211.22.108.239 Open in urlscan Pro
211.22.108.239 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://211.22.108.239/why/
Submission: On February 26 via manual (February 26th 2019, 1:00:56 pm UTC) from IT

Summary HTTP 16 Redirects Links 23 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 3 countries across 2 domains to perform 16 HTTP transactions. The main IP is 211.22.108.239, located in Taiwan and belongs to HINET Data Communication Business Group, TW. The main domain is 211.22.108.239.

This is the only time 211.22.108.239 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online) Generic China (Online)

Domain & IP information

	IP Address		AS Autonomous System
2	211.22.108.239 211.22.108.239		3462 (HINET Dat...) (HINET Data Communication Business Group)
12	103.129.252.34 103.129.252.34		137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
1	54.64.105.68 54.64.105.68		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
16	4

2 211.22.108.239 (Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 211-22-108-239.HINET-IP.hinet.net

211.22.108.239	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 103.129.252.34 (None, )

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.64.105.68 (Tokyo, Japan)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-64-105-68.ap-northeast-1.compute.amazonaws.com

mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	127.net mimg.127.net	36 KB
1	163.com ssl.mail.163.com Failed mail.163.com
16	2

	Domain	Requested by
12	mimg.127.net	211.22.108.239
1	mail.163.com	211.22.108.239
0	ssl.mail.163.com Failed	211.22.108.239
16	3

This site contains links to these domains. Also see Links.

Domain
mail.163.com
email.163.com
qiye.163.com
vip.163.com
hw.mail.163.com
18.mail.163.com
help.mail.163.com
help.163.com
reg.163.com
reg.email.163.com
ipad.mail.163.com
smart.mail.163.com
www.163.com
ss.knet.cn
1.163.com
mail.blog.163.com
music.163.com
uinfo.mail.163.com

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://211.22.108.239/why/
Frame ID: 727E15B2A80E1C0A1F8242E07FF8EA91
Requests: 15 HTTP requests in this frame

Frame: http://mail.163.com/preload6.htm
Frame ID: 90BE62B2AE18AF99430B744876DD12D6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Perl (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_perl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_perl(?:\/([\d\.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

16
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

3
Countries

150 kB
Transfer

145 kB
Size

0
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: http://mail.163.com/html/mail_intro/

Search URL Search Domain Scan URL

URL: http://email.163.com/
Title: 免费邮

Search URL Search Domain Scan URL

URL: http://qiye.163.com/
Title: 企业邮箱

Search URL Search Domain Scan URL

URL: http://vip.163.com/?b08abh1
Title: VIP邮箱

Search URL Search Domain Scan URL

URL: http://hw.mail.163.com/#163
Title: 国外用户登录

Search URL Search Domain Scan URL

URL: http://18.mail.163.com/login.do?from=mail
Title: 学生用户登录

Search URL Search Domain Scan URL

URL: http://mail.163.com/dashi/
Title: 手机客户端

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/
Title: 帮助

Search URL Search Domain Scan URL

URL: http://help.163.com/special/007528M7/xiaoyi_intd.html
Title: 在线答疑

Search URL Search Domain Scan URL

URL: http://mail.163.com/dashi/?from=mail101
Title: 下载邮箱大师

Search URL Search Domain Scan URL

URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail163
Title: 忘记密码了?

Search URL Search Domain Scan URL

URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=163mail_right
Title: 注册

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail5

Search URL Search Domain Scan URL

URL: http://ipad.mail.163.com/index.htm?dv=ipad
Title: 适配iPad版本

Search URL Search Domain Scan URL

URL: http://smart.mail.163.com/index.htm?dv=smart
Title: 手机智能版

Search URL Search Domain Scan URL

URL: http://www.163.com/

Search URL Search Domain Scan URL

URL: https://ss.knet.cn/verifyseal.dll?sn=e12051044010020841301459&ct=df&pa
Title:

Search URL Search Domain Scan URL

URL: http://mail.163.com/html/mail_intro
Title: 关于网易免费邮

Search URL Search Domain Scan URL

URL: http://1.163.com/
Title: 一元夺宝

Search URL Search Domain Scan URL

URL: http://mail.blog.163.com/
Title: 邮箱官方博客

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/feedback.do?m=add&categoryName=%e7%99%bb%e5%bd%95
Title: 意见反馈>>

Search URL Search Domain Scan URL

URL: http://music.163.com/?act=cmad_20130517_08
Title: 网易云音乐

Search URL Search Domain Scan URL

URL: http://uinfo.mail.163.com/cgi-bin/hseed/two.pl

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 211.22.108.239/why/	96 KB 96 KB	626ms 314ms	Document text/html	211.22.108.239 HINET Data Commun...
General Check archive.org Show headers Download Go to Full URL http://211.22.108.239/why/ Protocol HTTP/1.1 Server 211.22.108.239 , Taiwan, ASN3462 (HINET Data Communication Business Group, TW), Reverse DNS 211-22-108-239.HINET-IP.hinet.net Software Apache/2.2.21 (Unix) DAV/2 mod_ssl/2.2.21 OpenSSL/1.0.0c PHP/5.3.8 mod_apreq2-20090110/2.7.1 mod_perl/2.0.5 Perl/v5.10.1 / Resource Hash `023d73df488b8a7bea06ab2c3fe3db4366b3f69999f65e83001dbbbda91b9a4e` Request headers Host 211.22.108.239 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:03:49 GMT Server Apache/2.2.21 (Unix) DAV/2 mod_ssl/2.2.21 OpenSSL/1.0.0c PHP/5.3.8 mod_apreq2-20090110/2.7.1 mod_perl/2.0.5 Perl/v5.10.1 Last-Modified Fri, 26 Aug 2016 01:26:59 GMT ETag "1680033-1800d-53aef69298746" Accept-Ranges bytes Content-Length 98317 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	base_v5.js Show response 211.22.108.239/why/	18 KB 18 KB	302ms 301ms	Script application/x-javascript	211.22.108.239 HINET Data Commun...
General Check archive.org Show headers Download Go to Full URL http://211.22.108.239/why/base_v5.js Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 211.22.108.239 , Taiwan, ASN3462 (HINET Data Communication Business Group, TW), Reverse DNS 211-22-108-239.HINET-IP.hinet.net Software Apache/2.2.21 (Unix) DAV/2 mod_ssl/2.2.21 OpenSSL/1.0.0c PHP/5.3.8 mod_apreq2-20090110/2.7.1 mod_perl/2.0.5 Perl/v5.10.1 / Resource Hash `2686970c3d70ca85cf129efa9c9297278b60b9af0357a0396ff7a11c08cca6d5` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 211.22.108.239 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://211.22.108.239/why/ Connection keep-alive Cache-Control no-cache Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:03:50 GMT Last-Modified Fri, 26 Aug 2016 01:26:50 GMT Server Apache/2.2.21 (Unix) DAV/2 mod_ssl/2.2.21 OpenSSL/1.0.0c PHP/5.3.8 mod_apreq2-20090110/2.7.1 mod_perl/2.0.5 Perl/v5.10.1 ETag "1680032-463f-53aef68a766c6" Content-Type application/x-javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17983
GET H/1.1	200 OK	163logo.gif mimg.127.net/logo/	7 KB 7 KB	542ms 256ms	Image image/gif	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/163logo.gif Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Tue, 10 Feb 2009 07:01:48 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 6671 Expires Tue, 26 Feb 2019 13:32:29 GMT
GET H/1.1	200 OK	t.gif mimg.127.net/index/lib/img/	77 B 473 B	584ms 275ms	Image image/gif	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/t.gif Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 19 Nov 2014 08:43:00 GMT Server nginx ETag "546c5814-4d" X-Cache HIT from HKGM Content-Type image/gif Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 77 Expires Tue, 26 Feb 2019 13:51:00 GMT
GET H/1.1	200 OK	loading_s.gif mimg.127.net/index/lib/img/	578 B 976 B	275ms 275ms	Image image/gif	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/loading_s.gif Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 19 Nov 2014 08:43:00 GMT Server nginx ETag "546c5814-242" X-Cache HIT from HKGM Content-Type image/gif Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 578 Expires Tue, 26 Feb 2019 13:28:46 GMT
GET H/1.1	200 OK	netease_logo.gif mimg.127.net/logo/	1 KB 2 KB	540ms 265ms	Image image/gif	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/netease_logo.gif Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 01 Dec 2010 02:06:41 GMT Server nginx ETag "4cf5adb1-4ec" X-Cache HIT from HKGM Content-Type image/gif Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 1260 Expires Tue, 26 Feb 2019 13:09:11 GMT
GET H/1.1	200 OK	knet.png mimg.127.net/logo/	5 KB 5 KB	546ms 269ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/knet.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 16 May 2012 09:47:58 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 4611 Expires Tue, 26 Feb 2019 13:22:30 GMT
GET H/1.1	200 OK	year.js Show response mimg.127.net/copyright/	23 B 410 B	326ms 326ms	Script application/x-javascript	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Full URL http://mimg.127.net/copyright/year.js Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `098ec9249cb3e97872e1862b4400b9db4c6622a4d089b64b752ffc73b3ef7a30` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Fri, 29 Dec 2017 03:11:25 GMT Server nginx X-Cache MISS from HKGM Content-Type application/x-javascript Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control no-cache Connection keep-alive Accept-Ranges bytes Content-Length 23 Expires Sat, 29 Dec 2018 03:11:25 GMT
GET H/1.1	200 OK	130523_music.png mimg.127.net/index/163/effects/	2 KB 2 KB	753ms 249ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/effects/130523_music.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `629358b38df917468e648571e26aa879f5c3cb8cca934651f49646141c37fb8b` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Thu, 23 May 2013 05:15:06 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 1866 Expires Tue, 26 Feb 2019 13:17:01 GMT
GET H/1.1	200 OK	bg_v3.png mimg.127.net/index/163/img/2013/	10 KB 11 KB	767ms 252ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/img/2013/bg_v3.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 06 Aug 2014 08:38:32 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 10528 Expires Tue, 26 Feb 2019 13:48:53 GMT
GET H/1.1	200 OK	new.png mimg.127.net/index/lib/img/	225 B 601 B	502ms 257ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/new.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `8e5fbde0ebbcc317b159bc9f681b83117d152e55634cbcb617281e896e41ee2b` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Mon, 18 Aug 2014 08:39:52 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 225 Expires Tue, 26 Feb 2019 13:46:35 GMT
GET H/1.1	200 OK	login_v5.png mimg.127.net/index/163/img/2013/	4 KB 4 KB	482ms 248ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/img/2013/login_v5.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 17 Dec 2014 03:19:07 GMT Server nginx ETag "5490f62b-f6e" X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 3950 Expires Tue, 26 Feb 2019 13:02:46 GMT
GET H/1.1	200 OK	icon_code.png mimg.127.net/index/lib/img/	230 B 606 B	495ms 252ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/icon_code.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Tue, 23 Dec 2014 07:47:23 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 230 Expires Tue, 26 Feb 2019 13:03:06 GMT
GET H/1.1	200 OK	mailapp_logo_141212.png mimg.127.net/index/lib/img/	2 KB 2 KB	510ms 275ms	Image image/png	103.129.252.34 NETEASE-AS-AP NET...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/mailapp_logo_141212.png Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 103.129.252.34 -, , ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK), Reverse DNS Software nginx / Resource Hash `d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419` Request headers Referer http://211.22.108.239/why/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 26 Feb 2019 13:00:23 GMT Last-Modified Wed, 23 Mar 2016 09:26:25 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Access-Control-Allow-Origin .163.com .126.com .yeah.net .tryfun.com Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 2111 Expires Tue, 26 Feb 2019 13:12:08 GMT
GET		httpsEnable.gif ssl.mail.163.com/	0 0

GET H/1.1	200 OK	preload6.htm mail.163.com/ Frame 90BE	0 0	1171ms 410ms	Document text/html	54.64.105.68 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://mail.163.com/preload6.htm Requested by Host: 211.22.108.239 URL: http://211.22.108.239/why/ Protocol HTTP/1.1 Server 54.64.105.68 Tokyo, Japan, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-64-105-68.ap-northeast-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Host mail.163.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://211.22.108.239/why/ Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://211.22.108.239/why/ Response headers Server nginx Date Tue, 26 Feb 2019 12:58:23 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Accept-Encoding Accept-Encoding Last-Modified Mon, 15 May 2017 02:18:56 GMT ETag W/"59191010-3439" Expires Tue, 26 Feb 2019 13:44:48 GMT Cache-Control max-age=3600 X-Cache from HKGM from ntes_qiye Content-Encoding gzip

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ssl.mail.163.com
URL: https://ssl.mail.163.com/httpsEnable.gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online) Generic China (Online)

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| gOption function| fCheckLoginNow function| fCheckAutoLogin function| fAutoLogin boolean| gbForcepc object| oAndroidRedirect function| fCheckBrowser function| fHtml5Tag function| fCheckCookie function| fGetQuery function| fGetQueryHash function| $id function| fTrim function| fParseMNum function| fCheckAccount function| fGetScript function| fGetCookie function| fSetCookie function| fEventListen function| fEventUnlisten function| fRandom function| fUrlP function| fResize function| fJSONP function| fFQ function| fStartTime object| gUserInfo object| gVisitorCookie undefined| gMobileNumMailIsForbidden undefined| gMobileNumMailResult object| gMobileNumMail function| fEnData function| loginRequest function| getRnd undefined| DOMContentLoaded function| DOMREADY string| base64EncodeChars function| base64encode function| utf16to8 function| fGetLocator function| CapsLock function| MobCallback boolean| bGettingAlgorithm object| loginExtAD undefined| gAdUserPropertyData object| gAdResData object| gErrorInfo object| oStyle function| fCls object| oSpdTestPosition object| aSpdResult object| aSpdStartTime object| aSpdEndTime object| aSpdTmpTime object| aSpdQueue boolean| bSpdAuto string| sLocationInfo function| fSpeedTestPre function| fSpeedTest function| fSpd function| fLocationDot object| aLocationDot function| fSelectLoaction function| fSpdUserInit function| fLocationChoose function| fSetLocation function| fNetErrDebug object| indexLogin object| themeHandler object| gAdTemplate_lbp

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail.163.com
mimg.127.net
ssl.mail.163.com
ssl.mail.163.com
103.129.252.34
211.22.108.239
54.64.105.68
023d73df488b8a7bea06ab2c3fe3db4366b3f69999f65e83001dbbbda91b9a4e
065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be
098ec9249cb3e97872e1862b4400b9db4c6622a4d089b64b752ffc73b3ef7a30
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
2686970c3d70ca85cf129efa9c9297278b60b9af0357a0396ff7a11c08cca6d5
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5
629358b38df917468e648571e26aa879f5c3cb8cca934651f49646141c37fb8b
8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401
8e5fbde0ebbcc317b159bc9f681b83117d152e55634cbcb617281e896e41ee2b
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419
d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236
dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623