www.electrocoolhvacr.com Open in urlscan Pro
141.94.131.127 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Submission: On April 30 via automatic, source openphish (April 30th 2022, 4:00:42 am UTC) — Scanned from FR

Summary HTTP 20 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 3 domains to perform 20 HTTP transactions. The main IP is 141.94.131.127, located in France and belongs to OVH, FR. The main domain is www.electrocoolhvacr.com.

This is the only time www.electrocoolhvacr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic China (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	141.94.131.127 141.94.131.127	16276 (OVH) (OVH)
14	103.129.252.34 103.129.252.34	137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED)
1	123.126.96.214 123.126.96.214	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
1 2	59.111.239.33 59.111.239.33	45062 (NETEASE-N...) (NETEASE-NETWORK NetEase Building No.16 Ke Yun Road)
2	123.126.96.184 123.126.96.184	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
20	6

1 141.94.131.127 (France)

ASN16276 (OVH, FR)
PTR: fr-iron.fastbighost.net

www.electrocoolhvacr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 103.129.252.34 (Hong Kong)

ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK)

mimg.127.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 123.126.96.214 (China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
PTR: mail-m96214.mail.126.com

ssl.mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 59.111.239.33 (China) 1 redirects

ASN45062 (NETEASE-NETWORK NetEase Building No.16 Ke Yun Road, CN)

analytics.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 123.126.96.184 (China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)
PTR: mail-m96184.mail.126.com

count.mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
iplocator.mail.163.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	127.net mimg.127.net — Cisco Umbrella Rank: 141376 hzp.127.net Failed	610 KB
6	163.com 1 redirects ssl.mail.163.com — Cisco Umbrella Rank: 155706 analytics.163.com — Cisco Umbrella Rank: 340543 count.mail.163.com — Cisco Umbrella Rank: 565533 mail.163.com — Cisco Umbrella Rank: 48058 iplocator.mail.163.com — Cisco Umbrella Rank: 426767	5 KB
1	electrocoolhvacr.com www.electrocoolhvacr.com	24 KB
20	3

	Domain	Requested by
13	mimg.127.net	www.electrocoolhvacr.com mail.163.com mimg.127.net
2	analytics.163.com	1 redirects www.electrocoolhvacr.com
1	iplocator.mail.163.com	mimg.127.net
1	mail.163.com	www.electrocoolhvacr.com
1	count.mail.163.com	www.electrocoolhvacr.com
1	ssl.mail.163.com	www.electrocoolhvacr.com
1	www.electrocoolhvacr.com
0	hzp.127.net Failed	mimg.127.net
20	8

This site contains links to these domains. Also see Links.

Domain
www.163.com
vipmail.163.com
hw.mail.163.com
help.163.com
reg.163.com
qiye.163.com
reg.email.163.com
corp.163.com
mail.163.com
mail.blog.163.com
ss.cnnic.cn

Subject Issuer	Validity	Valid
*.mail.163.com GeoTrust RSA CN CA G2	`2021-08-18` - `2022-09-16`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Frame ID: 6EC8772D580F7025F13F869F18023702
Requests: 16 HTTP requests in this frame

Frame: http://mail.163.com/preload5.htm
Frame ID: 16666E7D422C564FD33841894C43E330
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

网易免费邮箱 - 中国第一大电子邮件服务商

Page Statistics

20
Requests

5 %
HTTPS

0 %
IPv6

3
Domains

8
Subdomains

6
IPs

3
Countries

639 kB
Transfer

1877 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: http://www.163.com/

Search URL Search Domain Scan URL

URL: http://vipmail.163.com/?from=email
Title: 收费邮

Search URL Search Domain Scan URL

URL: http://hw.mail.163.com/
Title: 国外用户登录

Search URL Search Domain Scan URL

URL: http://help.163.com/special/007525G0/163mail_index.html?b65abh1
Title: 帮助

Search URL Search Domain Scan URL

URL: http://help.163.com/09/1216/16/5QLUD00100753VB8.html?from=b08abI1

Search URL Search Domain Scan URL

URL: http://reg.163.com/RecoverPasswd1.shtml
Title: 忘记密码?

Search URL Search Domain Scan URL

URL: http://qiye.163.com/admin.jsp
Title: 进入管理员登录页面

Search URL Search Domain Scan URL

URL: http://reg.email.163.com/mailregAll/reg0.jsp?from=email163&regPage=163
Title: 注册网易免费邮

Search URL Search Domain Scan URL

URL: http://corp.163.com/index_gb.html
Title: 关于网易

Search URL Search Domain Scan URL

URL: http://mail.163.com/html/mail_intro
Title: 关于网易免费邮

Search URL Search Domain Scan URL

URL: http://mail.blog.163.com/
Title: 邮箱官方博客

Search URL Search Domain Scan URL

URL: http://help.163.com/
Title: 客户服务

Search URL Search Domain Scan URL

URL: http://corp.163.com/gb/legal/legal.html
Title: 隐私政策

Search URL Search Domain Scan URL

URL: https://ss.cnnic.cn/verifyseal.dll?sn=e12051044010020841301459&ct=df&pa=930861

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

http://analytics.163.com/ntes.js HTTP 307
https://analytics.163.com/ntes.js

20 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 163xffrxxzzz.htm Show response
www.electrocoolhvacr.com/control/163/ 82 KB
24 KB 150ms
17ms Document
text/html 141.94.131.127
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 141.94.131.127 , France, ASN16276 (OVH, FR),
Reverse DNS: fr-iron.fastbighost.net
Software: nginx /
Resource Hash: 2eedcabc30b2dc86675308bf7b48c454e954f76eef2d95271b62af70ae337841

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Sat, 30 Apr 2022 04:00:35 GMT
Last-Modified: Mon, 01 Jun 2015 13:19:42 GMT
Server: nginx
Transfer-Encoding: chunked

GET
H/1.1 200
OK base_v3.js Show response
mimg.127.net/index/lib/scripts/ 23 KB
8 KB 894ms
260ms Script
application/x-javascript 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: http://mimg.127.net/index/lib/scripts/base_v3.js
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: a0ceb7edc5991f85a9613588811fee01502816f4a31ed92b19b348c07854f052

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Nov 2013 10:13:30 GMT
Server: nginx
ETag: W/"5278c4ca-5d69"
Vary: Accept-Encoding
X-Cache: HIT from HKGM
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 30 Apr 2022 04:14:11 GMT

GET
H/1.1 200
OK ntes_logo.png
mimg.127.net/index/email/img/2012/ 983 B
1 KB 901ms
264ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/email/img/2012/ntes_logo.png
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 16ede25c08f54c3b1627d401b847eec08b089227058660799c2372dbd6f52425

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Mon, 17 Dec 2012 09:09:12 GMT
Server: nginx
ETag: "50cee138-3d7"
X-Cache: HIT from HKGM
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 983
Expires: Sat, 30 Apr 2022 04:49:59 GMT

GET
H/1.1 200
OK t.gif
mimg.127.net/p/ 77 B
478 B 264ms
264ms Image
image/gif 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/p/t.gif
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Mon, 18 Jun 2012 08:52:50 GMT
Server: nginx
ETag: "4fdeec62-4d"
X-Cache: HIT from HKGM
Content-Type: image/gif
Access-Control-Allow-Origin: *.163.com *.126.com *.yeah.net *.tryfun.com
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 77
Expires: Fri, 06 Jul 2029 08:57:39 GMT

GET
H/1.1 200
OK knet.png
mimg.127.net/logo/ 5 KB
5 KB 262ms
261ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/logo/knet.png
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Wed, 16 May 2012 09:47:58 GMT
Server: nginx
ETag: "4fb377ce-1203"
X-Cache: HIT from HKGM
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4611
Expires: Sat, 30 Apr 2022 04:58:59 GMT

GET
H2 200 httpsEnable.gif
ssl.mail.163.com/ 43 B
224 B 1069ms
182ms Image
image/gif 123.126.96.214
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.mail.163.com/httpsEnable.gif
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 123.126.96.214 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS: mail-m96214.mail.126.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sat, 30 Apr 2022 04:00:37 GMT
last-modified: Wed, 27 Oct 2021 02:55:03 GMT
server: nginx
etag: "6178bf87-2b"
content-type: image/gif
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sat, 30 Apr 2022 04:16:46 GMT

GET
H2

403

ntes.js
analytics.163.com/
Redirect Chain

http://analytics.163.com/ntes.js
https://analytics.163.com/ntes.js

0
0

647ms
213ms

Script
text/html

59.111.239.33
NETEASE-NETWORK N...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.163.com/ntes.js
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: H2
Server: 59.111.239.33 , China, ASN45062 (NETEASE-NETWORK NetEase Building No.16 Ke Yun Road, CN),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Redirect headers

Location: https://analytics.163.com/ntes.js
Date: Sat, 30 Apr 2022 04:00:37 GMT
Server: nginx
Connection: keep-alive
Content-Length: 180
Content-Type: text/html

GET
H/1.1 200
OK logo_v2.png
mimg.127.net/index/email/img/2012/ 10 KB
11 KB 278ms
278ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/email/img/2012/logo_v2.png
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 3cc3a1cc321b22df78b7bf0da839fd05906c7db47296afdf317298882a0b73be

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Fri, 19 Apr 2013 08:46:49 GMT
Server: nginx
ETag: "51710479-29a8"
X-Cache: HIT from HKGM
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10664
Expires: Sat, 30 Apr 2022 04:49:59 GMT

GET
H/1.1 200
OK bgx.png
mimg.127.net/index/email/img/2012/ 304 B
628 B 489ms
263ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/email/img/2012/bgx.png
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 86305704cb5ce03d2ce2c34224ecd1f54bfad514a5980bd9453fab19858af4d5

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Mon, 17 Dec 2012 09:09:16 GMT
Server: nginx
ETag: "50cee13c-130"
X-Cache: HIT from HKGM
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 304
Expires: Sat, 30 Apr 2022 04:49:59 GMT

GET
H/1.1 200
OK bg_v2.png
mimg.127.net/index/email/img/2012/ 16 KB
17 KB 485ms
260ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/email/img/2012/bg_v2.png
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 7d898171a5ede23236d3d2cdfe18d4590a5dc485f6229c66e24f6928d16e7072

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Fri, 19 Apr 2013 08:46:49 GMT
Server: nginx
ETag: "51710479-4165"
X-Cache: HIT from HKGM
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16741
Expires: Sat, 30 Apr 2022 04:49:59 GMT

GET
H/1.1 200
OK arr.png
mimg.127.net/index/email/img/2012/ 492 B
816 B 505ms
261ms Image
image/png 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/email/img/2012/arr.png
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: e4129228b3c1d9183ed091b163797dddf16a2cf72868bb4fa56c98e7a074686d

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:36 GMT
Last-Modified: Mon, 17 Dec 2012 09:09:16 GMT
Server: nginx
ETag: "50cee13c-1ec"
X-Cache: HIT from HKGM
Content-Type: image/png
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 492
Expires: Sat, 30 Apr 2022 04:49:59 GMT

GET
H/1.1 200
OK all2.jpg
mimg.127.net/index/email/img/2012/ 43 KB
44 KB 261ms
260ms Image
image/jpeg 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mimg.127.net/index/email/img/2012/all2.jpg
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 5b953cd3f6bbe8c85e45372e4d9f6019da313c92f99e7ab4d88b2734251c5bdc

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:38 GMT
Last-Modified: Fri, 25 Jan 2013 06:27:10 GMT
Server: nginx
ETag: "510225be-ade0"
X-Cache: HIT from HKGM
Content-Type: image/jpeg
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 44512
Expires: Sat, 30 Apr 2022 04:50:00 GMT

GET
H/1.1 200
OK webmail.gif
count.mail.163.com/beacon/ 49 B
318 B 964ms
203ms Image
image/gif 123.126.96.184
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://count.mail.163.com/beacon/webmail.gif?product=emailtab&type=default&tabname=163&rnd=1651291237913
Requested by: Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm
Protocol: HTTP/1.1
Server: 123.126.96.184 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS: mail-m96184.mail.126.com
Software: nginx /
Resource Hash: 93db6ff0af01c1416a4cf5643fa970e6facf75aa2c38a66404085039c2314e33

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:38 GMT
Last-Modified: Wed, 23 May 2012 03:14:23 GMT
Server: nginx
ETag: "4fbc560f-31"
X-Cache: BYPASS from ngx82-228.163.com
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49

GET
H/1.1 200
OK preload5.htm Show response
mail.163.com/ Frame 1666 9 KB
4 KB 1162ms
311ms Document
text/html 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL

http://mail.163.com/preload5.htm

Requested by

Host: www.electrocoolhvacr.com
URL: http://www.electrocoolhvacr.com/control/163/163xffrxxzzz.htm

Protocol

HTTP/1.1

Server

103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),

Reverse DNS

Software

nginx /

Resource Hash

042d634f329cc58e5b3fe7242a50316d7fb57e66eb3e51e44faa293c97cadf4a

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com .mediav.com .netstatic.net; connect-src 'self' .127.net .126.net .163.com .126.com .yeah.net .188.com .netease.com .qiyukf.com qiyukf.com .youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp

Request headers

Referer: http://www.electrocoolhvacr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Cache-Control: max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.mediav.com *.netstatic.net; connect-src 'self' *.127.net *.126.net *.163.com *.126.com *.yeah.net *.188.com *.netease.com *.qiyukf.com qiyukf.com *.youdao.com *.163yun.com; report-uri https://countly.mail.163.com/stats/csp
Content-Type: text/html
Date: Sat, 30 Apr 2022 04:00:38 GMT
ETag: W/"5373127e-2499"
Expires: Sat, 30 Apr 2022 04:33:19 GMT
Last-Modified: Wed, 14 May 2014 06:51:42 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding Accept-Encoding Accept-Encoding
X-Cache: from HKGM

GET
H/1.1 200
OK p0.js Show response
mimg.127.net/p/js5/5.1.0b1404091425/js/ Frame 1666 578 KB
188 KB 261ms
260ms Script
application/x-javascript 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: http://mimg.127.net/p/js5/5.1.0b1404091425/js/p0.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload5.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: bf9037271322ebb2be16d4770e5f3cc8177fe9a6239843b48535f5b0d1afe5f3

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Apr 2014 06:44:09 GMT
Server: nginx
ETag: W/"5344ec39-9084c"
Vary: Accept-Encoding, Origin
X-Cache: HIT from HKGM
Content-Type: application/x-javascript
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 26 Apr 2032 13:29:16 GMT

GET
DATA 200
OK truncated
/ Frame 1666 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK base64_compress.css
mimg.127.net/p/js5/5.1.0b1404091425/css/ Frame 1666 330 KB
85 KB 274ms
274ms Stylesheet
text/css 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: http://mimg.127.net/p/js5/5.1.0b1404091425/css/base64_compress.css
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload5.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: b1b282541f6b3666d5249a4ed1905dbbd2b8ce0f651fb36eba071d0f7b116def

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Apr 2014 06:43:58 GMT
Server: nginx
ETag: W/"5344ec2e-527d8"
Vary: Accept-Encoding, Origin
X-Cache: HIT from HKGM
Content-Type: text/css
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 26 Apr 2032 13:29:16 GMT

GET
H/1.1 200
OK iplocator Show response
iplocator.mail.163.com/ 152 B
342 B 797ms
188ms Script
text/plain 123.126.96.184
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL: http://iplocator.mail.163.com/iplocator?callback=fGetLocator
Requested by: Host: mimg.127.net
URL: http://mimg.127.net/index/lib/scripts/base_v3.js
Protocol: HTTP/1.1
Server: 123.126.96.184 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS: mail-m96184.mail.126.com
Software: nginx /
Resource Hash: be955ccc99a9afb7936282c7f4b9f0e2124d39d5dc17f23151eb6cda024b0e53

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:41 GMT
Server: nginx
Connection: keep-alive
Content-Length: 152
X-Cache: from ngx81-228.163.com
Content-Type: text/plain;charset=UTF-8

GET
H/1.1 200
OK p1.js Show response
mimg.127.net/p/js5/5.1.0b1404091425/js/ Frame 1666 777 KB
249 KB 260ms
260ms Script
application/x-javascript 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: http://mimg.127.net/p/js5/5.1.0b1404091425/js/p1.js
Requested by: Host: mail.163.com
URL: http://mail.163.com/preload5.htm
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 6e147c029b334a3d56a3ebcf503b8298d9e85e3fca73bc8de1d499d3d40c4242

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://mail.163.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:40 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Apr 2014 06:44:09 GMT
Server: nginx
ETag: W/"5344ec39-c2221"
Vary: Accept-Encoding, Origin
X-Cache: HIT from HKGM
Content-Type: application/x-javascript
Cache-Control: max-age=315360000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 26 Apr 2032 13:29:18 GMT

GET
H/1.1 200
OK gad.js Show response
mimg.127.net/m/login/ 1 KB
691 B 262ms
261ms Script
application/x-javascript 103.129.252.34
NETEASE-AS-AP NET...

General

Check archive.org

Show headers Download Go to

Full URL: http://mimg.127.net/m/login/gad.js
Requested by: Host: mimg.127.net
URL: http://mimg.127.net/index/lib/scripts/base_v3.js
Protocol: HTTP/1.1
Server: 103.129.252.34 , Hong Kong, ASN137263 (NETEASE-AS-AP NETEASE HONG KONG LIMITED, HK),
Reverse DNS
Software: nginx /
Resource Hash: 1c9f60c1e405da5f8d3eb2b526b76db044937a15ceadfe370f83b7c6bcf7fde8

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://www.electrocoolhvacr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sat, 30 Apr 2022 04:00:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 02 Jan 2014 02:03:52 GMT
Server: nginx
ETag: W/"52c4c908-460"
Vary: Accept-Encoding
X-Cache: HIT from HKGM
Content-Type: application/x-javascript
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 30 Apr 2022 04:02:03 GMT

GET hztest
hzp.127.net/cte/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: hzp.127.net
URL: http://hzp.127.net/cte/hztest?1651291241308

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic China (Online)

134 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://analytics.163.com/ntes.js Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.163.com
count.mail.163.com
hzp.127.net
iplocator.mail.163.com
mail.163.com
mimg.127.net
ssl.mail.163.com
www.electrocoolhvacr.com
hzp.127.net
103.129.252.34
123.126.96.184
123.126.96.214
141.94.131.127
59.111.239.33
042d634f329cc58e5b3fe7242a50316d7fb57e66eb3e51e44faa293c97cadf4a
16ede25c08f54c3b1627d401b847eec08b089227058660799c2372dbd6f52425
17add961a686edb5b25996bcc4e08a14e5e36b6a1796ffbbb9cc751e7ca97ac8
1c9f60c1e405da5f8d3eb2b526b76db044937a15ceadfe370f83b7c6bcf7fde8
2eedcabc30b2dc86675308bf7b48c454e954f76eef2d95271b62af70ae337841
3cc3a1cc321b22df78b7bf0da839fd05906c7db47296afdf317298882a0b73be
3f666934b806964af9be68a39f16151701e7a7b8009ac24e7acb9ac0a7c10aa5
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5b953cd3f6bbe8c85e45372e4d9f6019da313c92f99e7ab4d88b2734251c5bdc
6e147c029b334a3d56a3ebcf503b8298d9e85e3fca73bc8de1d499d3d40c4242
7d898171a5ede23236d3d2cdfe18d4590a5dc485f6229c66e24f6928d16e7072
86305704cb5ce03d2ce2c34224ecd1f54bfad514a5980bd9453fab19858af4d5
93db6ff0af01c1416a4cf5643fa970e6facf75aa2c38a66404085039c2314e33
a0ceb7edc5991f85a9613588811fee01502816f4a31ed92b19b348c07854f052
b1b282541f6b3666d5249a4ed1905dbbd2b8ce0f651fb36eba071d0f7b116def
be955ccc99a9afb7936282c7f4b9f0e2124d39d5dc17f23151eb6cda024b0e53
bf9037271322ebb2be16d4770e5f3cc8177fe9a6239843b48535f5b0d1afe5f3
e4129228b3c1d9183ed091b163797dddf16a2cf72868bb4fa56c98e7a074686d

www.electrocoolhvacr.com Open in urlscan Pro 141.94.131.127 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

20 Requests

5 %HTTPS

0 %IPv6

3 Domains

8 Subdomains

6 IPs

3 Countries

639 kBTransfer

1877 kBSize

0 Cookies

14 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

134 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.electrocoolhvacr.com Open in urlscan Pro
141.94.131.127 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

5 %
HTTPS

0 %
IPv6

3
Domains

8
Subdomains

6
IPs

3
Countries

639 kB
Transfer

1877 kB
Size

0
Cookies

20 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!