urlscan.io logo urlscan.io
SecurityTrails logo

dreammas.com.ng Open in urlscan Pro
164.160.129.137  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://dreammas.com.ng/ss/163_126/latest126/
Effective URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a9199990...
Submission Tags: @ipnigh
Submission: On November 02 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 20 HTTP transactions. The main IP is 164.160.129.137, located in Nigeria and belongs to Garanntor-Hosting-AS, NG. The main domain is dreammas.com.ng.
This is the only time dreammas.com.ng was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic China (Online) 163.cn (Online)

Domain & IP information

IP Address AS Autonomous System
1 3 164.160.129.137 328110 (Garanntor...)
14 103.129.252.34 137263 (NETEASE-A...)
20 3
Apex Domain
Subdomains		 Transfer
13 127.net
mimg.127.net
200 KB
3 dreammas.com.ng
dreammas.com.ng
113 KB
1 163.com
mail.163.com
iplocator.mail.163.com Failed
0 126.com Failed
ssl.mail.126.com Failed
ir3.mail.126.com Failed
ir.mail.126.com Failed
20 4
Domain Requested by
13 mimg.127.net dreammas.com.ng
3 dreammas.com.ng 1 redirects dreammas.com.ng
1 mail.163.com dreammas.com.ng
0 ir.mail.126.com Failed dreammas.com.ng
0 iplocator.mail.163.com Failed dreammas.com.ng
0 ir3.mail.126.com Failed dreammas.com.ng
0 ssl.mail.126.com Failed dreammas.com.ng
20 7

This site contains links to these domains. Also see Links.

Domain
mail.163.com
1.163.com
ss.knet.cn
Subject Issuer Validity Valid

This page contains 2 frames:

Primary Page: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Frame ID: FFB63912B74723248313AD3C88DC1B08
Requests: 19 HTTP requests in this frame

Frame: http://mail.163.com/preload6.htm
Frame ID: AC07F28A6BA6CF615AA0D7ED1EDFEF4B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://dreammas.com.ng/ss/163_126/latest126/ HTTP 302
    http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e59... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

20
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

7
Subdomains

3
IPs

2
Countries

313 kB
Transfer

307 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://dreammas.com.ng/ss/163_126/latest126/ HTTP 302
    http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1fef5b6155b279a6ce88715b18bc.php
dreammas.com.ng/ss/163_126/latest126/
Redirect Chain
  • http://dreammas.com.ng/ss/163_126/latest126/
  • http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv00...
90 KB
91 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
164.160.129.137 , Nigeria, ASN328110 (Garanntor-Hosting-AS, NG),
Reverse DNS
Software
Apache /
Resource Hash
673828f411721df981552d50fac873a9093515447c147f77aae690ae2cf28689

Request headers

Host
dreammas.com.ng
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:28 GMT
Server
Apache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Sat, 02 Nov 2019 00:20:28 GMT
Server
Apache
Location
1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
base_v5.min.js
dreammas.com.ng/ss/163_126/latest126/ 		22 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://dreammas.com.ng/ss/163_126/latest126/base_v5.min.js
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
164.160.129.137 , Nigeria, ASN328110 (Garanntor-Hosting-AS, NG),
Reverse DNS
Software
Apache /
Resource Hash
3253a3f8d53517f626af8adb363e47359952f319412745ffb1478e1e75caef83

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:28 GMT
Last-Modified
Mon, 02 Jan 2017 09:15:40 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
22376
126logo.gif
mimg.127.net/logo/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/logo/126logo.gif
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:28 GMT
Last-Modified
Tue, 10 Feb 2009 07:01:48 GMT
Server
nginx
ETag
"4991265c-19c1"
X-Cache
HIT from HKGM
Content-Type
image/gif
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6593
Expires
Sat, 02 Nov 2019 01:13:19 GMT
t.gif
mimg.127.net/index/lib/img/ 		77 B
473 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/lib/img/t.gif
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:28 GMT
Last-Modified
Wed, 19 Nov 2014 08:43:00 GMT
Server
nginx
ETag
"546c5814-4d"
X-Cache
HIT from HKGM
Content-Type
image/gif
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
77
Expires
Sat, 02 Nov 2019 01:09:33 GMT
loading_s.gif
mimg.127.net/index/lib/img/ 		578 B
976 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/lib/img/loading_s.gif
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 19 Nov 2014 08:43:00 GMT
Server
nginx
ETag
"546c5814-242"
X-Cache
HIT from HKGM
Content-Type
image/gif
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
578
Expires
Sat, 02 Nov 2019 00:47:31 GMT
netease_logo.gif
mimg.127.net/logo/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/logo/netease_logo.gif
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 01 Dec 2010 02:06:41 GMT
Server
nginx
ETag
"4cf5adb1-4ec"
X-Cache
HIT from HKGM
Content-Type
image/gif
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1260
Expires
Sat, 02 Nov 2019 00:58:12 GMT
knet.png
mimg.127.net/logo/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/logo/knet.png
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 16 May 2012 09:47:58 GMT
Server
nginx
ETag
"4fb377ce-1203"
X-Cache
HIT from HKGM
Content-Type
image/png
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4611
Expires
Sat, 02 Nov 2019 00:30:11 GMT
year.js
mimg.127.net/copyright/ 		23 B
438 B 		Script
General
Check archive.org
Download Go to
Full URL
http://mimg.127.net/copyright/year.js
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
098ec9249cb3e97872e1862b4400b9db4c6622a4d089b64b752ffc73b3ef7a30

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 12 Jun 2019 10:49:21 GMT
Server
nginx
ETag
"5d00d8b1-17"
X-Cache
HIT from HKGM
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=29209901
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
23
Expires
Thu, 11 Jun 2020 10:49:21 GMT
httpsEnable.gif
ssl.mail.126.com/ 		0
0
bg_v3.png
mimg.127.net/index/126/img/2013/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/126/img/2013/bg_v3.png
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
6c9e4b43a1a10a8d1384743318e115c60812bbfb2e0f314c1ead27930c2c7a74

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 06 Aug 2014 08:37:50 GMT
Server
nginx
ETag
"53e1e95e-28ce"
X-Cache
HIT from HKGM
Content-Type
image/png
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10446
Expires
Sat, 02 Nov 2019 01:09:33 GMT
login_v4.png
mimg.127.net/index/126/img/2013/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/126/img/2013/login_v4.png
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
753ac75f62579e480917b777de2565909be29687d31711671eb5fa4034a642d8

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 17 Dec 2014 03:21:56 GMT
Server
nginx
ETag
"5490f6d4-ac2"
X-Cache
EXPIRED from HKGM
Content-Type
image/png
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2754
Expires
Sat, 02 Nov 2019 01:20:29 GMT
icon_code.png
mimg.127.net/index/lib/img/ 		230 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/lib/img/icon_code.png
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Tue, 23 Dec 2014 07:47:23 GMT
Server
nginx
ETag
"54991e0b-e6"
X-Cache
HIT from HKGM
Content-Type
image/png
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
230
Expires
Sat, 02 Nov 2019 00:54:07 GMT
mailapp_logo_141212.png
mimg.127.net/index/lib/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/lib/img/mailapp_logo_141212.png
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:29 GMT
Last-Modified
Wed, 23 Mar 2016 09:26:25 GMT
Server
nginx
ETag
"56f26141-83f"
X-Cache
HIT from HKGM
Content-Type
image/png
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2111
Expires
Sat, 02 Nov 2019 01:20:24 GMT
preload6.htm
mail.163.com/ Frame AC07 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
http://mail.163.com/preload6.htm
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Host
mail.163.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc

Response headers

Server
nginx
Date
Sat, 02 Nov 2019 00:20:29 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding Accept-Encoding Accept-Encoding
Last-Modified
Tue, 29 Oct 2019 13:03:51 GMT
ETag
W/"5db838b7-35fb"
Expires
Sat, 02 Nov 2019 01:02:55 GMT
Cache-Control
max-age=3600
X-Cache
from HKGM
Content-Encoding
gzip
error_bg.png
mimg.127.net/index/126/img/2013/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/126/img/2013/error_bg.png
Requested by
Host: dreammas.com.ng
URL: http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
7c538ed7c5803c01e5ebc25a3597472724d509a0874ceda1b0a2700c3bb40b62

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:41 GMT
Last-Modified
Wed, 09 Oct 2013 09:32:29 GMT
Server
nginx
ETag
"525522ad-b94"
X-Cache
HIT from HKGM
Content-Type
image/png
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2964
Expires
Sat, 02 Nov 2019 00:21:59 GMT
get.do
ir3.mail.126.com/ 		0
0
iplocator
iplocator.mail.163.com/ 		0
0
get.do
ir.mail.126.com/ 		0
0
140919_mailapp_cnt.jpg
mimg.127.net/index/163/themes/ 		82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/163/themes/140919_mailapp_cnt.jpg
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
a3274f74ee9d2bae61e8b85aeb6ef59f5a5fbe915252aeb856f5d872f94bfbad

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:44 GMT
Last-Modified
Fri, 19 Sep 2014 09:33:49 GMT
Server
nginx
ETag
"541bf87d-14818"
X-Cache
HIT from HKGM
Content-Type
image/jpeg
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
83992
Expires
Sat, 02 Nov 2019 01:09:37 GMT
140919_mailapp_cnt.jpg
mimg.127.net/index/163/themes/ 		82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/index/163/themes/140919_mailapp_cnt.jpg
Protocol
HTTP/1.1
Server
103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
a3274f74ee9d2bae61e8b85aeb6ef59f5a5fbe915252aeb856f5d872f94bfbad

Request headers

Referer
http://dreammas.com.ng/ss/163_126/latest126/1fef5b6155b279a6ce88715b18bc.php?sam=77Inboxaspxn1d8e5917bddd6a5ad5a919999087&Id1d8e5917bddd6a5ad5a919999087&doc007ae74f75cd3f5de57cffe2a5c6&email=&jiv007ae74f75cd3f5de57cffe2a5c6&xls1d&id=fav&doc
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date
Sat, 02 Nov 2019 00:20:45 GMT
Last-Modified
Fri, 19 Sep 2014 09:33:49 GMT
Server
nginx
ETag
"541bf87d-14818"
X-Cache
HIT from HKGM
Content-Type
image/jpeg
Access-Control-Allow-Origin
*.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
83992
Expires
Sat, 02 Nov 2019 01:09:37 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ssl.mail.126.com
URL
https://ssl.mail.126.com/httpsEnable.gif
Domain
ir3.mail.126.com
URL
http://ir3.mail.126.com/get.do?prod=wmail_lbp&ver=1&uid=nt@126.com&domain=126.com&mobUser=0&callback=themeHandler.callback&rnd=0.15864159107334963
Domain
iplocator.mail.163.com
URL
http://iplocator.mail.163.com/iplocator?callback=fGetLocator
Domain
ir.mail.126.com
URL
http://ir.mail.126.com/get.do?uid=nt@126.com&domain=126.com&ver=4&ph=-1&callback=loginExtAD.callback&rnd=0.9832040166331952

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic China (Online) 163.cn (Online)

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| gOption function| fCheckLoginNow function| fCheckAutoLogin function| fAutoLogin undefined| gbForcepc object| oAndroidRedirect function| fCheckBrowser function| fHtml5Tag function| fCheckCookie function| fGetQuery function| fGetQueryHash function| $id function| fTrim function| fParseMNum function| fCheckAccount function| fGetScript function| fGetCookie function| fSetCookie function| fEventListen function| fEventUnlisten function| fRandom function| fUrlP function| fResize function| fJSONP function| fFQ function| fStartTime object| gUserInfo object| gVisitorCookie undefined| gMobileNumMailIsForbidden undefined| gMobileNumMailResult object| gMobileNumMail function| fEnData function| loginRequest function| getRnd undefined| DOMContentLoaded function| DOMREADY string| base64EncodeChars function| base64encode function| utf16to8 function| fGetLocator function| CapsLock function| MobCallback boolean| bGettingAlgorithm object| loginExtAD undefined| gAdUserPropertyData object| gAdResData object| gErrorInfo object| oStyle function| fCls object| aSpdResult object| aSpdStartTime object| aSpdEndTime object| aSpdTmpTime object| aSpdQueue boolean| bSpdAuto string| sLocationInfo function| fSpeedTestPre function| fSpeedTest function| fSpd function| fLocationDot object| aLocationDot function| fSelectLoaction function| fSpdUserInit function| fLocationChoose function| fSetLocation function| fNetErrDebug object| indexLogin object| themeHandler object| gAdTemplate_lbp boolean| bHTTPSDisabled number| oIntervalCheckInputAlways boolean| bImgLoaderIsLoaded

0 Cookies