usdh.net Open in urlscan Pro
211.205.155.42  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://dctsolution.net/ss.html?email= Page URL
2. http://usdh.net/movie/mission/mission-20180318.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	ss.html Show response dctsolution.net/	584 B 635 B	1125ms 441ms	Document text/html	103.28.36.66 NHANHOA-AS-VN Nha...
General Check archive.org Show headers Download Go to Full URL http://dctsolution.net/ss.html?email= Protocol HTTP/1.1 Server 103.28.36.66 , Viet Nam, ASN131353 (NHANHOA-AS-VN NhanHoa Software company, VN), Reverse DNS share-dedi02.nhanhoa.com Software LiteSpeed / Resource Hash feea52b5327d1559dabcbb619633c7cd59c8d9dc97ca8a8e6fdb5e961da4e3db Request headers Host dctsolution.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 content-type text/html last-modified Thu, 30 Sep 2021 13:36:11 GMT accept-ranges bytes content-encoding gzip vary Accept-Encoding content-length 343 date Sun, 03 Oct 2021 14:30:35 GMT server LiteSpeed
GET H/1.1	200 OK	Primary Request mission-20180318.html Show response usdh.net/movie/mission/	7 KB 3 KB	3991ms 616ms	Document text/html	211.205.155.42 SKB-AS SK Broadba...
General Check archive.org Show headers Download Go to Full URL http://usdh.net/movie/mission/mission-20180318.html Requested by Host: dctsolution.net URL: http://dctsolution.net/ss.html?email= Protocol HTTP/1.1 Server 211.205.155.42 Nam-gu, Korea, Republic Of, ASN9318 (SKB-AS SK Broadband Co Ltd, KR), Reverse DNS Software nginx / Resource Hash a6a93197512f5fb95381ad474bcdf3f600a8954b2cf0f09a4bc2a2b4ad4b419f Request headers Host usdh.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://dctsolution.net/ Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://dctsolution.net/ Response headers Server nginx Date Sun, 03 Oct 2021 14:30:40 GMT Content-Type text/html Content-Length 2701 Connection keep-alive Keep-Alive timeout=20 Last-Modified Thu, 30 Sep 2021 13:28:58 GMT ETag "1d8a-5cd366dd3de37-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	56ms 18ms	Script application/javascript	2001:4de0:ac18::1:a:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: usdh.net URL: http://usdh.net/movie/mission/mission-20180318.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers Accept-Language de-DE,de;q=0.9 Referer http://usdh.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 03 Oct 2021 14:30:40 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx etag W/"58d026fb-15283" vary Accept-Encoding x-hw 1633271440.dop024.ml1.t,1633271440.cds202.ml1.hn,1633271440.cds202.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	72ms 26ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: usdh.net URL: http://usdh.net/movie/mission/mission-20180318.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://usdh.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 03 Oct 2021 14:30:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723, 718 age 1020210 cdn-cachedat 2021-03-11 11:57:52 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 48f4598378fe1b699fcee6ac68d6cc25 cf-ray 6986dea7ad9f59e9-MXP cdn-requestcountrycode DE cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
dctsolution.net
stackpath.bootstrapcdn.com
usdh.net
103.28.36.66
2001:4de0:ac18::1:a:1a
211.205.155.42
2606:4700::6812:bcf
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a6a93197512f5fb95381ad474bcdf3f600a8954b2cf0f09a4bc2a2b4ad4b419f
feea52b5327d1559dabcbb619633c7cd59c8d9dc97ca8a8e6fdb5e961da4e3db