ybsgroup.com.my Open in urlscan Pro
101.99.70.216 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ybsgroup.com.my/mru/m/mail.ru/
Submission: On May 17 via automatic, source openphish (May 17th 2020, 12:31:40 pm UTC)

Summary HTTP 15 Redirects Links 53 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 15 HTTP transactions. The main IP is 101.99.70.216, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is ybsgroup.com.my.

This is the only time ybsgroup.com.my was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
5 14	101.99.70.216 101.99.70.216	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
1	217.69.139.102 217.69.139.102	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
2	185.5.137.244 185.5.137.244	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
1 2	217.20.147.1 217.20.147.1	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
15	5

14 101.99.70.216 (Malaysia) 5 redirects

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)

ybsgroup.com.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.ybsgroup.com.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.69.139.102 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: img.imgsmail.ru

img.imgsmail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.5.137.244 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: is-radar32.common.radar.imgsmail.ru

stat.radar.imgsmail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.20.147.1 (Russian Federation) 1 redirects

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: ip1.147.odnoklassniki.ru

ok.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	ybsgroup.com.my 5 redirects ybsgroup.com.my www.ybsgroup.com.my	107 KB
3	imgsmail.ru img.imgsmail.ru stat.radar.imgsmail.ru	54 KB
2	ok.ru 1 redirects ok.ru	249 B
0	mail.ru Failed portal.mail.ru Failed bar.love.mail.ru Failed
15	4

	Domain	Requested by
10	ybsgroup.com.my	5 redirects ybsgroup.com.my
4	www.ybsgroup.com.my	ybsgroup.com.my
2	ok.ru	1 redirects ybsgroup.com.my
2	stat.radar.imgsmail.ru	ybsgroup.com.my
1	img.imgsmail.ru	ybsgroup.com.my
0	bar.love.mail.ru Failed	ybsgroup.com.my
0	portal.mail.ru Failed	ybsgroup.com.my
15	7

This site contains links to these domains. Also see Links.

Domain
r.mail.ru
mail.ru
e.mail.ru

Subject Issuer	Validity	Valid
*.imgsmail.ru GeoTrust RSA CA 2018	`2019-07-10` - `2021-08-08`	2 years	crt.sh
*.ok.ru GeoTrust RSA CA 2018	`2019-08-07` - `2021-03-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://ybsgroup.com.my/mru/m/mail.ru/
Frame ID: C8D72E52412345B21EC515380EC00163
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ybsgroup.com.my/mru/m/mail.ru HTTP 301
http://ybsgroup.com.my/mru/m/mail.ru/ Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

15
Requests

13 %
HTTPS

0 %
IPv6

4
Domains

7
Subdomains

5
IPs

2
Countries

186 kB
Transfer

619 kB
Size

0
Cookies

53 Outgoing links

These are links going to different origins than the main page.

URL: https://r.mail.ru/n201603520?sz=&rnd=429940232
Title: Mail.Ru

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n215030470?sz=&rnd=429940232
Title: Почта0

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n201603521?sz=&rnd=429940232
Title: Мой Мир0

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n165232845?sz=&rnd=429940232
Title: Одноклассники0

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n215030471?sz=&rnd=429940232
Title: Игры0

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n102969579?sz=&rnd=429940232
Title: Знакомства

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n211738025?sz=&rnd=429940232
Title: Новости

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n102969581?sz=&rnd=429940232
Title: Поиск

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n201603522?sz=&rnd=429940232
Title: Все проекты

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715469?&rnd=714126433
Title: Авто

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715470?&rnd=714126433
Title: Бонус

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715471?&rnd=714126433
Title: Гороскопы

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715472?&rnd=714126433
Title: Дети

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715473?&rnd=714126433
Title: Добро

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715474?&rnd=714126433
Title: Здоровье

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715475?&rnd=714126433
Title: Календарь

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715476?&rnd=714126433
Title: Кино

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715477?&rnd=714126433
Title: Леди

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715478?&rnd=714126433
Title: Недвижимость

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715479?&rnd=714126433
Title: Облако

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715480?&rnd=714126433
Title: Ответы

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715481?&rnd=714126433
Title: Погода

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715482?&rnd=714126433
Title: Спорт

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715483?&rnd=714126433
Title: ТВ программа

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715484?&rnd=714126433
Title: Товары

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715485?&rnd=714126433
Title: Hi-Tech

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715487?&rnd=714126433
Title: Почта для бизнеса

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715488?&rnd=714126433
Title: Почта для образования

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715486?&rnd=714126433
Title: Медиатор

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715489?&rnd=714126433
Title: Рейтинг сайтов

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715490?&rnd=714126433
Title: myTarget

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715491?&rnd=714126433
Title: myWidget

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715492?&rnd=714126433
Title: Hotbox

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715493?&rnd=714126433
Title: Icebox

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715494?&rnd=714126433
Title: Teambox

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715495?&rnd=714126433
Title: SeoSan

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715496?&rnd=714126433
Title: Агент Mail.ru

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715497?&rnd=714126433
Title: Браузер "Амиго"

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715498?&rnd=714126433
Title: Юла

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715499?&rnd=714126433
Title: Beepcar

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715500?&rnd=714126433
Title: Delivery Club

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715501?&rnd=714126433
Title: ICQ

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259812680?&rnd=714126433
Title: Maps.Me

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715503?&rnd=714126433
Title: Мобильные приложения

Search URL Search Domain Scan URL

URL: https://r.mail.ru/n259715504?&rnd=714126433
Title: Список всех проектов

Search URL Search Domain Scan URL

URL: https://r.mail.ru/clb1126001/mailblog.mail.ru/multiauth-2/
Title: Вы можете одновременно работатьс несколькими почтовыми ящиками. Узнать больше

Search URL Search Domain Scan URL

URL: https://r.mail.ru/cls951827/e.mail.ru/login?lang=ru_RU&Page=&from=multi
Title: Добавить почтовый ящик

Search URL Search Domain Scan URL

URL: https://r.mail.ru/cls1074201/auth.mail.ru/cgi-bin/logout?next=1&lang=ru_RU&Page=
Title: выход

Search URL Search Domain Scan URL

URL: https://r.mail.ru/cls525468/r.mail.ru/clb1126011/e.mail.ru/signup?from=navi&lang=ru_RU&rnd=429940232
Title: Регистрация

Search URL Search Domain Scan URL

URL: https://r.mail.ru/cls951827/e.mail.ru/login?lang=ru_RU&Page=
Title: Вход

Search URL Search Domain Scan URL

URL: https://mail.ru/

Search URL Search Domain Scan URL

URL: https://e.mail.ru/password/restore/
Title: Забыли пароль?

Search URL Search Domain Scan URL

URL: https://e.mail.ru/signup?from=login
Title: Регистрация в Почте

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ybsgroup.com.my/mru/m/mail.ru HTTP 301
http://ybsgroup.com.my/mru/m/mail.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://ybsgroup.com.my/mru/m/mail.ru/index_files/authGate.js HTTP 301
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/authGate.js

Request Chain 2

http://ybsgroup.com.my/mru/m/mail.ru/index_files/app.js HTTP 301
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/app.js

Request Chain 3

http://ybsgroup.com.my/mru/m/mail.ru/index_files/external.js HTTP 301
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/external.js

Request Chain 4

http://ybsgroup.com.my/mru/m/mail.ru/index_files/mapi.js HTTP 301
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/mapi.js

Request Chain 13

http://ok.ru/mapi?query=%7B%22cmd%22%3A%22getCounters%22%7D&callback=__PHJSONPCallback_0&rnd=1589718676435 HTTP 301
https://ok.ru/mapi?query=%7B%22cmd%22%3A%22getCounters%22%7D&callback=__PHJSONPCallback_0&rnd=1589718676435

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
ybsgroup.com.my/mru/m/mail.ru/
Redirect Chain

http://ybsgroup.com.my/mru/m/mail.ru
http://ybsgroup.com.my/mru/m/mail.ru/

156 KB
49 KB

238ms
237ms

Document
text/html

101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 1f3743100795e66df210e762a0ac7e49a8bf3dd2f4db06a95c39c87013282a46

Request headers

Host: ybsgroup.com.my
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html
Last-Modified: Wed, 06 Sep 2017 05:06:12 GMT
Accept-Ranges: bytes
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Content-Length: 49721
Date: Sun, 17 May 2020 12:31:09 GMT
Server: LiteSpeed

Redirect headers

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 705
Date: Sun, 17 May 2020 12:31:09 GMT
Server: LiteSpeed
Location: http://ybsgroup.com.my/mru/m/mail.ru/
Vary: User-Agent

GET
H/1.1 200
OK main.css
ybsgroup.com.my/mru/m/mail.ru/index_files/ 223 KB
52 KB 476ms
454ms Stylesheet
text/css 101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://ybsgroup.com.my/mru/m/mail.ru/index_files/main.css
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9d96acaf0704083c097028692a1636c2f81af1c4b7b30284d309ed500afe275a

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 May 2020 12:31:10 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Jul 2017 15:42:26 GMT
Server: LiteSpeed
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 52565
Expires: Sun, 24 May 2020 12:31:10 GMT

GET
H/1.1

404
Not Found

authGate.js
www.ybsgroup.com.my/mru/m/mail.ru/index_files/
Redirect Chain

http://ybsgroup.com.my/mru/m/mail.ru/index_files/authGate.js
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/authGate.js

0
0

1096ms
667ms

Script
text/html

101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/authGate.js
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date: Sun, 17 May 2020 12:31:12 GMT
Server: LiteSpeed
X-Redirect-By: WordPress
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Location: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/authGate.js
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Content-Length: 0
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1

404
Not Found

app.js
www.ybsgroup.com.my/mru/m/mail.ru/index_files/
Redirect Chain

http://ybsgroup.com.my/mru/m/mail.ru/index_files/app.js
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/app.js

0
0

1094ms
670ms

Script
text/html

101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/app.js
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date: Sun, 17 May 2020 12:31:12 GMT
Server: LiteSpeed
X-Redirect-By: WordPress
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Location: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/app.js
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Content-Length: 0
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1

404
Not Found

external.js
www.ybsgroup.com.my/mru/m/mail.ru/index_files/
Redirect Chain

http://ybsgroup.com.my/mru/m/mail.ru/index_files/external.js
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/external.js

0
0

676ms
655ms

Script
text/html

101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/external.js
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date: Sun, 17 May 2020 12:31:14 GMT
Server: LiteSpeed
X-Redirect-By: WordPress
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Location: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/external.js
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Content-Length: 0
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1

404
Not Found

mapi.js
www.ybsgroup.com.my/mru/m/mail.ru/index_files/
Redirect Chain

http://ybsgroup.com.my/mru/m/mail.ru/index_files/mapi.js
http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/mapi.js

0
0

610ms
588ms

Script
text/html

101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/mapi.js
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date: Sun, 17 May 2020 12:31:13 GMT
Server: LiteSpeed
X-Redirect-By: WordPress
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Location: http://www.ybsgroup.com.my/mru/m/mail.ru/index_files/mapi.js
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Content-Length: 0
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK logo2x.png
ybsgroup.com.my/mru/m/mail.ru/index_files/ 3 KB
4 KB 238ms
237ms Image
image/png 101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ybsgroup.com.my/mru/m/mail.ru/index_files/logo2x.png
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ebd109c9dc20771ccc839cc319992b911f5e96c1add52a22c9f8b803c8b11273

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 May 2020 12:31:13 GMT
Last-Modified: Sat, 22 Jul 2017 15:42:26 GMT
Server: LiteSpeed
Vary: User-Agent
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3514
Expires: Sun, 24 May 2020 12:31:13 GMT

GET
H/1.1 200
OK d22345996.gif
ybsgroup.com.my/mru/m/mail.ru/index_files/ 43 B
352 B 237ms
237ms Image
image/gif 101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ybsgroup.com.my/mru/m/mail.ru/index_files/d22345996.gif
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: LiteSpeed /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 May 2020 12:31:13 GMT
Last-Modified: Sat, 22 Jul 2017 15:42:26 GMT
Server: LiteSpeed
Vary: User-Agent
Content-Type: image/gif
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Sun, 24 May 2020 12:31:13 GMT

GET
H/1.1 200
OK counter.gif
ybsgroup.com.my/mru/m/mail.ru/index_files/ 43 B
352 B 469ms
448ms Image
image/gif 101.99.70.216
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ybsgroup.com.my/mru/m/mail.ru/index_files/counter.gif
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: HTTP/1.1
Server: 101.99.70.216 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 17 May 2020 12:31:14 GMT
Last-Modified: Sat, 22 Jul 2017 15:42:26 GMT
Server: LiteSpeed
Vary: User-Agent
Content-Type: image/gif
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Sun, 24 May 2020 12:31:14 GMT

GET NaviData
portal.mail.ru/ 0
0

GET
H2 200 external.min.js Show response
img.imgsmail.ru/ph/0.50.10/ 210 KB
53 KB 246ms
66ms Script
application/javascript 217.69.139.102
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://img.imgsmail.ru/ph/0.50.10/external.min.js

Requested by

Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

217.69.139.102 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

img.imgsmail.ru

Software

nginx /

Resource Hash

f0d939d4b1387b516633150b8c03b3e43310e5e50dc58c1cc6ec0cc4dfac63af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 17 May 2020 12:31:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jul 2017 11:46:09 GMT
server: nginx
etag: W/"59709801-346ee"
content-type: application/javascript
status: 200
timing-allow-origin: *

GET
DATA 200
OK truncated
/ 27 KB
27 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc265b5c52350d03cce1f1f93245c9d869f0b7606eaa928fcf679e1d551ccd52

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ybsgroup.com.my/mru/m/mail.ru/index_files/main.css
Origin: http://ybsgroup.com.my

Response headers

Content-Type: application/font-woff

GET
H/1.1 200
OK update
stat.radar.imgsmail.ru/ 43 B
423 B 131ms
109ms Image
image/gif 185.5.137.244
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://stat.radar.imgsmail.ru/update?p=headline&t=other&v=4&i=updateError:1,updateError_netError:1,updateError_accountInfo:1,updateError_netError_accountInfo:1&rlog=navidata_errors&rlog_message=netError,accountInfo,netError&email=undefined&rnd=0.2765332598251369

Requested by

Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/

Protocol

HTTP/1.1

Server

185.5.137.244 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

is-radar32.common.radar.imgsmail.ru

Software

nginx/1.14.0 /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 May 2020 12:31:16 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.14.0
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, max-age=0
X-Host: is-radar32.i (81)
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 43
X-Request-ID: 891:ba9f8cf600000001
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET bar
bar.love.mail.ru/jsonp/ 0
0

GET
H2

503

mapi
ok.ru/
Redirect Chain

http://ok.ru/mapi?query=%7B%22cmd%22%3A%22getCounters%22%7D&callback=__PHJSONPCallback_0&rnd=1589718676435
https://ok.ru/mapi?query=%7B%22cmd%22%3A%22getCounters%22%7D&callback=__PHJSONPCallback_0&rnd=1589718676435

0
0

218ms
71ms

Script
text/plain

217.20.147.1
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL: https://ok.ru/mapi?query=%7B%22cmd%22%3A%22getCounters%22%7D&callback=__PHJSONPCallback_0&rnd=1589718676435
Requested by: Host: ybsgroup.com.my
URL: http://ybsgroup.com.my/mru/m/mail.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.20.147.1 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS: ip1.147.odnoklassniki.ru
Software: apache /
Resource Hash

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 503
date: Sun, 17 May 2020 12:31:16 GMT
server: apache
content-length: 0

Redirect headers

Location: https://ok.ru/mapi?query=%7B%22cmd%22%3A%22getCounters%22%7D&callback=__PHJSONPCallback_0&rnd=1589718676435
Date: Sun, 17 May 2020 12:31:16 GMT
Server: Apache
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK update
stat.radar.imgsmail.ru/ 43 B
423 B 65ms
65ms Image
image/gif 185.5.137.244
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://stat.radar.imgsmail.ru/update?p=headline&t=loading_ybsgroupComMy&v=14744&i=redirect:692,domainLookup0:0,connect:0,request:237,response:435,domComplete:4794,domContentLoaded:3792,load:4794&rnd=0.33387894230863435

Protocol

HTTP/1.1

Server

185.5.137.244 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

is-radar32.common.radar.imgsmail.ru

Software

nginx/1.14.0 /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://ybsgroup.com.my/mru/m/mail.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 17 May 2020 12:31:17 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.14.0
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, max-age=0
X-Host: is-radar32.i (81)
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 43
X-Request-ID: 891:ba9f998a00000001
Expires: Thu, 01 Jan 1970 00:00:01 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: portal.mail.ru
URL: http://portal.mail.ru/NaviData?mac=1&gamescnt=1&Socials=1&rnd=1589718676089

Domain: bar.love.mail.ru
URL: http://bar.love.mail.ru/jsonp/bar?rnd=1589718676435

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: http://ybsgroup.com.my/mru/m/mail.ru/(Line 145) Message: headline.inline.js: 5.39501953125ms
console-api	debug	URL: https://img.imgsmail.ru/ph/0.50.10/external.min.js(Line 218) Message: headline.external.js: 3.427978515625ms

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bar.love.mail.ru
img.imgsmail.ru
ok.ru
portal.mail.ru
stat.radar.imgsmail.ru
www.ybsgroup.com.my
ybsgroup.com.my
bar.love.mail.ru
portal.mail.ru
101.99.70.216
185.5.137.244
217.20.147.1
217.69.139.102
1f3743100795e66df210e762a0ac7e49a8bf3dd2f4db06a95c39c87013282a46
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
9d96acaf0704083c097028692a1636c2f81af1c4b7b30284d309ed500afe275a
bc265b5c52350d03cce1f1f93245c9d869f0b7606eaa928fcf679e1d551ccd52
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
ebd109c9dc20771ccc839cc319992b911f5e96c1add52a22c9f8b803c8b11273
f0d939d4b1387b516633150b8c03b3e43310e5e50dc58c1cc6ec0cc4dfac63af

ybsgroup.com.my Open in urlscan Pro 101.99.70.216 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

13 %HTTPS

0 %IPv6

4 Domains

7 Subdomains

5 IPs

2 Countries

186 kBTransfer

619 kBSize

0 Cookies

53 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

ybsgroup.com.my Open in urlscan Pro
101.99.70.216 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

13 %
HTTPS

0 %
IPv6

4
Domains

7
Subdomains

5
IPs

2
Countries

186 kB
Transfer

619 kB
Size

0
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!