ecbdedecn.com Open in urlscan Pro
94.100.31.218 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ecbdedecn.com/user126mailJsp.php
Submission: On August 05 via api (August 5th 2017, 9:31:29 pm UTC) from CA

Summary HTTP 23 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 4 domains to perform 23 HTTP transactions. The main IP is 94.100.31.218, located in Netherlands and belongs to SWIFTWAY-AS Netherlands, GB. The main domain is ecbdedecn.com.

This is the only time ecbdedecn.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic China (Online) 163.cn (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	94.100.31.218 94.100.31.218	35017 (SWIFTWAY-...) (SWIFTWAY-AS Netherlands)
14	43.230.90.2 43.230.90.2	135391 (AOFEI-HK ...) (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED)
1	123.125.50.99 123.125.50.99	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
3	123.125.50.97 123.125.50.97	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
3	220.181.12.206 220.181.12.206	23724 (CHINANET-...) (CHINANET-IDC-BJ-AP IDC)
23	6

1 94.100.31.218 (Netherlands)

ASN35017 (SWIFTWAY-AS Netherlands, GB)
PTR: host3.azaronline.com

ecbdedecn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 43.230.90.2 (Hong Kong)

ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
PTR: proxy90-2.mail.163.com

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 123.125.50.99 (Beijing, China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)

ssl.mail.126.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 123.125.50.97 (Beijing, China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)

ir3.mail.126.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
iplocator.mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ir.mail.126.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 220.181.12.206 (Beijing, China)

ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN)
PTR: m12-206.163.com

irpmt.mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	127.net mimg.127.net	122 KB
4	163.com mail.163.com Failed iplocator.mail.163.com irpmt.mail.163.com	299 B
3	126.com ssl.mail.126.com ir3.mail.126.com ir.mail.126.com	3 KB
1	ecbdedecn.com ecbdedecn.com	102 KB
23	4

	Domain	Requested by
14	mimg.127.net	ecbdedecn.com mimg.127.net
3	irpmt.mail.163.com	ecbdedecn.com
1	ir.mail.126.com	mimg.127.net
1	iplocator.mail.163.com	mimg.127.net
1	ir3.mail.126.com	mimg.127.net
1	ssl.mail.126.com	ecbdedecn.com
1	ecbdedecn.com
0	mail.163.com Failed	ecbdedecn.com
23	8

This site contains links to these domains. Also see Links.

Domain
mail.163.com
email.163.com
qiye.163.com
vip.126.com
hw.mail.163.com
help.mail.163.com
help.163.com
r.mail.163.com
reg.163.com
reg.email.163.com
ipad.mail.163.com
smart.mail.163.com
www.163.com
ss.knet.cn
1.163.com
qian.163.com
you.163.com
img2.cache.netease.com
uinfo.mail.163.com

Subject Issuer	Validity	Valid
ssl.mail.163.com GeoTrust SSL CA - G3	`2015-10-15` - `2018-01-30`	2 years	crt.sh
mimg.127.net GeoTrust SSL CA - G3	`2016-08-10` - `2019-08-10`	3 years	crt.sh
*.mail.163.com GeoTrust SSL CA - G3	`2017-05-22` - `2019-08-21`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://ecbdedecn.com/user126mailJsp.php
Frame ID: 29845.1
Requests: 22 HTTP requests in this frame

Frame: http://mail.163.com/preload6.htm
Frame ID: 29845.4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

23
Requests

30 %
HTTPS

0 %
IPv6

4
Domains

8
Subdomains

6
IPs

3
Countries

228 kB
Transfer

263 kB
Size

0
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: http://mail.163.com/html/mail_intro/

Search URL Search Domain Scan URL

URL: http://email.163.com/
Title: 免费邮

Search URL Search Domain Scan URL

URL: http://qiye.163.com/
Title: 企业邮箱

Search URL Search Domain Scan URL

URL: http://vip.126.com/?b09abh1
Title: VIP邮箱

Search URL Search Domain Scan URL

URL: http://hw.mail.163.com/#126
Title: 国外用户登录

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail13
Title: 手机客户端

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/
Title: 帮助

Search URL Search Domain Scan URL

URL: http://help.163.com/special/007528M7/xiaoyi_intd.html
Title: 在线答疑

Search URL Search Domain Scan URL

URL: https://r.mail.163.com/r.jsp?url=https%3A%2F%2F3c.163.com%2Fact%2Foneact%2Fhdframe.do%3Fid%3D166%26from%3Dhuiyuanhuodong1&sign=-195567281&_r_ignore_statId=1_16_136_1276&_r_ignore_uid=nt@126.com

Search URL Search Domain Scan URL

URL: http://mail.163.com/dashi/?from=mail101
Title: 下载邮箱大师

Search URL Search Domain Scan URL

URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail126
Title: 忘记密码了?

Search URL Search Domain Scan URL

URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=126mail
Title: 注册

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail5

Search URL Search Domain Scan URL

URL: http://ipad.mail.163.com/index.htm?dv=ipad
Title: 适配iPad版本

Search URL Search Domain Scan URL

URL: http://smart.mail.163.com/index.htm?dv=smart
Title: 手机智能版

Search URL Search Domain Scan URL

URL: http://r.mail.163.com/r.jsp?url=http%3A%2F%2Fu.163.com%2Fgift%3Ffrom%3Dmail&sign=-783259184&_r_ignore_statId=1_7_43_19&_r_ignore_uid=nt@126.com
Title: 签到就送豪礼！人人有份！

Search URL Search Domain Scan URL

URL: https://r.mail.163.com/r.jsp?url=http%3A%2F%2Fyou.163.com%2Fact%2Fpub%2FAPEBTdjXIB.html%3Ffrom%3Dweb_gg_mail_dlywz_0&sign=-1933007724&_r_ignore_statId=1_7_117_148&_r_ignore_uid=nt@126.com
Title: 10款科技爆品限时买1送1！

Search URL Search Domain Scan URL

URL: http://www.163.com/

Search URL Search Domain Scan URL

URL: https://ss.knet.cn/verifyseal.dll?sn=e12052344010022026301459&ct=df&pa=343068
Title:

Search URL Search Domain Scan URL

URL: http://mail.163.com/html/mail_intro
Title: 关于网易免费邮

Search URL Search Domain Scan URL

URL: http://1.163.com/
Title: 一元夺宝

Search URL Search Domain Scan URL

URL: http://qian.163.com/
Title: 网易�有钱

Search URL Search Domain Scan URL

URL: http://you.163.com/
Title: 网易严选

Search URL Search Domain Scan URL

URL: http://img2.cache.netease.com/www/icp.jpg
Title: ICP证粤B2-20090191

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/feedback.do?m=add&categoryName=%e7%99%bb%e5%bd%95
Title: 意见反馈>>

Search URL Search Domain Scan URL

URL: http://uinfo.mail.163.com/cgi-bin/hseed/two.pl

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request user126mailJsp.php Show response ecbdedecn.com/	102 KB 102 KB	129ms 113ms	Document text/html	94.100.31.218 SWIFTWAY-AS Nethe...
General Check archive.org Show headers Download Go to Full URL http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 94.100.31.218 , Netherlands, ASN35017 (SWIFTWAY-AS Netherlands, GB), Reverse DNS host3.azaronline.com Software Apache / Resource Hash `80a117080f43baee86f60d16887914cbb6ec7d594de42a292506710c841c2dbb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=90 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	base_v5.min.js Show response mimg.127.net/index/lib/scripts/	17 KB 6 KB	891ms 244ms	Script application/x-javascript	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Full URL http://mimg.127.net/index/lib/scripts/base_v5.min.js Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `66f7395da705f823eb253cb60f2ae419ae3a77b1901cad9e035a3e5639023243` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Content-Encoding gzip Last-Modified Thu, 28 Apr 2016 03:04:49 GMT Server nginx Vary Accept-Encoding X-Cache HIT from HKGM Content-Type application/x-javascript Cache-Control max-age=3600 Transfer-Encoding chunked Connection keep-alive Expires Sat, 05 Aug 2017 22:13:26 GMT
GET H/1.1	200 OK	126logo.gif mimg.127.net/logo/	6 KB 6 KB	241ms 240ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/126logo.gif Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Tue, 10 Feb 2009 07:01:48 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 6593 Expires Sat, 05 Aug 2017 21:43:58 GMT
GET H/1.1	200 OK	t.gif mimg.127.net/index/lib/img/	77 B 77 B	243ms 242ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/t.gif Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 19 Nov 2014 08:43:00 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 77 Expires Sat, 05 Aug 2017 22:23:35 GMT
GET H/1.1	200 OK	loading_s.gif mimg.127.net/index/lib/img/	578 B 578 B	221ms 220ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/loading_s.gif Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 19 Nov 2014 08:43:00 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 578 Expires Sat, 05 Aug 2017 21:31:20 GMT
GET H/1.1	200 OK	netease_logo.gif mimg.127.net/logo/	1 KB 1 KB	477ms 240ms	Image image/gif	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/netease_logo.gif Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 01 Dec 2010 02:06:41 GMT Server nginx X-Cache HIT from HKGM Content-Type image/gif Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 1260 Expires Sat, 05 Aug 2017 21:43:37 GMT
GET H/1.1	200 OK	knet.png mimg.127.net/logo/	5 KB 5 KB	483ms 240ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/logo/knet.png Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 16 May 2012 09:47:58 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 4611 Expires Sat, 05 Aug 2017 21:45:10 GMT
GET H/1.1	200 OK	year.js Show response mimg.127.net/copyright/	23 B 23 B	853ms 246ms	Script application/x-javascript	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Full URL http://mimg.127.net/copyright/year.js Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `e8d520daeac47000a5c92c5147bc1711e0aea45cb1d6f85e7330f3a6e90a4e4f` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Sat, 31 Dec 2016 16:12:49 GMT Server nginx X-Cache HIT from HKGM Content-Type application/x-javascript Cache-Control max-age=14910973 Connection keep-alive Accept-Ranges bytes Content-Length 23 Expires Sun, 31 Dec 2017 16:12:49 GMT
GET H/1.1	200 OK	httpsEnable.gif ssl.mail.126.com/	43 B 43 B	1362ms 249ms	Image image/gif	123.125.50.99 CHINA169-BJ China...
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.mail.126.com/httpsEnable.gif Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_CBC Server 123.125.50.99 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN), Reverse DNS Software nginx / Resource Hash `4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:17 GMT Last-Modified Mon, 13 Aug 2012 07:05:51 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 43 Content-Type image/gif
GET H/1.1	200 OK	bg_v3.png mimg.127.net/index/126/img/2013/	10 KB 10 KB	483ms 241ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/126/img/2013/bg_v3.png Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `6c9e4b43a1a10a8d1384743318e115c60812bbfb2e0f314c1ead27930c2c7a74` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 06 Aug 2014 08:37:50 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 10446 Expires Sat, 05 Aug 2017 21:43:31 GMT
GET H/1.1	200 OK	login_v4.png mimg.127.net/index/126/img/2013/	3 KB 3 KB	443ms 231ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/126/img/2013/login_v4.png Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `753ac75f62579e480917b777de2565909be29687d31711671eb5fa4034a642d8` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 17 Dec 2014 03:21:56 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 2754 Expires Sat, 05 Aug 2017 21:49:19 GMT
GET H/1.1	200 OK	icon_code.png mimg.127.net/index/lib/img/	230 B 230 B	444ms 233ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/icon_code.png Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Tue, 23 Dec 2014 07:47:23 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 230 Expires Sat, 05 Aug 2017 21:43:37 GMT
GET H/1.1	200 OK	mailapp_logo_141212.png mimg.127.net/index/lib/img/	2 KB 2 KB	421ms 221ms	Image image/png	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/mailapp_logo_141212.png Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:15 GMT Last-Modified Wed, 23 Mar 2016 09:26:25 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 2111 Expires Sat, 05 Aug 2017 21:44:55 GMT
GET		preload6.htm mail.163.com/ Frame 2984	0 0

GET H/1.1	200 OK	get.do Show response ir3.mail.126.com/	25 KB 3 KB	1009ms 253ms	Script application/json	123.125.50.97 CHINA169-BJ China...
General Check archive.org Show headers Download Go to Full URL http://ir3.mail.126.com/get.do?prod=wmail_lbp&ver=1&uid=nt@126.com&domain=126.com&mobUser=0&callback=themeHandler.callback&rnd=0.6622908665842016 Requested by Host: mimg.127.net URL: http://mimg.127.net/index/lib/scripts/base_v5.min.js Protocol HTTP/1.1 Server 123.125.50.97 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN), Reverse DNS Software nginx / Resource Hash `0ac6328f99bbe593e13047b49ff8afe500f8bb1ffcae1840870a5b9e41fe91de` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:19 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding X-Cache from ngx209-24.163.com Content-Type application/json;charset=utf-8 Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	iplocator Show response iplocator.mail.163.com/	152 B 152 B	723ms 252ms	Script text/plain	123.125.50.97 CHINA169-BJ China...
General Check archive.org Show headers Download Go to Full URL http://iplocator.mail.163.com/iplocator?callback=fGetLocator Requested by Host: mimg.127.net URL: http://mimg.127.net/index/lib/scripts/base_v5.min.js Protocol HTTP/1.1 Server 123.125.50.97 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN), Reverse DNS Software nginx / Resource Hash `c7a3b7594267b1c7b16aefe35ccc900c4055000c5a6659bbd898b1e28e7eeaea` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:19 GMT Server nginx Connection keep-alive Content-Length 152 X-Cache from ngx209-35.163.com Content-Type text/plain;charset=UTF-8
GET H/1.1	200 OK	get.do Show response ir.mail.126.com/	782 B 782 B	841ms 252ms	Script application/json	123.125.50.97 CHINA169-BJ China...
General Check archive.org Show headers Download Go to Full URL http://ir.mail.126.com/get.do?uid=nt@126.com&domain=126.com&ver=4&ph=-1&callback=loginExtAD.callback&rnd=0.9915633594748308 Requested by Host: mimg.127.net URL: http://mimg.127.net/index/lib/scripts/base_v5.min.js Protocol HTTP/1.1 Server 123.125.50.97 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN), Reverse DNS Software nginx / Resource Hash `10bdd82d0432a2ab79f1d93f30a16f7b7a4c2f692c01226dd305b7e9d9a5687e` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:19 GMT Server nginx Connection keep-alive Content-Length 782 X-Cache from ngx209-28.163.com Content-Type application/json;charset=utf-8
GET H/1.1	200 OK	bLoginTpl.js Show response mimg.127.net/m/ir/8/	3 KB 1 KB	240ms 240ms	Script application/x-javascript	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Full URL https://mimg.127.net/m/ir/8/bLoginTpl.js Requested by Host: mimg.127.net URL: http://mimg.127.net/index/lib/scripts/base_v5.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `f3e1cb84d3ffd4259c5a06e4b5ce70e69dfe607945f75cc5c09d2bff88f34653` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:19 GMT Content-Encoding gzip Last-Modified Tue, 20 Sep 2016 01:40:56 GMT Server nginx Vary Accept-Encoding X-Cache HIT from HKGM Content-Type application/x-javascript Cache-Control max-age=3600 Transfer-Encoding chunked Connection keep-alive Expires Sat, 05 Aug 2017 22:02:14 GMT
GET H/1.1	200 OK	stat.gif irpmt.mail.163.com/ir/	49 B 49 B	882ms 175ms	Image image/gif	220.181.12.206 CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Show image Full URL https://irpmt.mail.163.com/ir/stat.gif?statId=1_16_136_1276&uid=nt@126.com&rnd=0.9390395894751566 Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_CBC Server 220.181.12.206 Beijing, China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS m12-206.163.com Software nginx / Resource Hash `93db6ff0af01c1416a4cf5643fa970e6facf75aa2c38a66404085039c2314e33` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:20 GMT Last-Modified Mon, 04 Nov 2013 07:00:10 GMT Server nginx ETag "527745fa-31" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 49
GET H/1.1	200 OK	promPic.jpg mimg.127.net/m/lc/img/LoginBackgroundPic/1276/4/	83 KB 83 KB	477ms 477ms	Image image/jpeg	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL https://mimg.127.net/m/lc/img/LoginBackgroundPic/1276/4/promPic.jpg Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `0f416ccf6fde638eddce52b28b642ec4c4baf0e6279518af5ac478056a813329` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:19 GMT Last-Modified Mon, 31 Jul 2017 07:59:27 GMT Server nginx X-Cache HIT from HKGM Content-Type image/jpeg Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 85327 Expires Sat, 05 Aug 2017 22:20:57 GMT
GET H/1.1	200 OK	bgPic.jpg mimg.127.net/m/lc/img/LoginBackgroundPic/1276/2/	3 KB 3 KB	281ms 240ms	Image image/jpeg	43.230.90.2 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL https://mimg.127.net/m/lc/img/LoginBackgroundPic/1276/2/bgPic.jpg Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS proxy90-2.mail.163.com Software nginx / Resource Hash `0b2142f0225ef0fa0ad38d4f414ce2417d4b89e3f16073fcdfa8d3b86832aa29` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:19 GMT Last-Modified Mon, 31 Jul 2017 07:59:27 GMT Server nginx X-Cache HIT from HKGM Content-Type image/jpeg Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 3023 Expires Sat, 05 Aug 2017 22:20:49 GMT
GET H/1.1	200 OK	stat.gif irpmt.mail.163.com/ir/	49 B 49 B	822ms 176ms	Image image/gif	220.181.12.206 CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Show image Full URL https://irpmt.mail.163.com/ir/stat.gif?statId=1_7_43_19&rnd=1501968679610&uid=nt@126.com Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_CBC Server 220.181.12.206 Beijing, China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS m12-206.163.com Software nginx / Resource Hash `93db6ff0af01c1416a4cf5643fa970e6facf75aa2c38a66404085039c2314e33` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:20 GMT Last-Modified Mon, 04 Nov 2013 07:00:10 GMT Server nginx ETag "527745fa-31" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 49
GET H/1.1	200 OK	stat.gif irpmt.mail.163.com/ir/	49 B 49 B	823ms 177ms	Image image/gif	220.181.12.206 CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Show image Full URL https://irpmt.mail.163.com/ir/stat.gif?statId=1_7_117_148&rnd=1501968679610&uid=nt@126.com Requested by Host: ecbdedecn.com URL: http://ecbdedecn.com/user126mailJsp.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_CBC Server 220.181.12.206 Beijing, China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS m12-206.163.com Software nginx / Resource Hash `93db6ff0af01c1416a4cf5643fa970e6facf75aa2c38a66404085039c2314e33` Request headers Referer http://ecbdedecn.com/user126mailJsp.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Sat, 05 Aug 2017 21:31:20 GMT Last-Modified Mon, 04 Nov 2013 07:00:10 GMT Server nginx ETag "527745fa-31" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 49

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mail.163.com
URL: http://mail.163.com/preload6.htm

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic China (Online) 163.cn (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ecbdedecn.com
iplocator.mail.163.com
ir.mail.126.com
ir3.mail.126.com
irpmt.mail.163.com
mail.163.com
mimg.127.net
ssl.mail.126.com
mail.163.com
123.125.50.97
123.125.50.99
220.181.12.206
43.230.90.2
94.100.31.218
065f86db73775341c54048befea1dbd24e6013780ce06db950cee6e5908463be
0ac6328f99bbe593e13047b49ff8afe500f8bb1ffcae1840870a5b9e41fe91de
0b2142f0225ef0fa0ad38d4f414ce2417d4b89e3f16073fcdfa8d3b86832aa29
0f416ccf6fde638eddce52b28b642ec4c4baf0e6279518af5ac478056a813329
10bdd82d0432a2ab79f1d93f30a16f7b7a4c2f692c01226dd305b7e9d9a5687e
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5
4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
66f7395da705f823eb253cb60f2ae419ae3a77b1901cad9e035a3e5639023243
6c9e4b43a1a10a8d1384743318e115c60812bbfb2e0f314c1ead27930c2c7a74
753ac75f62579e480917b777de2565909be29687d31711671eb5fa4034a642d8
80a117080f43baee86f60d16887914cbb6ec7d594de42a292506710c841c2dbb
93db6ff0af01c1416a4cf5643fa970e6facf75aa2c38a66404085039c2314e33
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
c7a3b7594267b1c7b16aefe35ccc900c4055000c5a6659bbd898b1e28e7eeaea
d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419
d89a3449505416c5c98e43f5b1db73d56a3fd4e7eea48e047d028e87857d7236
e8d520daeac47000a5c92c5147bc1711e0aea45cb1d6f85e7330f3a6e90a4e4f
f3e1cb84d3ffd4259c5a06e4b5ce70e69dfe607945f75cc5c09d2bff88f34653

ecbdedecn.com Open in urlscan Pro 94.100.31.218 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

23 Requests

30 %HTTPS

0 %IPv6

4 Domains

8 Subdomains

6 IPs

3 Countries

228 kBTransfer

263 kBSize

0 Cookies

26 Outgoing links

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

ecbdedecn.com Open in urlscan Pro
94.100.31.218 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

30 %
HTTPS

0 %
IPv6

4
Domains

8
Subdomains

6
IPs

3
Countries

228 kB
Transfer

263 kB
Size

0
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!