icgbl.org - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 118.190.84.13, located in Qingdao, China and belongs to ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN. The main domain is icgbl.org.
TLS certificate: Issued by TrustAsia RSA DV TLS CA G2 on November 11th 2024. Valid for: 3 months.

This is the only time icgbl.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Incomplete client_setup_S660930871_.exe 16 MB

Size: 16 MB (16820344 bytes, 3% done)

Downloaded from: https://storage.googleapis.com/kksayu/%E7%99%BE%E9%87%8C%E4%B8%9C%E5%90%9B/client_setup_S660930871_.exe

Domain & IP information

	IP Address	AS Autonomous System
1 1	154.44.30.229 154.44.30.229	979 (NETLAB-SDN) (NETLAB-SDN)
2	118.190.84.13 118.190.84.13	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
1	113.219.142.41 113.219.142.41	63838 (CT-HUNAN-...) (CT-HUNAN-HENGYANG-IDC Hengyang)
1	2a00:1450:400... 2a00:1450:4001:802::201b	15169 (GOOGLE) (GOOGLE)
4	3

1 154.44.30.229 (Hong Kong, Hong Kong) 1 redirects

ASN979 (NETLAB-SDN, US)

fukellc.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 118.190.84.13 (Qingdao, China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

icgbl.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 113.219.142.41 (China)

ASN63838 (CT-HUNAN-HENGYANG-IDC Hengyang, CN)

yj.ibm12.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::201b (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	icgbl.org icgbl.org	12 KB
1	googleapis.com storage.googleapis.com — Cisco Umbrella Rank: 314
1	ibm12.cn yj.ibm12.cn	616 B
1	fukellc.top 1 redirects fukellc.top	188 B
4	4

	Domain	Requested by
2	icgbl.org
1	storage.googleapis.com	icgbl.org
1	yj.ibm12.cn	icgbl.org
1	fukellc.top	1 redirects
4	4

This site contains no links.

Subject Issuer	Validity	Valid
icgbl.org TrustAsia RSA DV TLS CA G2	`2024-11-11` - `2025-02-09`	3 months	crt.sh
yj.ibm12.cn R10	`2024-11-22` - `2025-02-20`	3 months	crt.sh
storage.googleapis.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a
Frame ID: 54CC3FC8A0CEEDE13D2DCCD2B5F5B2F8
Requests: 3 HTTP requests in this frame

Frame: https://storage.googleapis.com/kksayu/%E7%99%BE%E9%87%8C%E4%B8%9C%E5%90%9B/client_setup_S660930871_.exe
Frame ID: AC589CE8C5C8C01F6CD5D0FFA73975C9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

2

Page URL History Show full URLs

https://fukellc.top/ HTTP 302
https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455... Page URL

Page Statistics

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

12 kB
Transfer

11 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fukellc.top/ HTTP 302
https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 20241201105841_46455.html Show response
icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/
Redirect Chain

https://fukellc.top/
https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a

10 KB
10 KB

1819ms
429ms

Document
text/html

118.190.84.13
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 118.190.84.13 Qingdao, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: nginx/1.14.0 /
Resource Hash: 02dcc971e74e199f8fa898ce778764eaf4f94f170c81858e7e186bb8d799960e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 10331
Content-Type: text/html
Date: Mon, 02 Dec 2024 14:42:22 GMT
ETag: "674c4161-285b"
Last-Modified: Sun, 01 Dec 2024 10:58:41 GMT
Server: nginx/1.14.0

Redirect headers

content-type: text/html; charset=UTF-8
date: Mon, 02 Dec 2024 14:42:21 GMT
location: https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a
server: nginx
strict-transport-security: max-age=31536000

GET
H/1.1 200
OK api.php Show response
yj.ibm12.cn/ 145 B
616 B 4025ms
481ms XHR
application/json 113.219.142.41
CT-HUNAN-HENGYANG...

General

Check archive.org

Show headers Download Go to

Full URL

https://yj.ibm12.cn/api.php?id=37e48dc56a

Requested by

Host: icgbl.org
URL: https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

113.219.142.41 , China, ASN63838 (CT-HUNAN-HENGYANG-IDC Hengyang, CN),

Reverse DNS

Software

JSP3/2.0.14 /

Resource Hash

39251272eab132cfa26efac5db45e6c13c164c5bcbce8cb1d3593dd6f8327a01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://icgbl.org/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000
X-Cache-Status: MISS
Content-Encoding: gzip
Connection: keep-alive
Ohc-Cache-HIT: chenzct62 [1], czix77 [1]
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Date: Mon, 02 Dec 2024 14:42:27 GMT
Content-Type: application/json; charset=UTF-8
Vary: Accept-Encoding
Server: JSP3/2.0.14
Access-Control-Allow-Headers: Content-Type

GET
H/1.1 404
Not Found favicon.ico
icgbl.org/ 1 KB
1 KB 244ms
244ms Other
text/html 118.190.84.13
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: https://icgbl.org/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 118.190.84.13 Qingdao, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: nginx/1.14.0 / PHP/7.2.10
Resource Hash: 16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a

Response headers

Transfer-Encoding: chunked
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Date: Mon, 02 Dec 2024 14:42:23 GMT
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/7.2.10
Server: nginx/1.14.0

GET
H2 200 client_setup_S660930871_.exe
storage.googleapis.com/kksayu/%E7%99%BE%E9%87%8C%E4%B8%9C%E5%90%9B/ Frame AC58 0
0 286ms
259ms Document
application/x-msdownload 2a00:1450:4001:802::201b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/kksayu/%E7%99%BE%E9%87%8C%E4%B8%9C%E5%90%9B/client_setup_S660930871_.exe
Requested by: Host: icgbl.org
URL: https://icgbl.org/cssviews/adminview/js/kindeditor/attached/file/20241201/20241201105841_46455.html?id=37e48dc56a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash

Request headers

Referer: https://icgbl.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-length: 16820344
content-type: application/x-msdownload
date: Mon, 02 Dec 2024 14:42:27 GMT
etag: "56d5168e68d16cafcae3d0134242887d"
expires: Mon, 02 Dec 2024 15:42:27 GMT
last-modified: Thu, 28 Nov 2024 23:57:10 GMT
server: UploadServer
x-goog-generation: 1732838230689353
x-goog-hash: crc32c=5cN6TQ== md5=VtUWjmjRbK/K49ATQkKIfQ==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 16820344
x-guploader-uploadid: AFiumC7eCpnpx12JXwwDNO7zhYUqgArSee2BiEB2PC9JbkN19lztetcuJAhYP3qpfImQCtgB6ik

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			icgbl.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: usdefhhja4j6lbgg9h84u76cap

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://icgbl.org/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fukellc.top
icgbl.org
storage.googleapis.com
yj.ibm12.cn
113.219.142.41
118.190.84.13
154.44.30.229
2a00:1450:4001:802::201b
02dcc971e74e199f8fa898ce778764eaf4f94f170c81858e7e186bb8d799960e
16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2
39251272eab132cfa26efac5db45e6c13c164c5bcbce8cb1d3593dd6f8327a01

icgbl.org Open in urlscan Pro 118.190.84.13 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

12 kBTransfer

11 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

icgbl.org Open in urlscan Pro
118.190.84.13 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

12 kB
Transfer

11 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions