67-uitr.ml
Open in
urlscan Pro
181.215.195.79
Malicious Activity!
Public Scan
URL:
http://67-uitr.ml/mosafejo/New/netdoors/NewRemind.html
Submission: On November 02 via api from CA
Submission: On November 02 via api from CA
Summary
This website contacted 5 IPs
in 3 countries
across 3 domains to perform 13 HTTP transactions.
The main IP is 181.215.195.79, located in
Amsterdam, Netherlands and
belongs to SPRINT-SDC, PL.
The main domain is 67-uitr.ml.
This is the only time 67-uitr.ml was scanned on urlscan.io!
This is the only time 67-uitr.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 163.cn (Online) Generic China (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 181.215.195.79 181.215.195.79 | 197226 (SPRINT-SDC) (SPRINT-SDC) | |
| 9 | 103.65.41.154 103.65.41.154 | 135391 (AOFEI-HK ...) (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED) | |
| 1 | 123.125.50.100 123.125.50.100 | 4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network) | |
| 1 | 223.252.195.164 223.252.195.164 | () () | |
| 1 | 54.64.105.68 54.64.105.68 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 13 | 5 |
1
181.215.195.79
(Amsterdam, Netherlands)
ASN197226 (SPRINT-SDC, PL)
PTR: edc167.naismandad.com
ASN197226 (SPRINT-SDC, PL)
PTR: edc167.naismandad.com
| 67-uitr.ml |
9
103.65.41.154
(Dongxiang, China)
ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
| mimg.127.net |
1
123.125.50.100
(Beijing, China)
ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
| ssl.mail.163.com |
1
54.64.105.68
(Tokyo, Japan)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-64-105-68.ap-northeast-1.compute.amazonaws.com
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-64-105-68.ap-northeast-1.compute.amazonaws.com
| mail.163.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
127.net
mimg.127.net |
37 KB |
| 3 |
163.com
ssl.mail.163.com analytics.163.com mail.163.com |
7 KB |
| 1 |
67-uitr.ml
67-uitr.ml |
73 KB |
| 13 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | mimg.127.net |
67-uitr.ml
|
| 1 | mail.163.com |
67-uitr.ml
|
| 1 | analytics.163.com |
67-uitr.ml
|
| 1 | ssl.mail.163.com |
67-uitr.ml
|
| 1 | 67-uitr.ml | |
| 13 | 5 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ssl.mail.163.com GeoTrust RSA CA 2018 |
2017-12-22 - 2020-02-20 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://67-uitr.ml/mosafejo/New/netdoors/NewRemind.html
Frame ID: 74270B3AB14F7259C71520E7B746709D
Requests: 12 HTTP requests in this frame
Frame:
http://mail.163.com/preload5.htm
Frame ID: C415B473FD77467A489BACADC46E9B56
Requests: 1 HTTP requests in this frame
27 Outgoing links
These are links going to different origins than the main page.
URL: http://mail.163.com/html/mail_intro/
Search URL Search Domain Scan URL
URL: http://email.163.com/
Title: 免费邮
Title: 免费邮
Search URL Search Domain Scan URL
URL: http://count.mail.163.com/beacon/click.htm?from=NO_43&ref=index_163mail
Title: 企业邮
Title: 企业邮
Search URL Search Domain Scan URL
URL: http://vip.163.com/?b08abh1
Title: VIP邮箱
Title: VIP邮箱
Search URL Search Domain Scan URL
URL: http://hw.mail.163.com/#163
Title: 国外用户登录
Title: 国外用户登录
Search URL Search Domain Scan URL
URL: http://help.163.com/special/007525G0/163mail_index.html?b08abh1
Title: 帮助
Title: 帮助
Search URL Search Domain Scan URL
URL: http://help.163.com/special/007525G0/163mail_ans.html?b08abI1
Title: 在线答疑
Title: 在线答疑
Search URL Search Domain Scan URL
URL: http://hd1.mail.163.com/lyricshow/index.do
Search URL Search Domain Scan URL
URL: http://music.163.com/#/m/song?id=187134
Search URL Search Domain Scan URL
URL: http://reg.163.com/getpasswd/RetakePassword.jsp?from=mail163
Title: 忘记密码了?
Title: 忘记密码了?
Search URL Search Domain Scan URL
URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=163mail_right
Title: 注 册
Title: 注 册
Search URL Search Domain Scan URL
URL: http://e.mail.163.com/mobilemail/home.do?from=163mail
Title: 注 册
Title: 注 册
Search URL Search Domain Scan URL
URL: http://ipad.mail.163.com/index.htm?dv=ipad
Title: 适配iPad版本
Title: 适配iPad版本
Search URL Search Domain Scan URL
URL: http://smart.mail.163.com/index.htm?dv=smart
Title: 手机智能版
Title: 手机智能版
Search URL Search Domain Scan URL
URL: http://mail.163.com/html/ntesmail5/
Title: 网易邮箱5.0版介绍
Title: 网易邮箱5.0版介绍
Search URL Search Domain Scan URL
URL: http://hd2.mail.163.com/mobilevup/index.do
Title: 免费发3G大附件邮件
Title: 免费发3G大附件邮件
Search URL Search Domain Scan URL
URL: http://reg.email.163.com/unireg/call.do?cmd=register.entrance&from=163mail_right
Title: 手机号码邮箱专享服务
Title: 手机号码邮箱专享服务
Search URL Search Domain Scan URL
URL: http://www.163.com/
Search URL Search Domain Scan URL
URL: https://ss.cnnic.cn/verifyseal.dll?sn=e12051044010020841301459&ct=df&pa=867422
Title:
Title:
Search URL Search Domain Scan URL
URL: http://corp.163.com/index_gb.html
Title: 关于网易
Title: 关于网易
Search URL Search Domain Scan URL
URL: http://mail.163.com/html/mail_intro
Title: 关于网易免费邮
Title: 关于网易免费邮
Search URL Search Domain Scan URL
URL: http://mail.blog.163.com/
Title: 邮箱官方博客
Title: 邮箱官方博客
Search URL Search Domain Scan URL
URL: http://help.163.com/
Title: 客户服务
Title: 客户服务
Search URL Search Domain Scan URL
URL: http://corp.163.com/gb/legal/legal.html
Title: 隐私政策
Title: 隐私政策
Search URL Search Domain Scan URL
URL: http://zhidao.mail.163.com/zhidao/lfeedback.jsp
Title: 意见反馈>>
Title: 意见反馈>>
Search URL Search Domain Scan URL
URL: http://music.163.com/?act=cmad_20130517_08
Title: 网易云音乐
Title: 网易云音乐
Search URL Search Domain Scan URL
URL: http://uinfo.mail.163.com/cgi-bin/hseed/two.pl
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
NewRemind.html
67-uitr.ml/mosafejo/New/netdoors/ |
73 KB 73 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
base_v3.js
mimg.127.net/index/lib/scripts/ |
23 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
163logo.gif
mimg.127.net/logo/ |
7 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
netease_logo.gif
mimg.127.net/logo/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
knet.png
mimg.127.net/logo/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
130523_music.png
mimg.127.net/index/163/effects/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
httpsEnable.gif
ssl.mail.163.com/ |
43 B 251 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ntes.js
analytics.163.com/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
130730_music_bg_new.jpg
mimg.127.net/index/163/themes/ |
0 993 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
130730_music_cnt_new.jpg
mimg.127.net/index/163/themes/ |
0 962 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login_v1.png
mimg.127.net/index/163/img/2013/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg_v1.png
mimg.127.net/index/163/img/2013/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
preload5.htm
mail.163.com/ Frame C415 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 163.cn (Online) Generic China (Online)191 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| fCheckLoginNow function| fCheckAutoLogin function| fAutoLogin undefined| gbForcepc object| oAndroidRedirect function| fCheckBrowser function| fHtml5Tag function| fCheckCookie function| fGetQuery function| fGetQueryHash function| $id function| fTrim function| fParseMNum function| fCheckAccount function| fGetScript function| fGetCookie function| fSetCookie function| fEventListen function| fEventUnlisten function| fRandom function| fUrlP function| fResize function| fFQ function| fStartTime object| gUserInfo object| gVisitorCookie undefined| gMobileNumMailIsForbidden undefined| gMobileNumMailResult object| gMobileNumMail function| fEnData function| loginRequest function| getRnd undefined| DOMContentLoaded function| DOMREADY string| base64EncodeChars function| base64encode function| utf16to8 function| fGetLocator function| fSetGadIndex function| MobCallback boolean| bGettingAlgorithm object| gIndexAd function| setCookie function| fSetLogType function| getCookie function| saveLoginType function| fLoginFormSubmit function| fGetVersion function| Cookie function| fInitUserName object| visitordata function| $ function| fEvent function| fCheckAutoLoginCookie object| oId object| oIdL object| oPw object| oPwL object| oStyle object| oStyleConf object| oStyleConfBlk object| oForm object| oSaveLogin object| oRemAutoLogin object| oAutoLoginTxt object| oAutoLoginWrap object| oAutoLoginCheckbox object| oSsl object| oTab object| oTips object| oTab1 object| oTab2 object| oIdLabel undefined| tab1Cls undefined| tab2Cls undefined| aTheme function| fThemeChange function| fMusicCallback function| fNextTheme function| fPrevTheme function| fScoreIndex function| fSetStyle undefined| ntabOn undefined| sTmpId undefined| sTmpPwd undefined| sTmpMob undefined| sTmpMobPwd undefined| fSwtichTab function| fCls undefined| bSwitchTabTimeout undefined| fSwitchTabTimeout undefined| fSetbSwitchTabTimeout function| fIdPwdFocus undefined| bCheckingPw function| fCheckPw function| fCheckAlways undefined| oFuncLogin undefined| oFuncLogin1 undefined| sLoginFunc undefined| bIsFirstLog undefined| sCoremailCookie undefined| bStartTime function| fOnSubmit function| fShowTheHttpLogin function| fShowPhoneReg undefined| oSpdTestPosition undefined| aSpdResult undefined| aSpdStartTime undefined| aSpdEndTime undefined| aSpdTmpTime undefined| aSpdQueue undefined| fSpeedTestPre undefined| fSpeedTest undefined| fSpd undefined| fLocationDot undefined| aLocationDot undefined| fSelectLoaction undefined| fSpdUserInit undefined| fLocationChoose undefined| sLocationInfo undefined| fSetLocation undefined| fNetErrDebug function| fPreload function| fKX function| fBodyVericalAlign function| fTmpSwitchLog string| _ntes_nacc string| _ntes_nvid number| _ntes_nvtm number| _ntes_nvfi number| _ntes_nvsf number| _ntes_nstm string| _ntes_nurl string| _ntes_ntit string| _ntes_nref string| _ntes_nres string| _ntes_nlag string| _ntes_nscd number| _ntes_nlmf string| _ntes_flsh string| _ntes_nssn number| _ntes_surv function| _ntes_void object| _ntes_domain_array object| _non_ntes_domain_array string| _ntes_cdmn string| _non_ntes_cdmn string| _ntes_src_addr boolean| _ntes_cookie_enabled boolean| _ntes_localstorage_enabled object| _ntes_page_data function| ntes_set_uid function| ntes_get_uid function| neteaseTracker function| neteaseClickTracker function| ntes_survey_popup function| ntes_get_navigation_info function| fetch_visitor_hash function| ntes_get_domain function| non_ntes_get_domain function| ntes_set_cookie_long function| ntes_set_cookie function| ntes_set_cookie_new function| ntes_get_cookie function| ntes_get_flashver number| _ntes_hexcase number| _ntes_chrsz function| ntes_hex_md5 function| ntes_core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| safe_add function| bit_rol function| str2binl function| binl2hex function| str_to_ent function| ntes_page_click_stat function| ntes_page_unload_stat function| neteaseClickStat function| _ntes_bindEvent function| _ntes_fixEvent function| _ntes_sendInfo function| recordAction function| neteaseClickStatForArea function| ntes_area_click_stat function| is_spider object| ntes_area_click_tools object| pattern0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
67-uitr.ml
analytics.163.com
mail.163.com
mimg.127.net
ssl.mail.163.com
103.65.41.154
123.125.50.100
181.215.195.79
223.252.195.164
54.64.105.68
0599a0771339c15ab62cbca21b22b61f6f2b1b6959d17a3f663923f672e5cc70
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
629358b38df917468e648571e26aa879f5c3cb8cca934651f49646141c37fb8b
a0ceb7edc5991f85a9613588811fee01502816f4a31ed92b19b348c07854f052
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
cda9f887a91d3809da759671631f612821d4e89e7e6f876b647c835a9a2d7beb
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e728b010e050883efe9d729785b212886d4faaa420a1a14f3b9e4aac35fbb0f2
e72e127bd3bf986b5bd30a194ef3810aa48b3c6c6c2d7328a1894caef8df222c