heaven-gate.ru - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 178.57.217.251, located in Russian Federation and belongs to IHC, RU. The main domain is heaven-gate.ru.

This is the only time heaven-gate.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	178.57.217.251 178.57.217.251	203226 (IHC) (IHC)
3	103.65.41.154 103.65.41.154	135391 (AOFEI-HK ...) (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED)
5	2

3 178.57.217.251 (Russian Federation) 1 redirects

ASN203226 (IHC, RU)
PTR: cpanel1.hothat.ru

heaven-gate.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.65.41.154 (Dongxiang, China)

ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	127.net mimg.127.net	17 KB
3	heaven-gate.ru 1 redirects heaven-gate.ru	190 KB
5	2

	Domain	Requested by
3	mimg.127.net	heaven-gate.ru
3	heaven-gate.ru	1 redirects heaven-gate.ru
5	2

This site contains links to these domains. Also see Links.

Domain
reg.163.com
reg.email.163.com
mail.163.com
ipad.mail.163.com
smart.mail.163.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://heaven-gate.ru/docs/index/
Frame ID: 6B306972AAF222309579F301D66E1AB5
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://heaven-gate.ru/docs/index HTTP 301
http://heaven-gate.ru/docs/index/ Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

207 kB
Transfer

226 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail163
Title: 忘记密码了?

Search URL Search Domain Scan URL

URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=163mail_right
Title: 注册

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail5

Search URL Search Domain Scan URL

URL: http://ipad.mail.163.com/index.htm?dv=ipad
Title: 适配iPad版本

Search URL Search Domain Scan URL

URL: http://smart.mail.163.com/index.htm?dv=smart
Title: 手机智能版

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://heaven-gate.ru/docs/index HTTP 301
http://heaven-gate.ru/docs/index/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response heaven-gate.ru/docs/index/ Redirect Chain http://heaven-gate.ru/docs/index http://heaven-gate.ru/docs/index/	30 KB 10 KB	54ms 54ms	Document text/html	178.57.217.251 IHC
General Check archive.org Show headers Download Go to Full URL http://heaven-gate.ru/docs/index/ Protocol HTTP/1.1 Server 178.57.217.251 , Russian Federation, ASN203226 (IHC, RU), Reverse DNS cpanel1.hothat.ru Software LiteSpeed / PHP/5.6.38 Resource Hash `313c68b5724c08dd1989e527dcc576d37fb71e2fb42771fb8f4e6b7bbb48686d` Request headers Host heaven-gate.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers X-Powered-By PHP/5.6.38 Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Content-Encoding gzip Vary Accept-Encoding Date Mon, 15 Oct 2018 00:58:01 GMT Server LiteSpeed Connection close Redirect headers Content-Type text/html Content-Length 617 Date Mon, 15 Oct 2018 00:58:01 GMT Server LiteSpeed Location http://heaven-gate.ru/docs/index/ Connection Keep-Alive
GET H/1.1	200 OK	163_bkg.jpg heaven-gate.ru/docs/index/	179 KB 180 KB	142ms 42ms	Image image/jpeg	178.57.217.251 IHC
General Check archive.org Show headers Download Go to Show image Full URL http://heaven-gate.ru/docs/index/163_bkg.jpg Requested by Host: heaven-gate.ru URL: http://heaven-gate.ru/docs/index/ Protocol HTTP/1.1 Server 178.57.217.251 , Russian Federation, ASN203226 (IHC, RU), Reverse DNS cpanel1.hothat.ru Software LiteSpeed / Resource Hash `48b696503f444201727a04e7b4a3450cd0c611fe905226b348dd51ff105f1286` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host heaven-gate.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://heaven-gate.ru/docs/index/ Connection keep-alive Cache-Control no-cache Referer http://heaven-gate.ru/docs/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Oct 2018 00:58:01 GMT Last-Modified Sat, 19 May 2018 02:42:52 GMT Server LiteSpeed Connection Keep-Alive ETag "2cd23-5aff8f2c-7c0271b17f0acc53;;;" Content-Length 183587 Content-Type image/jpeg
GET H/1.1	200 OK	login_v5.png mimg.127.net/index/163/img/2013/	4 KB 4 KB	931ms 218ms	Image image/png	103.65.41.154 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/img/2013/login_v5.png Requested by Host: heaven-gate.ru URL: http://heaven-gate.ru/docs/index/ Protocol HTTP/1.1 Server 103.65.41.154 Dongxiang, China, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS Software nginx / Resource Hash `8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401` Request headers Referer http://heaven-gate.ru/docs/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Oct 2018 00:58:02 GMT Last-Modified Wed, 17 Dec 2014 03:19:07 GMT Server nginx ETag "5490f62b-f6e" X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 3950 Expires Mon, 15 Oct 2018 01:26:24 GMT
GET H/1.1	200 OK	mailapp_logo_141212.png mimg.127.net/index/lib/img/	2 KB 2 KB	933ms 219ms	Image image/png	103.65.41.154 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/lib/img/mailapp_logo_141212.png Requested by Host: heaven-gate.ru URL: http://heaven-gate.ru/docs/index/ Protocol HTTP/1.1 Server 103.65.41.154 Dongxiang, China, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS Software nginx / Resource Hash `d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419` Request headers Referer http://heaven-gate.ru/docs/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Oct 2018 00:58:02 GMT Last-Modified Wed, 23 Mar 2016 09:26:25 GMT Server nginx ETag "56f26141-83f" X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 2111 Expires Mon, 15 Oct 2018 01:45:29 GMT
GET H/1.1	200 OK	bg_v3.png mimg.127.net/index/163/img/2013/	10 KB 11 KB	932ms 219ms	Image image/png	103.65.41.154 AOFEI-HK AOFEI DA...
General Check archive.org Show headers Download Go to Show image Full URL http://mimg.127.net/index/163/img/2013/bg_v3.png Requested by Host: heaven-gate.ru URL: http://heaven-gate.ru/docs/index/ Protocol HTTP/1.1 Server 103.65.41.154 Dongxiang, China, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK), Reverse DNS Software nginx / Resource Hash `dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623` Request headers Referer http://heaven-gate.ru/docs/index/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Oct 2018 00:58:02 GMT Last-Modified Wed, 06 Aug 2014 08:38:32 GMT Server nginx X-Cache HIT from HKGM Content-Type image/png Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 10528 Expires Mon, 15 Oct 2018 01:48:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

heaven-gate.ru
mimg.127.net
103.65.41.154
178.57.217.251
313c68b5724c08dd1989e527dcc576d37fb71e2fb42771fb8f4e6b7bbb48686d
48b696503f444201727a04e7b4a3450cd0c611fe905226b348dd51ff105f1286
8af8b8de1ecad45ba55cb3824728f4124f0966be0877381b36ba0ef195707401
d7916ca92b82038f9fb31b42361f28ec13a1c9339088ad8bd5911eb616003419
dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623

heaven-gate.ru Open in urlscan Pro 178.57.217.251 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

207 kBTransfer

226 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

heaven-gate.ru Open in urlscan Pro
178.57.217.251 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

207 kB
Transfer

226 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!