https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
Open in
urlscan Pro
164.160.129.137
Malicious Activity!
Public Scan
Effective URL: http://https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/7fce1443a749ea8fd22d8f39f353.php?login=Inboxaspxn6cce54953287c70313a2ae55a853&...
Submission: On November 02 via automatic, source openphish
Summary
This is the only time https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 163.cn (Online) Generic China (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 164.160.129.137 164.160.129.137 | 328110 (Garanntor...) (Garanntor-Hosting-AS) | |
15 | 103.129.252.34 103.129.252.34 | 137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED) | |
21 | 3 |
ASN328110 (Garanntor-Hosting-AS, NG)
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng |
ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)
mimg.127.net | |
mail.163.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
127.net
mimg.127.net |
204 KB |
3 |
foreewad.com.ng
1 redirects
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng |
116 KB |
1 |
163.com
ssl.mail.163.com Failed mail.163.com ir3.mail.163.com Failed iplocator.mail.163.com Failed ir.mail.163.com Failed |
|
21 | 3 |
Domain | Requested by | |
---|---|---|
14 | mimg.127.net |
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
3 | https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng |
1 redirects
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
1 | mail.163.com |
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
0 | ir.mail.163.com Failed |
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
0 | iplocator.mail.163.com Failed |
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
0 | ir3.mail.163.com Failed |
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
0 | ssl.mail.163.com Failed |
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
|
21 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
mail.163.com |
1.163.com |
ss.knet.cn |
Subject Issuer | Validity | Valid |
---|
This page contains 2 frames:
Primary Page:
http://https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/7fce1443a749ea8fd22d8f39f353.php?login=Inboxaspxn6cce54953287c70313a2ae55a853&Id6cce54953287c70313a2ae55a853&docc07da9f97b90111ed1a8551dbb9e&email=&jivc07da9f97b90111ed1a8551dbb9e&cgd&id=fav&wow
Frame ID: DB63122528C0739EA738D13F6DBF13E1
Requests: 20 HTTP requests in this frame
Frame:
http://mail.163.com/preload6.htm
Frame ID: 019E0790FB798CA15EA47DA94BAB88FB
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/
HTTP 302
http://https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/7fce1443a749ea8fd22d8f39f353.php?login=Inboxaspxn6cce54953... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: 用手机号码邮箱可直接登录易信
Search URL Search Domain Scan URL
Title: 花一元就有机会夺得潮流新品
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/
HTTP 302
http://https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/7fce1443a749ea8fd22d8f39f353.php?login=Inboxaspxn6cce54953287c70313a2ae55a853&Id6cce54953287c70313a2ae55a853&docc07da9f97b90111ed1a8551dbb9e&email=&jivc07da9f97b90111ed1a8551dbb9e&cgd&id=fav&wow Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
7fce1443a749ea8fd22d8f39f353.php
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/ Redirect Chain
|
93 KB 94 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base_v5.min.js
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng/163_126/latest163/ |
22 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
163logo.gif
mimg.127.net/logo/ |
7 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.gif
mimg.127.net/index/lib/img/ |
77 B 473 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading_s.gif
mimg.127.net/index/lib/img/ |
578 B 976 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
netease_logo.gif
mimg.127.net/logo/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
knet.png
mimg.127.net/logo/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
year.js
mimg.127.net/copyright/ |
23 B 438 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
130523_music.png
mimg.127.net/index/163/effects/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
httpsEnable.gif
ssl.mail.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_v3.png
mimg.127.net/index/163/img/2013/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_v5.png
mimg.127.net/index/163/img/2013/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_code.png
mimg.127.net/index/lib/img/ |
230 B 627 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mailapp_logo_141212.png
mimg.127.net/index/lib/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
preload6.htm
mail.163.com/ Frame 019E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error_bg.png
mimg.127.net/index/163/img/2013/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
get.do
ir3.mail.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
iplocator
iplocator.mail.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
get.do
ir.mail.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
140919_mailapp_cnt.jpg
mimg.127.net/index/163/themes/ |
82 KB 82 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
140919_mailapp_cnt.jpg
mimg.127.net/index/163/themes/ |
82 KB 82 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ssl.mail.163.com
- URL
- https://ssl.mail.163.com/httpsEnable.gif
- Domain
- ir3.mail.163.com
- URL
- http://ir3.mail.163.com/get.do?prod=wmail_lbp&ver=1&uid=nt@163.com&domain=163.com&mobUser=0&callback=themeHandler.callback&rnd=0.07850043157160758
- Domain
- iplocator.mail.163.com
- URL
- http://iplocator.mail.163.com/iplocator?callback=fGetLocator
- Domain
- ir.mail.163.com
- URL
- http://ir.mail.163.com/get.do?uid=nt@163.com&domain=163.com&ver=4&ph=-1&callback=loginExtAD.callback&rnd=0.1239365446344316
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 163.cn (Online) Generic China (Online)75 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| gOption function| fCheckLoginNow function| fCheckAutoLogin function| fAutoLogin undefined| gbForcepc object| oAndroidRedirect function| fCheckBrowser function| fHtml5Tag function| fCheckCookie function| fGetQuery function| fGetQueryHash function| $id function| fTrim function| fParseMNum function| fCheckAccount function| fGetScript function| fGetCookie function| fSetCookie function| fEventListen function| fEventUnlisten function| fRandom function| fUrlP function| fResize function| fJSONP function| fFQ function| fStartTime object| gUserInfo object| gVisitorCookie undefined| gMobileNumMailIsForbidden undefined| gMobileNumMailResult object| gMobileNumMail function| fEnData function| loginRequest function| getRnd undefined| DOMContentLoaded function| DOMREADY string| base64EncodeChars function| base64encode function| utf16to8 function| fGetLocator function| CapsLock function| MobCallback boolean| bGettingAlgorithm object| loginExtAD undefined| gAdUserPropertyData object| gAdResData object| gErrorInfo object| oStyle function| fCls object| oSpdTestPosition object| aSpdResult object| aSpdStartTime object| aSpdEndTime object| aSpdTmpTime object| aSpdQueue boolean| bSpdAuto string| sLocationInfo function| fSpeedTestPre function| fSpeedTest function| fSpd function| fLocationDot object| aLocationDot function| fSelectLoaction function| fSpdUserInit function| fLocationChoose function| fSetLocation function| fNetErrDebug object| indexLogin object| themeHandler object| gAdTemplate_lbp boolean| bHTTPSDisabled number| oIntervalCheckInputAlways boolean| bImgLoaderIsLoaded0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
https.mail.163.com.fghhgtf54tf45.655ttf54rfgvcrd456tyhyhyt6r5ee.foreewad.com.ng
iplocator.mail.163.com
ir.mail.163.com
ir3.mail.163.com
mail.163.com
mimg.127.net
ssl.mail.163.com
iplocator.mail.163.com
ir.mail.163.com
ir3.mail.163.com
ssl.mail.163.com
103.129.252.34
164.160.129.137
065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be
087a4fe6b5a676d4615e1ae1bb07633ded65b3f7204c878854f713ef85362a2b
098ec9249cb3e97872e1862b4400b9db4c6622a4d089b64b752ffc73b3ef7a30
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
3253a3f8d53517f626af8adb363e47359952f319412745ffb1478e1e75caef83
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5
629358b38df917468e648571e26aa879f5c3cb8cca934651f49646141c37fb8b
7c538ed7c5803c01e5ebc25a3597472724d509a0874ceda1b0a2700c3bb40b62
8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401
a3274f74ee9d2bae61e8b85aeb6ef59f5a5fbe915252aeb856f5d872f94bfbad
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419
d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236
dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623