urlscan.io logo urlscan.io
SecurityTrails logo

168million.be Open in urlscan Pro
161.35.197.66  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://168million.be/wp-admin/kr/acc0unt/komail.php?email=
Submission: On October 19 via api from IE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 161.35.197.66, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is 168million.be.
TLS certificate: Issued by R3 on July 28th 2022. Valid for: 3 months.
This is the only time 168million.be was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 161.35.197.66 14061 (DIGITALOC...)
1 195.123.217.64 21100 (ITLDC-NL)
1 192.0.72.22 2635 (AUTOMATTIC)
3 3
Apex Domain
Subdomains		 Transfer
2 168million.be
168million.be
1 KB
1 wordpress.com
yahnwagner.files.wordpress.com
95 KB
1 helpotus.com
helpotus.com — Cisco Umbrella Rank: 478780
3 3
Domain Requested by
2 168million.be 1 redirects
1 yahnwagner.files.wordpress.com 168million.be
1 helpotus.com 168million.be
3 3

This site contains no links.

Subject Issuer Validity Valid
168million.be
R3		 2022-07-28 -
2022-10-26		 3 months crt.sh
*.files.wordpress.com
Sectigo RSA Domain Validation Secure Server CA		 2021-12-28 -
2023-01-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://168million.be/wp-admin/kr/acc0unt/komail.php?email=
Frame ID: 5873CA2A4820C2A9D81C2FB0F0802908
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

메일 설정 | 이메일 업그레이드

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

96 kB
Transfer

96 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://168million.be/google_analytics_auto.js HTTP 302
  • https://helpotus.com/?s=168million.be

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request komail.php
168million.be/wp-admin/kr/acc0unt/ 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://168million.be/wp-admin/kr/acc0unt/komail.php?email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
161.35.197.66 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
168million.be
Software
LiteSpeed /
Resource Hash
5385e34ed760475bddf93eaf0d796241f085bda91e78824377cc64ac14ccb3e4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
gzip
content-length
867
content-type
text/html; charset=UTF-8
date
Wed, 19 Oct 2022 05:25:06 GMT
server
LiteSpeed
vary
Accept-Encoding
/
helpotus.com/
Redirect Chain
  • https://168million.be/google_analytics_auto.js
  • https://helpotus.com/?s=168million.be
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://helpotus.com/?s=168million.be
Requested by
Host: 168million.be
URL: https://168million.be/wp-admin/kr/acc0unt/komail.php?email=
Protocol
HTTP/1.1
Server
195.123.217.64 Meppel, Netherlands, ASN21100 (ITLDC-NL, UA),
Reverse DNS
helpotus.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://168million.be/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Redirect headers

location
https://helpotus.com/?s=168million.be
date
Wed, 19 Oct 2022 05:25:06 GMT
server
LiteSpeed
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
0
content-type
text/html; charset=utf-8
logoemail.png
yahnwagner.files.wordpress.com/2015/05/ 		94 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahnwagner.files.wordpress.com/2015/05/logoemail.png
Requested by
Host: 168million.be
URL: https://168million.be/wp-admin/kr/acc0unt/komail.php?email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4b89616e2a678635916096d9c0995d01703c202e96b6a5efdaf793d05fcb7238
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://168million.be/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Wed, 19 Oct 2022 05:25:06 GMT
x-content-type-options
nosniff
last-modified
Mon, 08 Jun 2015 01:57:39 GMT
server
nginx
x-orig-src
01_mogdir
vary
Origin
content-type
image/png
access-control-allow-origin
https://yahnwagner.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
96547
expires
Mon, 21 Nov 2022 07:38:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Domain/Path Name / Value
168million.be/ Name: __gads
Value: id%3D168million.be