qsons.pk Open in urlscan Pro
104.219.233.223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php
Submission: On February 23 via automatic, source openphish (February 23rd 2023, 1:22:23 pm UTC) — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 104.219.233.223, located in United States and belongs to DATAWAGON, US. The main domain is qsons.pk.

This is the only time qsons.pk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: SF Express (Transportation) Generic (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	104.219.233.223 104.219.233.223		27176 (DATAWAGON) (DATAWAGON)
10	1

10 104.219.233.223 (United States)

ASN27176 (DATAWAGON, US)
PTR: um.navicosoft.com

qsons.pk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	qsons.pk qsons.pk	137 KB
10	1

	Domain	Requested by
10	qsons.pk	qsons.pk
10	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php
Frame ID: 1063F508F97628FFE46A7A52F73352DF
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

顺丰速运

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

137 kB
Transfer

136 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request tracking2.php Show response qsons.pk/images/fav-icon/images/S.F.Express/	4 KB 2 KB	346ms 123ms	Document text/html	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / PHP/7.3.33 Resource Hash `a281602695e1873e81f9958e79b7213427a30da1ce57982680cf6406a9f60f2b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 1531 content-type text/html; charset=UTF-8 date Thu, 23 Feb 2023 13:22:18 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding x-powered-by PHP/7.3.33
GET H/1.1	200 OK	SFExpress.png qsons.pk/images/fav-icon/images/S.F.Express/images/	8 KB 8 KB	101ms 101ms	Image image/png	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/SFExpress.png Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `d30eeb036a0992cbf196e9f08e7b05c8038fe04cfca03328d3ec21af21c8750a` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:18 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 8064 expires Thu, 02 Mar 2023 13:22:18 GMT
GET H/1.1	200 OK	alert-icon-red-md.png qsons.pk/images/fav-icon/images/S.F.Express/images/	38 KB 39 KB	215ms 100ms	Image image/png	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/alert-icon-red-md.png Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `8fa2cd0c614884da89146e5ca369046b4b5a8a7df71213d0184753756e058d99` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 39161 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	mailenable.png qsons.pk/images/fav-icon/images/S.F.Express/images/	9 KB 9 KB	200ms 100ms	Image image/png	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/mailenable.png Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `d520d21d83ca745dd8eb87cd367c13a3414756827aa3ac033d7d1632eba594a8` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 9136 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	qqmail.jpg qsons.pk/images/fav-icon/images/S.F.Express/images/	33 KB 33 KB	200ms 100ms	Image image/jpeg	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/qqmail.jpg Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `2ba681b3bb179f5103018c11f3b43b5537e6a1be91e18f4b75482b5c370f82c1` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 33483 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	foxmail_logo.gif qsons.pk/images/fav-icon/images/S.F.Express/images/	2 KB 2 KB	287ms 100ms	Image image/gif	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/foxmail_logo.gif Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `4b3814ada58754daa7e2f161375d4924b2a36583e458d860268ea6e717a465b1` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/gif cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 1839 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	outlook.png qsons.pk/images/fav-icon/images/S.F.Express/images/	5 KB 5 KB	287ms 100ms	Image image/png	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/outlook.png Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `6b1af85883b2ab64690488468bf9fb0699b82e0b8c3239129847e726bcd79c1b` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 5104 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	qiyelogo.jpg qsons.pk/images/fav-icon/images/S.F.Express/images/	14 KB 15 KB	172ms 101ms	Image image/jpeg	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/qiyelogo.jpg Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `63c2ee1c99b0ceea71e3ee2f5c416e15890c77b9edd76882bd7016830485b9da` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 14702 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	netease_png.png qsons.pk/images/fav-icon/images/S.F.Express/images/	992 B 1 KB	172ms 101ms	Image image/png	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/netease_png.png Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `821ed71ac4fb691c086ddb9e6453f3317c083413428f98271c2f52f3b170044b` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 992 expires Thu, 02 Mar 2023 13:22:19 GMT
GET H/1.1	200 OK	Qq1.png qsons.pk/images/fav-icon/images/S.F.Express/images/	22 KB 22 KB	184ms 99ms	Image image/png	104.219.233.223 DATAWAGON
General Check archive.org Show headers Download Go to Show image Full URL http://qsons.pk/images/fav-icon/images/S.F.Express/images/Qq1.png Requested by Host: qsons.pk URL: http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php Protocol HTTP/1.1 Server 104.219.233.223 , United States, ASN27176 (DATAWAGON, US), Reverse DNS um.navicosoft.com Software LiteSpeed / Resource Hash `ea39d08c301bff6b21cf149ee9d22467b97855eb888b96e0f003691223b9bb78` Request headers accept-language de-DE,de;q=0.9 Referer http://qsons.pk/images/fav-icon/images/S.F.Express/tracking2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 13:22:19 GMT last-modified Wed, 10 May 2017 04:18:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 Connection Keep-Alive accept-ranges bytes Keep-Alive timeout=5, max=100 content-length 22494 expires Thu, 02 Mar 2023 13:22:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: SF Express (Transportation) Generic (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| validateForm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			qsons.pk/	1969-12-31 23:59:59	Name: PHPSESSID Value: 491bda2432fa632ea8b48e296be7f441

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

qsons.pk
104.219.233.223
2ba681b3bb179f5103018c11f3b43b5537e6a1be91e18f4b75482b5c370f82c1
4b3814ada58754daa7e2f161375d4924b2a36583e458d860268ea6e717a465b1
63c2ee1c99b0ceea71e3ee2f5c416e15890c77b9edd76882bd7016830485b9da
6b1af85883b2ab64690488468bf9fb0699b82e0b8c3239129847e726bcd79c1b
821ed71ac4fb691c086ddb9e6453f3317c083413428f98271c2f52f3b170044b
8fa2cd0c614884da89146e5ca369046b4b5a8a7df71213d0184753756e058d99
a281602695e1873e81f9958e79b7213427a30da1ce57982680cf6406a9f60f2b
d30eeb036a0992cbf196e9f08e7b05c8038fe04cfca03328d3ec21af21c8750a
d520d21d83ca745dd8eb87cd367c13a3414756827aa3ac033d7d1632eba594a8
ea39d08c301bff6b21cf149ee9d22467b97855eb888b96e0f003691223b9bb78

qsons.pk Open in urlscan Pro 104.219.233.223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

137 kBTransfer

136 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

qsons.pk Open in urlscan Pro
104.219.233.223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

137 kB
Transfer

136 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!