Type
application/x-javascript
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
23
Expires
Fri, 31 Dec 2021 10:43:14 GMT
httpsEnable.gif
ssl.mail.163.com/
43 B
251 B
Image
General
Full URL
https://ssl.mail.163.com/httpsEnable.gif
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
123.126.97.210 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
mail-m97210.mail.163.com
Software
nginx /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Wed, 15 Jun 2011 02:19:09 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Content-Type
image/gif
ntes.js
analytics.163.com/
23 KB
8 KB
Script
General
Full URL
https://analytics.163.com/ntes.js
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
223.252.195.133 , China, ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
8d6f692b9777a1cb85882e99845b3c85c23333f800824d9d5eeaab801e92131e

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 01 Jan 2021 01:05:09 GMT
content-encoding
gzip
last-modified
Thu, 31 Dec 2020 07:58:43 GMT
server
nginx
content-type
application/javascript
x-server-id
S170
cache-control
max-age=3600
content-length
7686
expires
Fri, 01 Jan 2021 02:05:09 GMT
login.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//
4 KB
4 KB
Image
General
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//login.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.58.177.239 Hangzhou, China, ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
a48f5ba832b9bcb1444871afeeb254fade0edc8ccd3122de34acceabb66434ac

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Thu, 13 Nov 2014 10:33:23 GMT
Server
nginx
ETag
"546488f3-fdf"
X-Cache
HIT from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4063
Expires
Wed, 25 Dec 2030 01:34:05 GMT
sprite.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//
6 KB
6 KB
Image
General
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//sprite.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.58.177.239 Hangzhou, China, ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
1650584f5c4f5b4e20435812baabcdf60113361578b9c001c1ef9cc638c886fd

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Thu, 13 Nov 2014 10:33:23 GMT
Server
nginx
ETag
"546488f3-1632"
X-Cache
HIT from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5682
Expires
Wed, 25 Dec 2030 00:21:08 GMT
codebg.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//
6 KB
6 KB
Image
General
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//codebg.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.58.177.239 Hangzhou, China, ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
8696828c26cab79a60130d39242aa14bbcc38181ec2cfcb4320d5100f82fbf9e

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Thu, 13 Nov 2014 10:33:23 GMT
Server
nginx
ETag
"546488f3-1665"
X-Cache
HIT from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5733
Expires
Wed, 25 Dec 2030 03:54:28 GMT
applogin_example.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//
7 KB
7 KB
Image
General
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//applogin_example.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
123.58.177.239 Hangzhou, China, ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
4e0171daa235a3165e2295b05780d34c366126e00c624b958766b84ee3fbe832

Request headers

Referer
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php?email=&domain=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 01 Jan 2021 01:05:09 GMT
Last-Modified
Mon, 13 Jun 2016 00:36:38 GMT
Server
nginx
ETag
"575e0016-1bd9"
X-Cache
HIT from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7129
Expires
Wed, 25 Dec 2030 03:54:28 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online) Generic China (Online)

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated undefined| gDocHeight function| resizeBody undefined| _ntes_nacc string| _ntes_nvid number| _ntes_nvtm number| _ntes_nvfi number| _ntes_nvsf number| _ntes_nstm string| _ntes_nurl string| _ntes_ntit string| _ntes_nref string| _ntes_nres string| _ntes_nlag string| _ntes_nscd number| _ntes_nlmf string| _ntes_flsh string| _ntes_nssn number| _ntes_surv function| _ntes_void object| _ntes_domain_array object| _non_ntes_domain_array string| _ntes_cdmn string| _non_ntes_cdmn string| _ntes_src_addr object| _ntes_cookie_enabled object| _ntes_localstorage_enabled object| _ntes_page_data function| ntes_set_uid function| ntes_get_uid function| neteaseTracker function| neteaseClickTracker function| ntes_survey_popup function| ntes_get_navigation_info function| fetch_visitor_hash function| ntes_get_domain function| non_ntes_get_domain function| ntes_set_cookie_long function| ntes_set_cookie function| ntes_set_cookie_new function| ntes_get_cookie function| ntes_get_flashver number| _ntes_hexcase number| _ntes_chrsz function| ntes_hex_md5 function| ntes_core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| safe_add function| bit_rol function| str2binl function| binl2hex function| str_to_ent function| ntes_page_click_stat function| ntes_page_unload_stat function| neteaseClickStat function| _ntes_bindEvent function| _ntes_fixEvent function| _ntes_sendInfo function| recordAction function| neteaseClickStatForArea function| ntes_area_click_stat function| is_spider object| ntes_area_click_tools object| pattern

0 Cookies