www.cskhnguyenkim.com
Open in
urlscan Pro
150.95.104.167
Malicious Activity!
Public Scan
Submitted URL: http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn?x=x&a=xxx@qq.com
Effective URL: http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/itcliljjd3v4pfivwhqi60y0zt.php?a=eHh4QHFxLmNvbQ...
Submission: On November 12 via manual from CN
Effective URL: http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/itcliljjd3v4pfivwhqi60y0zt.php?a=eHh4QHFxLmNvbQ...
Submission: On November 12 via manual from CN
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 6 HTTP transactions.
The main IP is 150.95.104.167, located in
Japan and
belongs to RUNSYSTEM-AS-VN GMO-Z.com Runsystem Joint Stock Company, VN.
The main domain is www.cskhnguyenkim.com.
This is the only time www.cskhnguyenkim.com was scanned on urlscan.io!
This is the only time www.cskhnguyenkim.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 8 | 150.95.104.167 150.95.104.167 | 131392 (RUNSYSTEM...) (RUNSYSTEM-AS-VN GMO-Z.com Runsystem Joint Stock Company) | |
| 6 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
cskhnguyenkim.com
2 redirects
www.cskhnguyenkim.com |
78 KB |
| 6 | 1 |
| Domain | Requested by | |
|---|---|---|
| 8 | www.cskhnguyenkim.com |
2 redirects
www.cskhnguyenkim.com
|
| 6 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 2 frames:
Primary Page:
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/itcliljjd3v4pfivwhqi60y0zt.php?a=eHh4QHFxLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=eHh4QHFxLmNvbQ==&loginID=&.
Frame ID: D6CB5039E2A2280880D4C279B7AE1EB3
Requests: 2 HTTP requests in this frame
Frame:
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/ova.php?a=eHh4QHFxLmNvbQ==&i=0&c=
Frame ID: B9D5D568183732CFB6A1B0BAF11F90FA
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn?x=x&a=xxx@qq.com
HTTP 301
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/?x=x&a=xxx@qq.com HTTP 302
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/itcliljjd3v4pfivwhqi60y0zt.... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn?x=x&a=xxx@qq.com
HTTP 301
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/?x=x&a=xxx@qq.com HTTP 302
http://www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/itcliljjd3v4pfivwhqi60y0zt.php?a=eHh4QHFxLmNvbQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=eHh4QHFxLmNvbQ==&loginID=&. Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
itcliljjd3v4pfivwhqi60y0zt.php
www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/ Redirect Chain
|
894 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ova.php
www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/ Frame B9D5 |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
qq.jpg
www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/ico/bg/ |
62 KB 62 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/css/ Frame B9D5 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
js.js
www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/ico/ Frame B9D5 |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
qq.ico
www.cskhnguyenkim.com/wp-content/uploads/dynamic_avia/_lfi/session/srn/ico/ Frame B9D5 |
4 KB 4 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.cskhnguyenkim.com/ | Name: PHPSESSID Value: apr0lvvmfbhip9rb7ef5n78ea3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.cskhnguyenkim.com
150.95.104.167
0f245981be19a707f4f0ef29d59b1d0b694d8d94ee3872d17e118766b1d4ab7f
1bcbd711541fce74fc4c58fce450956c507db9e1e9d83af8f13ed448e114f9a0
2e7bba6345b8fdbad0d374476e3c511819c8d4697ceebba554a536c3724f85db
7dd989433ffceb7c6582374776a21d9bc4245dbe2aaca1ae98501fb74ba2747a
f7b15dcf04e9c697bba3bdce49ae36dfdb255aad6486a6cdd8f81c577aefd7d1