flekomax.top
Open in
urlscan Pro
213.189.56.206
Malicious Activity!
Public Scan
Effective URL: https://flekomax.top/Apps/5iDHL/8e9c81s7iujeu60v2nfa9gv7.php?b7LC5K1565920502b7c8caa19cff100b869c77aff6b3dfc2b7c8caa1...
Submission: On August 16 via manual from HK
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on July 24th 2019. Valid for: 3 months.
This is the only time flekomax.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 103.90.226.147 103.90.226.147 | 135905 (VNPT-AS-V...) (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP) | |
1 2 | 213.189.56.206 213.189.56.206 | 57367 (ECO-ATMAN...) (ECO-ATMAN-PL ECO-ATMAN-) | |
13 | 106.122.255.38 106.122.255.38 | 133774 (CHINATELE...) (CHINATELECOM-FUJIAN-FUZHOU-IDC1 Fuzhou) | |
14 | 2 |
ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN)
z755carcare.com |
ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL)
PTR: web26.mydevil.net
flekomax.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
5idhl.com
etracing.5idhl.com |
269 KB |
2 |
flekomax.top
1 redirects
flekomax.top |
11 KB |
1 |
z755carcare.com
1 redirects
z755carcare.com |
253 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
13 | etracing.5idhl.com |
flekomax.top
etracing.5idhl.com |
2 | flekomax.top | 1 redirects |
1 | z755carcare.com | 1 redirects |
14 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.5idhl.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
flekomax.top Let's Encrypt Authority X3 |
2019-07-24 - 2019-10-22 |
3 months | crt.sh |
*.5idhl.com GeoTrust RSA CA 2018 |
2018-05-28 - 2019-10-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://flekomax.top/Apps/5iDHL/8e9c81s7iujeu60v2nfa9gv7.php?b7LC5K1565920502b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2&login=x
Frame ID: 2A74C16E92CC1B1CE6C195046292A79F
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://z755carcare.com/d/?login=x
HTTP 302
https://flekomax.top/Apps/5iDHL/?login=x HTTP 302
https://flekomax.top/Apps/5iDHL/8e9c81s7iujeu60v2nfa9gv7.php?b7LC5K1565920502b7c8caa19cff100b869c... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: 立刻注册
Search URL Search Domain Scan URL
Title: 重置密码
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://z755carcare.com/d/?login=x
HTTP 302
https://flekomax.top/Apps/5iDHL/?login=x HTTP 302
https://flekomax.top/Apps/5iDHL/8e9c81s7iujeu60v2nfa9gv7.php?b7LC5K1565920502b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2b7c8caa19cff100b869c77aff6b3dfc2&login=x Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
8e9c81s7iujeu60v2nfa9gv7.php
flekomax.top/Apps/5iDHL/ Redirect Chain
|
11 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
etracing.5idhl.com/EClaim/css/ |
118 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base.css
etracing.5idhl.com/EClaim/css/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
etracing.5idhl.com/EClaim/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
content.css
etracing.5idhl.com/EClaim/css/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.3.min.js
etracing.5idhl.com/EClaim/js/ |
94 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common.js
etracing.5idhl.com/EClaim/js/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
layer.js
etracing.5idhl.com/EClaim/js/layer/ |
21 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jsWin.js
etracing.5idhl.com/EClaim/js/ |
1 KB 997 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
etracing.5idhl.com/EClaim/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
imageServlet
etracing.5idhl.com/EClaim/claim/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
national.png
etracing.5idhl.com/EClaim/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
layer.css
etracing.5idhl.com/EClaim/js/layer/skin/default/ |
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-body.jpg
etracing.5idhl.com/EClaim/images/ |
162 KB 162 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| export2pdf function| jsCreateRandomCode function| jsSetValuebyCheckbox function| jsSetValuebySelect function| jsSetOPTNameValue function| jsGeneratePDF function| jsDownloadDoc function| jsUploadFile function| jsDelUploadFile function| jsGetReloadUploadFileList function| jsSubmitDocument function| jsCheckingDate function| jsVerifyUUID function| jsVerifyEmail function| jsVerifyImgCode function| jsVerifyPhoneCode object| layer function| openJsWin function| createMengBan function| createWin function| winTitleHTML0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
etracing.5idhl.com
flekomax.top
z755carcare.com
103.90.226.147
106.122.255.38
213.189.56.206
128f8b9185f2b9ce70ed84cd53a663028a366e8067dd43131da5ed2b3a0c1ee0
1caf4d1a4798e38ff1e7c7f3c4f96bdbef470e9439344095d8407d167f23918a
367f0db970a2058fe4a832d0ad72126da933ef44e66ddf965bdb8f26ed17fa70
661f380b3cedd25209ae8dacce24bb16c3cd43bb6a2a3c1a830b2af0112837ee
7c06812819b9b9174dea3e3167958745712f9cb0594c31bcd3d2a8ad6beb9bd3
c44b69316ec5698a599c3dfaf38234954552891a33ef1caad4819ffe23fe5272
c74e117aacdf398503bfab73dd2791fe03de045d4011e6202bc7133b03296e8c
e0381fc5a655a10afc48c33c78dd935842361f20ea2bada1160c34f5cdfd7ca9
e789e21d7038024b1b1cf2e0aded5240d553fdde58bc35470e45a45cd826306f
e7bb14238dc429ccf87c250bb1a441f47cfc0119a3973801cd60890445b87150
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ef46131149b6b6a98a411469caab0a7baf189aed1c0e899561755fc89fe478b4
fd1df53216557cfcb5629d56b44536931aac98ec67eed520986dfc3f3043293b
fefc5c5314aa67b5e56ab4d5e8aab61af50a9ca93df64786b24f77a46a5c22f8