567007.selcdn.ru Open in urlscan Pro
2a00:ab00:0:12::205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://567007.selcdn.ru/765435/index%20copy%202.html
Submission: On June 29 via automatic, source openphish (June 29th 2021, 2:07:46 pm UTC)

Summary HTTP 3 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 2a00:ab00:0:12::205, located in Russian Federation and belongs to SELECTEL, RU. The main domain is 567007.selcdn.ru.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on November 26th 2020. Valid for: a year.

This is the only time 567007.selcdn.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic China (Online) 163.cn (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:ab00:0:1... 2a00:ab00:0:12::205	49505 (SELECTEL) (SELECTEL)
1	103.129.252.34 103.129.252.34	137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
3	4

1 2a00:ab00:0:12::205 (Russian Federation)

ASN49505 (SELECTEL, RU)

567007.selcdn.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.129.252.34 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	gstatic.com www.gstatic.com	2 KB
1	127.net mimg.127.net	134 KB
1	selcdn.ru 567007.selcdn.ru	86 KB
3	3

	Domain	Requested by
1	www.gstatic.com	567007.selcdn.ru
1	mimg.127.net	567007.selcdn.ru
1	567007.selcdn.ru
3	3

This site contains links to these domains. Also see Links.

Domain
qiye.163.com
hw.qiye.163.com
mail.163.com
gb.corp.163.com
weibo.com
reg.163.com
ss.knet.cn

Subject Issuer	Validity	Valid
*.selcdn.ru RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2020-11-26` - `2021-12-27`	a year	crt.sh
mimg.127.net GeoTrust CN RSA CA G1	`2019-07-11` - `2021-09-08`	2 years	crt.sh
*.gstatic.com GTS CA 1C3	`2021-05-31` - `2021-08-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://567007.selcdn.ru/765435/index%20copy%202.html
Frame ID: A843EB9F053538B17E6AA25EED2D99BD
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

223 kB
Transfer

241 kB
Size

0
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://qiye.163.com/entry/buy-price.htm
Title: 新用户开通

Search URL Search Domain Scan URL

URL: https://hw.qiye.163.com/
Title: 国外用户登录

Search URL Search Domain Scan URL

URL: http://mail.163.com/dashi/dlpro.html?from=mail45
Title: 邮箱大师

Search URL Search Domain Scan URL

URL: https://qiye.163.com/help/l-1.html
Title: 帮助中心

Search URL Search Domain Scan URL

URL: https://qiye.163.com/

Search URL Search Domain Scan URL

URL: http://gb.corp.163.com/gb/home.shtml
Title: 关于网易

Search URL Search Domain Scan URL

URL: http://weibo.com/163qiye
Title: 官方微博

Search URL Search Domain Scan URL

URL: http://gb.corp.163.com/gb/legal.html
Title: 相关法律

Search URL Search Domain Scan URL

URL: https://reg.163.com/agreement_mobile_ysbh_wap.shtml?v=20171127
Title: 隐私政策

Search URL Search Domain Scan URL

URL: https://ss.knet.cn/verifyseal.dll?sn=e12051044010020841301459&ct=df&pa=151131
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index%20copy%202.html Show response
567007.selcdn.ru/765435/ 86 KB
86 KB 153ms
71ms Document
text/html 2a00:ab00:0:12::205
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL: https://567007.selcdn.ru/765435/index%20copy%202.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a00:ab00:0:12::205 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software: /
Resource Hash: 5d9bc33fa2ca0f5954ec057d5afa738dd25fd058c5e60b0255aacf590169ba3e

Request headers

:method: GET
:authority: 567007.selcdn.ru
:scheme: https
:path: /765435/index%20copy%202.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges
content-length: 88077
content-type: text/html
etag: "3aa0896e5361afcc3e67675b0f03de75"
last-modified: Tue, 29 Jun 2021 00:50:26 GMT
x-timestamp: 1624927825.08590
x-trans-id: 168ce73f67b29e6a
date: Tue, 29 Jun 2021 00:55:01 GMT
age: 47543

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 825 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60475ffd41d476cab4bbe6c9b06358f2419e43ca09f51061df33f0dba9f66462

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 promPic.png
mimg.127.net/m/lc/img/qiye/45/95/1/ 134 KB
134 KB 995ms
229ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mimg.127.net/m/lc/img/qiye/45/95/1/promPic.png
Requested by: Host: 567007.selcdn.ru
URL: https://567007.selcdn.ru/765435/index%20copy%202.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 62ffd6d19dd46a8c3260d322c39ef4bf8d6219a6adfb6f0f3a049cfb7a68c554

Request headers

Referer: https://567007.selcdn.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 14:07:25 GMT
last-modified: Mon, 25 Nov 2019 08:41:47 GMT
server: nginx
etag: "5ddb93cb-2184b"
x-cache: HIT from HKGM
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 137291
expires: Sun, 22 Jun 2031 12:32:21 GMT

GET
DATA 200
OK truncated
/ 588 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78f95deba1d88e2fd1d8b43399c447f6eb336943374983cb83f4de4a97453c72

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 461 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6dc89bf0a893d2b0cbe97ad18f7023ff7cbb1ed76145104ca1335cba465294be

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 341 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 80089ae647f586811a97b726d1a96d4bc8655792ee2c7c735c42755e3d89822a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 163 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3c947f7fb9fe61ef5891883b997f2289d7b8281f889fc5da6271c37e1bbfd01

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92bded93a6be187282a3acbb72a66b616d395d9d4f164b87c179f0482c2fa00f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8f7a7554a70a86cb2ab9310991d40d6d5979bc641e836552117392cd7be5c0e6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 71ms
11ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: 567007.selcdn.ru
URL: https://567007.selcdn.ru/765435/index%20copy%202.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe03bfd95a2d4e640ed7d04dcb08ef991c327a5ab6f6fdb9eb06e1efc76af30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://567007.selcdn.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 29 Jun 2021 11:04:11 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 10993
vary: Origin
content-type: image/png
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1847
x-xss-protection: 0
expires: Wed, 29 Jun 2022 11:04:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic China (Online) 163.cn (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://567007.selcdn.ru/765435/index%20copy%202.html(Line 117) Message: https://567007.selcdn.ru/765435/index%20copy%202.html
console-api	log	URL: https://567007.selcdn.ru/765435/index%20copy%202.html(Line 118) Message: https://567007.selcdn.ru/765435/index%20copy%202.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

567007.selcdn.ru
mimg.127.net
www.gstatic.com
103.129.252.34
2a00:1450:4001:828::2003
2a00:ab00:0:12::205
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5d9bc33fa2ca0f5954ec057d5afa738dd25fd058c5e60b0255aacf590169ba3e
5fe03bfd95a2d4e640ed7d04dcb08ef991c327a5ab6f6fdb9eb06e1efc76af30
60475ffd41d476cab4bbe6c9b06358f2419e43ca09f51061df33f0dba9f66462
62ffd6d19dd46a8c3260d322c39ef4bf8d6219a6adfb6f0f3a049cfb7a68c554
6dc89bf0a893d2b0cbe97ad18f7023ff7cbb1ed76145104ca1335cba465294be
78f95deba1d88e2fd1d8b43399c447f6eb336943374983cb83f4de4a97453c72
80089ae647f586811a97b726d1a96d4bc8655792ee2c7c735c42755e3d89822a
8f7a7554a70a86cb2ab9310991d40d6d5979bc641e836552117392cd7be5c0e6
92bded93a6be187282a3acbb72a66b616d395d9d4f164b87c179f0482c2fa00f
a3c947f7fb9fe61ef5891883b997f2289d7b8281f889fc5da6271c37e1bbfd01

567007.selcdn.ru Open in urlscan Pro 2a00:ab00:0:12::205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

3 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

223 kBTransfer

241 kBSize

0 Cookies

10 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

567007.selcdn.ru Open in urlscan Pro
2a00:ab00:0:12::205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

223 kB
Transfer

241 kB
Size

0
Cookies

3 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!