webmail.l9qyw.asia
Open in
urlscan Pro
23.224.233.87
Malicious Activity!
Public Scan
Submission: On April 17 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on April 14th 2023. Valid for: 3 months.
This is the only time webmail.l9qyw.asia was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 23.224.233.87 23.224.233.87 | 40065 (CNSERVERS) (CNSERVERS) | |
4 | 157.185.163.158 157.185.163.158 | 54994 (QUANTILNE...) (QUANTILNETWORKS) | |
1 | 221.194.141.164 221.194.141.164 | 4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone) | |
2 | 103.235.46.191 103.235.46.191 | 55967 (BAIDU Bei...) (BAIDU Beijing Baidu Netcom Science and Technology Co.) | |
9 | 4 |
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
cdn.bootcdn.net |
ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)
hm.baidu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
msauth.cn
aadcdn.msauth.cn — Cisco Umbrella Rank: 753873 |
11 KB |
2 |
baidu.com
hm.baidu.com — Cisco Umbrella Rank: 8281 |
12 KB |
2 |
l9qyw.asia
webmail.l9qyw.asia |
39 KB |
1 |
bootcdn.net
cdn.bootcdn.net — Cisco Umbrella Rank: 107174 |
104 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
4 | aadcdn.msauth.cn |
webmail.l9qyw.asia
|
2 | hm.baidu.com |
webmail.l9qyw.asia
|
2 | webmail.l9qyw.asia |
webmail.l9qyw.asia
|
1 | cdn.bootcdn.net |
webmail.l9qyw.asia
|
9 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
passwordreset.activedirectory.windowsazure.cn |
www.21vbluecloud.com |
www.miibeian.gov.cn |
Subject Issuer | Validity | Valid | |
---|---|---|---|
webmail.iymqf.asia R3 |
2023-04-14 - 2023-07-13 |
3 months | crt.sh |
aadcdn.msauth.cn DigiCert Cloud Services CA-1 |
2022-11-11 - 2023-11-11 |
a year | crt.sh |
cdn.bootcdn.net TrustAsia RSA DV TLS CA G2 |
2022-06-06 - 2023-06-06 |
a year | crt.sh |
baidu.com GlobalSign RSA OV SSL CA 2018 |
2022-07-05 - 2023-08-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://webmail.l9qyw.asia/index/t5.html
Frame ID: 82EF4D3D14F7BC9701A1E8385AD6246C
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
登录到 OutlookDetected technologies
Baidu Analytics (百度统计) (Analytics) ExpandDetected patterns
- hm\.baidu\.com/hm\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: 忘记了密码
Search URL Search Domain Scan URL
Title: 使用条款
Search URL Search Domain Scan URL
Title: 隐私和 cookie
Search URL Search Domain Scan URL
Title: 沪ICP备13015306号-10
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
t5.html
webmail.l9qyw.asia/index/ |
57 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
webmail.l9qyw.asia/static/templete/outlook/static/css/ |
146 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
53_8b36337037cff88c3df203bb73d58e41.png
aadcdn.msauth.cn/shared/1.0/content/images/applogos/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn.msauth.cn/shared/1.0/content/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msauth.cn/shared/1.0/content/images/ |
513 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdn.bootcdn.net/ajax/libs/jquery/3.6.4/ |
286 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.js
hm.baidu.com/ |
29 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
aadcdn.msauth.cn/shared/1.0/content/images/appbackgrounds/ |
987 B 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.gif
hm.baidu.com/ |
43 B 299 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _hmt boolean| _bdhm_loaded_3226b22f2a06945ceb732c2228e96b24 object| mini_tangram_log_jvj6bn function| $ function| jQuery function| chekmail4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
webmail.l9qyw.asia/ | Name: PHPSESSID Value: f9a52d78175bd3b5ad32802be607dcac |
|
.hm.baidu.com/ | Name: HMACCOUNT_BFESS Value: 8F72875DF22DB6C9 |
|
.webmail.l9qyw.asia/ | Name: Hm_lvt_3226b22f2a06945ceb732c2228e96b24 Value: 1681744381 |
|
.webmail.l9qyw.asia/ | Name: Hm_lpvt_3226b22f2a06945ceb732c2228e96b24 Value: 1681744381 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.cn
cdn.bootcdn.net
hm.baidu.com
webmail.l9qyw.asia
103.235.46.191
157.185.163.158
221.194.141.164
23.224.233.87
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3bea31f3174a99d1468444bf8bd15fca88e20fac370013cd019c31e34d082aa1
48463799623b9bc113456cf13668cf1b8357d53c5364b443f1bee93c12c069bd
6bd8c1051ca05f5061e65b7c1998d70f3c8e07e6d6bdef4488eeed44e52d8ff1
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e1d056c337d6028e6ded60e32cface28c6dfd8de734880c3f1908d3427657a85
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898