urlscan.io logo urlscan.io
SecurityTrails logo

tangguifang1979.cn Open in urlscan Pro
199.19.226.102  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tangguifang1979.cn/
Effective URL: http://tangguifang1979.cn/NBCW2101.asp
Submission: On August 18 via manual from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 199.19.226.102, located in Las Vegas, United States and belongs to PONYNET, US. The main domain is tangguifang1979.cn.
This is the only time tangguifang1979.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPay (Financial)

Domain & IP information

IP Address AS Autonomous System
1 8 199.19.226.102 53667 (PONYNET)
2 2a00:1450:400... 15169 (GOOGLE)
9 2
Apex Domain
Subdomains		 Transfer
8 tangguifang1979.cn
tangguifang1979.cn
99 KB
2 googleusercontent.com
themes.googleusercontent.com
44 KB
9 2
Domain Requested by
8 tangguifang1979.cn 1 redirects tangguifang1979.cn
2 themes.googleusercontent.com tangguifang1979.cn
9 2

This site contains no links.

Subject Issuer Validity Valid
*.googleusercontent.com
GTS CA 1C3		 2021-07-26 -
2021-10-18		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://tangguifang1979.cn/NBCW2101.asp
Frame ID: 6BF3AB81168F18D2C2270CA7D633EB2F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://tangguifang1979.cn/ HTTP 302
    http://tangguifang1979.cn/NBCW2101.asp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

9
Requests

22 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

143 kB
Transfer

386 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tangguifang1979.cn/ HTTP 302
    http://tangguifang1979.cn/NBCW2101.asp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request NBCW2101.asp
tangguifang1979.cn/
Redirect Chain
  • http://tangguifang1979.cn/
  • http://tangguifang1979.cn/NBCW2101.asp
4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
4a8325ea606508db5646ac398e0e8a9990d57d23b73292a419dcec673d8b8b2e

Request headers

Host
tangguifang1979.cn
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Cache-Control
private
Content-Type
text/html
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Date
Wed, 18 Aug 2021 10:20:03 GMT
Content-Length
1942

Redirect headers

Cache-Control
private
Content-Type
text/html
Location
NBCW2101.asp
Server
Microsoft-IIS/10.0
Set-Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI; path=/
X-Powered-By
ASP.NET
Date
Wed, 18 Aug 2021 10:20:03 GMT
Content-Length
133
bootstrap.min.css
tangguifang1979.cn/22222_files/ 		120 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://tangguifang1979.cn/22222_files/bootstrap.min.css
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
tangguifang1979.cn
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://tangguifang1979.cn/NBCW2101.asp
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Connection
keep-alive
Cache-Control
no-cache
Referer
http://tangguifang1979.cn/NBCW2101.asp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 18 Aug 2021 10:20:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Jul 2021 14:25:38 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"05dfbc82977d71:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
19759
customStyle.css
tangguifang1979.cn/22222_files/ 		100 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://tangguifang1979.cn/22222_files/customStyle.css
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
a363ff2db3586da0bae950bea256769e36a2307c437bd571176d998362a9c87e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
tangguifang1979.cn
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://tangguifang1979.cn/NBCW2101.asp
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Connection
keep-alive
Cache-Control
no-cache
Referer
http://tangguifang1979.cn/NBCW2101.asp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 18 Aug 2021 10:20:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Jul 2021 14:25:40 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"08a2cca2977d71:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
17057
jquery-1.7.2.min.js
tangguifang1979.cn/js/ 		93 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://tangguifang1979.cn/js/jquery-1.7.2.min.js
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
tangguifang1979.cn
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://tangguifang1979.cn/NBCW2101.asp
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Connection
keep-alive
Cache-Control
no-cache
Referer
http://tangguifang1979.cn/NBCW2101.asp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 18 Aug 2021 10:20:03 GMT
Content-Encoding
gzip
Last-Modified
Mon, 15 Sep 2014 18:01:32 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"0e6c114fd1cf1:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
33717
main_logo.png
tangguifang1979.cn/22222_files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://tangguifang1979.cn/22222_files/main_logo.png
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
2585a14840656399885ba7e6fbd94516745c0c9e166815dfdd47a61dec15729b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
tangguifang1979.cn
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://tangguifang1979.cn/NBCW2101.asp
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Connection
keep-alive
Cache-Control
no-cache
Referer
http://tangguifang1979.cn/NBCW2101.asp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 18 Aug 2021 10:20:04 GMT
Last-Modified
Mon, 12 Jul 2021 15:10:48 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"08c44183077d71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1937
header_faq.png
tangguifang1979.cn/22222_files/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://tangguifang1979.cn/22222_files/header_faq.png
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
62c7ab03d6d92ae39a651edcf68d9f7d9cc77719a64748be3eafd4db079857f1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
tangguifang1979.cn
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://tangguifang1979.cn/NBCW2101.asp
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Connection
keep-alive
Cache-Control
no-cache
Referer
http://tangguifang1979.cn/NBCW2101.asp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 18 Aug 2021 10:20:04 GMT
Last-Modified
Mon, 12 Jul 2021 01:03:34 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"0b7d7bcb976d71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1151
yahoo-softbank.png
tangguifang1979.cn/22222_files/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://tangguifang1979.cn/22222_files/yahoo-softbank.png
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/NBCW2101.asp
Protocol
HTTP/1.1
Server
199.19.226.102 Las Vegas, United States, ASN53667 (PONYNET, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
5480f73d9482aa57b7380951872947bd2c697b7d26cfed254abe67d7fac8a30d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
tangguifang1979.cn
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://tangguifang1979.cn/NBCW2101.asp
Cookie
ASPSESSIONIDSABQTQRC=KHOHIJFCBOMHPGKMFMFJLBEI
Connection
keep-alive
Cache-Control
no-cache
Referer
http://tangguifang1979.cn/NBCW2101.asp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 18 Aug 2021 10:20:04 GMT
Last-Modified
Mon, 12 Jul 2021 15:52:02 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"0fde2da3577d71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
23466
cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
themes.googleusercontent.com/static/fonts/opensans/v6/ 		21 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://themes.googleusercontent.com/static/fonts/opensans/v6/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/22222_files/customStyle.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
90556675373ea9ed1d0e9b5678426d69296b6801c906ca378bb426aa3d6acdc3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://tangguifang1979.cn
Referer
http://tangguifang1979.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 12:20:40 GMT
x-content-type-options
nosniff
age
424764
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21956
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Aug 2022 12:20:40 GMT
MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
themes.googleusercontent.com/static/fonts/opensans/v6/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://themes.googleusercontent.com/static/fonts/opensans/v6/MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
Requested by
Host: tangguifang1979.cn
URL: http://tangguifang1979.cn/22222_files/customStyle.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a851d97fcc71c78ca279754fabc2289a600aabecec4d9e4387cab9c7400aa2d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
http://tangguifang1979.cn
Referer
http://tangguifang1979.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 18 Aug 2021 06:16:19 GMT
x-content-type-options
nosniff
age
14625
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 18 Aug 2022 06:16:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPay (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
tangguifang1979.cn/ Name: ASPSESSIONIDSABQTQRC
Value: KHOHIJFCBOMHPGKMFMFJLBEI