webmail.l9qyw.asia Open in urlscan Pro
23.224.233.87 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://webmail.l9qyw.asia/index/t3.html
Submission: On April 18 via automatic, source phishtank (April 18th 2023, 10:20:30 am UTC) — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 16 HTTP transactions. The main IP is 23.224.233.87, located in United States and belongs to CNSERVERS, US. The main domain is webmail.l9qyw.asia.
TLS certificate: Issued by R3 on April 14th 2023. Valid for: 3 months.

This is the only time webmail.l9qyw.asia was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
13	23.224.233.87 23.224.233.87	40065 (CNSERVERS) (CNSERVERS)
1	221.194.141.164 221.194.141.164	4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone)
2	103.235.46.191 103.235.46.191	55967 (BAIDU Bei...) (BAIDU Beijing Baidu Netcom Science and Technology Co.)
16	3

13 23.224.233.87 (United States)

ASN40065 (CNSERVERS, US)

webmail.l9qyw.asia	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 221.194.141.164 (China)

ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)

cdn.bootcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.235.46.191 (Hong Kong)

ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	l9qyw.asia webmail.l9qyw.asia	27 KB
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 6664	12 KB
1	bootcdn.net cdn.bootcdn.net — Cisco Umbrella Rank: 99683	104 KB
16	3

	Domain	Requested by
13	webmail.l9qyw.asia	webmail.l9qyw.asia
2	hm.baidu.com	webmail.l9qyw.asia
1	cdn.bootcdn.net	webmail.l9qyw.asia
16	3

This site contains no links.

Subject Issuer	Validity	Valid
webmail.iymqf.asia R3	`2023-04-14` - `2023-07-13`	3 months	crt.sh
cdn.bootcdn.net TrustAsia RSA DV TLS CA G2	`2022-06-06` - `2023-06-06`	a year	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2022-07-05` - `2023-08-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://webmail.l9qyw.asia/index/t3.html
Frame ID: A4E759BEFCD5F715F18A29C431859A02
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web App

Detected technologies

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

143 kB
Transfer

352 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request t3.html Show response
webmail.l9qyw.asia/index/ 8 KB
3 KB 1654ms
354ms Document
text/html 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

8c858b7c5622a62b1c7e7f41456b399ced5ca1906ba8b248e9cd8743e0c2db27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 18 Apr 2023 10:20:19 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 logon.css
webmail.l9qyw.asia/static/templete/microsft2/files/ 3 KB
1 KB 270ms
270ms Stylesheet
text/css 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

8b4840993268e6151ad10c4420ef82c16aa027484b2609b28d007b1f99877207

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:19 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Mon, 10 Apr 2023 05:00:14 GMT
server: nginx
etag: W/"643397de-a01"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Tue, 18 Apr 2023 22:20:19 GMT

GET
H2 200 owafont_zh_chs.css
webmail.l9qyw.asia/static/templete/microsft2/files/ 5 KB
2 KB 271ms
271ms Stylesheet
text/css 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/owafont_zh_chs.css

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

30f412c43f8a261b5727d613c1f17c80c1d8a031cca1c00f3443d864a7e6bef4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:19 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: W/"643384fa-159e"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Tue, 18 Apr 2023 22:20:19 GMT

GET
H2 200 flogon.js Show response
webmail.l9qyw.asia/static/templete/microsft2/files/ 4 KB
2 KB 272ms
272ms Script
application/javascript 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/flogon.js

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

808c144b550309d5e4bf04c7d433deeb93a0c7070ac3ff904c4b297fabe24cb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:19 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: W/"643384fa-1065"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Tue, 18 Apr 2023 22:20:19 GMT

GET
H2 200 lgntopl.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ 4 KB
5 KB 275ms
274ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/lgntopl.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: "643384fa-1167"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 4455
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgntopr.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ 581 B
787 B 277ms
276ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/lgntopr.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: "643384fa-245"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 581
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgnexlogo.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ 61 B
265 B 277ms
277ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/lgnexlogo.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: "643384fa-3d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 61
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgnbotl.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ 9 KB
9 KB 542ms
542ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/lgnbotl.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: "643384fa-245f"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 9311
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgnbotr.gif
webmail.l9qyw.asia/static/templete/microsft2/files/ 2 KB
3 KB 543ms
543ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/files/lgnbotr.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/index/t3.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 03:39:38 GMT
server: nginx
etag: "643384fa-958"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2392
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 jquery.js Show response
cdn.bootcdn.net/ajax/libs/jquery/3.6.4/ 286 KB
104 KB 1045ms
188ms Script
application/javascript 221.194.141.164
CHINA169-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bootcdn.net/ajax/libs/jquery/3.6.4/jquery.js

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

221.194.141.164 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),

Reverse DNS

Software

openresty /

Resource Hash

6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

nginx-hit: 1
date: Tue, 18 Apr 2023 10:20:21 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-ccdn-cachettl: 31536000
via: CHN-HElangfang-AREACUCC2-CACHE11[3],CHN-HElangfang-AREACUCC2-CACHE56[0,TCP_HIT,0],CHN-SH-GLOBAL1-CACHE154[860],CHN-SH-GLOBAL1-CACHE97[846,TCP_MISS,859],EA-SGP-GLOBAL1-CACHE24[565],EA-SGP-GLOBAL1-CACHE4[558,TCP_MISS,561]
age: 3198659
content-encoding: gzip
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 08 Mar 2023 16:05:42 GMT
server: openresty
cf-cdnjs-via: cfworker/kv
etag: W/"6408b256-1517c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Byd%2F0JSkGb%2F53tmDnjwhGB2tBCAb87izRf4ygOimpyQMx6Qn2D3fmYiyhVq0hJzcVkrsI2%2Fa1uo8zmtyZV2QUngcKnTRVDpa%2FYUC9Bx6T54SOt%2FOdEs0MIxQ9%2FgPqMPmi0Kg1vn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
x-ccdn-expires: 28337359
timing-allow-origin: *
cf-ray: 7a6b20727b41ab44-SIN
x-hcs-proxy-type: 1
expires: Fri, 01 Mar 2024 09:49:22 GMT

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 1927ms
352ms Script
application/javascript 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?3226b22f2a06945ceb732c2228e96b24

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

36217693f31f1cdef59f918ee1602a3eae649a96200aef9bee50bc0f7c6a600d

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 18 Apr 2023 10:20:21 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=172800
Server: apache
Etag: 52167af2516bb245beb3896826b343e1
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: application/javascript
Cache-Control: max-age=0, must-revalidate
Content-Length: 11266

GET
H2 200 lgntopm.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ 58 B
262 B 542ms
541ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/images/lgntopm.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 04:55:16 GMT
server: nginx
etag: "643396b4-3a"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 58
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgnleft.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ 290 B
495 B 542ms
542ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/images/lgnleft.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 03:44:00 GMT
server: nginx
etag: "64338600-122"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 290
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgnright.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ 306 B
511 B 541ms
540ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/images/lgnright.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 04:59:58 GMT
server: nginx
etag: "643397ce-132"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 306
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H2 200 lgnbotm.gif
webmail.l9qyw.asia/static/templete/microsft2/images/ 276 B
482 B 541ms
541ms Image
image/gif 23.224.233.87
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://webmail.l9qyw.asia/static/templete/microsft2/images/lgnbotm.gif

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.224.233.87 , United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

nginx /

Resource Hash

6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/static/templete/microsft2/files/logon.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 18 Apr 2023 10:20:20 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 10 Apr 2023 04:59:10 GMT
server: nginx
etag: "6433979e-114"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 276
expires: Thu, 18 May 2023 10:20:20 GMT

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 332ms
332ms Image
image/gif 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=1295254903&si=3226b22f2a06945ceb732c2228e96b24&v=1.3.0&lv=1&sn=54053&r=0&ww=1600&u=https%3A%2F%2Fwebmail.l9qyw.asia%2Findex%2Ft3.html&tt=Outlook%20Web%20App

Requested by

Host: webmail.l9qyw.asia
URL: https://webmail.l9qyw.asia/index/t3.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://webmail.l9qyw.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 18 Apr 2023 10:20:22 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
Server: apache
Content-Type: image/gif
Cache-Control: private, max-age=0, no-cache
Content-Length: 43

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
webmail.l9qyw.asia/	1969-12-31 23:59:59	Name: PHPSESSID Value: f98f587acc7a5125ad2f0d3063188ed4
.hm.baidu.com/	1970-01-20 20:46:13	Name: HMACCOUNT_BFESS Value: 5A69C7392D01BF57
.webmail.l9qyw.asia/	1970-01-20 19:55:49	Name: Hm_lvt_3226b22f2a06945ceb732c2228e96b24 Value: 1681813223
.webmail.l9qyw.asia/	1969-12-31 23:59:59	Name: Hm_lpvt_3226b22f2a06945ceb732c2228e96b24 Value: 1681813223

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.bootcdn.net
hm.baidu.com
webmail.l9qyw.asia
103.235.46.191
221.194.141.164
23.224.233.87
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
30f412c43f8a261b5727d613c1f17c80c1d8a031cca1c00f3443d864a7e6bef4
36217693f31f1cdef59f918ee1602a3eae649a96200aef9bee50bc0f7c6a600d
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a
6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1
808c144b550309d5e4bf04c7d433deeb93a0c7070ac3ff904c4b297fabe24cb1
8b4840993268e6151ad10c4420ef82c16aa027484b2609b28d007b1f99877207
8c858b7c5622a62b1c7e7f41456b399ced5ca1906ba8b248e9cd8743e0c2db27
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

webmail.l9qyw.asia Open in urlscan Pro 23.224.233.87 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

143 kBTransfer

352 kBSize

4 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

webmail.l9qyw.asia Open in urlscan Pro
23.224.233.87 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

143 kB
Transfer

352 kB
Size

4
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!