35.221.218.172 - urlscan.io

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 35.221.218.172, located in Taipei, Taiwan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is 35.221.218.172.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 7th 2024. Valid for: a year.

This is the only time 35.221.218.172 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	154.216.114.7 154.216.114.7	132839 (POWERLINE...) (POWERLINE-AS-AP POWER LINE DATACENTER)
2	111.45.11.83 111.45.11.83	56040 (CMNET-GUA...) (CMNET-GUANGDONG-AP China Mobile communications corporation)
1	35.221.218.172 35.221.218.172	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6	4

2 154.216.114.7 (Hong Kong, Hong Kong)

ASN132839 (POWERLINE-AS-AP POWER LINE DATACENTER, HK)

whatsap-vip1.com.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 111.45.11.83 (China)

ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.221.218.172 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 172.218.221.35.bc.googleusercontent.com

35.221.218.172	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 8226	12 KB
2	whatsap-vip1.com.cn whatsap-vip1.com.cn	2 KB
0	Failed function sub() { [native code] }. Failed
6	3

	Domain	Requested by
2	hm.baidu.com	whatsap-vip1.com.cn
2	whatsap-vip1.com.cn
0	35.221.218.172 Failed	35.221.218.172
6	3

This site contains no links.

Subject Issuer	Validity	Valid
baidu.com GlobalSign RSA OV SSL CA 2018	`2024-07-08` - `2025-08-09`	a year	crt.sh
35.221.218.172 Sectigo RSA Domain Validation Secure Server CA	`2024-08-07` - `2025-08-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://35.221.218.172:27770/register
Frame ID: E0727CC7CFEF3A27704FB784AF2026F4
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://whatsap-vip1.com.cn/ HTTP 307
https://whatsap-vip1.com.cn/ HTTP 307
http://whatsap-vip1.com.cn/ Page URL
https://35.221.218.172:27770/register Page URL

Detected technologies

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

17 kB
Transfer

38 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://whatsap-vip1.com.cn/ HTTP 307
https://whatsap-vip1.com.cn/ HTTP 307
http://whatsap-vip1.com.cn/ Page URL
https://35.221.218.172:27770/register Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://whatsap-vip1.com.cn/ HTTP 307
https://whatsap-vip1.com.cn/ HTTP 307
http://whatsap-vip1.com.cn/

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
whatsap-vip1.com.cn/
Redirect Chain

http://whatsap-vip1.com.cn/
https://whatsap-vip1.com.cn/
http://whatsap-vip1.com.cn/

611 B
842 B

538ms
204ms

Document
text/html

154.216.114.7
POWERLINE-AS-AP P...

General

Check archive.org

Show headers Download Go to

Full URL: http://whatsap-vip1.com.cn/
Protocol: HTTP/1.1
Server: 154.216.114.7 Hong Kong, Hong Kong, ASN132839 (POWERLINE-AS-AP POWER LINE DATACENTER, HK),
Reverse DNS
Software: nginx /
Resource Hash: c5dd4a2e69e6755ab3ed0c7522f5e889f9fb2bb5d202637eb984f10de0820e11

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 611
Content-Type: text/html
Date: Thu, 12 Sep 2024 03:48:59 GMT
ETag: "66dec1d9-263"
Last-Modified: Mon, 09 Sep 2024 09:37:29 GMT
Server: nginx

Redirect headers

Location: http://whatsap-vip1.com.cn/
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 1156ms
307ms Script
application/javascript 111.45.11.83
CMNET-GUANGDONG-A...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?cf7dd4e31bd4254693636e9096e16189

Requested by

Host: whatsap-vip1.com.cn
URL: http://whatsap-vip1.com.cn/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

111.45.11.83 , China, ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN),

Reverse DNS

Software

apache /

Resource Hash

23ad4ddedb387e87876599055743902b82293345eedb18048efcb714bc63e39d

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

Referer: http://whatsap-vip1.com.cn/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Thu, 12 Sep 2024 03:49:00 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=172800
Server: apache
Etag: 3a47f62e140bb6530f86111a93be72bc
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: application/javascript
Cache-Control: max-age=0, must-revalidate
Content-Length: 11284

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 305ms
304ms Image
image/gif 111.45.11.83
CMNET-GUANGDONG-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?hca=6C792B1E8DEA2F9B&cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=de-de&lo=0&rnd=1792286743&si=cf7dd4e31bd4254693636e9096e16189&v=1.3.2&lv=1&sn=52111&r=0&ww=1600&u=http%3A%2F%2Fwhatsap-vip1.com.cn%2F&tt=%E6%AD%A3%E5%9C%A8%E5%AE%89%E5%85%A8%E8%BF%9B%E5%85%A5.......

Requested by

Host: whatsap-vip1.com.cn
URL: http://whatsap-vip1.com.cn/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

111.45.11.83 , China, ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

Referer: http://whatsap-vip1.com.cn/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 12 Sep 2024 03:49:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
Server: apache
Content-Type: image/gif
Cache-Control: private, max-age=0, no-cache
Content-Length: 43

GET
H/1.1 200
OK favicon.ico
whatsap-vip1.com.cn/ 611 B
842 B 204ms
204ms Other
text/html 154.216.114.7
POWERLINE-AS-AP P...

General

Check archive.org

Show headers Download Go to

Full URL: http://whatsap-vip1.com.cn/favicon.ico
Protocol: HTTP/1.1
Server: 154.216.114.7 Hong Kong, Hong Kong, ASN132839 (POWERLINE-AS-AP POWER LINE DATACENTER, HK),
Reverse DNS
Software: nginx /
Resource Hash: c5dd4a2e69e6755ab3ed0c7522f5e889f9fb2bb5d202637eb984f10de0820e11

Request headers

Referer: http://whatsap-vip1.com.cn/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Thu, 12 Sep 2024 03:49:01 GMT
Last-Modified: Mon, 09 Sep 2024 09:37:29 GMT
Server: nginx
ETag: "66dec1d9-263"
Content-Type: text/html
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 611

GET
H2 200 Primary Request register Show response
35.221.218.172/ 8 KB
4 KB 738ms
303ms Document
text/html 35.221.218.172
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://35.221.218.172:27770/register
Requested by: Host: whatsap-vip1.com.cn
URL: http://whatsap-vip1.com.cn/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.221.218.172 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 172.218.221.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 5ed615bba8c7283d79e4ad2dde2fc0696f71b1f779015094dd1785360b9cfecd

Request headers

Referer: http://whatsap-vip1.com.cn/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-method: *
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html
date: Thu, 12 Sep 2024 03:49:02 GMT
etag: W/"66e25357-1f64"
last-modified: Thu, 12 Sep 2024 02:35:03 GMT
magic_string: 178aa526b36126fd25b8d3446d0c1d25 178aa526b36126fd25b8d3446d0c1d25
server: openresty
servers: Tengine/1.15.1 Tengine/1.15.1
timing-allow-origin: *
vary: Accept-Encoding Accept-Encoding

GET yunwei.js
35.221.218.172/saconfig/secure/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 35.221.218.172
URL: https://35.221.218.172:27770/saconfig/secure/yunwei.js?0.07884386273061339

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| isSupportWebp

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.hm.baidu.com/	1970-01-21 09:04:32	Name: HMACCOUNT_BFESS Value: 6C792B1E8DEA2F9B
.whatsap-vip1.com.cn/	1970-01-21 08:14:08	Name: Hm_lvt_cf7dd4e31bd4254693636e9096e16189 Value: 1726112941
.whatsap-vip1.com.cn/	1969-12-31 23:59:59	Name: Hm_lpvt_cf7dd4e31bd4254693636e9096e16189 Value: 1726112941
.whatsap-vip1.com.cn/	1969-12-31 23:59:59	Name: HMACCOUNT Value: 6C792B1E8DEA2F9B

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

35.221.218.172
hm.baidu.com
whatsap-vip1.com.cn
35.221.218.172
111.45.11.83
154.216.114.7
35.221.218.172
23ad4ddedb387e87876599055743902b82293345eedb18048efcb714bc63e39d
5ed615bba8c7283d79e4ad2dde2fc0696f71b1f779015094dd1785360b9cfecd
c5dd4a2e69e6755ab3ed0c7522f5e889f9fb2bb5d202637eb984f10de0820e11
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

35.221.218.172 Open in urlscan Pro 35.221.218.172 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

17 kBTransfer

38 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

4 Cookies

Indicators

35.221.218.172 Open in urlscan Pro
35.221.218.172 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

17 kB
Transfer

38 kB
Size

4
Cookies

6 HTTP transactions
0 data transactions