webmail.l9qyw.asia
Open in
urlscan Pro
23.224.233.87
Malicious Activity!
Public Scan
Submission: On April 18 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 14th 2023. Valid for: 3 months.
This is the only time webmail.l9qyw.asia was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
13 | 23.224.233.87 23.224.233.87 | 40065 (CNSERVERS) (CNSERVERS) | |
1 | 221.194.141.164 221.194.141.164 | 4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone) | |
2 | 103.235.46.191 103.235.46.191 | 55967 (BAIDU Bei...) (BAIDU Beijing Baidu Netcom Science and Technology Co.) | |
16 | 3 |
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
cdn.bootcdn.net |
ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)
hm.baidu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
l9qyw.asia
webmail.l9qyw.asia |
27 KB |
2 |
baidu.com
hm.baidu.com — Cisco Umbrella Rank: 6664 |
12 KB |
1 |
bootcdn.net
cdn.bootcdn.net — Cisco Umbrella Rank: 99683 |
104 KB |
16 | 3 |
Domain | Requested by | |
---|---|---|
13 | webmail.l9qyw.asia |
webmail.l9qyw.asia
|
2 | hm.baidu.com |
webmail.l9qyw.asia
|
1 | cdn.bootcdn.net |
webmail.l9qyw.asia
|
16 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webmail.iymqf.asia R3 |
2023-04-14 - 2023-07-13 |
3 months | crt.sh |
cdn.bootcdn.net TrustAsia RSA DV TLS CA G2 |
2022-06-06 - 2023-06-06 |
a year | crt.sh |
baidu.com GlobalSign RSA OV SSL CA 2018 |
2022-07-05 - 2023-08-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://webmail.l9qyw.asia/index/t3.html
Frame ID: A4E759BEFCD5F715F18A29C431859A02
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Outlook Web AppDetected technologies
Baidu Analytics (百度统计) (Analytics) ExpandDetected patterns
- hm\.baidu\.com/hm\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
t3.html
webmail.l9qyw.asia/index/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logon.css
webmail.l9qyw.asia/static/templete/microsft2/files/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owafont_zh_chs.css
webmail.l9qyw.asia/static/templete/microsft2/files/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flogon.js
webmail.l9qyw.asia/static/templete/microsft2/files/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgntopl.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ |
4 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgntopr.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ |
581 B 787 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgnexlogo.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ |
61 B 265 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgnbotl.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ |
9 KB 9 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgnbotr.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdn.bootcdn.net/ajax/libs/jquery/3.6.4/ |
286 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.js
hm.baidu.com/ |
29 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgntopm.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ |
58 B 262 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgnleft.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ |
290 B 495 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgnright.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ |
306 B 511 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lgnbotm.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ |
276 B 482 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.gif
hm.baidu.com/ |
43 B 299 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| initLogon function| redir function| shw function| hd function| clkExp function| clkSec function| clkBsc function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker function| secureCookie function| isHttps object| _hmt function| $ function| jQuery function| chekmail boolean| _bdhm_loaded_3226b22f2a06945ceb732c2228e96b24 object| mini_tangram_log_w7gkj64 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
webmail.l9qyw.asia/ | Name: PHPSESSID Value: f98f587acc7a5125ad2f0d3063188ed4 |
|
.hm.baidu.com/ | Name: HMACCOUNT_BFESS Value: 5A69C7392D01BF57 |
|
.webmail.l9qyw.asia/ | Name: Hm_lvt_3226b22f2a06945ceb732c2228e96b24 Value: 1681813223 |
|
.webmail.l9qyw.asia/ | Name: Hm_lpvt_3226b22f2a06945ceb732c2228e96b24 Value: 1681813223 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.bootcdn.net
hm.baidu.com
webmail.l9qyw.asia
103.235.46.191
221.194.141.164
23.224.233.87
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
30f412c43f8a261b5727d613c1f17c80c1d8a031cca1c00f3443d864a7e6bef4
36217693f31f1cdef59f918ee1602a3eae649a96200aef9bee50bc0f7c6a600d
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a
6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1
808c144b550309d5e4bf04c7d433deeb93a0c7070ac3ff904c4b297fabe24cb1
8b4840993268e6151ad10c4420ef82c16aa027484b2609b28d007b1f99877207
8c858b7c5622a62b1c7e7f41456b399ced5ca1906ba8b248e9cd8743e0c2db27
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301