zalandobawq.vip Open in urlscan Pro
188.114.97.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://zalandobawq.vip/
Effective URL:
https://zalandobawq.vip/h5/
Submission: On November 15 via api (November 15th 2024, 6:30:37 pm UTC) from PL — Scanned from NL

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 188.114.97.9, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is zalandobawq.vip.
TLS certificate: Issued by WE1 on November 14th 2024. Valid for: 3 months.

This is the only time zalandobawq.vip was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 16	188.114.97.9 188.114.97.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2408:4005:30a... 2408:4005:30a:4302:6218:d8d9:db29:5dd8	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
17	4

16 188.114.97.9 (Amsterdam, Netherlands) 2 redirects

ASN13335 (CLOUDFLARENET, US)

zalandobawq.vip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

www.zalandobawq.vip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2408:4005:30a:4302:6218:d8d9:db29:5dd8 (China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

cdn.dcloud.net.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	zalandobawq.vip 2 redirects zalandobawq.vip www.zalandobawq.vip	591 KB
1	dcloud.net.cn cdn.dcloud.net.cn — Cisco Umbrella Rank: 69293	419 B
17	2

	Domain	Requested by
16	zalandobawq.vip	2 redirects zalandobawq.vip
1	cdn.dcloud.net.cn	zalandobawq.vip
1	www.zalandobawq.vip	zalandobawq.vip
17	3

This site contains no links.

Subject Issuer	Validity	Valid
zalandobawq.vip WE1	`2024-11-14` - `2025-02-12`	3 months	crt.sh
*.dcloud.net.cn Certum Domain Validation CA SHA2	`2024-08-12` - `2025-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://zalandobawq.vip/h5/
Frame ID: E2C3B9238A4EE302684B5C6088AF7DED
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

zalando

Page URL History Show full URLs

http://zalandobawq.vip/ HTTP 307
https://zalandobawq.vip/ Page URL
https://zalandobawq.vip/cdn-cgi/phish-bypass?atok=fPGPe4Ds8ogbEsDDnw8bS5cGlRgQsYZvBlgNtMvY56U-173169... HTTP 301
https://zalandobawq.vip/ HTTP 302
https://zalandobawq.vip/index/login/index.html Page URL
https://zalandobawq.vip/h5/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

17
Requests

94 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

4
IPs

2
Countries

591 kB
Transfer

1335 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://zalandobawq.vip/ HTTP 307
https://zalandobawq.vip/ Page URL
https://zalandobawq.vip/cdn-cgi/phish-bypass?atok=fPGPe4Ds8ogbEsDDnw8bS5cGlRgQsYZvBlgNtMvY56U-1731695425-0.0.1.1-%2F HTTP 301
https://zalandobawq.vip/ HTTP 302
https://zalandobawq.vip/index/login/index.html Page URL
https://zalandobawq.vip/h5/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://zalandobawq.vip/ HTTP 307
https://zalandobawq.vip/

Request Chain 4

https://zalandobawq.vip/cdn-cgi/phish-bypass?atok=fPGPe4Ds8ogbEsDDnw8bS5cGlRgQsYZvBlgNtMvY56U-1731695425-0.0.1.1-%2F HTTP 301
https://zalandobawq.vip/ HTTP 302
https://zalandobawq.vip/index/login/index.html

17 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

403

/ Show response
zalandobawq.vip/
Redirect Chain

http://zalandobawq.vip/
https://zalandobawq.vip/

4 KB
2 KB

212ms
40ms

Document
text/html

188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f9d1e60950028f8f24570958fba30bf884927028390a34796ac3f2121c01a7b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8e314ffb6dec0e2e-AMS
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 15 Nov 2024 18:30:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RWcc625MSeesk086B8IYWoNcerc2agjNinwiOQEaElFooXbjWJkP%2Bq2nwZq2kclZ6AnNq5a2k%2BmC3CexACMd%2FCrdOWnvzuEj8UxqKRDonulJql%2BBD%2FM6mWh3HSwLHLG2Jys%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Location: https://zalandobawq.vip/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 cf.errors.css
zalandobawq.vip/cdn-cgi/styles/ 23 KB
5 KB 57ms
52ms Stylesheet
text/css 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/cdn-cgi/styles/cf.errors.css

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"673379a7-5df3"
x-content-type-options: nosniff
cf-ray: 8e314ffc2ede0e2e-AMS
expires: Fri, 15 Nov 2024 20:30:25 GMT
date: Fri, 15 Nov 2024 18:30:25 GMT
content-type: text/css
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
zalandobawq.vip/cdn-cgi/images/ 452 B
635 B 32ms
32ms Image
image/png 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zalandobawq.vip/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "673379a7-1c4"
x-content-type-options: nosniff
cf-ray: 8e314ffc9f7f0e2e-AMS
expires: Fri, 15 Nov 2024 20:30:26 GMT
accept-ranges: bytes
content-length: 452
date: Fri, 15 Nov 2024 18:30:26 GMT
content-type: image/png
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 403 favicon.ico
zalandobawq.vip/ 4 KB
2 KB 60ms
60ms Other
text/html 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6de32c66b2526c740bc425de692cae5c629ce7ba6d9d27907015a85f78b447e3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vHki%2BLVJEYDYT%2BNkfS6D7Y%2BA889jGpC4Kbm%2FCO3qT6o0sT9EhJL705CCcyZWcip9Heel9ocMEN78srQmVWGDV3xkUPUADFUHjgqZ2M5Wo5ol%2BSUm20WUUizAP%2Fay%2FCnWTtI%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e314ffcf8460e2e-AMS
date: Fri, 15 Nov 2024 18:30:26 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H3

200

index.html
zalandobawq.vip/index/login/
Redirect Chain

https://zalandobawq.vip/cdn-cgi/phish-bypass?atok=fPGPe4Ds8ogbEsDDnw8bS5cGlRgQsYZvBlgNtMvY56U-1731695425-0.0.1.1-%2F
https://zalandobawq.vip/
https://zalandobawq.vip/index/login/index.html

52 B
786 B

303ms
302ms

Document
text/html

188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/index/login/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://zalandobawq.vip/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 8e315019df370e2e-AMS
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Fri, 15 Nov 2024 18:30:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QFu1zL5wTDOUyRT2l2%2FlMBpn1hrAC0yXUmIVwRaqO6d6Cy4MG394%2Fasaz0faO0CXPN6k8M4Xb2HD1g29DbujCYQk4fwTPXdgdaZePVukJ6dYfwS3AdPB0RMKSfa7nyU1hLI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=23866&sent=32&recv=26&lost=0&retrans=0&sent_bytes=15508&recv_bytes=7417&delivery_rate=730&cwnd=12000&unsent_bytes=0&cid=f0fe0756b18799e9&ts=5316&x=1" cfHdrFlush;dur=0
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: no-cache,must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8e315015490e0e2e-AMS
content-type: text/html; charset=utf-8
date: Fri, 15 Nov 2024 18:30:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /index/login/index.html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hp27yjFkyV5CUqsRhakHfZ4yIp95FvkhIhESslKycaEv0TypiM%2BQuEJgeYq8LwcUNW5RYaRGoNBUOsOu%2FGJoBVwBjZ0%2FGNgd5Lw5mospAlO7wnHms%2Fi6MEK6ekSpD8zCBzc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=23595&sent=29&recv=23&lost=0&retrans=0&sent_bytes=14718&recv_bytes=6818&delivery_rate=451&cwnd=12000&unsent_bytes=0&cid=f0fe0756b18799e9&ts=4995&x=1" cfHdrFlush;dur=0
strict-transport-security: max-age=31536000

GET
H3 200 Primary Request / Show response
zalandobawq.vip/h5/ 781 B
1 KB 253ms
253ms Document
text/html 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fbe693357e6b73767cac04bd0e2c9b8dcdcdc09662f14d9dc5f550b9ef6ac6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://zalandobawq.vip/index/login/index.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e31501e1cd80e2e-AMS
content-encoding: zstd
content-type: text/html
date: Fri, 15 Nov 2024 18:30:31 GMT
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PimAV%2BiIvn7s0smcOgwT%2FL8m8tqS0yqd1rWJN%2F5PD4k26FF%2BN1CXWw8M3UOfaZXHCWa3%2FXqvd3zdJIVm%2F7G6k%2BkIqWl4gPzxilNzD6fOfrgdQijdL7kc7WztxrwSpUvg288%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=23945&sent=35&recv=29&lost=0&retrans=0&sent_bytes=16365&recv_bytes=8416&delivery_rate=16345&cwnd=12000&unsent_bytes=0&cid=f0fe0756b18799e9&ts=5947&x=1" cfHdrFlush;dur=0
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET favicon.ico
zalandobawq.vip/ 0
0

GET
H3 200 index.2da1efab.css
zalandobawq.vip/h5/static/ 94 KB
30 KB 52ms
51ms Stylesheet
text/css 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/h5/static/index.2da1efab.css

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-178f9"
age: 10557
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FgXKPtGoF9A0yKb%2B6vuySB4Bq%2BBChwoDmCfy7ztrVTbez3iY%2FLtgtilQUidm6yWFVN%2BLv7MjmoZ7Z6xlw4j7NFfx83%2BiBii2tCfW1wMvZ6Jq2W8EANE0NUp1fisw5uAmU2A%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 16 Nov 2024 03:34:34 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=24117&sent=48&recv=34&lost=0&retrans=0&sent_bytes=29508&recv_bytes=9717&delivery_rate=4547&cwnd=12000&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6072&x=1", cfHdrFlush;dur=12
date: Fri, 15 Nov 2024 18:30:31 GMT
content-type: text/css
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=43200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150203f780e2e-AMS
server: cloudflare

GET
H3 200 chunk-vendors.d70c425e.js Show response
zalandobawq.vip/h5/static/js/ 776 KB
271 KB 68ms
67ms Script
application/javascript 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/h5/static/js/chunk-vendors.d70c425e.js

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

377cc2e5a6ddddd3a5c0c29bf343ce73b403bdc7a6c13424c151497fc86d62c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-c1f78"
age: 10557
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IXjJGEDAQdBm7400vIpJt9HbBuq45eMAJ0glGSnd48jE4TcjMpU99ZSy%2B7O%2Buw5GE9eTaK7IBAVTawGyeTX27Ul%2Fbj%2Bm8LVuE2k7ybpLTfz65yrsODTwPCF%2BT1SEcYwPMwk%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 16 Nov 2024 03:34:34 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=24117&sent=48&recv=34&lost=0&retrans=0&sent_bytes=29508&recv_bytes=9717&delivery_rate=4547&cwnd=12000&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6071&x=1", cfHdrFlush;dur=13
date: Fri, 15 Nov 2024 18:30:31 GMT
content-type: application/javascript
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=43200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150203f7b0e2e-AMS
server: cloudflare

GET
H3 200 index.c3eb817c.js Show response
zalandobawq.vip/h5/static/js/ 216 KB
73 KB 32ms
31ms Script
application/javascript 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/h5/static/js/index.c3eb817c.js

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97245a80be4f4d3292419976be038deb521d1cd84ad7bd7b04119e1ffec082ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-35e81"
age: 10557
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWXGIi%2Bo7cUTv4ffhra7S8YDCju49E8wO6zX%2FRQA%2F9z19vzWsfMEQ0NLruhnyP67M61U4SHsTTvDiUjmW0B1K3AR2kjmwGU5jeTZIggs%2BLb5adHhIqqurYAvNpxZX5lcY8g%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 16 Nov 2024 03:34:34 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=24117&sent=38&recv=34&lost=0&retrans=0&sent_bytes=17536&recv_bytes=9717&delivery_rate=4547&cwnd=12000&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6070&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:31 GMT
content-type: application/javascript
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=43200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150203f7d0e2e-AMS
server: cloudflare

GET
H3 200 pages-index-index.37d19808.js Show response
zalandobawq.vip/h5/static/js/ 9 KB
4 KB 33ms
32ms Script
application/javascript 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/h5/static/js/pages-index-index.37d19808.js

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/static/js/index.c3eb817c.js

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

761fe487c65b96da05bae6544a6397983ca9eb3df69954f2281f47a53f5be0c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-23a2"
age: 10556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CPgr6NTdPwzo9NCOZJh1xY%2FwsELV2bFUrNSWaud0b8FGytyc6npXffnmEghiIR3qJDTUgSkcD1p5X97qiWFO%2BYHNqRFpzqYZVlY3beJe8U2Jwj7ZvcW5I327PFJOkkjj3Kw%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 16 Nov 2024 03:34:35 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=85141&sent=372&recv=101&lost=0&retrans=1&sent_bytes=410356&recv_bytes=13026&delivery_rate=594791&cwnd=160500&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6602&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:32 GMT
content-type: application/javascript
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=43200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150238ba60e2e-AMS
server: cloudflare

GET
H3 200 kefu Show response
www.zalandobawq.vip//ch/api/ 134 B
1021 B 809ms
718ms XHR
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zalandobawq.vip//ch/api/kefu

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/static/js/chunk-vendors.d70c425e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f68e8a28fdebe3e61eb37c8ead94405348a0c65fd5cfc1863c93dce186a3bacd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/

Response headers

access-control-expose-headers: User-Token-Csrf
content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6U1Hak3IPy291VVwkJYyL63xlJ7gJydUsxhwwXbw8pzRcJvP%2Ff7JbagWGaBSc603xOMZO2FPnxICcGPNZwpnr2wFEhWfbY7JFvIE6gqV%2FzTf7Qa545v0ivroB4uRnZHnS61Dy36"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST,PATCH,PUT,DELETE
expires: Thu, 19 Nov 1981 08:52:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=15990&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4218&recv_bytes=4468&delivery_rate=641&cwnd=12000&unsent_bytes=0&cid=8957b5d2f3574fc5&ts=749&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:33 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Authorization,Content-Type,If-Match,If-Modified-Since,If-None-Match,If-Unmodified-Since,X-Requested-With
strict-transport-security: max-age=31536000
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8e315024cdf70e3d-AMS
access-control-allow-origin: https://zalandobawq.vip
server: cloudflare

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a788ad071ed637ab2258c65a36d37d7affe1dcde7243d1aa4c03ae67040aea6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 service.png
zalandobawq.vip/h5/static/ 33 KB
33 KB 83ms
43ms Image
image/png 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zalandobawq.vip/h5/static/service.png

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29f158fc49b5f42dd433205a514359a0ec874a1838716f11af4e754beac3c943

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-832c"
age: 10556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uf4S7U%2BnN6ohUPUpGvoE96c6ZFWmjpnTg37qt2UUUmmMqrU3G5Q%2FqsyDRccahyCwATTJ72nXsn60B%2BjFBUJI1jLVHZzkcgPm4rxLpTzlzwcbVCIt8989Z0Uc%2FBYa0kflbBw%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 15 Dec 2024 15:34:36 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=76456&sent=379&recv=105&lost=0&retrans=1&sent_bytes=415028&recv_bytes=14378&delivery_rate=136532&cwnd=160500&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6761&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:32 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150247cf50e2e-AMS
server: cloudflare

GET
H3 200 logo.png
zalandobawq.vip/h5/static/ 104 KB
102 KB 88ms
36ms Image
image/png 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zalandobawq.vip/h5/static/logo.png

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09b5118b1e62fdc785d35b94a5a77ca7101b5ae42403354eea25e40510b503c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-19eea"
age: 10556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rJUozw%2BG0ladiFIaixy6KMz19xFBll%2FvMY8FWAVXg5XKahyLvHfHV2QPVxWr39kOKY6zzxsIEx%2BTetSe52SB7zNkfnMn2UF5kQUGoyUW5F2WXWX96GTJ80Z%2FbArGDwnHj2U%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 15 Dec 2024 15:34:36 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=76456&sent=419&recv=105&lost=0&retrans=1&sent_bytes=461862&recv_bytes=14378&delivery_rate=136532&cwnd=160500&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6772&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:32 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150249d0b0e2e-AMS
server: cloudflare

GET
H3 200 bg-login.png
zalandobawq.vip/h5/static/ 64 KB
62 KB 88ms
31ms Image
image/png 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zalandobawq.vip/h5/static/bg-login.png

Requested by

Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c8bb34e950cd5f9e929b2aecc82c314e98aa225fc6bf7ed09c8ca1b8e95eca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"6734c8b2-feef"
age: 10556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zVaWjbOAFPqzQdBPYgKPGRWgTHqcPFlmeNCuWFMKNThuyU%2BToFeBiH6QCZ96f2yMhsfzi8ISWGVJW13Sabs6iG0ih1rYNzilxYtf9tMq88iQKwFSmejHUhmKH3GCfWO0VKM%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 15 Dec 2024 15:34:36 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=76456&sent=409&recv=105&lost=0&retrans=1&sent_bytes=449862&recv_bytes=14378&delivery_rate=136532&cwnd=160500&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6772&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:32 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 15:41:38 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e3150249d100e2e-AMS
server: cloudflare

GET
H3 200 favicon.ico
zalandobawq.vip/ 4 KB
3 KB 53ms
53ms Other
image/x-icon 188.114.97.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zalandobawq.vip/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97a8aa4a501654a28f1fe60e1fce3f9070c80d698790beb60b2d714f78bd786f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/h5/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"5faea0b2-10be"
age: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ja%2B9No4YiRGVzbO%2BofgA0tpml%2B65N0zF4hSLA%2BEftxxFQuH5d0zaIYSUOmSaBfTZKidpXAfWgQJnxqwDENR4uC4PE5kz%2Bs1NshYNkbv7I8JXZ0j%2B8t82eLRzmnCCGJYZ5wE%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22732&sent=553&recv=124&lost=0&retrans=1&sent_bytes=620958&recv_bytes=15623&delivery_rate=4734493&cwnd=191700&unsent_bytes=0&cid=f0fe0756b18799e9&ts=6840&x=1", cfHdrFlush;dur=0
date: Fri, 15 Nov 2024 18:30:32 GMT
content-type: image/x-icon
last-modified: Fri, 13 Nov 2020 15:05:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e315024fd7f0e2e-AMS
server: cloudflare

GET
H2 200 shadow-grey.png
cdn.dcloud.net.cn/img/ 136 B
419 B 1277ms
331ms Image
image/png 2408:4005:30a:4302:6218:d8d9:db29:5dd8
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.dcloud.net.cn/img/shadow-grey.png
Requested by: Host: zalandobawq.vip
URL: https://zalandobawq.vip/h5/static/index.2da1efab.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2408:4005:30a:4302:6218:d8d9:db29:5dd8 , China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zalandobawq.vip/

Response headers

cache-control: max-age=75600
etag: "5cf8b5bf-88"
expires: Sat, 16 Nov 2024 15:30:36 GMT
accept-ranges: bytes
content-length: 136
date: Fri, 15 Nov 2024 18:30:36 GMT
content-type: image/png
last-modified: Thu, 06 Jun 2019 06:42:07 GMT
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: zalandobawq.vip
URL: https://zalandobawq.vip/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.zalandobawq.vip/	1970-01-21 01:03:01	Name: __cf_mw_byp Value: fPGPe4Ds8ogbEsDDnw8bS5cGlRgQsYZvBlgNtMvY56U-1731695425-0.0.1.1-/
zalandobawq.vip/	1969-12-31 23:59:59	Name: s0af7a93f Value: qvt2a762sjpcdtcs70phjnk4i0
.dcloud.net.cn/	1970-01-21 10:37:35	Name: __uni__uid Value: 2yld2Gc3k0xB3OexA0YLAg==

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://zalandobawq.vip/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://zalandobawq.vip/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.dcloud.net.cn
www.zalandobawq.vip
zalandobawq.vip
zalandobawq.vip
188.114.96.3
188.114.97.9
2408:4005:30a:4302:6218:d8d9:db29:5dd8
09b5118b1e62fdc785d35b94a5a77ca7101b5ae42403354eea25e40510b503c7
29f158fc49b5f42dd433205a514359a0ec874a1838716f11af4e754beac3c943
2f9d1e60950028f8f24570958fba30bf884927028390a34796ac3f2121c01a7b
377cc2e5a6ddddd3a5c0c29bf343ce73b403bdc7a6c13424c151497fc86d62c4
3fbe693357e6b73767cac04bd0e2c9b8dcdcdc09662f14d9dc5f550b9ef6ac6d
4a788ad071ed637ab2258c65a36d37d7affe1dcde7243d1aa4c03ae67040aea6
6c8bb34e950cd5f9e929b2aecc82c314e98aa225fc6bf7ed09c8ca1b8e95eca5
6de32c66b2526c740bc425de692cae5c629ce7ba6d9d27907015a85f78b447e3
761fe487c65b96da05bae6544a6397983ca9eb3df69954f2281f47a53f5be0c5
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
97245a80be4f4d3292419976be038deb521d1cd84ad7bd7b04119e1ffec082ad
97a8aa4a501654a28f1fe60e1fce3f9070c80d698790beb60b2d714f78bd786f
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f
e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f68e8a28fdebe3e61eb37c8ead94405348a0c65fd5cfc1863c93dce186a3bacd

zalandobawq.vip Open in urlscan Pro 188.114.97.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

94 %HTTPS

33 %IPv6

2 Domains

3 Subdomains

4 IPs

2 Countries

591 kBTransfer

1335 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

3 Cookies

2 Console Messages

Security Headers

Indicators

zalandobawq.vip Open in urlscan Pro
188.114.97.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

94 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

4
IPs

2
Countries

591 kB
Transfer

1335 kB
Size

3
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!