www.line-me-skyminsh-ks.cn
Open in
urlscan Pro
202.168.149.123
Malicious Activity!
Public Scan
Submission: On September 25 via automatic, source phishtank
Summary
TLS certificate: Issued by TrustAsia TLS RSA CA on September 21st 2018. Valid for: a year.
This is the only time www.line-me-skyminsh-ks.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Line (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 202.168.149.123 202.168.149.123 | 135544 (VTL-AS-AP...) (VTL-AS-AP Vanta Telecommunications Limited) | |
2 | 206.222.9.37 206.222.9.37 | 10297 (ENET-2) (ENET-2 - eNET Inc.) | |
1 | 206.222.9.34 206.222.9.34 | 10297 (ENET-2) (ENET-2 - eNET Inc.) | |
10 | 3 |
ASN135544 (VTL-AS-AP Vanta Telecommunications Limited, HK)
www.line-me-skyminsh-ks.cn |
ASN10297 (ENET-2 - eNET Inc., US)
PTR: 25.9.de.static.xlhost.com
web.chat4support.com |
ASN10297 (ENET-2 - eNET Inc., US)
PTR: 22.9.de.static.xlhost.com
srv.chat4support.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
line-me-skyminsh-ks.cn
www.line-me-skyminsh-ks.cn |
107 KB |
3 |
chat4support.com
web.chat4support.com srv.chat4support.com |
11 KB |
10 | 2 |
Domain | Requested by | |
---|---|---|
7 | www.line-me-skyminsh-ks.cn |
www.line-me-skyminsh-ks.cn
|
2 | web.chat4support.com |
www.line-me-skyminsh-ks.cn
web.chat4support.com |
1 | srv.chat4support.com |
web.chat4support.com
|
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
line-me-skyminsh-ks.cn TrustAsia TLS RSA CA |
2018-09-21 - 2019-09-21 |
a year | crt.sh |
web.chat4support.com Trustico RSA DV CA |
2018-03-01 - 2018-11-11 |
8 months | crt.sh |
srv.chat4support.com Trustico RSA DV CA |
2018-03-01 - 2018-10-12 |
7 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.line-me-skyminsh-ks.cn/Default/entry/sign/cvrtxs@gbSO93hid/Hfrom/vbss-h5c
Frame ID: EC7FE9228B5AE40E66B883105F77D3A8
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- headers server /IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
vbss-h5c
www.line-me-skyminsh-ks.cn/Default/entry/sign/cvrtxs@gbSO93hid/Hfrom/ |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
normalize.css
www.line-me-skyminsh-ks.cn/Static/css/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
swiper.min.css
www.line-me-skyminsh-ks.cn/Static/css/ |
19 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.line-me-skyminsh-ks.cn/Static/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image01.jpg
www.line-me-skyminsh-ks.cn/Static/images/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
www.line-me-skyminsh-ks.cn/Static/js/ |
85 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
swiper.min.js
www.line-me-skyminsh-ks.cn/Static/js/ |
118 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner.aspx
web.chat4support.com/weboperator/Operator/ |
970 B 1 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner.js
web.chat4support.com/weboperator/operator/js/ |
52 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
visit.asp
srv.chat4support.com/ |
374 B 574 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Line (Online)97 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Swiper string| _C4imgOn string| _C4imgOff string| _C4imgTop string| _C4imgMid string| _C4imgBottom number| _C4sid string| _C4sTag number| _C4style number| _C4online number| _C4nFloat number| _C4nInvite number| _C4nMode number| _C4nPos number| _C4nPosX number| _C4nPosY string| _C4HomePage string| _C4srvURL string| _C4webSrvUrl string| _C4Custom string| _C4SiteName string| _C4Language number| _C4ChatList string| _C4wid string| _C4v2cname string| _C4vCallUrl string| _C4ServiceTitle string| _C4ServiceContact string| _C4ServiceMessage number| _C4RefreshSecound number| _C4RefreshTry number| _C4RefreshDelay function| UrlDecode function| _C4initServiceLang function| closebtn function| HideBtnClose function| _C4helpDlg function| _C4InitInvite boolean| _C4Obj boolean| _C4IsDrag undefined| _C4DiffY undefined| _C4DiffX undefined| _C4DragObj function| _C4moveMouse function| _C4initDrag number| C4lastHScrollX number| C4lastHScrollY function| _C4InitHelp function| myBrowser number| C4lastScrollX number| C4lastScrollY function| _C4midPosition string| _C4oImg string| _C4img boolean| _C4Online string| _C4msg string| _C4operId string| _C4operName string| _C4Welcome number| _C4bCancel string| _C4vId boolean| _C4visited string| _C4vCountry string| _C4vCity string| _C4vOS string| _C4vBrowser string| _C4vKeyword boolean| _C4vKeywordMatch object| _C4newWindow object| _C4DeptList object| _C4OperList number| _C4isDemo function| _C4imgSrc function| _C4chat function| _C4cancelinvite function| _C4getTime number| _C4isUpdate function| _C4checkSite function| _C4update function| _C4initServiceList function| _C4chatDept function| _C4SortOperList function| _C4existDept function| _C4onlineDept function| _C4PutScript function| _C4initInviteLang function| C4S_GetVisitPage function| C4S_GetColor function| C4S_GetPageTitle function| C4S_GetReferrer function| C4S_GetTimeZone function| C4S_GetCookie function| C4S_getCookieVal function| C4S_GetVid function| C4S_SetCookie2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.line-me-skyminsh-ks.cn/ | Name: ASP.NET_SessionId Value: yx3tdnnrer3kke4pn410kjh0 |
|
www.line-me-skyminsh-ks.cn/Default/entry/sign/cvrtxs@gbSO93hid/Hfrom | Name: _C4vId Value: CA7941XY821K3YIF19K0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
srv.chat4support.com
web.chat4support.com
www.line-me-skyminsh-ks.cn
202.168.149.123
206.222.9.34
206.222.9.37
026ffd1a8ec6d99798569753a4f4e68af8f43d5e996a7e89a5095ed2236f2eb4
34200a216f42b734a9723a5367645bb517c31e036b42e2bf6a480c62880fc12c
43a350d405343afca68ac4fda7a3a82d2eb977c7449814816ab004020313aa33
531c503a592bcebbf1bdc25cefef01e7302ec89e350c3741052d8ad69749e89f
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a923191133a02286fd61e675ac601bfcf3576f6f38ec1d165c376da69b953692
b2687519fb85a19156f05c47696d7b05397ea1c5f7fd19c2e63912478c47cdec
c736eabcdadc2093a371e6eca74e49671352a39d417f8d0e29fe4a973d158e2c
fcc52c6f1315aa55dbc6d62c55437b49cadbabc1dde54a7e067b599764ee30b4
fefe1871a83ead7d98a00c4856096c933c0a64883900da21a0317b2a427537fd