www.dlogica.com
Open in
urlscan Pro
87.106.71.45
Malicious Activity!
Public Scan
Effective URL: https://www.dlogica.com/cn-dhl/DHLCN/szrezkntrhz4kbdkowweg5m8.php?53i6851527073834f004912c046653a542d93912a9ae4a07f00491...
Submission: On May 23 via manual from TW
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on April 21st 2018. Valid for: 3 months.
This is the only time www.dlogica.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 163.cn (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 98.129.229.79 98.129.229.79 | 53824 (LIQUIDWEB) (LIQUIDWEB - Liquid Web) | |
1 12 | 87.106.71.45 87.106.71.45 | 8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48) | |
12 | 2 |
ASN53824 (LIQUIDWEB - Liquid Web, L.L.C, US)
flw.armman.org |
ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
PTR: s16344166.onlinehome-server.info
www.dlogica.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
dlogica.com
1 redirects
www.dlogica.com |
374 KB |
1 |
armman.org
flw.armman.org |
426 B |
12 | 2 |
Domain | Requested by | |
---|---|---|
12 | www.dlogica.com |
1 redirects
flw.armman.org
www.dlogica.com |
1 | flw.armman.org | |
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dlogica.com Let's Encrypt Authority X3 |
2018-04-21 - 2018-07-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.dlogica.com/cn-dhl/DHLCN/szrezkntrhz4kbdkowweg5m8.php?53i6851527073834f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07&email=lalala@gmail.com
Frame ID: 880C49DE229562C940C9094A7490A1AC
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://flw.armman.org/cxdrew123qw/?email=lalala@gmail.com Page URL
-
https://www.dlogica.com/cn-dhl/DHLCN/index.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid....
HTTP 302
https://www.dlogica.com/cn-dhl/DHLCN/szrezkntrhz4kbdkowweg5m8.php?53i6851527073834f004912c046653a542... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://flw.armman.org/cxdrew123qw/?email=lalala@gmail.com Page URL
-
https://www.dlogica.com/cn-dhl/DHLCN/index.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=lalala@gmail.com
HTTP 302
https://www.dlogica.com/cn-dhl/DHLCN/szrezkntrhz4kbdkowweg5m8.php?53i6851527073834f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07f004912c046653a542d93912a9ae4a07&email=lalala@gmail.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
flw.armman.org/cxdrew123qw/ |
192 B 426 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
szrezkntrhz4kbdkowweg5m8.php
www.dlogica.com/cn-dhl/DHLCN/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DHL_China_logo.JPG
www.dlogica.com/cn-dhl/DHLCN/images/ |
24 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sina.png
www.dlogica.com/cn-dhl/DHLCN/images/ |
179 KB 179 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qq.png
www.dlogica.com/cn-dhl/DHLCN/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tom.gif
www.dlogica.com/cn-dhl/DHLCN/images/ |
689 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aliyun.jpg
www.dlogica.com/cn-dhl/DHLCN/images/ |
77 KB 78 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sohu.jpg
www.dlogica.com/cn-dhl/DHLCN/images/ |
29 KB 30 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
21cn.png
www.dlogica.com/cn-dhl/DHLCN/images/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
netease_png.png
www.dlogica.com/cn-dhl/DHLCN/images/ |
992 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qiye.gif
www.dlogica.com/cn-dhl/DHLCN/images/ |
3 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5_1_dhl_global_locator_all_340_187.gif
www.dlogica.com/cn-dhl/DHLCN/images/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 163.cn (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| validateForm1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.dlogica.com/ | Name: PHPSESSID Value: 5i8rulm6atcnaeovse3su3qej6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
flw.armman.org
www.dlogica.com
87.106.71.45
98.129.229.79
415fd79cdad4eaee8e8b0cb3ffcc47ed5c933cc074666e599ba3359b601fe04e
78f9c228f8d5a9e2d3264c4b845c6dccdd563a203df0ba6065ebc9ee566e7ff8
7a4fc73dc583abd9dd92c74406e668c546ea8a10f38c30bc3ce2ca819094a72f
821ed71ac4fb691c086ddb9e6453f3317c083413428f98271c2f52f3b170044b
9d3a6fb64c4fbb0549491610c83d61a7fa35a1d384a208c87db76c64790018ee
a66dc8fc3457a52d8d9e3ac2fc4084d52b2fb938a37e518e75522db6efe3a307
c7bf9a5a0d1d47ec737a9653f144416592d19fb65f9bc9133311c9e62adfcedc
d87ca059e18a471de8b916dfbcdfc3ef7fda94da362b986de701006ef469a43f
dbee10bbba8ec2900fa5136ca3d70ecbab8991891db961789d8c532af0d8ae26
ea39d08c301bff6b21cf149ee9d22467b97855eb888b96e0f003691223b9bb78
ed6dbc8fab5b63d6df0b079b70fc95459214b77dc174a05f0ea97d6a5fdc131c
fff5fd7bfa1d930af03e89b52e7839d9e0f1b6aabef7ab1b4d4eec9c99a72546