jinghuitc.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 122.10.96.86, located in Hong Kong and belongs to CHINANET-BACKBONE No.31,Jin-rong Street, CN. The main domain is jinghuitc.com.

This is the only time jinghuitc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
7	122.10.96.86 122.10.96.86		4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
7	1

7 122.10.96.86 (Hong Kong)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

jinghuitc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	jinghuitc.com jinghuitc.com	102 KB
7	1

	Domain	Requested by
7	jinghuitc.com	jinghuitc.com
7	1

This site contains links to these domains. Also see Links.

Domain
www.hmrc.gov.uk

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://jinghuitc.com/refund-hmrc-tax/en/indentify.php
Frame ID: 13009.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

102 kB
Transfer

102 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.hmrc.gov.uk/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set indentify.php Show response jinghuitc.com/refund-hmrc-tax/en/	29 KB 29 KB	678ms 408ms	Document text/html	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / PHP/5.2.14 Resource Hash `70a2d65dae1a345ab99664079a5201674ba5c746df3d1f31bdb0718901b50930` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Pragma no-cache Date Thu, 09 Feb 2017 01:05:06 GMT Server Apache/2.2.17 (Unix) X-Powered-By PHP/5.2.14 Transfer-Encoding chunked Content-Type text/html Set-Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d; path=/ Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=15, max=100 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	hok.js Show response jinghuitc.com/refund-hmrc-tax/en/	20 KB 20 KB	269ms 268ms	Script application/javascript	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL http://jinghuitc.com/refund-hmrc-tax/en/hok.js Requested by Host: jinghuitc.com URL: http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / Resource Hash `b06bc1381eef6d86626ffd5c3827d8ebf03249ce6c758bb4eed7a1e9aa229ad1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d Connection keep-alive Cache-Control no-cache Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 09 Feb 2017 01:05:07 GMT Last-Modified Fri, 27 Jan 2017 19:56:57 GMT Server Apache/2.2.17 (Unix) ETag "f65bf2-4f65-54718de434e7a" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=100 Content-Length 20325
GET H/1.1	200 OK	hmrc.css jinghuitc.com/refund-hmrc-tax/en/css/	45 KB 45 KB	272ms 272ms	Stylesheet text/css	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL http://jinghuitc.com/refund-hmrc-tax/en/css/hmrc.css Requested by Host: jinghuitc.com URL: http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / Resource Hash `d0d9adb7addbe2f02f7caeb5322e576d2a04ad96e7f26ac06c7f906ff931cc77` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d Connection keep-alive Cache-Control no-cache Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 09 Feb 2017 01:05:08 GMT Last-Modified Fri, 27 Jan 2017 19:56:57 GMT Server Apache/2.2.17 (Unix) ETag "f65be9-b38b-54718de434a92" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=99 Content-Length 45963
GET H/1.1	200 OK	print.css jinghuitc.com/refund-hmrc-tax/en/css/	899 B 899 B	268ms 267ms	Stylesheet text/css	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL http://jinghuitc.com/refund-hmrc-tax/en/css/print.css Requested by Host: jinghuitc.com URL: http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / Resource Hash `c96fcb2249036eb854b4b874f1a04aa5cc1b3a186d61f56fdedc5c42db944020` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d Connection keep-alive Cache-Control no-cache Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 09 Feb 2017 01:05:08 GMT Last-Modified Fri, 27 Jan 2017 19:56:57 GMT Server Apache/2.2.17 (Unix) ETag "f65bee-383-54718de434e7a" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=99 Content-Length 899
GET H/1.1	200 OK	digitalLogo.png jinghuitc.com/refund-hmrc-tax/en/img/	7 KB 7 KB	531ms 270ms	Image image/png	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Show image Full URL http://jinghuitc.com/refund-hmrc-tax/en/img/digitalLogo.png Requested by Host: jinghuitc.com URL: http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / Resource Hash `b072c44bfab6dbc45edf4cc19cedf2ae1ec20678d80a25ab29d1cc24063aab64` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d Connection keep-alive Cache-Control no-cache Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 09 Feb 2017 01:05:08 GMT Last-Modified Fri, 27 Jan 2017 19:56:57 GMT Server Apache/2.2.17 (Unix) ETag "f65bf4-1aa7-54718de434e7a" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=98 Content-Length 6823
GET H/1.1	404 Not Found	digitalLogo-print.png jinghuitc.com/refund-hmrc-tax/en/img/	319 B 319 B	539ms 272ms	Image text/html	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Show image Full URL http://jinghuitc.com/refund-hmrc-tax/en/img/digitalLogo-print.png Requested by Host: jinghuitc.com URL: http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / Resource Hash `d6885f4dd8faa365b606f36d545975c8823042a87c1663080abfec0554680ceb` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d Connection keep-alive Cache-Control no-cache Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 09 Feb 2017 01:05:08 GMT Server Apache/2.2.17 (Unix) Connection Keep-Alive Keep-Alive timeout=15, max=100 Content-Length 319 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	favicon.ico jinghuitc.com/	286 B 286 B	271ms 271ms	Other text/html	122.10.96.86 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL http://jinghuitc.com/favicon.ico Protocol HTTP/1.1 Server 122.10.96.86 , Hong Kong, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Apache/2.2.17 (Unix) / Resource Hash `47dad5aa654eb8f2fb6bb86fe65e7bafec3ec5f65c0c6b3b8392db1ab8da979b` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host jinghuitc.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://jinghuitc.com/refund-hmrc-tax/en/indentify.php Cookie PHPSESSID=4cb082018ab3e7b3b37c497aed451b8d Connection keep-alive Cache-Control no-cache Referer http://jinghuitc.com/refund-hmrc-tax/en/indentify.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Thu, 09 Feb 2017 01:05:08 GMT Server Apache/2.2.17 (Unix) Connection Keep-Alive Keep-Alive timeout=15, max=98 Content-Length 286 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			jinghuitc.com/	1970-01-01 00:00:00	Name: PHPSESSID Value: 4cb082018ab3e7b3b37c497aed451b8d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

jinghuitc.com
122.10.96.86
47dad5aa654eb8f2fb6bb86fe65e7bafec3ec5f65c0c6b3b8392db1ab8da979b
70a2d65dae1a345ab99664079a5201674ba5c746df3d1f31bdb0718901b50930
b06bc1381eef6d86626ffd5c3827d8ebf03249ce6c758bb4eed7a1e9aa229ad1
b072c44bfab6dbc45edf4cc19cedf2ae1ec20678d80a25ab29d1cc24063aab64
c96fcb2249036eb854b4b874f1a04aa5cc1b3a186d61f56fdedc5c42db944020
d0d9adb7addbe2f02f7caeb5322e576d2a04ad96e7f26ac06c7f906ff931cc77
d6885f4dd8faa365b606f36d545975c8823042a87c1663080abfec0554680ceb

jinghuitc.com Open in urlscan Pro 122.10.96.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

102 kBTransfer

102 kBSize

1 Cookies

1 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

jinghuitc.com Open in urlscan Pro
122.10.96.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

102 kB
Transfer

102 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!