![](/screenshots/20c9a6ae-9fb1-42e0-8727-84c93eb4a1d2.png)
diqvkzlvrbzquvzbdutt0g.on.drv.tw
Open in
urlscan Pro
47.251.10.111
Malicious Activity!
Public Scan
Effective URL: https://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d616gdgdidbcmzrly5zx6g...
Submission: On September 29 via api from AU — Scanned from AU
Summary
TLS certificate: Issued by R3 on July 2nd 2023. Valid for: 3 months.
This is the only time diqvkzlvrbzquvzbdutt0g.on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 47.88.48.79 47.88.48.79 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
6 | 47.251.10.111 47.251.10.111 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
2 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 192.229.179.87 192.229.179.87 | 15133 (EDGECAST) (EDGECAST) | |
2 | 142.250.76.106 142.250.76.106 | 15169 (GOOGLE) (GOOGLE) | |
2 | 52.175.64.109 52.175.64.109 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
6 | 142.251.221.72 142.251.221.72 | 15169 (GOOGLE) (GOOGLE) | |
5 | 172.217.167.78 172.217.167.78 | 15169 (GOOGLE) (GOOGLE) | |
2 | 216.239.38.181 216.239.38.181 | 15169 (GOOGLE) (GOOGLE) | |
2 | 142.250.4.155 142.250.4.155 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.66.227 142.250.66.227 | 15169 (GOOGLE) (GOOGLE) | |
30 | 10 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
diqvkzlvrbzquvzbdutt0g.on.drv.tw |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
diqvkzlvrbzquvzbdutt0g.on.drv.tw |
ASN15169 (GOOGLE, US)
PTR: syd09s24-in-f10.1e100.net
ajax.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: syd09s31-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: syd15s06-in-f14.1e100.net
www.google-analytics.com |
ASN15169 (GOOGLE, US)
PTR: sm-in-f155.1e100.net
stats.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: syd15s15-in-f3.1e100.net
www.google.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
drv.tw
1 redirects
diqvkzlvrbzquvzbdutt0g.on.drv.tw www.drv.tw — Cisco Umbrella Rank: 944778 |
216 KB |
6 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 111 |
446 KB |
5 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 96 |
42 KB |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 175 |
416 B |
2 |
google.com
analytics.google.com — Cisco Umbrella Rank: 270 |
322 B |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 720 |
59 KB |
2 |
w3schools.com
www.w3schools.com — Cisco Umbrella Rank: 31345 |
11 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 410 |
12 KB |
1 |
google.com.au
www.google.com.au — Cisco Umbrella Rank: 17063 |
408 B |
30 | 9 |
Domain | Requested by | |
---|---|---|
7 | diqvkzlvrbzquvzbdutt0g.on.drv.tw |
1 redirects
diqvkzlvrbzquvzbdutt0g.on.drv.tw
|
6 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
5 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com diqvkzlvrbzquvzbdutt0g.on.drv.tw |
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | analytics.google.com |
www.googletagmanager.com
|
2 | www.drv.tw |
diqvkzlvrbzquvzbdutt0g.on.drv.tw
|
2 | ajax.googleapis.com |
diqvkzlvrbzquvzbdutt0g.on.drv.tw
|
2 | www.w3schools.com |
diqvkzlvrbzquvzbdutt0g.on.drv.tw
|
2 | cdnjs.cloudflare.com |
diqvkzlvrbzquvzbdutt0g.on.drv.tw
|
1 | www.google.com.au |
diqvkzlvrbzquvzbdutt0g.on.drv.tw
|
30 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2023-07-02 - 2023-09-30 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.w3schools.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-03-05 - 2024-04-04 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
www.drv.tw GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2023-07-31 - 2024-01-31 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
*.google.com.au GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d616gdgdidbcmzrly5zx6g6tlyvlq7hs7c5tmq5
Frame ID: DB5FE150C360B0396747AA1C907814B3
Requests: 17 HTTP requests in this frame
Frame:
https://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d616gdgdidbcmzrly5zx6g6tlyvlq7hs7c5tmq5
Frame ID: 43C84837DC026DA63427637C44C6630E
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/20c9a6ae-9fb1-42e0-8727-84c93eb4a1d2.png)
Page Title
Authentication ...Page URL History Show full URLs
-
http://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d6...
HTTP 307
https://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d6... Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d616gdgdidbcmzrly5zx6g6tlyvlq7hs7c5tmq5
HTTP 307
https://diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/INFO-UPDATE.htm?6d61696c2822526f6f74484b523139363040476d616gdgdidbcmzrly5zx6g6tlyvlq7hs7c5tmq5 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
INFO-UPDATE.htm
diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/ Redirect Chain
|
522 KB 103 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
INFO-UPDATE.htm
diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/ Frame 43C8 |
522 KB 103 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 841 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2_002.png
diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/images/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2_002.png
diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/PORTAL%20-%20GMAIL%20Mail_files/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
131 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 43C8 |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ Frame 43C8 |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 43C8 |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ Frame 43C8 |
690 B 497 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2_002.png
diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/images/ Frame 43C8 |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2_002.png
diqvkzlvrbzquvzbdutt0g.on.drv.tw/www.mailserver.com/PORTAL%20-%20GMAIL%20Mail_files/ Frame 43C8 |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
217 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
283 KB 93 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ Frame 43C8 |
131 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ Frame 43C8 |
217 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ Frame 43C8 |
283 KB 93 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Frame 43C8 |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 146 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 268 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 56 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com.au/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 69 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ Frame 43C8 |
35 B 194 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 360 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ Frame 43C8 |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture string| s string| m function| $ function| jQuery function| _0x7f6e05 function| _0x38cc1d function| _0x1e2ddf function| _0x1a884c function| _0x55bc6e function| _0x57e6 function| _0x2bcd69 function| _0x3d59 function| _0x5e1881 function| _0x5df10e function| _0x55a480 function| _0x554465 function| _0x524c08 function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
diqvkzlvrbzquvzbdutt0g.on.drv.tw/ | Name: uid Value: rBSZwGUWPj8kjwV0g7MEAg== |
|
.drv.tw/ | Name: _gid Value: GA1.2.89536446.1695956549 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga Value: GA1.1.1514804744.1695956549 |
|
.drv.tw/ | Name: _ga_LHL0SH0Z7S Value: GS1.1.1695956548.1.1.1695956549.59.0.0 |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1695956548.1.1.1695956549.0.0.0 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
analytics.google.com
cdnjs.cloudflare.com
diqvkzlvrbzquvzbdutt0g.on.drv.tw
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.google.com.au
www.googletagmanager.com
www.w3schools.com
104.17.25.14
142.250.4.155
142.250.66.227
142.250.76.106
142.251.221.72
172.217.167.78
192.229.179.87
216.239.38.181
47.251.10.111
47.88.48.79
52.175.64.109
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
14c92656d5d7896a0bae8de4da47f0ba4074328976da752591e2320fe57b5d0e
43a55b887a2a636bdc2ed35ac3f94573ec530f99da6c9eda1a05f5e9a8e7fc4c
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
6b3f3a7460651ddeff5dfb9e8a0a170d85213a8168260be829ccb9cbce77fadd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
ab04ea00add135d1972e76d4ca04beb8e497bf72554c2ab074ec4470cf81d319
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c615533d796a2d883fcabff8d39bfdccf25d8a9114f682b2d8ed0972d9c6e6
fe30e9ad9c994239a1e8a49a7b6512ce48a4ce4d01b7695a5692ec0045241f41