gilbertdigital.net - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 192.185.56.46, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is gilbertdigital.net.

This is the only time gilbertdigital.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: EMS China (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 3	192.185.56.46 192.185.56.46	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2600:9000:218... 2600:9000:2182:c200:14:d87:7a8a:b221	16509 (AMAZON-02) (AMAZON-02)
1	211.156.201.16 211.156.201.16	24430 (CNNIC-CHI...) (CNNIC-CHINAPOST-AP CHINA STATE POST BUREAU)
2	2606:4700:303... 2606:4700:3037::6818:7b0e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	4

3 192.185.56.46 (Houston, United States) 2 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-56-46.unifiedlayer.com

gilbertdigital.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:c200:14:d87:7a8a:b221 (United States)

ASN16509 (AMAZON-02, US)

main.cdn.merchant.wish.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 211.156.201.16 (China)

ASN24430 (CNNIC-CHINAPOST-AP CHINA STATE POST BUREAU, CN)

www.ems.com.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::6818:7b0e (United States)

ASN13335 (CLOUDFLARENET, US)

ahmak.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	gilbertdigital.net 2 redirects gilbertdigital.net	3 KB
2	ahmak.net ahmak.net
1	ems.com.cn www.ems.com.cn	38 KB
1	wish.com main.cdn.merchant.wish.com
5	4

	Domain	Requested by
3	gilbertdigital.net	2 redirects
2	ahmak.net	gilbertdigital.net
1	www.ems.com.cn	gilbertdigital.net
1	main.cdn.merchant.wish.com	gilbertdigital.net
5	4

This site contains links to these domains. Also see Links.

Domain
www.cnpl.com.cn
www.spb.gov.cn
www.11183.com.cn

Subject Issuer	Validity	Valid
main.cdn.wish.com DigiCert SHA2 Secure Server CA	`2020-01-02` - `2022-02-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://gilbertdigital.net/wp-wap/config/emss.php
Frame ID: AB1FC33DE82402F66527B2651F0D1F6D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

20 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

41 kB
Transfer

44 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.cnpl.com.cn/

Search URL Search Domain Scan URL

URL: http://www.spb.gov.cn/kdy/

Search URL Search Domain Scan URL

URL: http://www.11183.com.cn/ec-web/register/register_toIndex.action
Title: 客户服务

Search URL Search Domain Scan URL

URL: http://www.11183.com.cn/ec-web/
Title: 网上下单

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://gilbertdigital.net/wp-wap/config/images/405.jpg HTTP 301
http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg

Request Chain 3

http://gilbertdigital.net/wp-wap/config/images/transparentbg.gif HTTP 301
http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request emss.php Show response gilbertdigital.net/wp-wap/config/	6 KB 3 KB	617ms 455ms	Document text/html	192.185.56.46 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 192.185.56.46 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-56-46.unifiedlayer.com Software nginx/1.17.9 / Resource Hash `168a949e7fa588ebcda8f4410bf225ae6ac6b55d8fbbe03185527e51f509ec37` Request headers Host gilbertdigital.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 08 Jun 2020 12:47:03 GMT Server nginx/1.17.9 Content-Type text/html Content-Length 2610 Vary Accept-Encoding Content-Encoding gzip X-Server-Cache false
GET H2	403	ems_large.png main.cdn.merchant.wish.com/d8f2f62fff68/img/erp_logos/	0 0	255ms 161ms	Image application/xml	2600:9000:2182:c200:14:d87:7a8a:b221 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://main.cdn.merchant.wish.com/d8f2f62fff68/img/erp_logos/ems_large.png Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:2182:c200:14:d87:7a8a:b221 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H/1.1	200 OK	index_finalV10_64_20131126.png www.ems.com.cn/images/	38 KB 38 KB	1215ms 452ms	Image image/png	211.156.201.16 CNNIC-CHINAPOST-A...
General Check archive.org Show headers Download Go to Show image Full URL http://www.ems.com.cn/images/index_finalV10_64_20131126.png Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 211.156.201.16 , China, ASN24430 (CNNIC-CHINAPOST-AP CHINA STATE POST BUREAU, CN), Reverse DNS Software / Resource Hash `49544b5aff247030a45c92522a4e72bb8b614361bb03dcb9c6815433d8399feb` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 08 Jun 2020 12:44:23 GMT Last-Modified Tue, 31 Mar 2020 11:55:42 GMT Accept-Ranges bytes Content-Length 38854
GET H/1.1	404 Not Found	405.jpg ahmak.net/istanbul/ankara-escort//wp-wap/config/images/ Redirect Chain http://gilbertdigital.net/wp-wap/config/images/405.jpg http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg	0 0	58ms 32ms	Image text/html	2606:4700:3037::6818:7b0e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 2606:4700:3037::6818:7b0e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers Location http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/405.jpg Date Mon, 08 Jun 2020 12:47:04 GMT Server nginx/1.17.9 Content-Length 0 X-Powered-By PHP/5.4.45 X-Server-Cache false Content-Type text/html
GET H/1.1	404 Not Found	transparentbg.gif ahmak.net/istanbul/ankara-escort//wp-wap/config/images/ Redirect Chain http://gilbertdigital.net/wp-wap/config/images/transparentbg.gif http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif	0 0	21ms 21ms	Image text/html	2606:4700:3037::6818:7b0e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif Requested by Host: gilbertdigital.net URL: http://gilbertdigital.net/wp-wap/config/emss.php Protocol HTTP/1.1 Server 2606:4700:3037::6818:7b0e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://gilbertdigital.net/wp-wap/config/emss.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers Location http://ahmak.net/istanbul/ankara-escort//wp-wap/config/images/transparentbg.gif Date Mon, 08 Jun 2020 12:47:04 GMT Server nginx/1.17.9 Content-Length 0 X-Powered-By PHP/5.4.45 X-Server-Cache false Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: EMS China (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| reloadcode

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ahmak.net
gilbertdigital.net
main.cdn.merchant.wish.com
www.ems.com.cn
192.185.56.46
211.156.201.16
2600:9000:2182:c200:14:d87:7a8a:b221
2606:4700:3037::6818:7b0e
168a949e7fa588ebcda8f4410bf225ae6ac6b55d8fbbe03185527e51f509ec37
49544b5aff247030a45c92522a4e72bb8b614361bb03dcb9c6815433d8399feb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

gilbertdigital.net Open in urlscan Pro 192.185.56.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

20 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

41 kBTransfer

44 kBSize

0 Cookies

4 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

gilbertdigital.net Open in urlscan Pro
192.185.56.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

41 kB
Transfer

44 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!