defjet.com.br
Open in
urlscan Pro
216.172.160.37
Malicious Activity!
Public Scan
Submission: On April 08 via automatic, source openphish
Summary
This is the only time defjet.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 163.cn (Online) Generic China (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 216.172.160.37 216.172.160.37 | 20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC) | |
6 | 43.230.90.2 43.230.90.2 | 135391 (AOFEI-HK ...) (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED) | |
1 | 123.125.50.100 123.125.50.100 | 4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network) | |
1 | 223.252.195.133 223.252.195.133 | 45062 (NETEASE-A...) (NETEASE-AS Guangzhou NetEase Computer System Co.) | |
1 | 54.217.235.157 54.217.235.157 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
12 | 6 |
ASN20013 (CYRUSONE - CyrusOne LLC, US)
PTR: vps.mercadaodoscartuchos.com.br
defjet.com.br |
ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
PTR: proxy90-2.mail.163.com
mimg.127.net |
ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
ssl.mail.163.com |
ASN45062 (NETEASE-AS Guangzhou NetEase Computer System Co., Ltd., CN)
analytics.163.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-217-235-157.eu-west-1.compute.amazonaws.com
mail.163.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
127.net
mimg.127.net |
25 KB |
3 |
163.com
ssl.mail.163.com analytics.163.com mail.163.com Failed iplocator.mail.163.com Failed |
7 KB |
1 |
defjet.com.br
defjet.com.br |
57 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
6 | mimg.127.net |
defjet.com.br
|
1 | mail.163.com |
defjet.com.br
|
1 | analytics.163.com |
defjet.com.br
|
1 | ssl.mail.163.com |
defjet.com.br
|
1 | defjet.com.br | |
0 | iplocator.mail.163.com Failed |
mimg.127.net
|
12 | 6 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl.mail.163.com GeoTrust SSL CA - G3 |
2015-10-15 - 2018-01-30 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://defjet.com.br/net/mail.163.com/index.htm
Frame ID: 8458.1
Requests: 11 HTTP requests in this frame
Frame:
http://mail.163.com/preload5.htm
Frame ID: 8458.5
Requests: 1 HTTP requests in this frame
22 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: 免费邮
Search URL Search Domain Scan URL
Title: 企业邮
Search URL Search Domain Scan URL
Title: VIP邮箱
Search URL Search Domain Scan URL
Title: 国外用户登录
Search URL Search Domain Scan URL
Title: 帮助
Search URL Search Domain Scan URL
Title: 忘记密码了?
Search URL Search Domain Scan URL
Title: 什么是自动登录
Search URL Search Domain Scan URL
Title: 注 册
Search URL Search Domain Scan URL
Title: 注 册
Search URL Search Domain Scan URL
Title: 适配iPad版本
Search URL Search Domain Scan URL
Title: 手机智能版
Search URL Search Domain Scan URL
Title: 在线答疑
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: 关于网易
Search URL Search Domain Scan URL
Title: 关于网易免费邮
Search URL Search Domain Scan URL
Title: 邮箱官方博客
Search URL Search Domain Scan URL
Title: 客户服务
Search URL Search Domain Scan URL
Title: 隐私政策
Search URL Search Domain Scan URL
Title: 意见反馈>>
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.htm
defjet.com.br/net/mail.163.com/ |
57 KB 57 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base_v3.js
mimg.127.net/index/lib/scripts/ |
23 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
163logo.gif
mimg.127.net/logo/ |
7 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
netease_logo.gif
mimg.127.net/logo/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
knet.png
mimg.127.net/logo/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
httpsEnable.gif
ssl.mail.163.com/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ntes.js
analytics.163.com/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_v5.png
mimg.127.net/index/163/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
preload5.htm
mail.163.com/ Frame 8458 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
130227_jimmy1_cnt.jpg
mimg.127.net/index/163/themes/ |
1 KB 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
iplocator
iplocator.mail.163.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
mail.163.com/ |
564 B 564 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mail.163.com
- URL
- http://mail.163.com/preload5.htm
- Domain
- iplocator.mail.163.com
- URL
- http://iplocator.mail.163.com/iplocator?callback=fGetLocator
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 163.cn (Online) Generic China (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.163.com
defjet.com.br
iplocator.mail.163.com
mail.163.com
mimg.127.net
ssl.mail.163.com
iplocator.mail.163.com
mail.163.com
123.125.50.100
216.172.160.37
223.252.195.133
43.230.90.2
54.217.235.157
0b52c5338af355699530a47683420e48c7344e779d3e815ff9943cbfdc153cf2
1422c5f9865b35c4f855c5e090680d9980fc864824d01f33c48ab8a77448cda0
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
1f8529f6983fe618dc540f324195a6e2ff69f06a1d60631db28a0eab31180180
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
61552b8425f08487c49c51fa8105fe3d5d6e28f740521a9267fd67cd5c4fbbbc
9689da8411a966f2f432480cb048e32322fdb9f670e2a97517cd13617cad193d
afd22221de115fda157aca40e2e1c834c42fa6718167c633495c9681a5bcfc57
b13de2eb10e93a66f6332b6ccb258bcf1502362a89b91c16f78ea425562e40a0
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199