urlscan.io logo urlscan.io
SecurityTrails logo

net1ease.thefixafence.com Open in urlscan Pro
192.185.28.92  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://webdisk.login.ali-inc.starlitenails.com/
Effective URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHp...
Submission: On August 26 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 192.185.28.92, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is net1ease.thefixafence.com.
TLS certificate: Issued by R10 on August 25th 2024. Valid for: 3 months.
This is the only time net1ease.thefixafence.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 192.185.140.149 19871 (NETWORK-S...)
2 14 192.185.28.92 19871 (NETWORK-S...)
1 163.181.92.228 24429 (TAOBAO Zh...)
1 111.124.200.204 139203 (CHINANET-...)
14 4
Apex Domain
Subdomains		 Transfer
14 thefixafence.com
net1ease.thefixafence.com
1 MB
1 163.com
vip.163.com — Cisco Umbrella Rank: 478327
809 B
1 127.net
urswebzj.nosdn.127.net — Cisco Umbrella Rank: 132273
21 KB
1 starlitenails.com
webdisk.login.ali-inc.starlitenails.com
109 B
14 4
Domain Requested by
14 net1ease.thefixafence.com 2 redirects net1ease.thefixafence.com
1 vip.163.com
1 urswebzj.nosdn.127.net net1ease.thefixafence.com
1 webdisk.login.ali-inc.starlitenails.com 1 redirects
14 4

This site contains no links.

Subject Issuer Validity Valid
net1ease.thefixafence.com
R10		 2024-08-25 -
2024-11-23		 3 months crt.sh
*.nosdn.127.net
GeoTrust RSA CN CA G2		 2024-05-30 -
2025-06-29		 a year crt.sh
*.163.com
GeoTrust RSA CN CA G2		 2024-03-28 -
2025-04-27		 a year crt.sh

This page contains 2 frames:

Primary Page: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Frame ID: F2E61AEC8F13A61396EFD6DE4CB390B1
Requests: 14 HTTP requests in this frame

Frame: https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
Frame ID: 7E184C472CF41FE73E2235275E1F541C
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://webdisk.login.ali-inc.starlitenails.com/ HTTP 302
    https://net1ease.thefixafence.com/z1?e=&fn=&usr= HTTP 301
    https://net1ease.thefixafence.com/z1/?e=&fn=&usr= HTTP 302
    https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHh... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1448 kB
Transfer

1584 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://webdisk.login.ali-inc.starlitenails.com/ HTTP 302
    https://net1ease.thefixafence.com/z1?e=&fn=&usr= HTTP 301
    https://net1ease.thefixafence.com/z1/?e=&fn=&usr= HTTP 302
    https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request auwerfwerf.php
net1ease.thefixafence.com/z1/
Redirect Chain
  • https://webdisk.login.ali-inc.starlitenails.com/
  • https://net1ease.thefixafence.com/z1?e=&fn=&usr=
  • https://net1ease.thefixafence.com/z1/?e=&fn=&usr=
  • https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bH...
43 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
da38b8e1d2740954703ac7ee15102ba0eec506777221d9fc0d409fdce17f780f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 26 Aug 2024 16:17:17 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 26 Aug 2024 16:17:16 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
pragma
no-cache
server
Apache
es5-polyfill.js
net1ease.thefixafence.com/z1/index_files/ 		2 KB
793 B 		Script
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/index_files/es5-polyfill.js
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
d5292586cfe2230f1c91cae1f71ad9156c23fb60f7cd9d2bce428647b2cad47c

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
content-encoding
gzip
last-modified
Fri, 12 Jul 2024 02:08:34 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
716
raven-3.27.0.min.js
net1ease.thefixafence.com/z1/index_files/ 		37 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/index_files/raven-3.27.0.min.js
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
8b6d98b0cf87dc28a33bbd54f6e64114b0b8417e654b82111fd0579e7efdbdbf

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
content-encoding
gzip
last-modified
Fri, 12 Jul 2024 02:08:16 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
16464
style.4a8744bc885e1253ce8a.css
net1ease.thefixafence.com/z1/index_files/ 		112 KB
62 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/index_files/style.4a8744bc885e1253ce8a.css
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
c3162dcaed5b93a1768a035afc9eaf59abc1f0573e5a5985e74bd3da183746cd

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
content-encoding
gzip
last-modified
Fri, 12 Jul 2024 02:08:12 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
text/css
spreadSign.m
net1ease.thefixafence.com/z1/index_files/ 		0
41 B 		Script
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/index_files/spreadSign.m
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
last-modified
Fri, 12 Jul 2024 02:08:14 GMT
server
Apache
accept-ranges
bytes
content-length
0
vip_logo.png
net1ease.thefixafence.com/z1/index_files/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://net1ease.thefixafence.com/z1/index_files/vip_logo.png
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
9b9ca278fea98d6549f7953e296313103fac720206bcf3240ac5a1a7a70f2a5b

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
last-modified
Fri, 12 Jul 2024 02:08:20 GMT
server
Apache
accept-ranges
bytes
content-length
6745
content-type
image/png
bg1.jpg
net1ease.thefixafence.com/z1/index_files/ 		483 KB
484 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://net1ease.thefixafence.com/z1/index_files/bg1.jpg
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
8ac4ba4e614357c13da588cebb396fc9815f8f66b0f85cc3e2969c6f44a33448

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
last-modified
Fri, 12 Jul 2024 02:08:10 GMT
server
Apache
accept-ranges
bytes
content-length
494923
content-type
image/jpeg
bg3.jpg
net1ease.thefixafence.com/z1/index_files/ 		299 KB
299 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://net1ease.thefixafence.com/z1/index_files/bg3.jpg
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
2228c2ab502184f2abb123e1359a162d2f8ece522ec31ac1d7e9f0fa6f9144d5

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:17 GMT
last-modified
Fri, 12 Jul 2024 02:08:34 GMT
server
Apache
accept-ranges
bytes
content-length
305763
content-type
image/jpeg
bg2.jpg
net1ease.thefixafence.com/z1/index_files/ 		513 KB
514 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://net1ease.thefixafence.com/z1/index_files/bg2.jpg
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
5db54d49dc16e246c318834a76842d8b452892d4fa53673e0f378ec24b8ed398

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:18 GMT
last-modified
Fri, 12 Jul 2024 02:08:20 GMT
server
Apache
accept-ranges
bytes
content-length
525730
content-type
image/jpeg
index_dl2_new.php
net1ease.thefixafence.com/z1/index_files/ Frame 7E18 		54 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
952c29179362cece1b02af7902c1e282b418a7e927e13e7045d326f39faddcc3

Request headers

Referer
https://net1ease.thefixafence.com/z1/auwerfwerf.php?e=QHZpcC4xNjMuY29t&VHIwcDJZV250MExSRlZpYzRNdUI9UUhacGNDNHhOak11WTI5dCZmZ2FSZHpTQnZmY2dPWDFlWDIzTD1VUU1TQVZYaHJSRmwxOTdCUlhYNSZGend5MUVYT2p6Umo3bHIwcHBOVD1wTjFDOVh5SjNBTTU1U2ZXam92dA==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 26 Aug 2024 16:17:18 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bf6cd4aac8dce7426f51a59a9192184e13545a50512265ccf4ae7348d97e0fd3

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		537 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ec0f4e6c0f509a1ad6cb6d31493fe7b09f3346f3b26c2b96e5533883b7547601

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d685a65ab2fcd5def1e40dec687ad2fe8226294fe053017ea4a921b2500cd417

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b7eb5b8fce9425b7d027ebbca22b6e0c40c6b95d451e19dfb4b1f13edc7ce817

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
urs.163.d3f075de.css
net1ease.thefixafence.com/z1/index_files/ Frame 7E18 		3 KB
873 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://net1ease.thefixafence.com/z1/index_files/urs.163.d3f075de.css
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
8e2d0e643fd9e76238aa210997c6be8310807c4224ddb3c3c34efb4f1c38d293

Request headers

Referer
https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:19 GMT
content-encoding
gzip
last-modified
Fri, 12 Jul 2024 02:08:24 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
795
captcha.php
net1ease.thefixafence.com/z1/ Frame 7E18 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://net1ease.thefixafence.com/z1/captcha.php
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.28.92 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-28-92.unifiedlayer.com
Software
Apache /
Resource Hash
96a8efca7bc9faff6206241e9ccef34d94cd972dacef411f795251868dcff201

Request headers

Referer
https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Aug 2024 16:17:19 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate
content-length
1212
expires
Thu, 19 Nov 1981 08:52:00 GMT
sprite_61fbe151ab715649c6b7c4ec39156201.png
urswebzj.nosdn.127.net/webzj_cdn101/ Frame 7E18 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://urswebzj.nosdn.127.net/webzj_cdn101/sprite_61fbe151ab715649c6b7c4ec39156201.png
Requested by
Host: net1ease.thefixafence.com
URL: https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
163.181.92.228 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
dd37cd41f21e27f74586217bc1a1e6017580492bec9774602ccfe0faf4c34663

Request headers

Referer
https://net1ease.thefixafence.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Sat, 24 Aug 2024 01:18:27 GMT
Via
cache1.l2de2[0,0,304-0,H], cache9.l2de2[1,0], ens-cache8.de5[0,1,200-0,H], ens-cache3.de5[3,0]
x-nos-object-name
webzj_cdn101%2Fsprite_61fbe151ab715649c6b7c4ec39156201.png
x-nos-request-id
7f8b1a5e-b95f-46a8-99ea-64b8140dad7f
Age
226732
X-Swift-CacheTime
2440237
X-Cache
HIT TCP_HIT dirn:12:49861062
Content-Disposition
inline; filename="webzj_cdn101%2Fsprite_61fbe151ab715649c6b7c4ec39156201.png"
Connection
keep-alive
x-nos-storage-class
STANDARD
X-Swift-SaveTime
Sun, 25 Aug 2024 19:27:51 GMT
Content-Length
21044
Last-Modified
Mon, 26 Mar 2018 11:09:00 Asia/Shanghai
Server
Tengine
ETag
61fbe151ab715649c6b7c4ec39156201
x-nos-requesttype
GetObject
Ali-Swift-Global-Savetime
1724462308
Content-Type
image/png;charset=UTF-8
Timing-Allow-Origin
*
EagleId
a3b55c9717246890401346164e
favicon.ico
vip.163.com/ 		318 B
809 B 		Other
General
Check archive.org
Download Go to
Full URL
https://vip.163.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
111.124.200.204 , China, ASN139203 (CHINANET-GUIZHOU-GUIAN-IDC Guizhou GuiAn IDC, CN),
Reverse DNS
Software
nginx /
Resource Hash
43c6594eb74940c6e0fb38d55c634425860093660f4eb0cb89334608dd9947eb
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.mediav.com *.netstatic.net; connect-src 'self' wss: *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp

Request headers

Referer
https://net1ease.thefixafence.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Mon, 26 Aug 2024 16:17:21 GMT
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.mediav.com *.netstatic.net; connect-src 'self' wss: *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp
last-modified
Mon, 20 Jun 2011 07:39:08 GMT
server
nginx
etag
"4dfef91c-13e"
content-type
image/x-icon
cache-control
max-age=60
accept-ranges
bytes
content-length
318
expires
Mon, 26 Aug 2024 16:18:21 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| Raven

1 Cookies

Domain/Path Name / Value
net1ease.thefixafence.com/ Name: PHPSESSID
Value: cd5ee1bfebef62c9bff6994fbf1989b8

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://net1ease.thefixafence.com/z1/index_files/index_dl2_new.php?username=
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

net1ease.thefixafence.com
urswebzj.nosdn.127.net
vip.163.com
webdisk.login.ali-inc.starlitenails.com
111.124.200.204
163.181.92.228
192.185.140.149
192.185.28.92
2228c2ab502184f2abb123e1359a162d2f8ece522ec31ac1d7e9f0fa6f9144d5
43c6594eb74940c6e0fb38d55c634425860093660f4eb0cb89334608dd9947eb
5db54d49dc16e246c318834a76842d8b452892d4fa53673e0f378ec24b8ed398
8ac4ba4e614357c13da588cebb396fc9815f8f66b0f85cc3e2969c6f44a33448
8b6d98b0cf87dc28a33bbd54f6e64114b0b8417e654b82111fd0579e7efdbdbf
8e2d0e643fd9e76238aa210997c6be8310807c4224ddb3c3c34efb4f1c38d293
952c29179362cece1b02af7902c1e282b418a7e927e13e7045d326f39faddcc3
96a8efca7bc9faff6206241e9ccef34d94cd972dacef411f795251868dcff201
9b9ca278fea98d6549f7953e296313103fac720206bcf3240ac5a1a7a70f2a5b
b7eb5b8fce9425b7d027ebbca22b6e0c40c6b95d451e19dfb4b1f13edc7ce817
bf6cd4aac8dce7426f51a59a9192184e13545a50512265ccf4ae7348d97e0fd3
c3162dcaed5b93a1768a035afc9eaf59abc1f0573e5a5985e74bd3da183746cd
d5292586cfe2230f1c91cae1f71ad9156c23fb60f7cd9d2bce428647b2cad47c
d685a65ab2fcd5def1e40dec687ad2fe8226294fe053017ea4a921b2500cd417
da38b8e1d2740954703ac7ee15102ba0eec506777221d9fc0d409fdce17f780f
dd37cd41f21e27f74586217bc1a1e6017580492bec9774602ccfe0faf4c34663
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec0f4e6c0f509a1ad6cb6d31493fe7b09f3346f3b26c2b96e5533883b7547601