dsmyaccessreg.com Open in urlscan Pro
89.45.67.200 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://dsmyaccessreg.com/htlmailllll.php
Submission: On April 12 via api (April 12th 2017, 6:40:09 pm UTC) from CA

Summary HTTP 19 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 19 HTTP transactions. The main IP is 89.45.67.200, located in Sofia, Bulgaria and belongs to BELCLOUD, BG. The main domain is dsmyaccessreg.com.

This is the only time dsmyaccessreg.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic China (Online) 163.cn (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	89.45.67.200 89.45.67.200	44901 (BELCLOUD) (BELCLOUD)
12	43.230.90.2 43.230.90.2	135391 (AOFEI-HK ...) (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED)
1	123.125.50.99 123.125.50.99	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
19	4

1 89.45.67.200 (Sofia, Bulgaria)

ASN44901 (BELCLOUD, BG)
PTR: cphost08.qhoster.net

dsmyaccessreg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 43.230.90.2 (Hong Kong)

ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
PTR: proxy90-2.mail.163.com

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 123.125.50.99 (Beijing, China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)

ssl.mail.126.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	127.net mimg.127.net	51 KB
1	126.com ssl.mail.126.com ir3.mail.126.com Failed ir.mail.126.com Failed www.126.com Failed	43 B
1	dsmyaccessreg.com dsmyaccessreg.com	103 KB
0	163.com Failed mail.163.com Failed iplocator.mail.163.com Failed
19	4

	Domain	Requested by
12	mimg.127.net	dsmyaccessreg.com
1	ssl.mail.126.com	dsmyaccessreg.com
1	dsmyaccessreg.com
0	www.126.com Failed
0	ir.mail.126.com Failed	mimg.127.net
0	iplocator.mail.163.com Failed	mimg.127.net
0	ir3.mail.126.com Failed	mimg.127.net
0	mail.163.com Failed	dsmyaccessreg.com
19	8

This site contains links to these domains. Also see Links.

Domain
mail.163.com
email.163.com
qiye.163.com
vip.126.com
hw.mail.163.com
help.mail.163.com
help.163.com
reg.163.com
reg.email.163.com
ipad.mail.163.com
smart.mail.163.com
1.163.com
www.163.com
ss.knet.cn
qian.163.com
you.163.com
img2.cache.netease.com
uinfo.mail.163.com

Subject Issuer	Validity	Valid
ssl.mail.163.com GeoTrust SSL CA - G3	`2015-10-15` - `2018-01-30`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://dsmyaccessreg.com/htlmailllll.php
Frame ID: 18710.1
Requests: 18 HTTP requests in this frame

Frame: http://mail.163.com/preload6.htm
Frame ID: 18710.4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

19
Requests

5 %
HTTPS

0 %
IPv6

4
Domains

8
Subdomains

4
IPs

3
Countries

154 kB
Transfer

179 kB
Size

0
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: http://mail.163.com/html/mail_intro/

Search URL Search Domain Scan URL

URL: http://email.163.com/
Title: 免费邮

Search URL Search Domain Scan URL

URL: http://qiye.163.com/
Title: 企业邮箱

Search URL Search Domain Scan URL

URL: http://vip.126.com/?b09abh1
Title: VIP邮箱

Search URL Search Domain Scan URL

URL: http://hw.mail.163.com/#126
Title: 国外用户登录

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail13
Title: 手机客户端

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/
Title: 帮助

Search URL Search Domain Scan URL

URL: http://help.163.com/special/007528M7/xiaoyi_intd.html
Title: 在线答疑

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail6

Search URL Search Domain Scan URL

URL: http://mail.163.com/dashi/?from=mail101
Title: 下载邮箱大师

Search URL Search Domain Scan URL

URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail126
Title: 忘记密码了?

Search URL Search Domain Scan URL

URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=126mail
Title: 注册

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail5

Search URL Search Domain Scan URL

URL: http://ipad.mail.163.com/index.htm?dv=ipad
Title: 适配iPad版本

Search URL Search Domain Scan URL

URL: http://smart.mail.163.com/index.htm?dv=smart
Title: 手机智能版

Search URL Search Domain Scan URL

URL: http://mail.163.com/html/131114_yixin/
Title: 用手机号码邮箱可直接登录易信

Search URL Search Domain Scan URL

URL: http://1.163.com/?from=loading
Title: 花一元就有机会夺得潮流新品

Search URL Search Domain Scan URL

URL: http://www.163.com/

Search URL Search Domain Scan URL

URL: https://ss.knet.cn/verifyseal.dll?sn=e12052344010022026301459&ct=df&pa=782581
Title:

Search URL Search Domain Scan URL

URL: http://mail.163.com/html/mail_intro
Title: 关于网易免费邮

Search URL Search Domain Scan URL

URL: http://1.163.com/
Title: 一元夺宝

Search URL Search Domain Scan URL

URL: http://qian.163.com/
Title: 网易�有钱

Search URL Search Domain Scan URL

URL: http://you.163.com/
Title: 网易严选

Search URL Search Domain Scan URL

URL: http://img2.cache.netease.com/www/icp.jpg
Title: ICP证粤B2-20090191

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/feedback.do?m=add&categoryName=%e7%99%bb%e5%bd%95
Title: 意见反馈>>

Search URL Search Domain Scan URL

URL: http://uinfo.mail.163.com/cgi-bin/hseed/two.pl

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request htlmailllll.php Show response dsmyaccessreg.com/	102 KB 103 KB	856ms 65ms	Document text/html	89.45.67.200 BELCLOUD
General Check archive.org Show headers Download Go to Full URL http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 89.45.67.200 Sofia, Bulgaria, ASN44901 (BELCLOUD, BG), Reverse DNS cphost08.qhoster.net Software Apache / PHP/5.6.30 Resource Hash `80a117080f43baee86f60d16887914cbb6ec7d594de42a292506710c841c2dbb` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host dsmyaccessreg.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/5.6.30 Transfer-Encoding chunked Keep-Alive timeout=2, max=100 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	base_v5.min.js Show response mimg.127.net/index/lib/scripts/	17 KB 6 KB	526ms 263ms	Script application/x-javascript	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Full URL http://mimg.127.net/index/lib/scripts/base_v5.min.js Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `66f7395da705f823eb253cb60f2ae419ae3a77b1901cad9e035a3e5639023243` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Content-Encoding gzip Last-Modified Thu, 28 Apr 2016 03:04:49 GMT Server nginx Vary Accept-Encoding X-Cache HIT from HKGM Content-Type application/x-javascript Cache-Control max-age=3600 Transfer-Encoding chunked Connection keep-alive Expires Wed, 12 Apr 2017 19:16:47 GMT
GET H/1.1	200 OK	126logo.gif mimg.127.net/logo/	6 KB 6 KB	264ms 263ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/126logo.gif Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Tue, 10 Feb 2009 07:01:48 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 6593 Expires Wed, 12 Apr 2017 18:48:56 GMT
GET H/1.1	200 OK	t.gif mimg.127.net/index/lib/img/	77 B 77 B	271ms 270ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/t.gif Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 19 Nov 2014 08:43:00 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 77 Expires Wed, 12 Apr 2017 19:31:36 GMT
GET H/1.1	200 OK	loading_s.gif mimg.127.net/index/lib/img/	578 B 578 B	528ms 263ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/loading_s.gif Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 19 Nov 2014 08:43:00 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 578 Expires Wed, 12 Apr 2017 19:00:57 GMT
GET H/1.1	200 OK	netease_logo.gif mimg.127.net/logo/	1 KB 1 KB	542ms 270ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/netease_logo.gif Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 01 Dec 2010 02:06:41 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 1260 Expires Wed, 12 Apr 2017 18:54:41 GMT
GET H/1.1	200 OK	knet.png mimg.127.net/logo/	5 KB 5 KB	656ms 274ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/knet.png Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 16 May 2012 09:47:58 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 4611 Expires Wed, 12 Apr 2017 18:44:12 GMT
GET H/1.1	200 OK	year.js Show response mimg.127.net/copyright/	23 B 23 B	549ms 274ms	Script application/x-javascript	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Full URL http://mimg.127.net/copyright/year.js Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `e8d520daeac47000a5c92c5147bc1711e0aea45cb1d6f85e7330f3a6e90a4e4f` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Sat, 31 Dec 2016 16:12:49 GMT Server nginx X-Cache HIT from HKGM Content-Type application/x-javascript Cache-Control max-age=31535805 Connection keep-alive Accept-Ranges bytes Content-Length 23 Expires Sun, 31 Dec 2017 16:12:49 GMT
GET H/1.1	200 OK	httpsEnable.gif ssl.mail.126.com/	43 B 43 B	909ms 225ms	Image image/gif	123.125.50.99 CHINA169-BJ China...
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.mail.126.com/httpsEnable.gif Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_CBC Server 123.125.50.99 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN), Reverse DNS Software nginx / Resource Hash `4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host ssl.mail.126.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:57 GMT Last-Modified Mon, 13 Aug 2012 07:05:51 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 43 Content-Type image/gif
GET H/1.1	200 OK	bg_v3.png mimg.127.net/index/126/img/2013/	10 KB 10 KB	501ms 256ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/126/img/2013/bg_v3.png Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `6c9e4b43a1a10a8d1384743318e115c60812bbfb2e0f314c1ead27930c2c7a74` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 06 Aug 2014 08:37:50 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 10446 Expires Wed, 12 Apr 2017 18:46:44 GMT
GET H/1.1	200 OK	login_v4.png mimg.127.net/index/126/img/2013/	3 KB 3 KB	505ms 258ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/126/img/2013/login_v4.png Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `753ac75f62579e480917b777de2565909be29687d31711671eb5fa4034a642d8` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 17 Dec 2014 03:21:56 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 2754 Expires Wed, 12 Apr 2017 19:17:52 GMT
GET H/1.1	200 OK	icon_code.png mimg.127.net/index/lib/img/	230 B 230 B	514ms 263ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/icon_code.png Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Tue, 23 Dec 2014 07:47:23 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 230 Expires Wed, 12 Apr 2017 19:03:23 GMT
GET H/1.1	200 OK	mailapp_logo_141212.png mimg.127.net/index/lib/img/	2 KB 2 KB	369ms 274ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/mailapp_logo_141212.png Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:39:56 GMT Last-Modified Wed, 23 Mar 2016 09:26:25 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 2111 Expires Wed, 12 Apr 2017 19:01:05 GMT
GET		preload6.htm mail.163.com/ Frame 1871	0 0

GET		get.do ir3.mail.126.com/	0 0

GET		iplocator iplocator.mail.163.com/	0 0

GET		get.do ir.mail.126.com/	0 0

GET		favicon.ico www.126.com/	0 0

GET H/1.1	200 OK	140919_mailapp_cnt.jpg mimg.127.net/index/163/themes/	31 KB 17 KB	271ms 271ms	Image image/jpeg	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/themes/140919_mailapp_cnt.jpg Requested by Host: dsmyaccessreg.com URL: http://dsmyaccessreg.com/htlmailllll.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mimg.127.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://dsmyaccessreg.com/htlmailllll.php Connection keep-alive Cache-Control no-cache Referer http://dsmyaccessreg.com/htlmailllll.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Wed, 12 Apr 2017 18:40:03 GMT Last-Modified Fri, 19 Sep 2014 09:33:49 GMT Server nginx X-Cache HIT from HKGM Content-Type image/jpeg Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 83992 Expires Wed, 12 Apr 2017 19:08:18 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mail.163.com
URL: http://mail.163.com/preload6.htm

Domain: ir3.mail.126.com
URL: http://ir3.mail.126.com/get.do?prod=wmail_lbp&ver=1&uid=nt@126.com&domain=126.com&mobUser=0&callback=themeHandler.callback&rnd=0.25887655391523756

Domain: iplocator.mail.163.com
URL: http://iplocator.mail.163.com/iplocator?callback=fGetLocator

Domain: ir.mail.126.com
URL: http://ir.mail.126.com/get.do?uid=nt@126.com&domain=126.com&ver=4&ph=-1&callback=loginExtAD.callback&rnd=0.47264774072061466

Domain: www.126.com
URL: http://www.126.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic China (Online) 163.cn (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dsmyaccessreg.com
iplocator.mail.163.com
ir.mail.126.com
ir3.mail.126.com
mail.163.com
mimg.127.net
ssl.mail.126.com
www.126.com
iplocator.mail.163.com
ir.mail.126.com
ir3.mail.126.com
mail.163.com
www.126.com
123.125.50.99
43.230.90.2
89.45.67.200
065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5
4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
66f7395da705f823eb253cb60f2ae419ae3a77b1901cad9e035a3e5639023243
6c9e4b43a1a10a8d1384743318e115c60812bbfb2e0f314c1ead27930c2c7a74
753ac75f62579e480917b777de2565909be29687d31711671eb5fa4034a642d8
80a117080f43baee86f60d16887914cbb6ec7d594de42a292506710c841c2dbb
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419
d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236
e8d520daeac47000a5c92c5147bc1711e0aea45cb1d6f85e7330f3a6e90a4e4f

dsmyaccessreg.com Open in urlscan Pro 89.45.67.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

19 Requests

5 %HTTPS

0 %IPv6

4 Domains

8 Subdomains

4 IPs

3 Countries

154 kBTransfer

179 kBSize

0 Cookies

26 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

dsmyaccessreg.com Open in urlscan Pro
89.45.67.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

5 %
HTTPS

0 %
IPv6

4
Domains

8
Subdomains

4
IPs

3
Countries

154 kB
Transfer

179 kB
Size

0
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!