www.lztxdy.com Open in urlscan Pro
240e:83:205:89:0:ff:b07e:389f Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.lztxdy.com/intern/aboutus.php
Submission: On June 30 via automatic, source openphish (June 30th 2021, 1:54:20 am UTC)

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 240e:83:205:89:0:ff:b07e:389f, located in China and belongs to CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN. The main domain is www.lztxdy.com.

This is the only time www.lztxdy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
7	240e:83:205:8... 240e:83:205:89:0:ff:b07e:389f		23724 (CHINANET-...) (CHINANET-IDC-BJ-AP IDC)
7	1

7 240e:83:205:89:0:ff:b07e:389f (China)

ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN)

www.lztxdy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	lztxdy.com www.lztxdy.com	145 KB
7	1

	Domain	Requested by
7	www.lztxdy.com	www.lztxdy.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.lztxdy.com/intern/aboutus.php
Frame ID: 21F9E689592BD8CD74A38754D92D98E2
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

7
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

145 kB
Transfer

150 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set aboutus.php Show response www.lztxdy.com/intern/	6 KB 2 KB	575ms 291ms	Document text/html	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Full URL http://www.lztxdy.com/intern/aboutus.php Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `57b88fae9e3d803086b5b66cf680693620de415b5f0134a91352e53a34586da8` Request headers Host www.lztxdy.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server openresty Date Wed, 30 Jun 2021 01:53:49 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Content-Encoding gzip Set-Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7; expires=Thu, 30-Jun-22 01:53:49 GMT; max-age=31536000; path=/; version=1
GET H/1.1	200 OK	style.css www.lztxdy.com/intern/css/	4 KB 1 KB	289ms 288ms	Stylesheet text/css	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Full URL http://www.lztxdy.com/intern/css/style.css Requested by Host: www.lztxdy.com URL: http://www.lztxdy.com/intern/aboutus.php Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `bce08cc241535933cea32e6ad07a17e78cd1977e1ff81acc8441e6c07b5607f1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.lztxdy.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.lztxdy.com/intern/aboutus.php Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7 Connection keep-alive Cache-Control no-cache Referer http://www.lztxdy.com/intern/aboutus.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 30 Jun 2021 01:53:50 GMT Content-Encoding gzip Last-Modified Tue, 29 Jun 2021 11:25:58 GMT Server openresty ETag W/"60db0346-e6d" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	jqueryLib.js Show response www.lztxdy.com/intern/js/	85 KB 85 KB	290ms 289ms	Script application/javascript	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Full URL http://www.lztxdy.com/intern/js/jqueryLib.js Requested by Host: www.lztxdy.com URL: http://www.lztxdy.com/intern/aboutus.php Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.lztxdy.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://www.lztxdy.com/intern/aboutus.php Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7 Connection keep-alive Cache-Control no-cache Referer http://www.lztxdy.com/intern/aboutus.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 30 Jun 2021 01:53:48 GMT Last-Modified Tue, 29 Jun 2021 11:26:15 GMT Server openresty ETag "60db0357-15287" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 86663
GET H/1.1	200 OK	actions.js Show response www.lztxdy.com/intern/js/	4 KB 4 KB	582ms 293ms	Script application/javascript	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Full URL http://www.lztxdy.com/intern/js/actions.js Requested by Host: www.lztxdy.com URL: http://www.lztxdy.com/intern/aboutus.php Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `f6620d16b188685ee0e3b3d43ec8b207a4f8ad643d276a36bacd523e7409cac5` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.lztxdy.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept / Referer http://www.lztxdy.com/intern/aboutus.php Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7 Connection keep-alive Cache-Control no-cache Referer http://www.lztxdy.com/intern/aboutus.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 30 Jun 2021 01:53:48 GMT Last-Modified Tue, 29 Jun 2021 11:26:09 GMT Server openresty ETag "60db0351-105b" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 4187
GET H/1.1	200 OK	img1.png www.lztxdy.com/intern/images/	11 KB 11 KB	287ms 286ms	Image image/png	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Show image Full URL http://www.lztxdy.com/intern/images/img1.png Requested by Host: www.lztxdy.com URL: http://www.lztxdy.com/intern/css/style.css Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `34b53621f50bda83302e248619666fcc73ec42c17b90b1b5066478c30dea257e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.lztxdy.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www.lztxdy.com/intern/css/style.css Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7 Connection keep-alive Cache-Control no-cache Referer http://www.lztxdy.com/intern/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 30 Jun 2021 01:53:51 GMT Last-Modified Tue, 29 Jun 2021 11:26:39 GMT Server openresty ETag "60db036f-2c64" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 11364
GET H/1.1	200 OK	img3.png www.lztxdy.com/intern/images/	4 KB 4 KB	292ms 291ms	Image image/png	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Show image Full URL http://www.lztxdy.com/intern/images/img3.png Requested by Host: www.lztxdy.com URL: http://www.lztxdy.com/intern/css/style.css Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `47f64f78db1e616f772ff22370549d440409c5725b5fc770a49119f8f6e60bc8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.lztxdy.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www.lztxdy.com/intern/css/style.css Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7 Connection keep-alive Cache-Control no-cache Referer http://www.lztxdy.com/intern/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 30 Jun 2021 01:53:51 GMT Last-Modified Tue, 29 Jun 2021 11:26:49 GMT Server openresty ETag "60db0379-1098" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 4248
GET H/1.1	200 OK	footer.png www.lztxdy.com/intern/images/	37 KB 37 KB	288ms 288ms	Image image/png	240e:83:205:89:0:ff:b07e:389f CHINANET-IDC-BJ-A...
General Check archive.org Show headers Download Go to Show image Full URL http://www.lztxdy.com/intern/images/footer.png Requested by Host: www.lztxdy.com URL: http://www.lztxdy.com/intern/css/style.css Protocol HTTP/1.1 Server 240e:83:205:89:0:ff:b07e:389f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN), Reverse DNS Software openresty / Resource Hash `00d54b962885d148c7c4c146110c17b1967fac317d43eb66e3d5cc9c2745309a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.lztxdy.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www.lztxdy.com/intern/css/style.css Cookie BAEID=578A65A9C7EBE924315AE110285B7CB7 Connection keep-alive Cache-Control no-cache Referer http://www.lztxdy.com/intern/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 30 Jun 2021 01:53:52 GMT Last-Modified Tue, 29 Jun 2021 11:26:34 GMT Server openresty ETag "60db036a-9208" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 37384

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| numbersOnly function| digitsOnly function| allowedChars function| isOneOf object| input

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.lztxdy.com/	1970-01-20 04:09:14	Name: BAEID Value: 578A65A9C7EBE924315AE110285B7CB7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.lztxdy.com
240e:83:205:89:0:ff:b07e:389f
00d54b962885d148c7c4c146110c17b1967fac317d43eb66e3d5cc9c2745309a
34b53621f50bda83302e248619666fcc73ec42c17b90b1b5066478c30dea257e
47f64f78db1e616f772ff22370549d440409c5725b5fc770a49119f8f6e60bc8
57b88fae9e3d803086b5b66cf680693620de415b5f0134a91352e53a34586da8
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
bce08cc241535933cea32e6ad07a17e78cd1977e1ff81acc8441e6c07b5607f1
f6620d16b188685ee0e3b3d43ec8b207a4f8ad643d276a36bacd523e7409cac5