defjet.com.br
Open in
urlscan Pro
216.172.160.37
Malicious Activity!
Public Scan
Submission: On April 11 via automatic, source openphish
Summary
This is the only time defjet.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 163.cn (Online) Generic China (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 216.172.160.37 216.172.160.37 | 20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC) | |
7 | 43.230.90.2 43.230.90.2 | 135391 (AOFEI-HK ...) (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED) | |
1 | 123.125.50.100 123.125.50.100 | 4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network) | |
1 | 223.252.195.133 223.252.195.133 | 45062 (NETEASE-A...) (NETEASE-AS Guangzhou NetEase Computer System Co.) | |
1 | 54.217.235.157 54.217.235.157 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
13 | 6 |
ASN20013 (CYRUSONE - CyrusOne LLC, US)
PTR: vps.mercadaodoscartuchos.com.br
defjet.com.br |
ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
PTR: proxy90-2.mail.163.com
mimg.127.net |
ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
ssl.mail.163.com |
ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN)
analytics.163.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-217-235-157.eu-west-1.compute.amazonaws.com
mail.163.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
127.net
mimg.127.net |
25 KB |
3 |
163.com
ssl.mail.163.com analytics.163.com mail.163.com Failed iplocator.mail.163.com Failed |
7 KB |
1 |
defjet.com.br
defjet.com.br |
57 KB |
13 | 3 |
Domain | Requested by | |
---|---|---|
7 | mimg.127.net |
defjet.com.br
|
1 | mail.163.com |
defjet.com.br
|
1 | analytics.163.com |
defjet.com.br
|
1 | ssl.mail.163.com |
defjet.com.br
|
1 | defjet.com.br | |
0 | iplocator.mail.163.com Failed |
mimg.127.net
|
13 | 6 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl.mail.163.com GeoTrust SSL CA - G3 |
2015-10-15 - 2018-01-30 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://defjet.com.br/net/mail.163.com/index.htm
Frame ID: 1067.1
Requests: 12 HTTP requests in this frame
Frame:
http://mail.163.com/preload5.htm
Frame ID: 1067.5
Requests: 1 HTTP requests in this frame
22 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: 免费邮
Search URL Search Domain Scan URL
Title: 企业邮
Search URL Search Domain Scan URL
Title: VIP邮箱
Search URL Search Domain Scan URL
Title: 国外用户登录
Search URL Search Domain Scan URL
Title: 帮助
Search URL Search Domain Scan URL
Title: 忘记密码了?
Search URL Search Domain Scan URL
Title: 什么是自动登录
Search URL Search Domain Scan URL
Title: 注 册
Search URL Search Domain Scan URL
Title: 注 册
Search URL Search Domain Scan URL
Title: 适配iPad版本
Search URL Search Domain Scan URL
Title: 手机智能版
Search URL Search Domain Scan URL
Title: 在线答疑
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: 关于网易
Search URL Search Domain Scan URL
Title: 关于网易免费邮
Search URL Search Domain Scan URL
Title: 邮箱官方博客
Search URL Search Domain Scan URL
Title: 客户服务
Search URL Search Domain Scan URL
Title: 隐私政策
Search URL Search Domain Scan URL
Title: 意见反馈>>
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.htm
defjet.com.br/net/mail.163.com/ |
57 KB 57 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base_v3.js
mimg.127.net/index/lib/scripts/ |
23 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
163logo.gif
mimg.127.net/logo/ |
7 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
netease_logo.gif
mimg.127.net/logo/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
knet.png
mimg.127.net/logo/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
httpsEnable.gif
ssl.mail.163.com/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ntes.js
analytics.163.com/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_v5.png
mimg.127.net/index/163/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
preload5.htm
mail.163.com/ Frame 1067 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
130227_jimmy4_cnt.jpg
mimg.127.net/index/163/themes/ |
1 KB 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
130227_jimmy4_bg.jpg
mimg.127.net/index/163/themes/ |
1 KB 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
iplocator
iplocator.mail.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
mail.163.com/ |
564 B 564 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mail.163.com
- URL
- http://mail.163.com/preload5.htm
- Domain
- iplocator.mail.163.com
- URL
- http://iplocator.mail.163.com/iplocator?callback=fGetLocator
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 163.cn (Online) Generic China (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.163.com
defjet.com.br
iplocator.mail.163.com
mail.163.com
mimg.127.net
ssl.mail.163.com
iplocator.mail.163.com
mail.163.com
123.125.50.100
216.172.160.37
223.252.195.133
43.230.90.2
54.217.235.157
0b52c5338af355699530a47683420e48c7344e779d3e815ff9943cbfdc153cf2
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
1f8529f6983fe618dc540f324195a6e2ff69f06a1d60631db28a0eab31180180
3d52c36a019e36a3fd86ed941536684814fecb0dc6c24c6f65d0ade3456dc42b
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
a0ceb7edc5991f85a9613588811fee01502816f4a31ed92b19b348c07854f052
afd22221de115fda157aca40e2e1c834c42fa6718167c633495c9681a5bcfc57
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
f92d6a9738a0f1a436634753634c4ba122ca21de25ab5cde4b8de992fdfd8948