qiangongzi58.com
Open in
urlscan Pro
43.156.253.184
Malicious Activity!
Public Scan
URL:
https://qiangongzi58.com/cgi/index.html
Submission: On December 12 via automatic, source openphish — Scanned from SG
Submission: On December 12 via automatic, source openphish — Scanned from SG
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 10 HTTP transactions.
The main IP is 43.156.253.184, located in
Singapore, Singapore and
belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN.
The main domain is qiangongzi58.com.
TLS certificate: Issued by R11 on December 11th 2024. Valid for: 3 months.
This is the only time qiangongzi58.com was scanned on urlscan.io!
TLS certificate: Issued by R11 on December 11th 2024. Valid for: 3 months.
This is the only time qiangongzi58.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NTT Docomo (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 43.156.253.184 43.156.253.184 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
| 1 | 49.102.154.3 49.102.154.3 | 9605 (DOCOMO NT...) (DOCOMO NTT DOCOMO) | |
| 10 | 3 |
8
43.156.253.184
(Singapore, Singapore)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
| qiangongzi58.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
qiangongzi58.com
qiangongzi58.com |
395 KB |
| 1 |
docomo.ne.jp
cfg.smt.docomo.ne.jp |
|
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 10 | 3 |
| Domain | Requested by | |
|---|---|---|
| 8 | qiangongzi58.com |
qiangongzi58.com
|
| 1 | cfg.smt.docomo.ne.jp |
qiangongzi58.com
|
| 0 | localhost Failed |
qiangongzi58.com
|
| 10 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| id.smt.docomo.ne.jp |
| dpoint.onelink.me |
| www.nttdocomo.co.jp |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| qiangongzi58.com R11 |
2024-12-11 - 2025-03-11 |
3 months | crt.sh |
| cfg.smt.docomo.ne.jp DigiCert TLS RSA SHA256 2020 CA1 |
2024-09-05 - 2025-09-30 |
a year | crt.sh |
This page contains 2 frames:
Frame:
http://localhost/
Frame ID: D4474C9238B266CEA34FC165D762E411
Requests: 12 HTTP requests in this frame
Frame:
https://cfg.smt.docomo.ne.jp/nnlappsdk-7.0.2/iframe.html
Frame ID: 4B966767A378E38D626EB2F8D39782FE
Requests: 1 HTTP requests in this frame
9 Outgoing links
These are links going to different origins than the main page.
URL: https://id.smt.docomo.ne.jp/
Search URL Search Domain Scan URL
URL: https://id.smt.docomo.ne.jp/src/utility/idpw_forget.html
Title: IDをお忘れの方
Title: IDをお忘れの方
Search URL Search Domain Scan URL
URL: https://id.smt.docomo.ne.jp/src/utility/index.html
Title: dアカウントとは？
Title: dアカウントとは？
Search URL Search Domain Scan URL
URL: https://id.smt.docomo.ne.jp/src/utility/notice.html
Title: ご利用上の注意
Title: ご利用上の注意
Search URL Search Domain Scan URL
URL: https://dpoint.onelink.me/roGT?pid=dpc_login&af_dp=dpoint%3A%2F%2Ftop&af_web_dp=https%3A%2F%2Fdpoint.jp%2Fguide%2Fhowto_dpoint%2Fapp%2Findex.html
Search URL Search Domain Scan URL
URL: https://id.smt.docomo.ne.jp/src/utility/notice.html#p08
Title: 共用のパソコンやタブレットでの利用について
Title: 共用のパソコンやタブレットでの利用について
Search URL Search Domain Scan URL
URL: https://www.nttdocomo.co.jp/utility/privacy/
Title: プライバシーポリシー
Title: プライバシーポリシー
Search URL Search Domain Scan URL
URL: https://id.smt.docomo.ne.jp/src/dlogin/rules.html
Title: ご利用規約/ご注意事項
Title: ご利用規約/ご注意事項
Search URL Search Domain Scan URL
URL: https://id.smt.docomo.ne.jp/src/utility/terms.html
Title: ご利用にあたって
Title: ご利用にあたって
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.html
qiangongzi58.com/cgi/ |
406 B 536 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chunk-vendors.3f1a91bb.js
qiangongzi58.com/cgi/static/js/ |
173 KB 175 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.2b8eb24d.js
qiangongzi58.com/cgi/static/js/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
172.fae44055.js
qiangongzi58.com/cgi/static/js/ |
137 KB 138 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
717.12c11281.css
qiangongzi58.com/cgi/static/css/ |
26 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
717.86a80b4d.js
qiangongzi58.com/cgi/static/js/ |
19 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
iframe.html
cfg.smt.docomo.ne.jp/nnlappsdk-7.0.2/ Frame 4B96 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pageServlet
qiangongzi58.com/cgi/api/ |
2 B 99 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
banner06.d570862c.jpg
qiangongzi58.com/cgi/static/img/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
102 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
localhost/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- localhost
- URL
- http://localhost/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NTT Docomo (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| webpackChunkcgi boolean| __VUE__1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| qiangongzi58.com/cgi | Name: JSESSIONID Value: F78F4319A7F67C9F6E1B1681227C4C1C |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cfg.smt.docomo.ne.jp
localhost
qiangongzi58.com
localhost
43.156.253.184
49.102.154.3
126adcd668df35cdc4e83948b880d7f15bc4e6a99ccd9af4a3e0aeb62287b3c6
293b57cc384290eab34796b4a5be203a7de0bbd6c6bcfb9bc41596fe622b5ee9
350f4d5bef39bf376d051c55cde14d8def0435a34f1cf5f3a5355fe0bc2cb356
63db3870b55faa8fae34c4a7168306a24df33f8838e920f22a8f6b47b8ebffa2
687b4426ef7e1103232a8fbd32cae8a85a512b021596718b9e7f1a732239773d
6b13b848fa311670dfb9fe7b1225c6ddc3ea3e844a0590b891904da861b65215
b20d8c37d103635f0b962f47137a7d4e4bbea09e2a51ed472c6ab96bd3dda376
c5b09f7e1258ba3ccce6988a8eb6a150aeb897397fd3d9ecf49780fd8e4ceafd
d8d91b2e06df73d70eb998e274b63b433db68b4fa1cfd0904f21f139b14c5567
e9c4d8032eb29dbb5beeec2755bc15e2da375fdf5e1c9045201a26c0e0a3f8fc
ff285d0fd3a5ddb5216fc5af9afeb023a6664a762b96be13a6da63f8045a3d7a