mailbox.gmaib.top Open in urlscan Pro
2606:4700:3033::6815:1ac9  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://yx.suying1.top/ Page URL
2. https://mailbox.gmaib.top/?gid=z241wr Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response yx.suying1.top/	344 B 656 B	2891ms 228ms	Document text/html	154.23.182.16 HKCICL-AS-AP Hong...
General Check archive.org Show headers Download Go to Full URL https://yx.suying1.top/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 154.23.182.16 Hong Kong, Hong Kong, ASN140227 (HKCICL-AS-AP Hong Kong Communications International Co., Limited, HK), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 82ba44c3c7d7e53597ac3458800668192addcb764cdfa02657aa5f812928df7e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Content-Encoding gzip Content-Length 362 Content-Type text/html Date Sun, 10 Nov 2024 04:30:29 GMT ETag "a973197b7016db1:0" Last-Modified Fri, 04 Oct 2024 15:17:09 GMT Server Microsoft-IIS/8.5 Vary Accept-Encoding X-Powered-By ASP.NET
GET H/1.1	200 OK	location.js yx.suying1.top/	150 B 555 B	228ms 227ms	Script application/javascript	154.23.182.16 HKCICL-AS-AP Hong...
General Check archive.org Show headers Download Go to Full URL https://yx.suying1.top/location.js Requested by Host: yx.suying1.top URL: https://yx.suying1.top/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 154.23.182.16 Hong Kong, Hong Kong, ASN140227 (HKCICL-AS-AP Hong Kong Communications International Co., Limited, HK), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://yx.suying1.top/ Response headers Content-Encoding gzip ETag "873bf8c04817db1:0" Accept-Ranges bytes Content-Length 248 Date Sun, 10 Nov 2024 04:30:29 GMT Content-Type application/javascript Last-Modified Sat, 05 Oct 2024 17:05:18 GMT Vary Accept-Encoding Server Microsoft-IIS/8.5 X-Powered-By ASP.NET
GET H/1.1	404 Not Found	favicon.ico yx.suying1.top/	1 KB 1 KB	228ms 228ms	Other text/html	154.23.182.16 HKCICL-AS-AP Hong...
General Check archive.org Show headers Download Go to Full URL https://yx.suying1.top/favicon.ico Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 154.23.182.16 Hong Kong, Hong Kong, ASN140227 (HKCICL-AS-AP Hong Kong Communications International Co., Limited, HK), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://yx.suying1.top/ Response headers Content-Length 1163 Date Sun, 10 Nov 2024 04:30:29 GMT Content-Type text/html X-Powered-By ASP.NET Server Microsoft-IIS/8.5
GET H3	200	Primary Request / Show response mailbox.gmaib.top/	519 B 1005 B	1012ms 635ms	Document text/html	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/?gid=z241wr Requested by Host: yx.suying1.top URL: https://yx.suying1.top/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.40 ASP.NET Resource Hash a41d3f392a5b57feb073d78b5a4e46d25a40c8be360a1a37d4686255f3e97b02 Request headers Referer https://yx.suying1.top/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8e034eba7f9565b1-FRA content-encoding zstd content-type text/html; charset=UTF-8 date Sun, 10 Nov 2024 04:30:30 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1XWhpG7%2BBttH%2BnBm6W21ER8YIbWOCmPgc6sZKCYjh5oxg4L8oFYfd0%2FKtknT0OxrE%2Flk76u23WK2SZUMjHU2d%2BbJNIP%2F6Zzkx%2Fc7eohMwL4AKWGaW66WE6NxSsdU%2FDdxyljSx8sAJbl6t5dS8QMsTA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=24999&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4161&recv_bytes=4446&delivery_rate=621&cwnd=12000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=586&x=1" cfHdrFlush;dur=0 vary Accept-Encoding x-powered-by PHP/5.6.40 ASP.NET
GET H3	200	components.js Show response mailbox.gmaib.top/assets/js/	584 KB 90 KB	36ms 36ms	Script application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/js/components.js Requested by Host: mailbox.gmaib.top URL: https://mailbox.gmaib.top/?gid=z241wr Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 97be42129d51a1deeddc39e6c6e6013a9176d13f4b7e8f9823ae9b5275d095e7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mailbox.gmaib.top/?gid=z241wr Response headers content-encoding gzip cf-cache-status HIT etag "6aec95a17116db1:0" age 6362 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R%2Fl6ylH4RkE%2BHVT2QZe7gg9OaPpUSRHLFdl2o6BQ3Gav1RdiD4Cym8K2EvAptbtJUMBC1EyhpvKqTksXZW7%2B114CrT0dbhrBblSWtE2ANBjhEi5cNFP1u3pXLyu3E0pLVQO2UKq3x2sA4%2BRWucTbWg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=25687&sent=15&recv=13&lost=0&retrans=0&sent_bytes=5236&recv_bytes=5109&delivery_rate=34483&cwnd=12000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=732&x=1", cfHdrFlush;dur=0 date Sun, 10 Nov 2024 04:30:30 GMT content-type application/javascript last-modified Fri, 04 Oct 2024 15:25:23 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ebec99e65b1-FRA x-powered-by ASP.NET server cloudflare
GET H3	200	jquery-3.7.1.min.js Show response mailbox.gmaib.top/assets/js/	85 KB 39 KB	95ms 95ms	Script application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/js/jquery-3.7.1.min.js Requested by Host: mailbox.gmaib.top URL: https://mailbox.gmaib.top/?gid=z241wr Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 99e691fae5e88eb36bafb24758b35f0f990708295f8f2abe2221891e328f776a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mailbox.gmaib.top/?gid=z241wr Response headers content-encoding gzip cf-cache-status HIT etag "ebffaa17116db1:0" age 6362 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5fZwN1XRFZNFZSnCz4EHm0XiRG8ykMpTg1Ax6eJZtl8y4LeU557mHgLms5LJLzkMz7%2Bvbe%2BadGYhAJG5x8xU6i8K2bPUOLpxtXxvpzy8sPJVZLI5ei1j5FKwVm4sICQEjXTAsr8fZFEAUfLnQAyWeg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=25687&sent=25&recv=13&lost=0&retrans=0&sent_bytes=17236&recv_bytes=5109&delivery_rate=34483&cwnd=12000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=732&x=1", cfHdrFlush;dur=21 date Sun, 10 Nov 2024 04:30:30 GMT content-type application/javascript last-modified Fri, 04 Oct 2024 15:25:24 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ebec99f65b1-FRA accept-ranges bytes content-length 38983 x-powered-by ASP.NET server cloudflare
GET H3	200	external_load.js Show response mailbox.gmaib.top/assets/js/	1 KB 2 KB	37ms 35ms	XHR application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/js/external_load.js Requested by Host: mailbox.gmaib.top URL: https://mailbox.gmaib.top/assets/js/jquery-3.7.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 3abb5546ccc29f67b1f50d6e3a381a9224dd4c388b014d4a187794dd2b1a3333 Request headers Referer https://mailbox.gmaib.top/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01 Response headers content-encoding gzip cf-cache-status HIT etag "c59bc5a17116db1:0" age 6360 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zaL%2FaAd%2FaFk2DIu7I9RPvi3wloCeL8qS4GVa5fcRZ7u7neyANwFWOS2zZfoLeB0ZBPKBpEt0D9qeiIql95rt0aOhP0wFD4VplxgrmlFgygHkNIPzhxgvLfq7WIdYaO2QcBntx1eFQFnCwLS0GQM40g%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=20234&sent=131&recv=62&lost=0&retrans=0&sent_bytes=140332&recv_bytes=7624&delivery_rate=2517381&cwnd=84000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=1025&x=1", cfHdrFlush;dur=0 date Sun, 10 Nov 2024 04:30:30 GMT content-type application/javascript last-modified Fri, 04 Oct 2024 15:25:23 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ec09a6e65b1-FRA accept-ranges bytes content-length 882 x-powered-by ASP.NET server cloudflare
GET H3	200	filename.js Show response mailbox.gmaib.top/assets/download/	119 B 889 B	550ms 548ms	Script application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/download/filename.js?v=2024111053030OsBRX Requested by Host: yx.suying1.top URL: https://yx.suying1.top/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash a12f76789b1b1cfdd98acd908f99a55fa2eed6b9f2cf87351387df7c02cb3787 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mailbox.gmaib.top/ Response headers content-encoding gzip cf-cache-status MISS etag "31702bc9dc32db1:0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=alytzEDUKNBPJP%2Bms5heLwbJfm6DscTaKNL0RE%2BZX34mdozfi%2B67Ic3xUy0i6c92LteTjSTGHE5uG5cNoNjNW3apWXOq3JuKk%2FHlGDFoVncTotDy6OVP5F3t38o1pxWq1a9M46HU7jbFTB9taOiACQ%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=20516&sent=264&recv=80&lost=0&retrans=0&sent_bytes=295806&recv_bytes=9391&delivery_rate=34449&cwnd=156000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=1585&x=1", cfHdrFlush;dur=0 date Sun, 10 Nov 2024 04:30:31 GMT content-type application/javascript last-modified Sat, 09 Nov 2024 19:22:58 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ec0ea8c65b1-FRA accept-ranges bytes content-length 229 x-powered-by ASP.NET server cloudflare
GET H3	200	layui.js Show response mailbox.gmaib.top/assets/libs/layui/	348 KB 146 KB	34ms 32ms	XHR application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/libs/layui/layui.js Requested by Host: mailbox.gmaib.top URL: https://mailbox.gmaib.top/assets/js/jquery-3.7.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 38aaec70dc4d8b77e41db78e626b6c51b2b465e502b15b268d9cd028247b97ef Request headers Referer https://mailbox.gmaib.top/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01 Response headers content-encoding gzip cf-cache-status HIT etag "635a65a27116db1:0" age 6358 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iIaPThRK5jpb4Z%2FGIoI8tubhzz0fb5Ri1BQXK%2FbzCUfuty54QPgRk5nJfXz%2F3SmMfie3Ng1BAK8yPEFb6kCT0%2FwRORqi8V1ltc5Y3ZUVtgygT%2FBLO4lORTVatFxoviGu6qcP3d4KZ4eJ10Qd15hjhw%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=20119&sent=134&recv=65&lost=0&retrans=0&sent_bytes=141947&recv_bytes=8367&delivery_rate=35113&cwnd=84000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=1080&x=1", cfHdrFlush;dur=0 date Sun, 10 Nov 2024 04:30:30 GMT content-type application/javascript last-modified Fri, 04 Oct 2024 15:25:24 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ec0ea8e65b1-FRA x-powered-by ASP.NET server cloudflare
GET H3	200	jquery-3.7.1.min.js Show response mailbox.gmaib.top/assets/js/	85 KB 0	0ms 0ms	XHR application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/js/jquery-3.7.1.min.js Requested by Host: mailbox.gmaib.top URL: https://mailbox.gmaib.top/assets/js/jquery-3.7.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 99e691fae5e88eb36bafb24758b35f0f990708295f8f2abe2221891e328f776a Request headers Referer https://mailbox.gmaib.top/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01 Response headers content-encoding gzip cf-cache-status HIT etag "ebffaa17116db1:0" age 6362 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5fZwN1XRFZNFZSnCz4EHm0XiRG8ykMpTg1Ax6eJZtl8y4LeU557mHgLms5LJLzkMz7%2Bvbe%2BadGYhAJG5x8xU6i8K2bPUOLpxtXxvpzy8sPJVZLI5ei1j5FKwVm4sICQEjXTAsr8fZFEAUfLnQAyWeg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=25687&sent=25&recv=13&lost=0&retrans=0&sent_bytes=17236&recv_bytes=5109&delivery_rate=34483&cwnd=12000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=732&x=1", cfHdrFlush;dur=21 date Sun, 10 Nov 2024 04:30:30 GMT content-type application/javascript last-modified Fri, 04 Oct 2024 15:25:24 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ebec99f65b1-FRA accept-ranges bytes content-length 38983 x-powered-by ASP.NET server cloudflare
GET H3	200	main.js Show response mailbox.gmaib.top/assets/js/	1000 B 1 KB	35ms 35ms	XHR application/javascript	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/assets/js/main.js Requested by Host: mailbox.gmaib.top URL: https://mailbox.gmaib.top/assets/js/jquery-3.7.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 70b2752d0860ca47dc479b1ed8e8c37327f49f399559af7a51c117d46cff4043 Request headers Referer https://mailbox.gmaib.top/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01 Response headers content-encoding gzip cf-cache-status HIT etag "4abf29a27116db1:0" age 6356 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hd2akKMZq0vObXFqAQdkqMPzq2wSYhERc%2BmF5EmbX8ctgQKvej9WuqCu5w23SjYXJrepIZttiHMhWGR7udWtWzqminlsoeHed0Z2Ced5Izh5R%2FiYTm4zOsut8XswyyMR2iZlbAR%2FQUL8dRe0DbxgGg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=20357&sent=262&recv=79&lost=0&retrans=0&sent_bytes=294334&recv_bytes=9346&delivery_rate=2191985&cwnd=156000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=1198&x=1", cfHdrFlush;dur=0 date Sun, 10 Nov 2024 04:30:30 GMT content-type application/javascript last-modified Fri, 04 Oct 2024 15:25:24 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ec1aada65b1-FRA accept-ranges bytes content-length 760 x-powered-by ASP.NET server cloudflare
GET H3	200	favicon.ico mailbox.gmaib.top/	5 KB 2 KB	43ms 39ms	Other image/x-icon	2606:4700:3033::6815:1ac9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://mailbox.gmaib.top/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3033::6815:1ac9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mailbox.gmaib.top/ Response headers content-encoding zstd cf-cache-status HIT etag W/"6aaa51a07116db1:0" age 6357 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NCra%2Fd4RqTafioosMy8od0v7si8aCqfpzi68s1M1RgTuel6rgn6zbd490qL1iqxnYj1jKsHsU3%2FF8fPWxpA4pe9KgdcbYzlQgjeqBrqJ0LSFwPrM9QTs%2Be7lzExQdOhdbmRzsUk8%2FgIzo%2BdrgfiyCg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=20588&sent=266&recv=82&lost=0&retrans=0&sent_bytes=296743&recv_bytes=9783&delivery_rate=27268&cwnd=156000&unsent_bytes=0&cid=4a69d9d6eff807e1&ts=1716&x=1", cfHdrFlush;dur=0 date Sun, 10 Nov 2024 04:30:31 GMT content-type image/x-icon last-modified Fri, 04 Oct 2024 15:25:21 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e034ec4ec4c65b1-FRA x-powered-by ASP.NET server cloudflare

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| components string| componentsm function| $ function| jQuery function| generateUniqueId function| makeid object| layui function| lay object| layer function| validateEmail string| filename string| downloadFileName string| downloadLink

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://yx.suying1.top/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)
recommendation	verbose	URL: https://mailbox.gmaib.top/?gid=z241wr Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mailbox.gmaib.top
yx.suying1.top
154.23.182.16
2606:4700:3033::6815:1ac9
38aaec70dc4d8b77e41db78e626b6c51b2b465e502b15b268d9cd028247b97ef
3abb5546ccc29f67b1f50d6e3a381a9224dd4c388b014d4a187794dd2b1a3333
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
70b2752d0860ca47dc479b1ed8e8c37327f49f399559af7a51c117d46cff4043
82ba44c3c7d7e53597ac3458800668192addcb764cdfa02657aa5f812928df7e
97be42129d51a1deeddc39e6c6e6013a9176d13f4b7e8f9823ae9b5275d095e7
99e691fae5e88eb36bafb24758b35f0f990708295f8f2abe2221891e328f776a
a12f76789b1b1cfdd98acd908f99a55fa2eed6b9f2cf87351387df7c02cb3787
a41d3f392a5b57feb073d78b5a4e46d25a40c8be360a1a37d4686255f3e97b02