lefqwu8.cn Open in urlscan Pro
27.124.24.45 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lefqwu8.cn/client/login.html
Submission: On June 19 via automatic, source openphish (June 19th 2021, 1:38:59 am UTC)

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 27.124.24.45, located in New Delhi, India and belongs to BCPL-SG BGPNET Global ASN, SG. The main domain is lefqwu8.cn.
TLS certificate: Issued by R3 on June 18th 2021. Valid for: 3 months.

This is the only time lefqwu8.cn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: TS Cubic Card (Financial)

Domain & IP information

	IP Address		AS Autonomous System
14	27.124.24.45 27.124.24.45		64050 (BCPL-SG B...) (BCPL-SG BGPNET Global ASN)
14	1

14 27.124.24.45 (New Delhi, India)

ASN64050 (BCPL-SG BGPNET Global ASN, SG)

lefqwu8.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	lefqwu8.cn lefqwu8.cn	55 KB
14	1

	Domain	Requested by
14	lefqwu8.cn	lefqwu8.cn
14	1

This site contains no links.

Subject Issuer	Validity	Valid
lefqwu8.cn R3	`2021-06-18` - `2021-09-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lefqwu8.cn/client/login.html
Frame ID: 41D1386D994A704F3323E60782FA65E7
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

55 kB
Transfer

65 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.html Show response lefqwu8.cn/client/	15 KB 4 KB	841ms 278ms	Document text/html	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `c94ebfd1b719f32b9f7dea6e8d59e31d79d62ad1eb41b8d6abb23c2836acea6d` Request headers :method GET :authority lefqwu8.cn :scheme https :path /client/login.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:41 GMT server Apache last-modified Mon, 26 Apr 2021 15:14:56 GMT etag "3a3f-5c0e19bc1d50f-gzip" accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 3684 content-type text/html
GET H2	200	smtp.js Show response lefqwu8.cn/js/	871 B 574 B	278ms 277ms	Script application/javascript	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Full URL https://lefqwu8.cn/js/smtp.js Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776` Request headers :path /js/smtp.js pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT content-encoding gzip last-modified Sun, 25 Apr 2021 13:38:03 GMT server Apache etag "367-5c0cc2363d72a-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 480
GET H2	200	1619429939(1).png lefqwu8.cn/img/	2 KB 3 KB	277ms 277ms	Image image/png	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/1619429939(1).png Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `b9f9cefc44e1ff4b3069d162e6d9c06e29ca3048098908239dab3513981abb20` Request headers :path /img/1619429939(1).png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 10:39:13 GMT server Apache accept-ranges bytes etag "9a5-5c0ddc1ab93b5" content-length 2469 content-type image/png
GET H2	200	tscubic_card_text.jpg lefqwu8.cn/img/	4 KB 4 KB	277ms 277ms	Image image/jpeg	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/tscubic_card_text.jpg Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `74af5338b03f86ccfd5ab3aabd55a9098a86e07a35cbfaf56335e5d1ccc02ce7` Request headers :path /img/tscubic_card_text.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 10:40:10 GMT server Apache accept-ranges bytes etag "eeb-5c0ddc51c4bc6" content-length 3819 content-type image/jpeg
GET H2	200	login-nav.gif lefqwu8.cn/img/	2 KB 2 KB	282ms 282ms	Image image/gif	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/login-nav.gif Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `0618e10da9790c6a9d3ec97a2fccba9b5dd6bc60648ec3c16e4122cee000d993` Request headers :path /img/login-nav.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 09:42:13 GMT server Apache accept-ranges bytes etag "665-5c0dcf5def9f2" content-length 1637 content-type image/gif
GET H2	200	login.gif lefqwu8.cn/img/	3 KB 3 KB	280ms 279ms	Image image/gif	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/login.gif Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `4efe37ded4796728a55f571be002793ee4a2b6e28d82e3df642b77136be31e85` Request headers :path /img/login.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 09:39:58 GMT server Apache accept-ranges bytes etag "a76-5c0dcedd309f4" content-length 2678 content-type image/gif
GET H2	200	ttl_new.gif lefqwu8.cn/img/	2 KB 2 KB	280ms 279ms	Image image/gif	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/ttl_new.gif Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `bb4e51a19a86c79de2b4a8d66ef1d5b4fc109abfaf6362a1da94a04bea8a5a45` Request headers :path /img/ttl_new.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 09:56:41 GMT server Apache accept-ranges bytes etag "71b-5c0dd298ea273" content-length 1819 content-type image/gif
GET H2	200	btn_regist.gif lefqwu8.cn/img/	4 KB 4 KB	280ms 279ms	Image image/gif	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/btn_regist.gif Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `255d639ed93e3417be0fd8be85f87efe8796dfc79f205f0fcb17043009af844e` Request headers :path /img/btn_regist.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 10:01:38 GMT server Apache accept-ranges bytes etag "f8e-5c0dd3b4589af" content-length 3982 content-type image/gif
GET H2	200	1619429817(1).png lefqwu8.cn/img/	14 KB 15 KB	281ms 280ms	Image image/png	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/1619429817(1).png Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `a30d918fb9e0413d059e76967e83fe435a13fb81ae1ebd9a75fdfae078926f56` Request headers :path /img/1619429817(1).png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 10:37:11 GMT server Apache accept-ranges bytes etag "3966-5c0ddba6ac8b9" content-length 14694 content-type image/png
GET H2	200	img_webcheck.gif lefqwu8.cn/img/	5 KB 5 KB	280ms 279ms	Image image/gif	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/img_webcheck.gif Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `67b60054c3dcae6d252012ee08dc88da003d71a9c4c6ab4a126e0b3b43cfb3c6` Request headers :path /img/img_webcheck.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 10:03:48 GMT server Apache accept-ranges bytes etag "13bb-5c0dd430c7d66" content-length 5051 content-type image/gif
GET H2	200	suo.png lefqwu8.cn/img/	4 KB 4 KB	280ms 279ms	Image image/png	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/suo.png Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `5a25998701087e04f3e22029a71e401d71303332aae45dc93d77d359847a0fa3` Request headers :path /img/suo.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 08:58:07 GMT server Apache accept-ranges bytes etag "1029-5c0dc582294e3" content-length 4137 content-type image/png
GET H2	200	yaoshi.png lefqwu8.cn/img/	5 KB 5 KB	280ms 279ms	Image image/png	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/yaoshi.png Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `b12c834b6f5a7a5c5b5c661d62abcec38e3db412bb678d7760c97199dc1a3a4d` Request headers :path /img/yaoshi.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 09:15:35 GMT server Apache accept-ranges bytes etag "14b8-5c0dc969fcf06" content-length 5304 content-type image/png
GET H2	200	bottom.gif lefqwu8.cn/img/	711 B 781 B	280ms 280ms	Image image/gif	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/bottom.gif Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `d809c7b7dcdb3448a8131b14056f442b02f8d57a80c26524d74745f93bcc33ca` Request headers :path /img/bottom.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 09:37:37 GMT server Apache accept-ranges bytes etag "2c7-5c0dce5695f19" content-length 711 content-type image/gif
GET H2	200	39e8c992482180b9a51b888cc230f5f.png lefqwu8.cn/img/	4 KB 4 KB	805ms 804ms	Image image/png	27.124.24.45 BCPL-SG BGPNET Gl...
General Check archive.org Show headers Download Go to Show image Full URL https://lefqwu8.cn/img/39e8c992482180b9a51b888cc230f5f.png Requested by Host: lefqwu8.cn URL: https://lefqwu8.cn/client/login.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.124.24.45 New Delhi, India, ASN64050 (BCPL-SG BGPNET Global ASN, SG), Reverse DNS Software Apache / Resource Hash `235371dc600b7af64ae4cb18d2d4c8cb031ea71070dda334220a547f2572eb99` Request headers :path /img/39e8c992482180b9a51b888cc230f5f.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority lefqwu8.cn referer https://lefqwu8.cn/client/login.html :scheme https sec-fetch-site same-origin :method GET Referer https://lefqwu8.cn/client/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 19 Jun 2021 01:38:42 GMT last-modified Mon, 26 Apr 2021 10:49:34 GMT server Apache accept-ranges bytes etag "1107-5c0dde6b0fd75" content-length 4359 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TS Cubic Card (Financial)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lefqwu8.cn
27.124.24.45
0618e10da9790c6a9d3ec97a2fccba9b5dd6bc60648ec3c16e4122cee000d993
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
235371dc600b7af64ae4cb18d2d4c8cb031ea71070dda334220a547f2572eb99
255d639ed93e3417be0fd8be85f87efe8796dfc79f205f0fcb17043009af844e
4efe37ded4796728a55f571be002793ee4a2b6e28d82e3df642b77136be31e85
5a25998701087e04f3e22029a71e401d71303332aae45dc93d77d359847a0fa3
67b60054c3dcae6d252012ee08dc88da003d71a9c4c6ab4a126e0b3b43cfb3c6
74af5338b03f86ccfd5ab3aabd55a9098a86e07a35cbfaf56335e5d1ccc02ce7
a30d918fb9e0413d059e76967e83fe435a13fb81ae1ebd9a75fdfae078926f56
b12c834b6f5a7a5c5b5c661d62abcec38e3db412bb678d7760c97199dc1a3a4d
b9f9cefc44e1ff4b3069d162e6d9c06e29ca3048098908239dab3513981abb20
bb4e51a19a86c79de2b4a8d66ef1d5b4fc109abfaf6362a1da94a04bea8a5a45
c94ebfd1b719f32b9f7dea6e8d59e31d79d62ad1eb41b8d6abb23c2836acea6d
d809c7b7dcdb3448a8131b14056f442b02f8d57a80c26524d74745f93bcc33ca

lefqwu8.cn Open in urlscan Pro 27.124.24.45 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

55 kBTransfer

65 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

lefqwu8.cn Open in urlscan Pro
27.124.24.45 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

55 kB
Transfer

65 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!