mail.159-223-49-58.cprapid.com Open in urlscan Pro
159.223.49.58 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://mail.159-223-49-58.cprapid.com/
Submission: On June 17 via api (June 17th 2024, 1:43:28 pm UTC) from US — Scanned from SG

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 159.223.49.58, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is mail.159-223-49-58.cprapid.com.

This is the only time mail.159-223-49-58.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online)

Domain & IP information

	IP Address	AS Autonomous System
15	159.223.49.58 159.223.49.58	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	103.129.252.59 103.129.252.59	137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
16	3

15 159.223.49.58 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

mail.159-223-49-58.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.129.252.59 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	cprapid.com mail.159-223-49-58.cprapid.com	32 KB
1	163.com mail.163.com — Cisco Umbrella Rank: 51145	1 KB
16	2

	Domain	Requested by
15	mail.159-223-49-58.cprapid.com	mail.159-223-49-58.cprapid.com
1	mail.163.com
16	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://mail.159-223-49-58.cprapid.com/
Frame ID: 61B3642DC902AC45A6B5D2677FE51E66
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

网易邮箱超大附件下载

Page URL History Show full URLs

http://mail.159-223-49-58.cprapid.com/ HTTP 307
https://mail.159-223-49-58.cprapid.com/ HTTP 307
http://mail.159-223-49-58.cprapid.com/ Page URL

Page Statistics

16
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

33 kB
Transfer

51 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mail.159-223-49-58.cprapid.com/ HTTP 307
https://mail.159-223-49-58.cprapid.com/ HTTP 307
http://mail.159-223-49-58.cprapid.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
mail.159-223-49-58.cprapid.com/
Redirect Chain

http://mail.159-223-49-58.cprapid.com/
https://mail.159-223-49-58.cprapid.com/
http://mail.159-223-49-58.cprapid.com/

8 KB
3 KB

4ms
4ms

Document
text/html

159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: accd401d2b7a34496ba0a71ae96ac8376a52f3d49e4ff9c7d2075447ba2ada6a

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 2487
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Jun 2024 13:43:24 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding

Redirect headers

Location: http://mail.159-223-49-58.cprapid.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK background.css
mail.159-223-49-58.cprapid.com/css/ 3 KB
1 KB 5ms
5ms Stylesheet
text/css 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/css/background.css
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 25fdc0be7124d7294b35fc44fa22887156a82ac28b733fe8877f771d543b301b

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Tue, 16 Apr 2024 01:31:29 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "cec-6162cb27a5e40-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1056

GET
H/1.1 200
OK button.css
mail.159-223-49-58.cprapid.com/css/ 3 KB
952 B 9ms
5ms Stylesheet
text/css 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/css/button.css
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 62499e6a685147582c414703436551da587ad2d46dfae1397bd083c0ad50fa77

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Fri, 12 Apr 2024 08:01:31 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "a73-615e1adfb0cc0-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 616

GET
H/1.1 200
OK modal.css
mail.159-223-49-58.cprapid.com/css/ 2 KB
1 KB 7ms
3ms Stylesheet
text/css 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/css/modal.css
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 60a97520f4107ba84886c3b38b98bbdcc8f10304bbc9d45a1cd586310890b072

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Apr 2024 01:45:45 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "8e7-6164103574440-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 867

GET
H/1.1 200
OK download.css
mail.159-223-49-58.cprapid.com/css/ 789 B
696 B 9ms
5ms Stylesheet
text/css 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/css/download.css
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 3f9aae4b47acb5e8db1648bbff533c8242cafc9bad32a81e353ba607ea3ce7ff

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Thu, 11 Apr 2024 02:57:29 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "315-615c950d4d840-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 360

GET
H/1.1 200
OK 163logo.gif
mail.159-223-49-58.cprapid.com/images/ 7 KB
7 KB 9ms
6ms Image
image/gif 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.159-223-49-58.cprapid.com/images/163logo.gif
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Last-Modified: Thu, 21 Mar 2024 06:57:32 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "1a0f-6142638a64f00"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 6671

GET
H/1.1 200
OK X.png
mail.159-223-49-58.cprapid.com/images/ 637 B
922 B 9ms
6ms Image
image/png 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.159-223-49-58.cprapid.com/images/X.png
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: cb183768821e6d24ddfa73158d796a1732f18ed83f6167e402c26abaccf6dc68

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Last-Modified: Mon, 25 Mar 2024 05:30:15 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "27d-6147577dd87c0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 637

GET
H/1.1 200
OK m.png
mail.159-223-49-58.cprapid.com/images/ 2 KB
2 KB 4ms
3ms Image
image/png 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.159-223-49-58.cprapid.com/images/m.png
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: c26f81ba8f4b8cc5f2d8ae58169dd2528fa9ca11dc5a449e554269f25583ff34

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Last-Modified: Thu, 21 Mar 2024 06:53:15 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "88a-614262954ccc0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2186

GET
H/1.1 200
OK 163email.png
mail.159-223-49-58.cprapid.com/images/ 6 KB
6 KB 4ms
4ms Image
image/png 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.159-223-49-58.cprapid.com/images/163email.png
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: d26f60f65c52e1ac774ed640acb28e4071ae27f524789e6093e89dac63c20202

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Last-Modified: Thu, 28 Mar 2024 00:04:01 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "1686-614ad42b01e40"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 5766

GET
H/1.1 200
OK logo.js Show response
mail.159-223-49-58.cprapid.com/js/ 620 B
653 B 4ms
4ms Script
text/javascript 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/js/logo.js
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 4d9c95cdab14737bd39d1535fda994da7217c0c0e698be1be4a21e62de2b907f

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Thu, 02 May 2024 02:01:34 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "26c-6176efb867b80-gzip"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 311

GET
H/1.1 200
OK time.js Show response
mail.159-223-49-58.cprapid.com/js/ 1 KB
960 B 5ms
4ms Script
text/javascript 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/js/time.js
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: e7b336d0d4e1d376b3ec391a25c0a36a18ae8d981de5ecd51d4c03945e61e45f

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Mar 2024 01:48:54 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "481-6149a9bf04d80-gzip"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 618

GET
H/1.1 200
OK login.js Show response
mail.159-223-49-58.cprapid.com/js/ 11 KB
4 KB 5ms
5ms Script
text/javascript 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/js/login.js
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 15812982a8e8a2801972ae816007bc517b6861da57c1c548f3a7c8d57b8443f7

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 22 Apr 2024 01:43:41 GMT
Server: Apache/2.4.52 (Ubuntu)
ETag: "2d4b-616a591280d40-gzip"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3604

GET
H/1.1 200
OK listFiles.php Show response
mail.159-223-49-58.cprapid.com/ 3 KB
4 KB 4ms
3ms Fetch
application/json 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/listFiles.php
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/js/logo.js
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 9b8c1cd147d6015be81e3b4f0815fc44ae3ed81eb42551b5bd29677970cbccab

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Server: Apache/2.4.52 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 3474
Content-Type: application/json

GET
H/1.1 200
OK listFiles2.php Show response
mail.159-223-49-58.cprapid.com/ 21 B
216 B 4ms
3ms Fetch
application/json 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/listFiles2.php
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/js/login.js
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: a0806ff246ff87d8c405ea550790e2036e2b727c6371b9ef88a6a8dac3d6f295

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Server: Apache/2.4.52 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 21
Content-Type: application/json

GET
H/1.1 200
OK checkFileType.php Show response
mail.159-223-49-58.cprapid.com/ 17 B
212 B 4ms
3ms Fetch
application/json 159.223.49.58
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.159-223-49-58.cprapid.com/checkFileType.php
Requested by: Host: mail.159-223-49-58.cprapid.com
URL: http://mail.159-223-49-58.cprapid.com/js/login.js
Protocol: HTTP/1.1
Server: 159.223.49.58 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.52 (Ubuntu) /
Resource Hash: 2c8e42328e5d224e5592ec09514dd3b76742dc1e5501ae21862e034b3d3eb353

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:24 GMT
Server: Apache/2.4.52 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 17
Content-Type: application/json

GET
H/1.1 200
OK favicon.ico
mail.163.com/ 318 B
1 KB 437ms
107ms Other
image/x-icon 103.129.252.59
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL

http://mail.163.com/favicon.ico

Protocol

HTTP/1.1

Server

103.129.252.59 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),

Reverse DNS

Software

nginx /

Resource Hash

43c6594eb74940c6e0fb38d55c634425860093660f4eb0cb89334608dd9947eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com .mediav.com .netstatic.net; connect-src 'self' wss: .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 17 Jun 2024 13:43:25 GMT
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.mediav.com *.netstatic.net; connect-src 'self' wss: *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp
Last-Modified: Sun, 01 Jan 2006 12:37:08 GMT
Server: nginx
ETag: "43b7ccf4-13e"
Content-Type: image/x-icon
Cache-Control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 318
Expires: Mon, 17 Jun 2024 13:44:24 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1db4f13a62d8460daffc915dfaf709140d778dc78a6453162a37f09558079289

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Referer: http://mail.159-223-49-58.cprapid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: http://mail.159-223-49-58.cprapid.com/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail.159-223-49-58.cprapid.com
mail.163.com
103.129.252.59
159.223.49.58
15812982a8e8a2801972ae816007bc517b6861da57c1c548f3a7c8d57b8443f7
1db4f13a62d8460daffc915dfaf709140d778dc78a6453162a37f09558079289
25fdc0be7124d7294b35fc44fa22887156a82ac28b733fe8877f771d543b301b
2c8e42328e5d224e5592ec09514dd3b76742dc1e5501ae21862e034b3d3eb353
3f9aae4b47acb5e8db1648bbff533c8242cafc9bad32a81e353ba607ea3ce7ff
43c6594eb74940c6e0fb38d55c634425860093660f4eb0cb89334608dd9947eb
4d9c95cdab14737bd39d1535fda994da7217c0c0e698be1be4a21e62de2b907f
60a97520f4107ba84886c3b38b98bbdcc8f10304bbc9d45a1cd586310890b072
62499e6a685147582c414703436551da587ad2d46dfae1397bd083c0ad50fa77
9b8c1cd147d6015be81e3b4f0815fc44ae3ed81eb42551b5bd29677970cbccab
a0806ff246ff87d8c405ea550790e2036e2b727c6371b9ef88a6a8dac3d6f295
accd401d2b7a34496ba0a71ae96ac8376a52f3d49e4ff9c7d2075447ba2ada6a
c26f81ba8f4b8cc5f2d8ae58169dd2528fa9ca11dc5a449e554269f25583ff34
cb183768821e6d24ddfa73158d796a1732f18ed83f6167e402c26abaccf6dc68
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
d26f60f65c52e1ac774ed640acb28e4071ae27f524789e6093e89dac63c20202
e7b336d0d4e1d376b3ec391a25c0a36a18ae8d981de5ecd51d4c03945e61e45f

mail.159-223-49-58.cprapid.com Open in urlscan Pro 159.223.49.58 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

33 kBTransfer

51 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

mail.159-223-49-58.cprapid.com Open in urlscan Pro
159.223.49.58 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

33 kB
Transfer

51 kB
Size

0
Cookies

16 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!