urlscan.io logo urlscan.io
SecurityTrails logo

baibaoxiang.vip Open in urlscan Pro
119.28.52.49  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://baibaoxiang.vip/ING/r4/
Effective URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Submission Tags: 6933334
Submission: On January 23 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 6 countries across 7 domains to perform 20 HTTP transactions. The main IP is 119.28.52.49, located in Hong Kong and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is baibaoxiang.vip.
TLS certificate: Issued by TrustAsia TLS RSA CA on August 6th 2020. Valid for: a year.
This is the only time baibaoxiang.vip was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
9 119.28.52.49 132203 (TENCENT-N...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a0b:4d07:101::1 44239 (PROINITY ...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3 193.41.234.21 16289 (ING-DIREC...)
4 2606:4700:e6:... 13335 (CLOUDFLAR...)
20 8
9    119.28.52.49 (Hong Kong)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
baibaoxiang.vip
1    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a0b:4d07:101::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)
icono-49d6.kxcdn.com
1    2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:81b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2606:4700::6812:1634 (United States)

ASN13335 (CLOUDFLARENET, US)
kit.fontawesome.com
3    193.41.234.21 (Madrid, Spain)

ASN16289 (ING-DIRECT-SPAIN, ES)
ing.ingdirect.es
4    2606:4700:e6::ac40:ca1c (United States)

ASN13335 (CLOUDFLARENET, US)
ka-f.fontawesome.com
Domain Requested by
9 baibaoxiang.vip baibaoxiang.vip
4 ka-f.fontawesome.com kit.fontawesome.com
baibaoxiang.vip
3 ing.ingdirect.es 1 redirects baibaoxiang.vip
1 kit.fontawesome.com baibaoxiang.vip
1 ajax.googleapis.com baibaoxiang.vip
1 maxcdn.bootstrapcdn.com baibaoxiang.vip
1 icono-49d6.kxcdn.com baibaoxiang.vip
1 cdnjs.cloudflare.com baibaoxiang.vip
20 8

This site contains no links.

Subject Issuer Validity Valid
www.baibaoxiang.vip
TrustAsia TLS RSA CA		 2020-08-06 -
2021-08-06		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
*.kxcdn.com
Thawte RSA CA 2018		 2019-07-04 -
2021-09-01		 2 years crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2020-09-22 -
2021-10-12		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-13 -
2021-12-14		 a year crt.sh
ing.ingdirect.es
DigiCert SHA2 Extended Validation Server CA		 2020-07-09 -
2022-07-10		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Frame ID: 72004F058158E3E760EF22EBD406F5E7
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://baibaoxiang.vip/ING/r4/ Page URL
  2. https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
  • html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

100 %
HTTPS

75 %
IPv6

7
Domains

8
Subdomains

8
IPs

6
Countries

317 kB
Transfer

639 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://baibaoxiang.vip/ING/r4/ Page URL
  2. https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://ing.ingdirect.es/pfm/assets/images/norton-logo.png HTTP 302
  • https://ing.ingdirect.es/pfm/

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
baibaoxiang.vip/ING/r4/ 		275 B
501 B 		Document
General
Check archive.org
Download Go to
Full URL
https://baibaoxiang.vip/ING/r4/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
97a8c7822dc6d076401411d03d9b7d6f202c55b819175c35bcb5445c5c9fcca7

Request headers

:method
GET
:authority
baibaoxiang.vip
:scheme
https
:path
/ING/r4/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Sat, 23 Jan 2021 16:08:08 GMT
content-type
text/html; charset-UTF-8;charset=UTF-8
set-cookie
PHPSESSID=g59ot0rbbaaffvc43i8vhgm3i1; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
Primary Request publications.php
baibaoxiang.vip/ING/r4/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
9ef40c2f4aa313c34aab4474e8939b68fb79ff687179486d99db8d8d8427db4d

Request headers

:method
GET
:authority
baibaoxiang.vip
:scheme
https
:path
/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://baibaoxiang.vip/ING/r4/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=g59ot0rbbaaffvc43i8vhgm3i1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://baibaoxiang.vip/ING/r4/

Response headers

server
nginx
date
Sat, 23 Jan 2021 16:08:08 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
content-encoding
gzip
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:08 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
241184
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
content-length
5631
cf-request-id
07d199cdb50000060520844000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sl49tMI0b6HYXWk1f3LA%2FoXbnNx69jVaA3OHXDAKSk3JMiH%2BXQrxvdfcI%2BzOx9m9%2FjK9nqo%2B9tJnLwn%2FnppsLsz7%2FSb0bXmOJJumSVN4WQqbrC35ToMZH%2B6dlBVBaT7uwA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6162c58f88df0605-FRA
expires
Thu, 13 Jan 2022 16:08:08 GMT
navbar.css
baibaoxiang.vip/ING/r4/App/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://baibaoxiang.vip/ING/r4/App/css/navbar.css
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
f4948dbf00f11bc77beb2b6c5ce4364ba0d8aa73594f969bd525954dc6bca73e

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
content-encoding
gzip
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
etag
W/"600c1992-1673"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 24 Jan 2021 04:08:09 GMT
body.css
baibaoxiang.vip/ING/r4/App/css/ 		1 KB
719 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://baibaoxiang.vip/ING/r4/App/css/body.css
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
b3e7a746100e97655b71495bb0fa83bbcc3f4ded049cd5a36638923c9e75cb09

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
content-encoding
gzip
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
etag
W/"600c1992-588"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 24 Jan 2021 04:08:09 GMT
icono.min.css
icono-49d6.kxcdn.com/ 		42 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://icono-49d6.kxcdn.com/icono.min.css
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software
keycdn-engine /
Resource Hash
af5eb7b630394e61de5d229bb59017bdc45a126a23ecab83012fbd66d1c5332f

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:08 GMT
content-encoding
br
last-modified
Tue, 11 Oct 2016 16:43:52 GMT
server
keycdn-engine
x-edge-location
defr
etag
W/"57fd16c8-a90a"
vary
Accept-Encoding
access-control-allow-methods
*
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=604800
access-control-allow-headers
*
expires
Sat, 30 Jan 2021 16:08:08 GMT
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ 		141 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://baibaoxiang.vip
Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:34:10 GMT
etag
"1544639650"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
20563
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 09:25:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
24170
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30399
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 23 Jan 2022 09:25:18 GMT
9870a60e4f.js
kit.fontawesome.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/9870a60e4f.js
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9be7bf8fbea9c4a0f93fa7a2e2acba510fa6f848f0b49c83301c3ddf51a5ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:08 GMT
content-encoding
gzip
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
cf-cache-status
REVALIDATED
strict-transport-security
max-age=31536000; preload
cf-request-id
07d199cdb500001762db9ae000000001
x-request-id
FlpOSMVe5UocdaUC-5eB
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=60, public, must-revalidate
cf-ray
6162c58f88201762-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
val_login.js
baibaoxiang.vip/ING/r4/App/js/ 		2 KB
507 B 		Script
General
Check archive.org
Download Go to
Full URL
https://baibaoxiang.vip/ING/r4/App/js/val_login.js
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
adccb506cd605e83c77b54a2f8cc3788ca564aaf3e479a0904ff6007416883a9

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
content-encoding
gzip
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
etag
W/"600c1992-62a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Sun, 24 Jan 2021 04:08:09 GMT
logoING.svg
baibaoxiang.vip/ING/r4/App/img/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://baibaoxiang.vip/ING/r4/App/img/logoING.svg
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
accept-ranges
bytes
etag
"600c1992-84d7"
content-length
34007
content-type
image/svg+xml
/
ing.ingdirect.es/pfm/
Redirect Chain
  • https://ing.ingdirect.es/pfm/assets/images/norton-logo.png
  • https://ing.ingdirect.es/pfm/
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ing.ingdirect.es/pfm/
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.41.234.21 Madrid, Spain, ASN16289 (ING-DIRECT-SPAIN, ES),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Date
Sat, 23 Jan 2021 16:08:03 GMT
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubdomains
Content-Type
text/html
Location
https://ing.ingdirect.es/pfm/#login
Connection
keep-alive
Content-Length
138
X-Xss-Protection
1; mode=block
LogoDNIE-trazado.svg
ing.ingdirect.es/pfm/assets/images/ 		13 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ing.ingdirect.es/pfm/assets/images/LogoDNIE-trazado.svg
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.41.234.21 Madrid, Spain, ASN16289 (ING-DIRECT-SPAIN, ES),
Reverse DNS
Software
/
Resource Hash
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 23 Jan 2021 16:07:57 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 15 Jan 2021 14:23:56 GMT
ETag
W/"6001a57c-32db"
Strict-Transport-Security
max-age=31536000; includeSubdomains
Content-Type
image/svg+xml
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Xss-Protection
1; mode=block
footerbanner.png
baibaoxiang.vip/ING/r4/App/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://baibaoxiang.vip/ING/r4/App/img/footerbanner.png
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
f3efc08ac2c0a7a9c082d3dd21598b822afea0fa8014530b56f5a0bd8c110fac

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
etag
"600c1992-13e1"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
5089
expires
Mon, 22 Feb 2021 16:08:09 GMT
free.min.css
ka-f.fontawesome.com/releases/v5.15.2/css/ 		59 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/css/free.min.css?token=9870a60e4f
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9870a60e4f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
via
1.1 aa34a836095df9de9d246a53dd63f1d7.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6537
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
cf-request-id
07d199cebb00000eafdd347000000001
last-modified
Wed, 13 Jan 2021 18:32:18 GMT
server
cloudflare
etag
W/"4ecc071b77d6b1790fa9fb8a5173f972"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XUSzNA2j6RhkHBy6h3Srpoh19Lu%2BDEf2dYq88nGWu9Nq66QzsPCmdUZPgXlEomb5IRnMtyS3xAZfC0XK0OBhPTGBzepeoeX0kUiTX3B%2Bna9RqIm%2BwsRVQ7%2BXqKvYSmS%2BEQ%3D%3D"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
OSL50-C1
cf-ray
6162c5912d670eaf-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
duLQnswcZ5qRv2Vh1rU5y-L7Xv0Qq9WeOF-prKpXUJGnQ3HROhu1-w==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.2/css/ 		26 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/css/free-v4-shims.min.css?token=9870a60e4f
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9870a60e4f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101

Request headers

Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
via
1.1 410f51195842d9b592b15d6588c36655.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6537
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
cf-request-id
07d199cebc00000eafbc0f4000000001
last-modified
Wed, 13 Jan 2021 18:32:17 GMT
server
cloudflare
etag
W/"1848e71668f42835079e5fa2af6cf4a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Lq5OhqNBHNAx6voAyJs3tQADzfZkszGaUZsAWuJSH2PBMr3oGUj3i7e0eHPA6X1m9jbDRWjfnUM6gMqFz0tn5Hng0PcXVGO1HDipDx%2B4llfU%2FVkNYzaHcfQmzZAEqHErYQ%3D%3D"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
OSL50-C1
cf-ray
6162c5912d690eaf-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
Mjh5mNlvZFwK4tqad_uETXl0IEvKvwENYBMSPoBE5MR_bdNNtIDp_Q==
banner-login_1164x300.jpg
baibaoxiang.vip/ING/r4/App/img/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://baibaoxiang.vip/ING/r4/App/img/banner-login_1164x300.jpg
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/App/css/navbar.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e

Request headers

Referer
https://baibaoxiang.vip/ING/r4/App/css/navbar.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
etag
"600c1992-15ad7"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
88791
expires
Mon, 22 Feb 2021 16:08:09 GMT
button-loading-dark.gif
baibaoxiang.vip/ING/r4/App/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://baibaoxiang.vip/ING/r4/App/img/button-loading-dark.gif
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/App/css/navbar.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
119.28.52.49 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
483c4a0396691993a641ec409c44b8b7e1daab0ae7e2b2944c4bc59520bb7655

Request headers

Referer
https://baibaoxiang.vip/ING/r4/App/css/navbar.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
last-modified
Sat, 23 Jan 2021 12:41:54 GMT
server
nginx
etag
"600c1992-9f1"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2545
expires
Mon, 22 Feb 2021 16:08:09 GMT
free-fa-regular-400.woff2
ka-f.fontawesome.com/releases/v5.15.2/webfonts/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/webfonts/free-fa-regular-400.woff2
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf114b3206d8f8772f9be31295020a7b2e5fc8ee8e4a924d338c420a63e2b48a

Request headers

Origin
https://baibaoxiang.vip
Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6690
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
content-length
13596
cf-request-id
07d199cf6300000eafea897000000001
last-modified
Wed, 13 Jan 2021 18:39:07 GMT
server
cloudflare
etag
"e9010f368abcaf8b49cae5e87216a2bc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FVzVLMC%2FRxg1KJUGwJ2ldqWdVAI%2B8qfCVaqzSqUY2C88ySUD%2FUqBaZVi3qv18ElqE4UkYv74TIq6xb86l1LY2WgcAtQQTkkylKfyAHXVIdnB3t4s3FVOMliyBD1rkmxOow%3D%3D"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
6162c59238500eaf-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
8wOo14di8N0YPDvYXRYyIn-EipYRLTrSpyG4yTaM5hb-oN7N6QFalg==
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.2/webfonts/ 		78 KB
79 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.2/webfonts/free-fa-solid-900.woff2
Requested by
Host: baibaoxiang.vip
URL: https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b94af5a5be53424e948d36a705a1169d952ba6b23761aea3098967a643765454

Request headers

Origin
https://baibaoxiang.vip
Referer
https://baibaoxiang.vip/ING/r4/publications.php?ip=517335637code=646509420&id=7461697&country=604477460
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 23 Jan 2021 16:08:09 GMT
via
1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6413
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
content-length
80272
cf-request-id
07d199cf6300000eaf53375000000001
last-modified
Wed, 13 Jan 2021 18:39:13 GMT
server
cloudflare
etag
"a156119daf157b8244f7c816f85638cc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=suGwYNSrSRFpJQvceD3Vqhw1LDpZyWWtjxHP%2ByQow2bULAYjZQaYG43jqs6J%2BSt94B80Cpe9pq3WOOe0A6XJQNfecq7VZyfDP8%2FH1winclNgJ1AbY7yQdXO20zJdZkNViw%3D%3D"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
6162c59238560eaf-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
d0OWUQ3rCK6l4NorttAckTEbR0zCSl8JUCeaHBIg0XhKlH0DS4MQBQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| FontAwesomeKitConfig

1 Cookies

Domain/Path Name / Value
baibaoxiang.vip/ Name: PHPSESSID
Value: g59ot0rbbaaffvc43i8vhgm3i1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
baibaoxiang.vip
cdnjs.cloudflare.com
icono-49d6.kxcdn.com
ing.ingdirect.es
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
119.28.52.49
193.41.234.21
2001:4de0:ac19::1:b:3a
2606:4700::6810:135e
2606:4700::6812:1634
2606:4700:e6::ac40:ca1c
2a00:1450:4001:81b::200a
2a0b:4d07:101::1
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
483c4a0396691993a641ec409c44b8b7e1daab0ae7e2b2944c4bc59520bb7655
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
97a8c7822dc6d076401411d03d9b7d6f202c55b819175c35bcb5445c5c9fcca7
9ef40c2f4aa313c34aab4474e8939b68fb79ff687179486d99db8d8d8427db4d
a9be7bf8fbea9c4a0f93fa7a2e2acba510fa6f848f0b49c83301c3ddf51a5ce8
adccb506cd605e83c77b54a2f8cc3788ca564aaf3e479a0904ff6007416883a9
af5eb7b630394e61de5d229bb59017bdc45a126a23ecab83012fbd66d1c5332f
b3e7a746100e97655b71495bb0fa83bbcc3f4ded049cd5a36638923c9e75cb09
b94af5a5be53424e948d36a705a1169d952ba6b23761aea3098967a643765454
bf114b3206d8f8772f9be31295020a7b2e5fc8ee8e4a924d338c420a63e2b48a
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3efc08ac2c0a7a9c082d3dd21598b822afea0fa8014530b56f5a0bd8c110fac
f4948dbf00f11bc77beb2b6c5ce4364ba0d8aa73594f969bd525954dc6bca73e