www.jzwk8.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 103.113.92.89, located in China and belongs to ASLINE-AS-AP ASLINE LIMITED, HK. The main domain is www.jzwk8.com.

This is the only time www.jzwk8.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	103.113.92.89 103.113.92.89	18013 (ASLINE-AS...) (ASLINE-AS-AP ASLINE LIMITED)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

2 103.113.92.89 (China)

ASN18013 (ASLINE-AS-AP ASLINE LIMITED, HK)

www.jzwk8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	jzwk8.com www.jzwk8.com	1 KB
1	cloudflare.com cdnjs.cloudflare.com	28 KB
3	2

	Domain	Requested by
2	www.jzwk8.com	www.jzwk8.com
1	cdnjs.cloudflare.com	www.jzwk8.com
3	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store
Frame ID: DFC4AE472DE3C76A0A455D731B79E92F
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.jzwk8.com/content/pages/submitted/noteprint.php?game=m1ma1qhx1v0cs0f&exactly=night&fin... Page URL
http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

3
Requests

33 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

29 kB
Transfer

281 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.jzwk8.com/content/pages/submitted/noteprint.php?game=m1ma1qhx1v0cs0f&exactly=night&finger=baby Page URL
http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

3 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK noteprint.php Show response
www.jzwk8.com/content/pages/submitted/ 3 KB
1 KB 4113ms
2662ms Document
text/html 103.113.92.89
ASLINE-AS-AP ASLI...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.jzwk8.com/content/pages/submitted/noteprint.php?game=m1ma1qhx1v0cs0f&exactly=night&finger=baby
Protocol: HTTP/1.1
Server: 103.113.92.89 , China, ASN18013 (ASLINE-AS-AP ASLINE LIMITED, HK),
Reverse DNS
Software: Apache/2.4.7 (Centos) /
Resource Hash: d39a8e3d0ff1a5c18be8a500e1155cfe649498807b752746dd04234f25187b22

Request headers

Host: www.jzwk8.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache/2.4.7 (Centos)
Date: Tue, 29 Dec 2020 14:42:53 GMT
Content-Encoding: gzip
Content-type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK Primary Request noteprint.php
www.jzwk8.com/content/pages/submitted/ 185 KB
0 9854ms
9854ms Document
text/html 103.113.92.89
ASLINE-AS-AP ASLI...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store
Requested by: Host: www.jzwk8.com
URL: http://www.jzwk8.com/content/pages/submitted/noteprint.php?game=m1ma1qhx1v0cs0f&exactly=night&finger=baby
Protocol: HTTP/1.1
Server: 103.113.92.89 , China, ASN18013 (ASLINE-AS-AP ASLINE LIMITED, HK),
Reverse DNS
Software: Apache/2.4.7 (Centos) /
Resource Hash

Request headers

Host: www.jzwk8.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.jzwk8.com/content/pages/submitted/noteprint.php?game=m1ma1qhx1v0cs0f&exactly=night&finger=baby
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.jzwk8.com/content/pages/submitted/noteprint.php?game=m1ma1qhx1v0cs0f&exactly=night&finger=baby

Response headers

Server: Apache/2.4.7 (Centos)
Date: Tue, 29 Dec 2020 14:43:04 GMT
Content-Encoding: gzip
Content-type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2

200

jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

86 KB
28 KB

17ms
17ms

Script
application/javascript

2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: www.jzwk8.com
URL: http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Dec 2020 14:44:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 298012
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
content-length: 27748
cf-request-id: 07508e23c600000601c23f6000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wiu9v4ThrD7tBqEGeD2tc29SSTwn2zEtxX695iSN7AUxNyalDbnTX23K4yOpTdsLd33IQkOE%2BhoLWpuI0goVE5JOyOu2%2BEXdfTw2Ee%2BzLV6Hr8GoSevVPkU2srUkJQXvrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 60944c7f9c510601-FRA
expires: Sun, 19 Dec 2021 14:44:23 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e

Request headers

Referer: http://www.jzwk8.com/content/pages/submitted/noteprint.php?leg=9fqy99gp9t0v&sentence=fill&bob=store
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
www.jzwk8.com
103.113.92.89
2606:4700::6810:125e
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e
d39a8e3d0ff1a5c18be8a500e1155cfe649498807b752746dd04234f25187b22

www.jzwk8.com Open in urlscan Pro 103.113.92.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

33 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

29 kBTransfer

281 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

www.jzwk8.com Open in urlscan Pro
103.113.92.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

29 kB
Transfer

281 kB
Size

0
Cookies

3 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!