nhatngusakura.com Open in urlscan Pro
103.130.216.100  Malicious Activity! Public Scan

URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f569...
Submission: On October 22 via automatic, source openphish — Scanned from DE

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 103.130.216.100, located in Viet Nam and belongs to WEBICO-AS-VN Webico Company Limited, VN. The main domain is nhatngusakura.com.
This is the only time nhatngusakura.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
10 103.130.216.100 135951 (WEBICO-AS...)
1 2a00:1450:400... 15169 (GOOGLE)
1 194.1.147.82 210250 (WPX)
12 3
Apex Domain
Subdomains
Transfer
10 nhatngusakura.com
nhatngusakura.com
2 MB
1 smallenvelop.com
smallenvelop.com
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 306
30 KB
12 3
Domain Requested by
10 nhatngusakura.com nhatngusakura.com
1 smallenvelop.com nhatngusakura.com
1 ajax.googleapis.com nhatngusakura.com
12 3

This site contains no links.

Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1C3
2022-09-26 -
2022-12-19
3 months crt.sh
nhatngusakura.com
R3
2022-09-14 -
2022-12-13
3 months crt.sh
smallenvelop.com
R3
2022-09-01 -
2022-11-30
3 months crt.sh

This page contains 1 frames:

Primary Page: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Frame ID: 7E2E1443D4CC56E5E952DB35D22AE8C0
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

92 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

2000 kB
Transfer

2054 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
nhatngusakura.com/wehhsfargoo/
4 KB
2 KB
Document
General
Full URL
http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
HTTP/1.1
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed / PHP/7.4.32
Resource Hash
3f2a22676798087ea4f7092aaa1ada0ea1a9a7811d150db644cfaf987f9d842a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-encoding
gzip
content-length
1476
content-type
text/html; charset=UTF-8
date
Sat, 22 Oct 2022 00:13:03 GMT
server
LiteSpeed
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
x-powered-by
PHP/7.4.32
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/
84 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:11:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30028
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 22 Oct 2023 00:11:54 GMT
w1.png
nhatngusakura.com/wehhsfargoo/images/
14 KB
14 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w1.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
c825218949fd1e01b648571a1aac2422f382e713ca07d75a9fa028c27c54e2e7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
14261
expires
Sat, 29 Oct 2022 00:13:04 GMT
w2.png
nhatngusakura.com/wehhsfargoo/images/
466 KB
466 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w2.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
2e93757f631c5f59cefe5e2e539b259cc71b971ff9e18c8d3bdb29dc956ea89c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
476809
expires
Sat, 29 Oct 2022 00:13:04 GMT
w3.png
nhatngusakura.com/wehhsfargoo/images/
371 KB
371 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w3.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
64701075a3cdc35fcff4383b98a6a42d827b62ec99c2ab6f41595fdee80d9f99
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
379570
expires
Sat, 29 Oct 2022 00:13:04 GMT
w4.png
nhatngusakura.com/wehhsfargoo/images/
652 KB
652 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w4.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
132aee365fd34939b9f166f3d496c106c8b88164f15a660ed447c56be369ab34
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
667181
expires
Sat, 29 Oct 2022 00:13:04 GMT
w5.png
nhatngusakura.com/wehhsfargoo/images/
305 KB
305 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w5.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
69007d0509bdbb2e53417d9e6dc5e24fae3abd22fa6f97c36a754f1c86bffb6a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
312201
expires
Sat, 29 Oct 2022 00:13:04 GMT
w6.png
nhatngusakura.com/wehhsfargoo/images/
78 KB
78 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w6.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
65e54c437b7e5b607b1532d08a91e7d1f332a39e2036047728ee183c75d64eff
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
80023
expires
Sat, 29 Oct 2022 00:13:04 GMT
w7.png
nhatngusakura.com/wehhsfargoo/images/
2 KB
2 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w7.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
302bcd9813da778d0b8318432b453f44a10cf9a2be5ea372258b2e5f83a1adc9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
2518
expires
Sat, 29 Oct 2022 00:13:04 GMT
w8.png
nhatngusakura.com/wehhsfargoo/images/
78 KB
79 KB
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/w8.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
2f52444b6661a762ececef9913d14b18d3a12a33284fc8d3d059ebec7b717a18
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
80314
expires
Sat, 29 Oct 2022 00:13:04 GMT
Preloader_11.gif
smallenvelop.com/wp-content/uploads/2014/08/
0
0
Image
General
Full URL
https://smallenvelop.com/wp-content/uploads/2014/08/Preloader_11.gif
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
194.1.147.82 Chicago, United States, ASN210250 (WPX, BG),
Reverse DNS
wpx.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

wgh.png
nhatngusakura.com/wehhsfargoo/images/
798 B
830 B
Image
General
Full URL
https://nhatngusakura.com/wehhsfargoo/images/wgh.png
Requested by
Host: nhatngusakura.com
URL: http://nhatngusakura.com/wehhsfargoo/login.php?cmd=login_submit&id=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966&session=f89139b8cdbbcb50e1f56925990a1966f89139b8cdbbcb50e1f56925990a1966
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.130.216.100 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h216100.tino.org
Software
LiteSpeed /
Resource Hash
9483c45d8cbbd94ccc687a5088b8ba35d8ff8b2b3855198c05179514985e317f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://nhatngusakura.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sat, 22 Oct 2022 00:13:04 GMT
last-modified
Wed, 25 Nov 2020 14:52:30 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
798
expires
Sat, 29 Oct 2022 00:13:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://smallenvelop.com/wp-content/uploads/2014/08/Preloader_11.gif
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN