nkddhvvjz.misecure.com
Open in
urlscan Pro
152.89.218.174
Malicious Activity!
Public Scan
URL:
https://nkddhvvjz.misecure.com/75a83d1d2aac384631b6e960345f.php?sam=77
Submission: On September 22 via automatic, source openphish — Scanned from DE
Submission: On September 22 via automatic, source openphish — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 152.89.218.174, located in
Estonia and
belongs to SMARTAPE, RU.
The main domain is nkddhvvjz.misecure.com.
TLS certificate: Issued by R3 on September 21st 2023. Valid for: 3 months.
This is the only time nkddhvvjz.misecure.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on September 21st 2023. Valid for: 3 months.
This is the only time nkddhvvjz.misecure.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic China (Online) 163.cn (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 152.89.218.174 152.89.218.174 | 56694 (SMARTAPE) (SMARTAPE) | |
| 1 | 103.129.252.89 103.129.252.89 | 137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED) | |
| 14 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
misecure.com
nkddhvvjz.misecure.com |
105 KB |
| 1 |
127.net
mimg.127.net — Cisco Umbrella Rank: 120911 |
134 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | nkddhvvjz.misecure.com |
nkddhvvjz.misecure.com
|
| 1 | mimg.127.net |
nkddhvvjz.misecure.com
|
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| qiye.163.com |
| hw.qiye.163.com |
| mail.qiye.163.com |
| gb.corp.163.com |
| weibo.com |
| reg.163.com |
| ss.knet.cn |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| nkddhvvjz.misecure.com R3 |
2023-09-21 - 2023-12-20 |
3 months | crt.sh |
| mimg.127.net GeoTrust RSA CN CA G2 |
2023-08-29 - 2024-09-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://nkddhvvjz.misecure.com/75a83d1d2aac384631b6e960345f.php?sam=77
Frame ID: 9A7A60B72CA722C62814DA54FE799497
Requests: 20 HTTP requests in this frame
9 Outgoing links
These are links going to different origins than the main page.
URL: https://qiye.163.com/
Search URL Search Domain Scan URL
URL: https://qiye.163.com/entry/buy-price.htm
Title: 新用户开通
Title: 新用户开通
Search URL Search Domain Scan URL
URL: https://hw.qiye.163.com/
Title: 国外用户登录
Title: 国外用户登录
Search URL Search Domain Scan URL
URL: https://mail.qiye.163.com/mailapp/qiyeurs/?hl=en_US&from=http%3A%2F%2Fmail.qiye.163.com%2F#/resetPwd
Title: Forget password
Title: Forget password
Search URL Search Domain Scan URL
URL: http://gb.corp.163.com/gb/home.shtml
Title: 关于网易
Title: 关于网易
Search URL Search Domain Scan URL
URL: http://weibo.com/163qiye
Title: 官方微博
Title: 官方微博
Search URL Search Domain Scan URL
URL: http://gb.corp.163.com/gb/legal.html
Title: 相关法律
Title: 相关法律
Search URL Search Domain Scan URL
URL: https://reg.163.com/agreement_mobile_ysbh_wap.shtml?v=20171127
Title: 隐私政策
Title: 隐私政策
Search URL Search Domain Scan URL
URL: https://ss.knet.cn/verifyseal.dll?sn=e12051044010020841301459&ct=df&pa=151131
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
75a83d1d2aac384631b6e960345f.php
nkddhvvjz.misecure.com/ |
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
base_v3.js
nkddhvvjz.misecure.com/files/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
qiye_algorithm.js
nkddhvvjz.misecure.com/files/ |
27 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
raven-3.js
nkddhvvjz.misecure.com/files/ |
37 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
nkddhvvjz.misecure.com/files/ |
41 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
getqrcode.jpg
nkddhvvjz.misecure.com/files/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
year.js
nkddhvvjz.misecure.com/files/ |
23 B 69 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
knet.png
nkddhvvjz.misecure.com/files/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
httpsEnable.gif
nkddhvvjz.misecure.com/files/ |
43 B 97 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
es5-polyfill.js
nkddhvvjz.misecure.com/files/ |
2 KB 762 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vendorsindex.js
nkddhvvjz.misecure.com/files/ |
47 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.js
nkddhvvjz.misecure.com/files/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
raven-3.js
nkddhvvjz.misecure.com/files/ |
0 14 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
promPic.png
mimg.127.net/m/lc/img/qiye/45/95/1/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
588 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
461 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
341 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
163 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic China (Online) 163.cn (Online)131 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| fCheckLoginNow function| fCheckAutoLogin function| fAutoLogin undefined| gbForcepc object| oAndroidRedirect function| fCheckBrowser function| fHtml5Tag function| fCheckCookie function| fGetQuery function| fGetQueryHash function| $id function| fTrim function| fParseMNum function| fCheckAccount function| fGetScript function| fGetCookie function| fSetCookie function| fEventListen function| fEventUnlisten function| fRandom function| fUrlP function| fResize function| fFQ function| fStartTime object| gUserInfo object| gVisitorCookie undefined| gMobileNumMailIsForbidden undefined| gMobileNumMailResult object| gMobileNumMail function| fEnData function| loginRequest function| getRnd undefined| DOMContentLoaded function| DOMREADY string| base64EncodeChars function| base64encode function| utf16to8 function| fGetLocator function| fSetGadIndex function| MobCallback boolean| bGettingAlgorithm object| gIndexAd string| b64map string| b64pad function| hex2b64 function| b64tohex function| b64toBA number| dbits number| canary boolean| j_lm function| BigInteger function| nbi function| am1 function| am2 function| am3 number| BI_FP string| BI_RM object| BI_RC number| rr number| vv function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| Arcfour function| ARC4init function| ARC4next function| prng_newstate number| rng_psize undefined| rng_state object| rng_pool number| rng_pptr function| rng_seed_int function| rng_seed_time number| t undefined| z function| rng_get_byte function| rng_get_bytes function| SecureRandom function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt function| add function| MD5hex function| R1 function| R2 function| R3 function| R4 function| MD5 object| Raven object| webpackJsonp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mimg.127.net
nkddhvvjz.misecure.com
103.129.252.89
152.89.218.174
098ec9249cb3e97872e1862b4400b9db4c6622a4d089b64b752ffc73b3ef7a30
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
58d160da1c3c3a8fdc93ce59449ae45ba28948ff5024b1ea2d609eb06fe91ad0
60475ffd41d476cab4bbe6c9b06358f2419e43ca09f51061df33f0dba9f66462
62ffd6d19dd46a8c3260d322c39ef4bf8d6219a6adfb6f0f3a049cfb7a68c554
6dc89bf0a893d2b0cbe97ad18f7023ff7cbb1ed76145104ca1335cba465294be
78f95deba1d88e2fd1d8b43399c447f6eb336943374983cb83f4de4a97453c72
80089ae647f586811a97b726d1a96d4bc8655792ee2c7c735c42755e3d89822a
8b6d98b0cf87dc28a33bbd54f6e64114b0b8417e654b82111fd0579e7efdbdbf
92bded93a6be187282a3acbb72a66b616d395d9d4f164b87c179f0482c2fa00f
a0ceb7edc5991f85a9613588811fee01502816f4a31ed92b19b348c07854f052
a3c947f7fb9fe61ef5891883b997f2289d7b8281f889fc5da6271c37e1bbfd01
b73e828651d5ed0a58649ea6f85c7369eb5c2eca01550aec05d7d76a81646c0e
bc07362137bbc06fa722c31a1105ae10400a8750e343e144ce55aadeca9d1b32
c948a51709e4f0bd4c7f0b6f21ed55286524e2b6c74efdb1969473cb40deccde
d5292586cfe2230f1c91cae1f71ad9156c23fb60f7cd9d2bce428647b2cad47c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7e948917b71479588f940c86a2e5ea0658bd4cce75dea6c960db040a3c7d161
fd4b14d54cd94fcc62ac48648efa5688e7cf5b0e564edb0a5576c8dc6fa11cdd