urlscan.io logo urlscan.io
SecurityTrails logo

www.act-fire.kz Open in urlscan Pro
2a00:5da0:1000::136  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Submission: On April 17 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 4 countries across 5 domains to perform 23 HTTP transactions. The main IP is 2a00:5da0:1000::136, located in Kazakhstan and belongs to PS, KZ. The main domain is www.act-fire.kz.
This is the only time www.act-fire.kz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alibaba (Online)

Domain & IP information

IP Address AS Autonomous System
1 2a00:5da0:100... 48716 (PS)
9 195.138.255.9 201011 (NETZBETRI...)
2 195.138.255.8 201011 (NETZBETRI...)
3 205.204.101.203 45102 (CNNIC-ALI...)
4 104.111.216.213 16625 (AKAMAI-AS)
1 198.11.132.221 45102 (CNNIC-ALI...)
1 151.101.194.110 54113 (FASTLY)
23 8
1    2a00:5da0:1000::136 (Kazakhstan)

ASN48716 (PS, KZ)
www.act-fire.kz
9    195.138.255.9 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)
style.alibaba.com
2    195.138.255.8 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)
img.alibaba.com
3    205.204.101.203 (Santa Clara, United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
login.alibaba.com
4    104.111.216.213 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-216-213.deploy.static.akamaitechnologies.com
u.alicdn.com
1    198.11.132.221 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
gj.mmstat.com
1    151.101.194.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
Domain Requested by
9 style.alibaba.com www.act-fire.kz
4 u.alicdn.com style.alibaba.com
www.act-fire.kz
img.alibaba.com
3 login.alibaba.com www.act-fire.kz
2 img.alibaba.com www.act-fire.kz
1 js-agent.newrelic.com www.act-fire.kz
1 gj.mmstat.com www.act-fire.kz
1 www.act-fire.kz
0 beacon-2.newrelic.com Failed js-agent.newrelic.com
0 dmtracking2.alibaba.com Failed www.act-fire.kz
23 9
Subject Issuer Validity Valid
*.alibaba.com
GlobalSign Organization Validation CA - SHA256 - G2		 2018-09-20 -
2019-09-21		 a year crt.sh

This page contains 1 frames:

Primary Page: http://www.act-fire.kz/llehsd/trider/lia/oj/
Frame ID: 7CC5DEEF07B4729DE2096509EB0697E8
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • env /^Prototype$/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i
Overall confidence: 100%
Detected patterns
  • env /^YAHOO$/i

Page Statistics

23
Requests

13 %
HTTPS

14 %
IPv6

5
Domains

9
Subdomains

8
IPs

4
Countries

178 kB
Transfer

600 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.act-fire.kz/llehsd/trider/lia/oj/ 		18 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
2a00:5da0:1000::136 , Kazakhstan, ASN48716 (PS, KZ),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
8b8fb07ec28892c3ab0d8b7e8ac38ca453009716bbeb481976ec56b87a9fb648
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Host
www.act-fire.kz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx
Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Last-Modified
Sun, 03 Nov 2013 21:08:54 GMT
ETag
W/"4607-4ea4c34f92580"
X-Content-Type-Options
nosniff
X-Powered-By
PleskLin
Content-Encoding
gzip
sns.css
style.alibaba.com/css/4v/myalibaba/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/css/4v/myalibaba/sns.css?c=200810221400
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
9ec5d063d2e931c417a3cee9c25aa57818c355721ad2b79feed9136d1dbf8639

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:16:17 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547554795
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1382
Expires
Wed, 17 Apr 2019 17:37:57 GMT
common.css
style.alibaba.com/css/4v/ 		52 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/css/4v/common.css?c=201012162100
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
411d07f14787124be96f5a19e696d938dd908047b69f326db873cff09e02a27a

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:16:14 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547554795
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
9578
Expires
Wed, 17 Apr 2019 17:37:57 GMT
navigat.css
style.alibaba.com/css/4v/ 		56 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/css/4v/navigat.css?c=201009032100
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
6824ba31cf9e1f0980037f326b924f2c68df8d8c7e7c57a76b5b036a67278c18

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:16:17 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547554795
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10248
Expires
Wed, 17 Apr 2019 17:37:57 GMT
navCGS.css
style.alibaba.com/css/4v/ 		2 KB
1008 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/css/4v/navCGS.css?c=201009032100
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
de2a0fb9e86d811040c7d83d2f8ce488cffb693213a93f44647eef2c73f0fd08

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:16:17 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547554796
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
551
Expires
Wed, 17 Apr 2019 17:37:57 GMT
relateJS.css
style.alibaba.com/css/4v/ 		14 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/css/4v/relateJS.css?c=200810221400
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
206231c07cacd1ebe9000fd14a0cabf9b330aeeb1f1cd531dfee8e08b7a73401

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:16:17 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1552265219
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3786
Expires
Wed, 17 Apr 2019 17:37:57 GMT
myalibaba.css
style.alibaba.com/css/4v/ 		61 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/css/4v/myalibaba.css?c=20110530
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
8532bc98b6274c2a98bb1fabbaf27329ce93a910c0861c39253269b024864be4

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:16:17 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1552274395
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11283
Expires
Wed, 17 Apr 2019 17:37:57 GMT
ae.js
style.alibaba.com/js/ 		219 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/js/ae.js?c=200810221400
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
5e82fe9e45fe19e01fe821fb610788526c85d910c6a9ce3e723d47fccff09e31

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:26:46 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547554796
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64687
Expires
Wed, 17 Apr 2019 17:37:57 GMT
myalibaba.js
style.alibaba.com/js/ 		73 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/js/myalibaba.js?c=200810221400
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
7a4e70e5ee385c0370dd9dfa871eda1ff8fabeb4b05350da7437f1b211ac1e59

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:26:47 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1544685152
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
18122
Expires
Wed, 17 Apr 2019 17:37:57 GMT
en.js
style.alibaba.com/js/language/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://style.alibaba.com/js/language/en.js
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.9 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
f7ae5cc117d5e2b262d948fdeef9b3055996320facb26c9e1f3401be6ea8d802

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 10:26:47 GMT
Server
Tengine
FW_IP
195.138.255.9
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547554797
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1602
Expires
Wed, 17 Apr 2019 17:37:57 GMT
beacon_en.js
img.alibaba.com/js/ 		49 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://img.alibaba.com/js/beacon_en.js
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.8 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
1bdde2f3a57ea1aa424c873bcdd41f7034ca22503c2f359e58b06509e37bf37b

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
FW_IP
195.138.255.8
Connection
keep-alive
Content-Length
17736
Last-Modified
Thu, 22 Jun 2017 10:26:47 GMT
Server
Tengine
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1552263424
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1800
Accept-Ranges
bytes
Timing-Allow-Origin
*
Expires
Wed, 17 Apr 2019 16:21:11 GMT
sorcing-signin.css
login.alibaba.com/css/4v/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.alibaba.com/css/4v/sorcing-signin.css?version=20110104
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.204.101.203 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
d964bcb73b05d3296862b64ac3d2145d15c1309f39ffa12f10d6671152a3c16c

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Tue, 02 Apr 2019 04:51:39 GMT
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/css
base-mod.js
u.alicdn.com/js/5v/lib/_hozmod/addon/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://u.alicdn.com/js/5v/lib/_hozmod/addon/base-mod.js
Requested by
Host: style.alibaba.com
URL: http://style.alibaba.com/js/ae.js?c=200810221400
Protocol
HTTP/1.1
Server
104.111.216.213 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-216-213.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
5a08771e2bcdddf4e29f5c11b07ee37c70e49cfb4c00d1334c3b175aa6daca98

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
FW_IP
104.111.216.213
x-server-id
unicorn011139197107.us.oc27
x-readtime
0
Connection
keep-alive
Content-Length
4258
Last-Modified
Mon, 26 Mar 2018 06:55:57 GMT
Server
Tengine
ETag
1d51b07b_0
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547263649
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=1791
SERVED-FROM
2.16.187.47
Timing-Allow-Origin
*, *
Network_Info
DE_FRANKFURT_24940
EagleId
c60b890d15546334170171293e
Expires
Wed, 17 Apr 2019 17:37:48 GMT
7.gif
gj.mmstat.com/ 		43 B
567 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gj.mmstat.com/7.gif?logtype=1&title=&pre=&cache=f133bcd&scr=1600x1200&isbeta=5&spm-cnt=0.0.0.0.DTnQkr&aplus&pageid=c4027eaecdcc70024e3c5b5316a2c44f297e079626&dmtrack_c=%7Baep_usuc_f%3D-%7Caeu_cid%3D-%7D&p=1&o=mac&b=chrome67&s=1600x1200&w=webkit&mx=360ee
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
198.11.132.221 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 17 Apr 2019 17:07:57 GMT
P3P
CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:01 GMT
b.jpg
dmtracking2.alibaba.com/ 		0
0
headCap.gif
u.alicdn.com/images/eng/style/css_images/navigation/ 		149 B
763 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u.alicdn.com/images/eng/style/css_images/navigation/headCap.gif
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
104.111.216.213 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-216-213.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
a0ea565170f019a7d86ed01dae02c43deaed123e792bfd5fd3b4464070c569e3

Request headers

Referer
http://style.alibaba.com/css/4v/common.css?c=201012162100
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
FW_IP
104.111.216.213
x-server-id
unicorn010177031110.us.ot7
x-readtime
0
Connection
keep-alive
Content-Length
149
Last-Modified
Mon, 26 Mar 2018 06:55:57 GMT
Server
Tengine
ETag
fcc48097_0
Ali-Swift-Global-Savetime
1547565507
Content-Type
image/gif
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=23580606
SERVED-FROM
2.16.187.13
Timing-Allow-Origin
*, *
Network_Info
DE_FRANKFURT_24940
EagleId
c60b891e15475655074713168e
Expires
Wed, 15 Jan 2020 15:18:03 GMT
logo_alibaba_sprite.gif
u.alicdn.com/images/eng/style/logo/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u.alicdn.com/images/eng/style/logo/logo_alibaba_sprite.gif
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
104.111.216.213 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-216-213.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
2bd29eb9f85f17a49d2a22e8d16629399a8d3456a45d46acb873be417d1a9633

Request headers

Referer
http://style.alibaba.com/css/4v/common.css?c=201012162100
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
FW_IP
104.111.216.213
x-server-id
unicorn010176181102.us.ot7
x-readtime
1
Connection
keep-alive
Content-Length
3885
Last-Modified
Mon, 26 Mar 2018 06:55:57 GMT
Server
Tengine
ETag
fb18ea90_0
Ali-Swift-Global-Savetime
1547561961
Content-Type
image/gif
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=23577122
SERVED-FROM
2.16.187.13
Timing-Allow-Origin
*, *
Network_Info
DE_FRANKFURT_24940
EagleId
c60b893c15475619612742251e
Expires
Wed, 15 Jan 2020 14:19:59 GMT
signin_head_bg.png
login.alibaba.com/images/eng/style/css_images/ 		630 B
846 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/css_images/signin_head_bg.png
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.204.101.203 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
c503a04975b22bed74b1fcca57e22de46147170280df9c321803ba4f2482dc58

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin.css?version=20110104
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Last-Modified
Tue, 02 Apr 2019 04:51:39 GMT
Connection
keep-alive
Accept-Ranges
bytes
ETag
"5ca2ea5b-276"
Content-Length
630
Content-Type
image/png
alibaba_logo.png
login.alibaba.com/images/eng/style/logo/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.alibaba.com/images/eng/style/logo/alibaba_logo.png
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.204.101.203 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
/
Resource Hash
0219efe34cf993a3703ef8d47a913b8532b7015ea4ce1689c93712253a31af6a

Request headers

Referer
https://login.alibaba.com/css/4v/sorcing-signin.css?version=20110104
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Last-Modified
Tue, 02 Apr 2019 04:51:39 GMT
Connection
keep-alive
Accept-Ranges
bytes
ETag
"5ca2ea5b-2055"
Content-Length
8277
Content-Type
image/png
forget_pwd_images.gif
img.alibaba.com/images/eng/style/css_images/myalibaba/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://img.alibaba.com/images/eng/style/css_images/myalibaba/forget_pwd_images.gif
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
195.138.255.8 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Tengine /
Resource Hash
3652901d483e8a03d2a86ad2c30dfb80519559e5fd9251f237d72a6971ccd60b

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Last-Modified
Thu, 22 Jun 2017 09:37:46 GMT
Server
Tengine
FW_IP
195.138.255.8
Ali-Swift-Global-Savetime
1547554797
Content-Type
image/gif
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=172800
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
2885
Expires
Thu, 18 Apr 2019 08:36:32 GMT
nr-100.js
js-agent.newrelic.com/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://js-agent.newrelic.com/nr-100.js
Requested by
Host: www.act-fire.kz
URL: http://www.act-fire.kz/llehsd/trider/lia/oj/
Protocol
HTTP/1.1
Server
151.101.194.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a57d3172d4a009a1a0d38993ea6dbe03fab6aa1ec429aa4aab563465b0dc43bd

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:57 GMT
Content-Encoding
gzip
x-amz-request-id
E5DCA6A1E273C29D
X-Cache
HIT
Connection
keep-alive
Content-Length
3318
x-amz-id-2
yBW6wq72OpUUzr5BVZC7OQ3Xd7MaWDToYn+JABKXPABJ6IcwYuSpKIJuAGSdO2uKwu2SuSTlKYk=
X-Served-By
cache-hhn1543-HHN
Last-Modified
Wed, 28 Feb 2018 23:33:30 GMT
Server
AmazonS3
X-Timer
S1555520878.990632,VS0,VE0
ETag
"d650235bc408d454223f87f23b0b4a2d"
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 varnish
Cache-Control
public, max-age=7200, stale-if-error=604800
Accept-Ranges
bytes
X-Cache-Hits
72935
72759b5cb7
beacon-2.newrelic.com/1/ 		0
0
sufei.js
u.alicdn.com/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://u.alicdn.com/js/sufei.js?v=2015-05-26
Requested by
Host: img.alibaba.com
URL: http://img.alibaba.com/js/beacon_en.js
Protocol
HTTP/1.1
Server
104.111.216.213 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-216-213.deploy.static.akamaitechnologies.com
Software
Tengine /
Resource Hash
138c168bf7799529cbb2f013450ec1a5b8729d9b3c2ca1b55f831c1241b6822e

Request headers

Referer
http://www.act-fire.kz/llehsd/trider/lia/oj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 17 Apr 2019 17:07:58 GMT
Content-Encoding
gzip
FW_IP
104.111.216.213
x-server-id
unicorn011139197107.us.oc27
x-readtime
1
Connection
keep-alive
Content-Length
2787
Last-Modified
Mon, 26 Mar 2018 06:55:57 GMT
Server
Tengine
Vary
Accept-Encoding
Ali-Swift-Global-Savetime
1547555057
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
FW_IP
Cache-Control
max-age=23570217
SERVED-FROM
2.16.187.6
Timing-Allow-Origin
*
Network_Info
DE_FRANKFURT_24940
EagleId
c60b891515475550571787346e
Expires
Wed, 15 Jan 2020 12:24:55 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dmtracking2.alibaba.com
URL
http://dmtracking2.alibaba.com/b.jpg?cD17MX0mdT17L3d3dy5hY3QtZmlyZS5rei9sbGVoc2QvdHJpZGVyL2xpYS9vai99Jm09e0dFVH0mcz17MjAwfSZyPXstfSZhPXstfSZiPXtpZm09MH0mYz17YWVwX3VzdWNfZj0tfGFldV9jaWQ9LX0=&pageid=c4027eaecdcc70024e3c5b5316a2c44f297e079626&sys=chrome67.0|x11|1600*1200|en-US&ver=41&time=1555520877216
Domain
beacon-2.newrelic.com
URL
http://beacon-2.newrelic.com/1/72759b5cb7?a=2285494&be=224&qt=0&ap=0&dc=575&fe=907&to=bwYAMktTW0cDVEMNDFZMNxRQHUFRD0dbSwtNGhZISVpF&v=42&jsonp=NREUM.setToken&perf=%7B%22timing%22%3A%7B%22of%22%3A1555520876837%2C%20%22n%22%3A0%2C%20%22dl%22%3A221%2C%20%22di%22%3A799%2C%20%22ds%22%3A799%2C%20%22de%22%3A800%2C%20%22dc%22%3A1130%2C%20%22l%22%3A1130%2C%20%22le%22%3A1131%2C%20%22f%22%3A0%2C%20%22dn%22%3A1%2C%20%22dne%22%3A1%2C%20%22c%22%3A1%2C%20%22ce%22%3A107%2C%20%22rq%22%3A107%2C%20%22rp%22%3A218%2C%20%22rpe%22%3A231%7D%2C%20%22navigation%22%3A%7B%7D%7D

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alibaba (Online)

245 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| NREUMQ string| globalImgServer object| IL function| vd function| controlListShow function| addMoreAttributeContent function| setCheckedFlag function| getCheckedRecordNum function| trim function| trimExt function| isNumber function| initSelectWithValue function| initGsSelectWithValue function| encode function| XMLEncode function| XMLDecode function| adjustImageSize function| setImgSize function| setImgSizeWH function| setBigImgSize function| fixOverflowBox function| setBigImgInner function| setGsBigImgSize function| setGsImgInner function| bbimg function| clk object| initText function| clearSearchText function| isIEBrowse function| adjustScreenWidth function| encodeKeyword function| loadscript function| tempTrackObj function| agTrack function| loadHtml function| writeHiddenIFrame function| openWinForReferrer function| getFirefoxVer function| gotoUrlForReferrer function| log function| AC_AX_RunContent function| AC_AX_GetArgs function| AC_AddExtension function| AC_Generateobj function| AC_FL_RunContent function| AC_AL_RunContent function| AC_AL_Generateobj function| AC_SW_RunContent function| AC_GetArgs object| ELE_NAME_ARRAY string| MY_WEB_SERVER string| US_MY_ALIBABA string| WWW_SERVER string| MSG_SERVER function| check function| listclick function| getFormElVals function| getIds function| inquiryNow function| addBasket function| getCheckedNum function| getBuyOfferCheckedNum function| getSellOfferCheckedNum function| getCompanyCheckedNum function| getProductCheckedNum function| getCheckedItemNum function| uncheckQuote function| uncheckRFQ function| singleInquiryNow function| fixTextOverflowY function| openGsIcon function| openTPIcon function| logger function| doIfExploreIsNotSupport function| getWebATMVersion function| getWebATMVersion2 function| getWebATMVersion3 function| clientNotReadyAction function| getWebAtmUrl function| isWebAtmMainLoaded function| openNewWebAtm function| openOldWebAtm function| doOpenWebIM function| OnlyCheckAlitalkInstalled function| newCheckAlitalkInstalled function| clickAlitalk function| clickChatNowStat function| alitalkEncryptForRfq function| alitalkEncrypt function| alitalkInstallOrLogin function| alitalkEncryptFormyalibaba function| sendMessage function| sendMessageNotEn function| alitalkFeedback function| SetCookie function| GetCookie function| DelCookie function| clickSave string| fromSellLeads string| fromProduct object| fromProductRegExp string| fromCompany object| fromMinisiteRegExp string| fromBuyLead string| fromQcInspection string| fromFreeFeedBack string| fromGScontact string| fromGSFeedBack string| fromRFQ string| fromQuotation string| wwwServer string| imageServer function| alitalkEncryptNew function| alitalkEncrypt4Anonymous function| isSiteLogin function| alitalkEncryptForEsite function| alitalkEncryptForEscrow function| targetToWebMessage function| alitalkEncryptLiveInput function| alitalkEncryptGetLive function| alitalkEncryptLastest function| getFeedBackUrlLastest function| getFeedBackUrl function| urlAddQueryString function| makeFeedBackElement function| makeFeedBackButton function| openMaxWin function| startTM function| validateTM function| buyingLeadsCheckRight function| alitalkEncryptNewBuyingLeads function| startorInstallTM function| startAlitalk function| multiImg function| multiImgById function| singleUserImgById function| singleUserImgSmall function| multiImgSmall function| singleUserImg16 function| userDefineATM function| singleUserImg24 function| newSingleUserImg function| singleUserImg32 function| singleUserImg48 function| showVirtualATMIcon function| atmMultiImg function| atmSingleImg function| noticeCycle function| getMessageStatus object| BIInquiry undefined| __define object| AE object| YAHOO object| $D object| $E function| $ object| TB function| $M object| YL object| YUD object| YUE function| get object| ATMAPI function| checkInstallEnaliint function| sendClientMsg function| addContact function| startWW function| checkIE function| checkIEorFirefox function| checkFirefoxIsBigThan15 function| divCycle function| floatDiv object| seajs function| define object| __private_jsmonitor__ function| fixSelectView object| Prototype object| Class object| Abstract object| Try function| PeriodicalExecuter function| Template object| $break object| $continue object| Enumerable function| $A object| Hash function| $H function| $R object| Ajax boolean| _nativeExtensions object| Toggle object| Insertion function| Selector function| $$ object| Field object| Form function| $F object| Position function| Validation function| RegexValidation function| RequiredValidation function| TrimRequiredValidation function| EmailValidation function| NumericValidation function| MatchedValidation function| ChineseValidation function| ChineseRequiredValidation function| LengthValidation function| LengthNotRequiredValidation function| CJKLengthValidation function| MultiValidation function| RadioValidation function| EmapValidator function| ValidateHandler function| ValidateRenderer function| AlertRenderer function| InfoRenderer object| msgBox function| ObjectRange string| property object| dmtrack function| sk_dmtracking_core function| sk_dmtracking object| ali_analytics number| g_aplus_loaded string| g_aplus_pv_id object| goldlog number| beaconStartTime object| nameStorage object| g_SPM string| dmtrack_c string| dmtrack_pageid object| aplusExParams object| _img_0.2476441907092164 string| g_aplus_pv_req function| trackFavorite function| signin object| NR_QUEUE object| NREUM string| prop number| _sufei

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

beacon-2.newrelic.com
dmtracking2.alibaba.com
gj.mmstat.com
img.alibaba.com
js-agent.newrelic.com
login.alibaba.com
style.alibaba.com
u.alicdn.com
www.act-fire.kz
beacon-2.newrelic.com
dmtracking2.alibaba.com
104.111.216.213
151.101.194.110
195.138.255.8
195.138.255.9
198.11.132.221
205.204.101.203
2a00:5da0:1000::136
0219efe34cf993a3703ef8d47a913b8532b7015ea4ce1689c93712253a31af6a
138c168bf7799529cbb2f013450ec1a5b8729d9b3c2ca1b55f831c1241b6822e
1bdde2f3a57ea1aa424c873bcdd41f7034ca22503c2f359e58b06509e37bf37b
206231c07cacd1ebe9000fd14a0cabf9b330aeeb1f1cd531dfee8e08b7a73401
2bd29eb9f85f17a49d2a22e8d16629399a8d3456a45d46acb873be417d1a9633
3652901d483e8a03d2a86ad2c30dfb80519559e5fd9251f237d72a6971ccd60b
411d07f14787124be96f5a19e696d938dd908047b69f326db873cff09e02a27a
5a08771e2bcdddf4e29f5c11b07ee37c70e49cfb4c00d1334c3b175aa6daca98
5e82fe9e45fe19e01fe821fb610788526c85d910c6a9ce3e723d47fccff09e31
6824ba31cf9e1f0980037f326b924f2c68df8d8c7e7c57a76b5b036a67278c18
7a4e70e5ee385c0370dd9dfa871eda1ff8fabeb4b05350da7437f1b211ac1e59
8532bc98b6274c2a98bb1fabbaf27329ce93a910c0861c39253269b024864be4
8b8fb07ec28892c3ab0d8b7e8ac38ca453009716bbeb481976ec56b87a9fb648
9ec5d063d2e931c417a3cee9c25aa57818c355721ad2b79feed9136d1dbf8639
a0ea565170f019a7d86ed01dae02c43deaed123e792bfd5fd3b4464070c569e3
a57d3172d4a009a1a0d38993ea6dbe03fab6aa1ec429aa4aab563465b0dc43bd
c503a04975b22bed74b1fcca57e22de46147170280df9c321803ba4f2482dc58
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d964bcb73b05d3296862b64ac3d2145d15c1309f39ffa12f10d6671152a3c16c
de2a0fb9e86d811040c7d83d2f8ce488cffb693213a93f44647eef2c73f0fd08
f7ae5cc117d5e2b262d948fdeef9b3055996320facb26c9e1f3401be6ea8d802