electrocoolhvacr.com
Open in
urlscan Pro
88.218.28.56
Malicious Activity!
Public Scan
Effective URL: https://electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Submission: On June 25 via api from LU — Scanned from NL
Summary
TLS certificate: Issued by R3 on May 9th 2024. Valid for: 3 months.
This is the only time electrocoolhvacr.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic China (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 88.218.28.56 88.218.28.56 | 50673 (SERVERIUS-AS) (SERVERIUS-AS) | |
7 | 103.129.252.89 103.129.252.89 | 137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED) | |
1 | 220.197.30.201 220.197.30.201 | 4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone) | |
12 | 4 |
ASN50673 (SERVERIUS-AS, NL)
PTR: nl-iron.fastbighost.net
electrocoolhvacr.com |
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
PTR: m30201.mail.163.com
ssl.mail.163.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
127.net
mimg.127.net — Cisco Umbrella Rank: 131941 |
34 KB |
1 |
163.com
ssl.mail.163.com — Cisco Umbrella Rank: 314127 analytics.163.com Failed email.163.com Failed |
224 B |
1 |
electrocoolhvacr.com
electrocoolhvacr.com |
24 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
7 | mimg.127.net |
electrocoolhvacr.com
|
1 | ssl.mail.163.com |
electrocoolhvacr.com
|
1 | electrocoolhvacr.com | |
0 | email.163.com Failed | |
0 | analytics.163.com Failed |
electrocoolhvacr.com
|
12 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.163.com |
vipmail.163.com |
hw.mail.163.com |
help.163.com |
qiye.163.com |
corp.163.com |
mail.163.com |
mail.blog.163.com |
ss.cnnic.cn |
Subject Issuer | Validity | Valid | |
---|---|---|---|
webdisk.electrocoolhvacr.com R3 |
2024-05-09 - 2024-08-07 |
3 months | crt.sh |
mimg.127.net GeoTrust RSA CN CA G2 |
2023-08-29 - 2024-09-14 |
a year | crt.sh |
*.mail.163.com GeoTrust RSA CN CA G2 |
2023-08-29 - 2024-09-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Frame ID: C637A114169766C5D6D18A83F6E19259
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
网易免费邮箱 - 中国第一大电子邮件服务商Page URL History Show full URLs
-
http://electrocoolhvacr.com/control/163/163xffrxxzzz.htm
HTTP 307
https://electrocoolhvacr.com/control/163/163xffrxxzzz.htm Page URL
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: 收费邮
Search URL Search Domain Scan URL
Title: 国外用户登录
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 进入管理员登录页面
Search URL Search Domain Scan URL
Title: 关于网易
Search URL Search Domain Scan URL
Title: 关于网易免费邮
Search URL Search Domain Scan URL
Title: 邮箱官方博客
Search URL Search Domain Scan URL
Title: 客户服务
Search URL Search Domain Scan URL
Title: 隐私政策
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://electrocoolhvacr.com/control/163/163xffrxxzzz.htm
HTTP 307
https://electrocoolhvacr.com/control/163/163xffrxxzzz.htm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
163xffrxxzzz.htm
electrocoolhvacr.com/control/163/ Redirect Chain
|
82 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ntes_logo.png
mimg.127.net/index/email/img/2012/ |
983 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t.gif
mimg.127.net/p/ |
77 B 274 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
knet.png
mimg.127.net/logo/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
httpsEnable.gif
ssl.mail.163.com/ |
43 B 224 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
base_v3.js
mimg.127.net/index/lib/scripts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
ntes.js
analytics.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_v2.png
mimg.127.net/index/email/img/2012/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bgx.png
mimg.127.net/index/email/img/2012/ |
304 B 494 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_v2.png
mimg.127.net/index/email/img/2012/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arr.png
mimg.127.net/index/email/img/2012/ |
492 B 682 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
email.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mimg.127.net
- URL
- http://mimg.127.net/index/lib/scripts/base_v3.js
- Domain
- analytics.163.com
- URL
- http://analytics.163.com/ntes.js
- Domain
- email.163.com
- URL
- http://email.163.com/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic China (Online)88 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 undefined| event object| fence object| sharedStorage object| gOption undefined| bForcepc undefined| bPreviewPc function| fCheckAccount string| _ntes_nacc object| gWindow function| fCalc function| fChangeBg undefined| oMain undefined| oMainHd function| fChangePos function| fCheckboxChange undefined| gCurrentDomain undefined| gShoujiDomain undefined| gShoujiCache undefined| gLoginInfo undefined| bIsEuid undefined| sPreUrl undefined| sPreUid undefined| sPreReason undefined| sUid undefined| sStyle undefined| sEnUsername undefined| oForm undefined| oFormQiye undefined| oUrl2 undefined| oUserName undefined| oUserIpt undefined| oTxtAccount undefined| oTxtPwd undefined| oDomain undefined| oDomainQiye undefined| oStyle undefined| oGetPwd undefined| oLoginOpt undefined| oErr undefined| oLoginFtTips undefined| oIdL undefined| oIdLabel undefined| oPwL undefined| oPwLabel function| fSwitchTab function| fCheckShoujiDomain function| MobCallback function| fSetShoujiDomain function| fLoginFtTipsVer function| fLoginFtDarr function| fEmuIcon function| fE function| fVerSelect function| fEmuIconTick function| fSwitchUserInfo function| fSecureLinkage function| fSubmit function| fSetAction function| fSaveLoginInfo function| fCheckqiye function| fGetQiyeMsg function| fStyleEvent function| fCls function| fIdInputEvent function| fCheckAlways undefined| oPopup undefined| oPopupClose undefined| oPopupCont undefined| oPopupSub undefined| oMask function| fKX undefined| sLocationInfo undefined| fSetLocation undefined| fNetErrDebug undefined| oSpdTestPosition undefined| aSpdResult undefined| aSpdStartTime undefined| aSpdEndTime undefined| aSpdTmpTime undefined| aSpdQueue undefined| fSpeedTestPre undefined| fSpeedTest undefined| fSpd function| fTmpSwitchLog undefined| fShowPopup undefined| fHidePopup0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
15 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.163.com
electrocoolhvacr.com
email.163.com
mimg.127.net
ssl.mail.163.com
analytics.163.com
email.163.com
mimg.127.net
103.129.252.89
220.197.30.201
88.218.28.56
16ede25c08f54c3b1627d401b847eec08b089227058660799c2372dbd6f52425
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
2eedcabc30b2dc86675308bf7b48c454e954f76eef2d95271b62af70ae337841
3cc3a1cc321b22df78b7bf0da839fd05906c7db47296afdf317298882a0b73be
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
7d898171a5ede23236d3d2cdfe18d4590a5dc485f6229c66e24f6928d16e7072
86305704cb5ce03d2ce2c34224ecd1f54bfad514a5980bd9453fab19858af4d5
e4129228b3c1d9183ed091b163797dddf16a2cf72868bb4fa56c98e7a074686d