urlscan.io logo urlscan.io
SecurityTrails logo

kolito.tk Open in urlscan Pro
162.240.38.177  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://kolito.tk/gs/login.globalsources.com/sso/
Effective URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Submission: On January 30 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 162.240.38.177, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is kolito.tk.
TLS certificate: Issued by R3 on January 22nd 2022. Valid for: 3 months.
This is the only time kolito.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Global Sources (E-commerce)

Domain & IP information

IP Address AS Autonomous System
4 162.240.38.177 46606 (UNIFIEDLA...)
7 203.92.211.29 2687 (ATGS-MMD-AS)
11 2
Apex Domain
Subdomains		 Transfer
7 globalsources.com
login.globalsources.com
70 KB
4 kolito.tk
kolito.tk
12 KB
11 2
Domain Requested by
7 login.globalsources.com kolito.tk
4 kolito.tk kolito.tk
11 2

This site contains links to these domains. Also see Links.

Domain
www.globalsources.com
login.globalsources.com
Subject Issuer Validity Valid
www.kolito.tk
R3		 2022-01-22 -
2022-04-22		 3 months crt.sh
login.globalsources.com
Thawte RSA CA 2018		 2021-09-08 -
2022-10-09		 a year crt.sh

This page contains 1 frames:

Primary Page: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Frame ID: 0FFFCC37AFC10D29B79D7AD62C3FF8AE
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Global Sources

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

82 kB
Transfer

201 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
kolito.tk/gs/login.globalsources.com/sso/ 		0
121 B 		Document
General
Check archive.org
Download Go to
Full URL
https://kolito.tk/gs/login.globalsources.com/sso/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.240.38.177 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
5581747.muzawa.tk
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

refresh
0; url=GeneralManager.php?action=Login&cid=&rand=36039111
content-length
0
content-type
text/html; charset=UTF-8
date
Sun, 30 Jan 2022 16:11:41 GMT
server
Apache
Primary Request GeneralManager.php
kolito.tk/gs/login.globalsources.com/sso/ 		12 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.240.38.177 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
5581747.muzawa.tk
Software
Apache /
Resource Hash
60bb6ff3eed8631bc3342a974806bba51874b87a7ed14907f76e3d8218417cfe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/gs/login.globalsources.com/sso/

Response headers

content-type
text/html; charset=UTF-8
date
Sun, 30 Jan 2022 16:11:42 GMT
server
Apache
BASE.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/includes/BASE.CSS
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
a0ff7bd26675d0bd632c14628c1dbf2dd81ff6f092575f1616551d2eca4700b3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 18 Jan 2022 05:57:18 GMT
Server
Apache
ntCoent-Length
3613
Vary
grlnclientipaddr
Content-Type
text/css
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1280
Expires
Mon, 01 Jan 1999 00:00:00 GMT
SSO.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/ 		42 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/includes/SSO.CSS
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
a902a54ef745281d6db09a88afc32e80efbb5b355bfb7828a49a6899d2865613
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 18 Jan 2022 06:05:42 GMT
Server
Apache
ntCoent-Length
42892
Vary
grlnclientipaddr
Content-Type
text/css
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
10518
Expires
Mon, 01 Jan 1999 00:00:00 GMT
jqueryandplugins.js
login.globalsources.com/sso/gsol/pex/en/balat/includes/ 		99 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/includes/jqueryandplugins.js
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
5ee7561a3a5c0bcfd620ab6004ff7cab8ee16c800aada8a165c32cd104086cd5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:43 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Dec 2021 06:26:14 GMT
Server
Apache
ntCoent-Length
101169
Vary
grlnclientipaddr
Content-Type
application/x-javascript
Transfer-Encoding
chunked
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Expires
Mon, 01 Jan 1999 00:00:00 GMT
ssoscripts.js
login.globalsources.com/sso/gsol/pex/en/common/includes/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login.globalsources.com/sso/gsol/pex/en/common/includes/ssoscripts.js
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
32f86e94393b05f14551012f52a982144bf746f23b51c1209ceadeceb2ee75b4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:44 GMT
Content-Encoding
gzip
Last-Modified
Tue, 18 Jan 2022 06:03:37 GMT
Server
Apache
ntCoent-Length
40516
Vary
grlnclientipaddr
Content-Type
application/x-javascript
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
11262
Expires
Mon, 01 Jan 1999 00:00:00 GMT
GSLOGO.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/images/GSLOGO.PNG
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
465c8b941a45a964b3c73162a3357083c03e807f2eb45a6e0cc03658f686ece6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:43 GMT
Last-Modified
Fri, 10 Dec 2021 06:26:14 GMT
Server
Apache
Vary
grlnclientipaddr
Content-Type
image/png
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3788
Expires
Mon, 01 Jan 1999 00:00:00 GMT
BLANK.GIF
login.globalsources.com/sso/gsol/pex/en/balat/images/ 		43 B
669 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/images/BLANK.GIF
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:45 GMT
Last-Modified
Mon, 13 Dec 2021 05:40:24 GMT
Server
Apache
Vary
grlnclientipaddr
Content-Type
image/gif
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
43
Expires
Mon, 01 Jan 1999 00:00:00 GMT
webtrends-prod.js
kolito.tk/sso/gsol/pex/en/balat/includes/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://kolito.tk/sso/gsol/pex/en/balat/includes/webtrends-prod.js
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.240.38.177 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
5581747.muzawa.tk
Software
Apache /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Sun, 30 Jan 2022 16:11:43 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
LINKEDIN_BUTTON.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/images/LINKEDIN_BUTTON.PNG
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
d0f108ac5521a079f476c836ca9612310bd8da9e75ba91ff412653453939ae51
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 30 Jan 2022 16:11:45 GMT
Last-Modified
Mon, 13 Dec 2021 05:40:24 GMT
Server
Apache
Vary
grlnclientipaddr
Content-Type
image/png
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1634
Expires
Mon, 01 Jan 1999 00:00:00 GMT
webtrends-prod.js
kolito.tk/sso/gsol/pex/en/balat/includes/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://kolito.tk/sso/gsol/pex/en/balat/includes/webtrends-prod.js
Requested by
Host: kolito.tk
URL: https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.240.38.177 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
5581747.muzawa.tk
Software
Apache /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kolito.tk/gs/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=&rand=36039111
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Sun, 30 Jan 2022 16:11:43 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Global Sources (E-commerce)

150 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| sldpnl function| $ function| jQuery object| Color number| DELAY_SHOW_HIDE string| RFI_MINILOGIN string| RFI_MINIREG string| RFI_MINIREG_PALITE string| USER_REGISTRATION string| PALITE_UPGRADE string| USER_PROFILE string| RFQ_REG string| M_REG string| M_RFI_REG string| EMAGLITE_REG string| LOGIN_LINKEDIN string| BUYER_REGISTRATION_LINKEDIN string| LINKEDIN_EXISTING string| LINKEDIN_NEWREG string| LINKEDIN_EXISTING_NOAPP object| WTSI_P_PREFIX function| winPop function| winPop2 function| winPop3 function| sortThis function| toggleDefValue function| syncCheckboxToHidden function| checkValidID function| getRandom boolean| isMSIE3 string| path number| expDays object| exp string| value function| GetCookie function| SetCookie function| DeleteCookie function| setUniqCookie function| showBox function| hideBox function| delayShowBox function| delayHideBox function| delayShowBox2 function| delayHideBox2 function| toggleHiddenByCheckbox function| checkKeyword function| LTrim function| RTrim function| Trim function| checkIsFilledMandatory function| checkForEmailError function| validateEmailValue function| trimFieldValue function| checkforEmail function| checkEmailFieldNoTrack function| checkEmailIsNotInError function| checkEmailField function| showEmailTipWithError function| showEmailTipWithErrorEmag function| showEmailTipWithErrorEmagCheck function| showErrorEmagLoginCheck function| hasSpecialChars function| hasSpaceChars function| checkUidChar function| showUidTipWithError function| checkPwdChar function| checkValuesMatch function| isNum function| isNumWithSpace function| isPhone function| extendisPhone function| checkNameBg function| changeNameBg function| checkFieldIsNotInError function| changePhoneBg function| toggleLabelColor function| checkEmailBg function| checkPhoneBg function| validatePhoneForEmag function| validatePhoneNumberForEmag function| validatePhoneForOTP function| validateOTPInput function| hideErrorBoxForOTP function| checkPhoneBgEmag function| changeCompanyNameBg function| checkCompanyNameBgEmag function| checkNameBgEmagLiteForm function| checkEmagSelected function| validateCompanyNameForEmag function| checkCombineNameEmag function| checkNameBgEmagLiteFormNew function| checkCompanyURL function| checkCompanyURLFieldError function| checkCompanyURLField function| checkCompanyURLFieldMobile function| checkCompanyDescriptionField function| WTFieldErrorTag function| WTFieldPWLengthErrorTag function| WTFieldTag function| WTNumFieldTag string| msg_invalidemailchar string| msg_invalidemail string| invalidemailchar string| invalidemail string| iChar string| iEmail boolean| goWT_Track function| getEvent function| automailKeydown function| automail function| fillinmaill function| hideAutomailBox undefined| req undefined| ctyflag function| checkCountryFieldMobile function| validatingCountryMobile boolean| first_load function| processCountryMobile function| checkUid function| requestReminder function| removeSpaceTelFax function| removeSpaceTelMobile function| removeSpaces function| checkIMoption function| checkEMoption function| isEmpty function| validatePAKW function| toggleCheckBox undefined| compurl function| appendSuggestedCompUrl function| showOverlayLogin function| downloadfile function| checkCompanyURLFieldForSmallRFI function| InvalidMsg object| today number| timetoday number| randm string| timenow boolean| nets boolean| nseven number| bVer function| displayFocus function| login_decodeappURL function| login_decodeRegAppURL function| login_decodeSubAppURL function| displayAlert object| snooky function| showMsg undefined| _tag

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://kolito.tk/sso/gsol/pex/en/balat/includes/webtrends-prod.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://kolito.tk/sso/gsol/pex/en/balat/includes/webtrends-prod.js
Message:
Failed to load resource: the server responded with a status of 404 ()