urlscan.io logo urlscan.io
SecurityTrails logo

my3ddreams.com Open in urlscan Pro
192.185.183.65  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Submission: On September 13 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 3 domains to perform 12 HTTP transactions. The main IP is 192.185.183.65, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is my3ddreams.com.
This is the only time my3ddreams.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online) Generic China (Online)

Domain & IP information

IP Address AS Autonomous System
1 192.185.183.65 46606 (UNIFIEDLA...)
5 54.176.139.60 16509 (AMAZON-02)
1 18.159.198.32 16509 (AMAZON-02)
3 103.129.252.34 137263 (NETEASE-A...)
1 123.126.97.210 4808 (CHINA169-...)
1 223.252.195.133 45062 (NETEASE-A...)
12 6
1    192.185.183.65 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: ebbswebs.biz
my3ddreams.com
5    54.176.139.60 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: mail-aws13960.qiye.163.com
mimg.qiye.163.com
mimghz.qiye.163.com
1    18.159.198.32 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: mail-aws19832.qiye.163.com
mail.qiye.163.com
3    103.129.252.34 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)
mimg.127.net
1    123.126.97.210 (Fengtai, China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
PTR: mail-m97210.mail.163.com
ssl.mail.163.com
1    223.252.195.133 (China)

ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN)
analytics.163.com
Domain Requested by
4 mimghz.qiye.163.com my3ddreams.com
3 mimg.127.net my3ddreams.com
1 analytics.163.com my3ddreams.com
1 ssl.mail.163.com my3ddreams.com
1 mail.qiye.163.com my3ddreams.com
1 mimg.qiye.163.com my3ddreams.com
1 my3ddreams.com
12 7
Subject Issuer Validity Valid
*.qiye.163.com
GeoTrust CN RSA CA G1		 2020-01-20 -
2022-02-19		 2 years crt.sh
mimg.127.net
GeoTrust RSA CN CA G2		 2021-08-17 -
2022-09-09		 a year crt.sh
ssl.mail.163.com
GeoTrust CN RSA CA G1		 2020-01-07 -
2022-03-05		 2 years crt.sh
*.163.com
GeoTrust CN RSA CA G1		 2020-02-12 -
2022-04-10		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Frame ID: AD941F854688DCB7E3E435E91B8D94A2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

网易企业邮箱 - 登录入口

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

12
Requests

83 %
HTTPS

0 %
IPv6

3
Domains

7
Subdomains

6
IPs

4
Countries

59 kB
Transfer

91 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ii.php
my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ 		29 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Server
192.185.183.65 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
ebbswebs.biz
Software
Apache /
Resource Hash
24206933e5d2a0e696622323807fca96a6bebed0f40c575fe055ccd23d8c0384

Request headers

Host
my3ddreams.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Mon, 13 Sep 2021 12:07:23 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
8992
Keep-Alive
timeout=5, max=75
Content-Type
text/html; charset=UTF-8
logo.gif
mimg.qiye.163.com/o/public/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimg.qiye.163.com/o/public/logo.gif
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.176.139.60 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
mail-aws13960.qiye.163.com
Software
nginx /
Resource Hash
ed6dbc8fab5b63d6df0b079b70fc95459214b77dc174a05f0ea97d6a5fdc131c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:31 GMT
Last-Modified
Thu, 18 Oct 2012 06:21:43 GMT
Server
nginx
X-Cache
from ntes_qiye
Content-Type
image/gif
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3232
Expires
Tue, 13 Sep 2022 12:07:31 GMT
getqrcode.do
mail.qiye.163.com/mailapp/commonweb/qrcode/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mail.qiye.163.com/mailapp/commonweb/qrcode/getqrcode.do?w=130&h=130
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
18.159.198.32 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
mail-aws19832.qiye.163.com
Software
nginx /
Resource Hash
59e781429ff48baf5941649747b6178a3f0c483090ef3a390b61ffd1e7c6c6d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:28 GMT
Server
nginx
Connection
keep-alive
Content-Type
image/jpeg
Content-Length
8062
X-Cache
from ntes_qiye
P3P
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
netease_logo.gif
mimg.127.net/logo/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimg.127.net/logo/netease_logo.gif
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 13 Sep 2021 12:07:25 GMT
last-modified
Wed, 01 Dec 2010 02:06:41 GMT
server
nginx
etag
"4cf5adb1-4ec"
x-cache
HIT from HKGM
content-type
image/gif
cache-control
max-age=3600
accept-ranges
bytes
content-length
1260
expires
Mon, 13 Sep 2021 12:40:17 GMT
knet.png
mimg.127.net/logo/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimg.127.net/logo/knet.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 13 Sep 2021 12:07:25 GMT
last-modified
Wed, 16 May 2012 09:47:58 GMT
server
nginx
etag
"4fb377ce-1203"
x-cache
HIT from HKGM
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
content-length
4611
expires
Mon, 13 Sep 2021 13:01:20 GMT
year.js
mimg.127.net/copyright/ 		23 B
364 B 		Script
General
Check archive.org
Download Go to
Full URL
http://mimg.127.net/copyright/year.js
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
b7d3c2e78895ed6048d40b23537f1d008f0f169de24ec0745765b7e3765c0069

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:25 GMT
Last-Modified
Thu, 31 Dec 2020 10:43:14 GMT
Server
nginx
ETag
"5fedab42-17"
X-Cache
HIT from HKGM
Content-Type
application/x-javascript
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
23
Expires
Fri, 31 Dec 2021 10:43:14 GMT
httpsEnable.gif
ssl.mail.163.com/ 		43 B
251 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.mail.163.com/httpsEnable.gif
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
123.126.97.210 Fengtai, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
mail-m97210.mail.163.com
Software
nginx /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:25 GMT
Last-Modified
Wed, 15 Jun 2011 02:19:09 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Content-Type
image/gif
ntes.js
analytics.163.com/ 		23 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.163.com/ntes.js
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
223.252.195.133 , China, ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN),
Reverse DNS
Software
nginx /
Resource Hash
25db958af8f71e0c19b5ad136125dac706ee9592790160e6ae65f9b292d7fd2a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 13 Sep 2021 12:07:24 GMT
content-encoding
gzip
last-modified
Tue, 31 Aug 2021 10:42:56 GMT
server
nginx
content-type
application/javascript
x-server-id
S170
cache-control
max-age=3600
content-length
7846
expires
Mon, 13 Sep 2021 13:07:24 GMT
login.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img// 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//login.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.176.139.60 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
mail-aws13960.qiye.163.com
Software
nginx /
Resource Hash
a48f5ba832b9bcb1444871afeeb254fade0edc8ccd3122de34acceabb66434ac

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:31 GMT
Last-Modified
Thu, 13 Nov 2014 10:33:23 GMT
Server
nginx
X-Cache
from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4063
Expires
Tue, 13 Sep 2022 00:19:44 GMT
sprite.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img// 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//sprite.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.176.139.60 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
mail-aws13960.qiye.163.com
Software
nginx /
Resource Hash
1650584f5c4f5b4e20435812baabcdf60113361578b9c001c1ef9cc638c886fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:31 GMT
Last-Modified
Thu, 13 Nov 2014 10:33:23 GMT
Server
nginx
X-Cache
from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5682
Expires
Mon, 12 Sep 2022 23:00:06 GMT
codebg.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img// 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//codebg.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.176.139.60 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
mail-aws13960.qiye.163.com
Software
nginx /
Resource Hash
8696828c26cab79a60130d39242aa14bbcc38181ec2cfcb4320d5100f82fbf9e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:31 GMT
Last-Modified
Thu, 13 Nov 2014 10:33:23 GMT
Server
nginx
X-Cache
from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5733
Expires
Tue, 13 Sep 2022 00:43:11 GMT
applogin_example.png
mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img// 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mimghz.qiye.163.com/o/mailapp/qiyelogin/style/img//applogin_example.png
Requested by
Host: my3ddreams.com
URL: http://my3ddreams.com/comm/Yhatspokfun/neteaseqiye/ii.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.176.139.60 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
mail-aws13960.qiye.163.com
Software
nginx /
Resource Hash
4e0171daa235a3165e2295b05780d34c366126e00c624b958766b84ee3fbe832

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://my3ddreams.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Mon, 13 Sep 2021 12:07:31 GMT
Last-Modified
Mon, 13 Jun 2016 00:36:38 GMT
Server
nginx
X-Cache
from ntes_qiye
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7129
Expires
Tue, 13 Sep 2022 00:19:45 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online) Generic China (Online)

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster undefined| gDocHeight function| resizeBody undefined| _ntes_nacc string| _ntes_nvid number| _ntes_nvtm number| _ntes_nvfi number| _ntes_nvsf number| _ntes_nstm string| _ntes_nurl string| _ntes_ntit string| _ntes_nref string| _ntes_nres string| _ntes_nlag string| _ntes_nscd number| _ntes_nlmf string| _ntes_flsh string| _ntes_nssn number| _ntes_surv function| _ntes_void object| _ntes_domain_array object| _non_ntes_domain_array string| _ntes_cdmn string| _non_ntes_cdmn string| _ntes_src_addr object| _ntes_cookie_enabled object| _ntes_localstorage_enabled object| _ntes_page_data function| ntes_set_uid function| ntes_get_uid function| neteaseTracker function| neteaseClickTracker function| ntes_survey_popup function| ntes_get_navigation_info function| fetch_visitor_hash function| ntes_get_domain function| non_ntes_get_domain function| ntes_set_cookie_long function| ntes_set_cookie function| ntes_set_cookie_new function| ntes_get_cookie function| ntes_get_flashver number| _ntes_hexcase number| _ntes_chrsz function| ntes_hex_md5 function| ntes_core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| safe_add function| bit_rol function| str2binl function| binl2hex function| str_to_ent function| ntes_page_click_stat function| ntes_page_unload_stat function| neteaseClickStat function| _ntes_bindEvent function| _ntes_fixEvent function| _ntes_sendInfo function| recordAction function| neteaseClickStatForArea function| ntes_area_click_stat function| is_spider object| ntes_area_click_tools object| pattern

1 Cookies

Domain/Path Name / Value
.mail.qiye.163.com/ Name: qrcode_uuid
Value: 6aac7797465a42ddb11282137d75bbf0