www.ckconstruccion.com Open in urlscan Pro
190.184.196.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.ckconstruccion.com/.gas/goal/163/
Submission: On July 14 via automatic, source openphish (July 14th 2023, 8:04:13 pm UTC) — Scanned from DE

Summary HTTP 23 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 23 HTTP transactions. The main IP is 190.184.196.34, located in San José, Costa Rica and belongs to NAVEGALO S.A., CR. The main domain is www.ckconstruccion.com.

This is the only time www.ckconstruccion.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online) Generic China (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	190.184.196.34 190.184.196.34	28110 (NAVEGALO ...) (NAVEGALO S.A.)
16	103.129.252.89 103.129.252.89	137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
1	123.126.96.214 123.126.96.214	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
2	103.129.252.87 103.129.252.87	137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
23	5

1 190.184.196.34 (San José, Costa Rica)

ASN28110 (NAVEGALO S.A., CR)
PTR: kylo.racklodge.com

www.ckconstruccion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 103.129.252.89 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 123.126.96.214 (Beijing, China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
PTR: mail-m96214.mail.126.com

ssl.mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.129.252.87 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	127.net mimg.127.net — Cisco Umbrella Rank: 112251	2 MB
3	163.com ssl.mail.163.com — Cisco Umbrella Rank: 284182 mail.163.com — Cisco Umbrella Rank: 41204 ir3.mail.163.com Failed iplocator.mail.163.com Failed ir.mail.163.com Failed	9 KB
1	ckconstruccion.com www.ckconstruccion.com	189 KB
23	3

	Domain	Requested by
16	mimg.127.net	www.ckconstruccion.com mail.163.com
2	mail.163.com	www.ckconstruccion.com
1	ssl.mail.163.com	www.ckconstruccion.com
1	www.ckconstruccion.com
0	ir.mail.163.com Failed	mimg.127.net
0	iplocator.mail.163.com Failed	mimg.127.net
0	ir3.mail.163.com Failed	mimg.127.net
23	7

This site contains links to these domains. Also see Links.

Domain
mail.163.com
email.163.com
qiye.163.com
vip.163.com
hw.mail.163.com
help.mail.163.com
help.163.com
reg.163.com
reg.email.163.com
ipad.mail.163.com
smart.mail.163.com
www.yixin.im
yixin.im
www.163.com
ss.knet.cn
corp.163.com
mail.blog.163.com
music.163.com
uinfo.mail.163.com

Subject Issuer	Validity	Valid
*.mail.163.com GeoTrust RSA CN CA G2	`2022-08-22` - `2023-09-19`	a year	crt.sh
mimg.127.net GeoTrust RSA CN CA G2	`2022-08-22` - `2023-09-12`	a year	crt.sh

This page contains 3 frames:

Primary Page: http://www.ckconstruccion.com/.gas/goal/163/
Frame ID: 7B2C202B7F4160C52EC1E1DC0DF74848
Requests: 13 HTTP requests in this frame

Frame: http://mail.163.com/preload6.htm
Frame ID: FD4C025F7D852AEE0A400EA12C5FA267
Requests: 6 HTTP requests in this frame

Frame: http://mail.163.com/preload6.htm
Frame ID: 3010BDDC3E7EF8B02C22793B09BB70D5
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

163网易免费邮--中文邮箱第一品牌163网易免费邮--中文邮箱第一品牌

Page Statistics

23
Requests

39 %
HTTPS

0 %
IPv6

3
Domains

7
Subdomains

5
IPs

3
Countries

1736 kB
Transfer

4899 kB
Size

0
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: http://mail.163.com/html/mail_intro/

Search URL Search Domain Scan URL

URL: http://email.163.com/
Title: 免费邮

Search URL Search Domain Scan URL

URL: http://qiye.163.com/
Title: 企业邮箱

Search URL Search Domain Scan URL

URL: http://vip.163.com/?b08abh1
Title: VIP邮箱

Search URL Search Domain Scan URL

URL: http://hw.mail.163.com/#163
Title: 国外用户登录

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail13
Title: 手机版

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/
Title: 帮助

Search URL Search Domain Scan URL

URL: http://help.163.com/special/007528M7/xiaoyi_intd.html
Title: 在线答疑

Search URL Search Domain Scan URL

URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail163
Title: 忘记密码了?

Search URL Search Domain Scan URL

URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=163mail_right
Title: 注册

Search URL Search Domain Scan URL

URL: http://mail.163.com/client/dl.html?from=mail5
Title: Android版

Search URL Search Domain Scan URL

URL: http://ipad.mail.163.com/index.htm?dv=ipad
Title: 适配iPad版本

Search URL Search Domain Scan URL

URL: http://smart.mail.163.com/index.htm?dv=smart
Title: 手机智能版

Search URL Search Domain Scan URL

URL: http://www.yixin.im/
Title: 易信

Search URL Search Domain Scan URL

URL: http://yixin.im/
Title: 马上安装

Search URL Search Domain Scan URL

URL: http://www.163.com/

Search URL Search Domain Scan URL

URL: https://ss.knet.cn/verifyseal.dll?sn=e12051044010020841301459&ct=df&pa

Search URL Search Domain Scan URL

URL: http://corp.163.com/index_gb.html
Title: 关于网易

Search URL Search Domain Scan URL

URL: http://mail.163.com/html/mail_intro
Title: 关于网易免费邮

Search URL Search Domain Scan URL

URL: http://mail.blog.163.com/
Title: 邮箱官方博客

Search URL Search Domain Scan URL

URL: http://corp.163.com/gb/legal/legal.html
Title: 隐私政策

Search URL Search Domain Scan URL

URL: http://help.mail.163.com/feedback.do?m=add&categoryName=%e7%99%bb%e5%bd%95
Title: 意见反馈>>

Search URL Search Domain Scan URL

URL: http://music.163.com/?act=cmad_20130517_08
Title: 网易云音乐

Search URL Search Domain Scan URL

URL: http://uinfo.mail.163.com/cgi-bin/hseed/two.pl

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.ckconstruccion.com/.gas/goal/163/ 189 KB
189 KB 2689ms
616ms Document
text/html 190.184.196.34
NAVEGALO S.A.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 190.184.196.34 San José, Costa Rica, ASN28110 (NAVEGALO S.A., CR),
Reverse DNS: kylo.racklodge.com
Software: Apache /
Resource Hash: c7b89a4e7a205b893d85a8a6faed383e98c2451033f289408cd57af3afbfb1fc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 14 Jul 2023 20:04:05 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK base_v5.min.js Show response
mimg.127.net/index/lib/scripts/ 17 KB
7 KB 1292ms
231ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: http://mimg.127.net/index/lib/scripts/base_v5.min.js
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 66f7395da705f823eb253cb60f2ae419ae3a77b1901cad9e035a3e5639023243

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Apr 2016 03:04:49 GMT
Server: nginx
ETag: W/"57217dd1-4485"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Connection: keep-alive
Expires: Fri, 14 Jul 2023 21:04:06 GMT

GET
H/1.1 200
OK 163logo.gif
mimg.127.net/logo/ 7 KB
7 KB 1296ms
232ms Image
image/gif 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/logo/163logo.gif
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Tue, 10 Feb 2009 07:01:48 GMT
Server: nginx
ETag: "4991265c-1a0f"
Content-Type: image/gif
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6671
Expires: Fri, 14 Jul 2023 20:57:02 GMT

GET
H/1.1 200
OK netease_logo.gif
mimg.127.net/logo/ 1 KB
2 KB 230ms
230ms Image
image/gif 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/logo/netease_logo.gif
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Wed, 01 Dec 2010 02:06:41 GMT
Server: nginx
ETag: "4cf5adb1-4ec"
Content-Type: image/gif
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1260
Expires: Fri, 14 Jul 2023 20:59:36 GMT

GET
H/1.1 200
OK knet.png
mimg.127.net/logo/ 5 KB
5 KB 233ms
232ms Image
image/png 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/logo/knet.png
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Wed, 16 May 2012 09:47:58 GMT
Server: nginx
ETag: "4fb377ce-1203"
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4611
Expires: Fri, 14 Jul 2023 20:07:11 GMT

GET
H/1.1 200
OK 130523_music.png
mimg.127.net/index/163/effects/ 2 KB
2 KB 232ms
232ms Image
image/png 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/163/effects/130523_music.png
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 629358b38df917468e648571e26aa879f5c3cb8cca934651f49646141c37fb8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Thu, 23 May 2013 05:15:06 GMT
Server: nginx
ETag: "519da5da-74a"
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1866
Expires: Fri, 14 Jul 2023 20:41:13 GMT

GET
H2 200 httpsEnable.gif
ssl.mail.163.com/ 43 B
224 B 584ms
172ms Image
image/gif 123.126.96.214
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.mail.163.com/httpsEnable.gif
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 123.126.96.214 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS: mail-m96214.mail.126.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:07 GMT
last-modified: Wed, 27 Oct 2021 02:55:03 GMT
server: nginx
etag: "6178bf87-2b"
content-type: image/gif
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Fri, 14 Jul 2023 20:38:31 GMT

GET
H/1.1 200
OK bg_v3.png
mimg.127.net/index/163/img/2013/ 10 KB
11 KB 455ms
230ms Image
image/png 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/163/img/2013/bg_v3.png
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Wed, 06 Aug 2014 08:38:32 GMT
Server: nginx
ETag: "53e1e988-2920"
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10528
Expires: Fri, 14 Jul 2023 21:04:07 GMT

GET
H/1.1 200
OK login_v3.png
mimg.127.net/index/163/img/2013/ 4 KB
4 KB 464ms
234ms Image
image/png 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/163/img/2013/login_v3.png
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: c38075e05644153b539300f92a90120b06e215fd25e46c9a4250a513cf56a327

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Thu, 07 Aug 2014 05:42:56 GMT
Server: nginx
ETag: "53e311e0-eb5"
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3765
Expires: Fri, 14 Jul 2023 21:04:07 GMT

GET
H/1.1 200
OK yixin_ico_v1.png
mimg.127.net/index/163/img/2013/ 4 KB
4 KB 464ms
234ms Image
image/png 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/163/img/2013/yixin_ico_v1.png
Requested by: Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/
Protocol: HTTP/1.1
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 3433683b0b8ff7c9ccbddd9291cc89f32b139de17ff1088ea7d754866af586be

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ckconstruccion.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 14 Jul 2023 20:04:07 GMT
Last-Modified: Tue, 24 Jun 2014 02:29:48 GMT
Server: nginx
ETag: "53a8e29c-efc"
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3836
Expires: Fri, 14 Jul 2023 21:04:07 GMT

GET
H/1.1 200
OK preload6.htm Show response
mail.163.com/ Frame FD4C 13 KB
4 KB 4090ms
3138ms Document
text/html 103.129.252.87
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL

http://mail.163.com/preload6.htm

Requested by

Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/

Protocol

HTTP/1.1

Server

103.129.252.87 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),

Reverse DNS

Software

nginx /

Resource Hash

25953d2f5e41b03e49c8ef91c7256164b1059bdf956c0375ba51d986b004c85d

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com .mediav.com .netstatic.net; connect-src 'self' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp

Request headers

Referer: http://www.ckconstruccion.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.mediav.com *.netstatic.net; connect-src 'self' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp
Content-Type: text/html
Date: Fri, 14 Jul 2023 20:04:08 GMT
ETag: W/"64a3e6dc-35fb"
Expires: Fri, 14 Jul 2023 20:38:16 GMT
Last-Modified: Tue, 04 Jul 2023 09:31:08 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK preload6.htm Show response
mail.163.com/ Frame 3010 13 KB
4 KB 4079ms
3137ms Document
text/html 103.129.252.87
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL

http://mail.163.com/preload6.htm

Requested by

Host: www.ckconstruccion.com
URL: http://www.ckconstruccion.com/.gas/goal/163/

Protocol

HTTP/1.1

Server

103.129.252.87 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),

Reverse DNS

Software

nginx /

Resource Hash

25953d2f5e41b03e49c8ef91c7256164b1059bdf956c0375ba51d986b004c85d

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com .mediav.com .netstatic.net; connect-src 'self' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp

Request headers

Referer: http://www.ckconstruccion.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.mediav.com *.netstatic.net; connect-src 'self' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp
Content-Type: text/html
Date: Fri, 14 Jul 2023 20:04:08 GMT
ETag: W/"64a3e6dc-35fb"
Expires: Fri, 14 Jul 2023 20:38:52 GMT
Last-Modified: Tue, 04 Jul 2023 09:31:08 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2 200 bjs-1.1.6.js Show response
mimg.127.net/p/bjs/release/ Frame FD4C 129 KB
42 KB 1224ms
748ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/bjs/release/bjs-1.1.6.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 590dd1d1a50d8bfb4b082194ebfe1cf712446e8c3794d6072636104b89b03c0a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:11 GMT
content-encoding: gzip
last-modified: Mon, 06 Feb 2023 06:13:00 GMT
server: nginx
etag: W/"63e09a6c-2041d"
vary: Accept-Encoding, Origin
content-type: application/x-javascript
cache-control: max-age=315360000
expires: Fri, 04 Feb 2033 05:21:29 GMT

GET
H2 200 p0.js Show response
mimg.127.net/p/js6/6.0b2306291848/js/ Frame FD4C 706 KB
228 KB 1223ms
748ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/js6/6.0b2306291848/js/p0.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: abe5d1e504451c35fbc9cc584502b5c1079ccad7c69a38023d4d76bf1f93acac

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:11 GMT
content-encoding: gzip
last-modified: Thu, 29 Jun 2023 11:36:11 GMT
server: nginx
etag: W/"649d6cab-b0656"
vary: Accept-Encoding, Origin
content-type: application/x-javascript
cache-control: max-age=315360000
expires: Thu, 30 Jun 2033 19:50:21 GMT

GET
DATA 200
OK truncated
/ Frame FD4C 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 base64_compress.css
mimg.127.net/p/js6/6.0b2306291848/css/ Frame FD4C 259 KB
98 KB 989ms
514ms Stylesheet
text/css 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/js6/6.0b2306291848/css/base64_compress.css
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 2fc4053c6035334c5a5cc42bc084a9148a1861f766fb1aa2fa238f4807e51cf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:11 GMT
content-encoding: gzip
last-modified: Thu, 29 Jun 2023 11:36:10 GMT
server: nginx
etag: W/"649d6caa-40bce"
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 30 Jun 2033 19:50:21 GMT

GET
DATA 200
OK truncated
/ Frame 3010 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 bjs-1.1.6.js Show response
mimg.127.net/p/bjs/release/ Frame 3010 129 KB
42 KB 1217ms
748ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/bjs/release/bjs-1.1.6.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 590dd1d1a50d8bfb4b082194ebfe1cf712446e8c3794d6072636104b89b03c0a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:11 GMT
content-encoding: gzip
last-modified: Mon, 06 Feb 2023 06:13:00 GMT
server: nginx
etag: W/"63e09a6c-2041d"
vary: Accept-Encoding, Origin
content-type: application/x-javascript
cache-control: max-age=315360000
expires: Fri, 04 Feb 2033 05:21:29 GMT

GET
H2 200 p0.js Show response
mimg.127.net/p/js6/6.0b2306291848/js/ Frame 3010 706 KB
228 KB 1217ms
748ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/js6/6.0b2306291848/js/p0.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: abe5d1e504451c35fbc9cc584502b5c1079ccad7c69a38023d4d76bf1f93acac

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:11 GMT
content-encoding: gzip
last-modified: Thu, 29 Jun 2023 11:36:11 GMT
server: nginx
etag: W/"649d6cab-b0656"
vary: Accept-Encoding, Origin
content-type: application/x-javascript
cache-control: max-age=315360000
expires: Thu, 30 Jun 2033 19:50:21 GMT

GET
H2 200 base64_compress.css
mimg.127.net/p/js6/6.0b2306291848/css/ Frame 3010 259 KB
98 KB 1215ms
747ms Stylesheet
text/css 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/js6/6.0b2306291848/css/base64_compress.css
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 2fc4053c6035334c5a5cc42bc084a9148a1861f766fb1aa2fa238f4807e51cf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:11 GMT
content-encoding: gzip
last-modified: Thu, 29 Jun 2023 11:36:10 GMT
server: nginx
etag: W/"649d6caa-40bce"
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: max-age=315360000
expires: Thu, 30 Jun 2033 19:50:21 GMT

GET
H2 200 p1.js Show response
mimg.127.net/p/js6/6.0b2306291848/js/ Frame FD4C 1 MB
381 KB 234ms
234ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/js6/6.0b2306291848/js/p1.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: d3c1f9f07af9836fa8c47dd4a345f4a1985dde665958b2469d5a214af7226291

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:13 GMT
content-encoding: gzip
last-modified: Thu, 29 Jun 2023 11:36:11 GMT
server: nginx
etag: W/"649d6cab-131f23"
vary: Accept-Encoding, Origin
content-type: application/x-javascript
cache-control: max-age=315360000
expires: Thu, 30 Jun 2033 22:20:42 GMT

GET get.do
ir3.mail.163.com/ 0
0

GET iplocator
iplocator.mail.163.com/ 0
0

GET get.do
ir.mail.163.com/ 0
0

GET
H2 200 p1.js Show response
mimg.127.net/p/js6/6.0b2306291848/js/ Frame 3010 1 MB
381 KB 237ms
237ms Script
application/x-javascript 103.129.252.89
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: https://mimg.127.net/p/js6/6.0b2306291848/js/p1.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload6.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.89 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: d3c1f9f07af9836fa8c47dd4a345f4a1985dde665958b2469d5a214af7226291

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 20:04:13 GMT
content-encoding: gzip
last-modified: Thu, 29 Jun 2023 11:36:11 GMT
server: nginx
etag: W/"649d6cab-131f23"
vary: Accept-Encoding, Origin
content-type: application/x-javascript
cache-control: max-age=315360000
expires: Thu, 30 Jun 2033 22:20:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ir3.mail.163.com
URL: http://ir3.mail.163.com/get.do?prod=wmail_lbp&ver=1&uid=nt@163.com&domain=163.com&mobUser=0&callback=themeHandler.callback&rnd=0.6264387676627541

Domain: iplocator.mail.163.com
URL: http://iplocator.mail.163.com/iplocator?callback=fGetLocator

Domain: ir.mail.163.com
URL: http://ir.mail.163.com/get.do?uid=nt@163.com&domain=163.com&ver=4&ph=-1&callback=loginExtAD.callback&rnd=0.9043928262946273

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online) Generic China (Online)

79 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

iplocator.mail.163.com
ir.mail.163.com
ir3.mail.163.com
mail.163.com
mimg.127.net
ssl.mail.163.com
www.ckconstruccion.com
iplocator.mail.163.com
ir.mail.163.com
ir3.mail.163.com
103.129.252.87
103.129.252.89
123.126.96.214
190.184.196.34
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
25953d2f5e41b03e49c8ef91c7256164b1059bdf956c0375ba51d986b004c85d
2fc4053c6035334c5a5cc42bc084a9148a1861f766fb1aa2fa238f4807e51cf5
3433683b0b8ff7c9ccbddd9291cc89f32b139de17ff1088ea7d754866af586be
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
590dd1d1a50d8bfb4b082194ebfe1cf712446e8c3794d6072636104b89b03c0a
629358b38df917468e648571e26aa879f5c3cb8cca934651f49646141c37fb8b
66f7395da705f823eb253cb60f2ae419ae3a77b1901cad9e035a3e5639023243
abe5d1e504451c35fbc9cc584502b5c1079ccad7c69a38023d4d76bf1f93acac
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
c38075e05644153b539300f92a90120b06e215fd25e46c9a4250a513cf56a327
c7b89a4e7a205b893d85a8a6faed383e98c2451033f289408cd57af3afbfb1fc
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
d3c1f9f07af9836fa8c47dd4a345f4a1985dde665958b2469d5a214af7226291
dd8b4abb72cdfaa00427d235cfa1a0efe27f528db7b61669d7328404d49cb623

www.ckconstruccion.com Open in urlscan Pro 190.184.196.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

23 Requests

39 %HTTPS

0 %IPv6

3 Domains

7 Subdomains

5 IPs

3 Countries

1736 kBTransfer

4899 kBSize

0 Cookies

24 Outgoing links

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

79 JavaScript Global Variables

0 Cookies

Indicators

www.ckconstruccion.com Open in urlscan Pro
190.184.196.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

39 %
HTTPS

0 %
IPv6

3
Domains

7
Subdomains

5
IPs

3
Countries

1736 kB
Transfer

4899 kB
Size

0
Cookies

23 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!