29.baidubtcn.cafe Open in urlscan Pro
103.171.34.215 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://29.baidubtcn.cafe/
Submission: On January 21 via api (January 21st 2024, 4:10:22 pm UTC) from US — Scanned from US

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 3 domains to perform 22 HTTP transactions. The main IP is 103.171.34.215, located in Hong Kong and belongs to VH-GLOBAL VH Global Limited, HK. The main domain is 29.baidubtcn.cafe.
TLS certificate: Issued by R3 on August 5th 2023. Valid for: 3 months.

This is the only time 29.baidubtcn.cafe was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
11	103.171.34.215 103.171.34.215	42960 (VH-GLOBAL...) (VH-GLOBAL VH Global Limited)
7	149.88.81.9 149.88.81.9	142032 (HFTCL-AS-...) (HFTCL-AS-AP High Family Technology Co.)
2	81.68.128.21 81.68.128.21	45090 (TENCENT-N...) (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
2	108.186.255.86 108.186.255.86	54600 (PEG-SV) (PEG-SV)
22	4

11 103.171.34.215 (Hong Kong)

ASN42960 (VH-GLOBAL VH Global Limited, HK)

29.baidubtcn.cafe	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 149.88.81.9 (London, United Kingdom)

ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK)

res.zvo.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.translate.zvo.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 81.68.128.21 (China)

ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

api.kefu.leimingyun.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.186.255.86 (United States)

ASN54600 (PEG-SV, US)

america.api.translate.zvo.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	baidubtcn.cafe 29.baidubtcn.cafe	1000 KB
9	zvo.cn res.zvo.cn api.translate.zvo.cn america.api.translate.zvo.cn	51 KB
2	leimingyun.com api.kefu.leimingyun.com	331 B
22	3

	Domain	Requested by
11	29.baidubtcn.cafe	29.baidubtcn.cafe
6	api.translate.zvo.cn	res.zvo.cn
2	america.api.translate.zvo.cn	res.zvo.cn
2	api.kefu.leimingyun.com	res.zvo.cn
1	res.zvo.cn	29.baidubtcn.cafe
22	5

This site contains no links.

Subject Issuer	Validity	Valid
dhl-plus.com R3	`2023-08-05` - `2023-11-03`	3 months	crt.sh
res.zvo.cn TrustAsia RSA DV TLS CA G2	`2023-12-26` - `2024-12-25`	a year	crt.sh
api.translate.zvo.cn TrustAsia RSA DV TLS CA G2	`2023-08-01` - `2024-07-31`	a year	crt.sh
api.kefu.leimingyun.com R3	`2024-01-05` - `2024-04-04`	3 months	crt.sh
america.api.translate.zvo.cn R3	`2024-01-05` - `2024-04-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://29.baidubtcn.cafe/
Frame ID: 62A49A0AFD8A06AB3AC7661EDC96928D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

物流管理系统

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

22
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

4
Countries

1051 kB
Transfer

1219 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
29.baidubtcn.cafe/ 4 KB
2 KB 3283ms
344ms Document
text/html 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to

Full URL

https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

0c63e15197df0cd9b982f34aa70fc940d6c26892646aec56e611246706c7a240

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 21 Jan 2024 16:10:05 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
29.baidubtcn.cafe/static/admin/css/ 118 KB
24 KB 477ms
473ms Stylesheet
text/css 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to

Full URL

https://29.baidubtcn.cafe/static/admin/css/bootstrap.min.css?v=3.3.6

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

68b69105673fbb64096c34b060f900d2731d4f19202ad8f2c11274f3d6f59126

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Sat, 15 Jul 2023 16:24:50 GMT
server: nginx
etag: W/"64b2c852-1d996"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Mon, 22 Jan 2024 04:10:06 GMT

GET
H2 200 css.css
29.baidubtcn.cafe/static/index/css/ 3 KB
1 KB 478ms
474ms Stylesheet
text/css 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to

Full URL

https://29.baidubtcn.cafe/static/index/css/css.css

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

fe5ccee402aa4f07fbd643779e74ef9efd012c75376bfdd83dd5902b802b7d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Wed, 19 Jul 2023 04:09:26 GMT
server: nginx
etag: W/"64b761f6-b69"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Mon, 22 Jan 2024 04:10:06 GMT

GET
H2 200 jquery.min.js Show response
29.baidubtcn.cafe/static/admin/js/ 82 KB
33 KB 479ms
476ms Script
application/javascript 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to

Full URL

https://29.baidubtcn.cafe/static/admin/js/jquery.min.js?v=2.1.4

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

de4b3c3d1dc2506b6693f0f98884e1dc074cda9d66cab39b7b48a115fdfc4c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Sat, 15 Jul 2023 16:25:02 GMT
server: nginx
etag: W/"64b2c85e-1497d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Mon, 22 Jan 2024 04:10:06 GMT

GET
H2 200 logo.png
29.baidubtcn.cafe/static/index/img/ 12 KB
12 KB 709ms
707ms Image
image/png 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://29.baidubtcn.cafe/static/index/img/logo.png

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

b8fecebcff79b47cf15214232b96927b5b7b57d9bdd9035d87407b4faaf29f42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 01 Aug 2023 02:03:00 GMT
server: nginx
etag: "64c867d4-3005"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 12293
expires: Tue, 20 Feb 2024 16:10:06 GMT

GET
H2 200 4.jpg
29.baidubtcn.cafe/static/index/img/dhl/ 18 KB
18 KB 709ms
708ms Image
image/jpeg 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://29.baidubtcn.cafe/static/index/img/dhl/4.jpg

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

f30176fc4a100abe22f2da63c43fa24a847903bab422ccd037f8035531db1cfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 01 Aug 2023 03:10:40 GMT
server: nginx
etag: "64c877b0-474f"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 18255
expires: Tue, 20 Feb 2024 16:10:06 GMT

GET
H2 200 5.jpg
29.baidubtcn.cafe/static/index/img/dhl/ 24 KB
24 KB 235ms
235ms Image
image/jpeg 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://29.baidubtcn.cafe/static/index/img/dhl/5.jpg

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

fcc9f7034648d7b2d71965603efbe54122245cac1a9532b3dc3b5acece1b2f9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 01 Aug 2023 03:10:42 GMT
server: nginx
etag: "64c877b2-5f1c"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 24348
expires: Tue, 20 Feb 2024 16:10:06 GMT

GET
H2 200 6.jpg
29.baidubtcn.cafe/static/index/img/dhl/ 22 KB
23 KB 236ms
235ms Image
image/jpeg 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://29.baidubtcn.cafe/static/index/img/dhl/6.jpg

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

69f8fc22e7169bfcc0313609478b5c0dd60af9d6732d33b17f40e990f00b20e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 01 Aug 2023 03:10:44 GMT
server: nginx
etag: "64c877b4-5976"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 22902
expires: Tue, 20 Feb 2024 16:10:06 GMT

GET
H/1.1 200
OK translate.js Show response
res.zvo.cn/translate/ 45 KB
45 KB 1062ms
337ms Script
application/javascript 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://res.zvo.cn/translate/translate.js
Requested by: Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: 8e959729c9fcb9dd35689649da2a143252443400eed1e255fc5adf2c2b6f209b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Sun, 21 Jan 2024 16:09:50 GMT
Last-Modified: Sat, 20 Jan 2024 12:07:22 GMT
Server: nginx/1.19.6
ETag: "65abb77a-b369"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 45929

GET
H2 200 layer.min.js Show response
29.baidubtcn.cafe/static/admin/js/plugins/layer/ 21 KB
8 KB 236ms
236ms Script
application/javascript 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to

Full URL

https://29.baidubtcn.cafe/static/admin/js/plugins/layer/layer.min.js

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

fd8f3a227ff1476d3d7fb5dd45d8dda480dd894737f5fb55c3ed181a8ede64d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Sat, 15 Jul 2023 16:25:08 GMT
server: nginx
etag: W/"64b2c864-535f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Mon, 22 Jan 2024 04:10:06 GMT

GET
H2 200 banner.jpg
29.baidubtcn.cafe/static/index/img/ 851 KB
852 KB 456ms
455ms Image
image/jpeg 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://29.baidubtcn.cafe/static/index/img/banner.jpg

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/static/index/css/css.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

65c9a7079063c28a4e7eb45ba7967b8857aa08d1f26f8a3b735dc565f3f6fc5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/static/index/css/css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:06 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 18 Jul 2023 14:38:26 GMT
server: nginx
etag: "64b6a3e2-d4bf2"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 871410
expires: Tue, 20 Feb 2024 16:10:06 GMT

OPTIONS
H/1.1 200 connectTest.json
api.translate.zvo.cn/ 0
0 963ms
242ms Preflight 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/connectTest.json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://29.baidubtcn.cafe
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Sun, 21 Jan 2024 16:09:51 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

OPTIONS
H/1.1 200 connectTest.json
api.kefu.leimingyun.com/ 0
0 1495ms
404ms Preflight 81.68.128.21
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.kefu.leimingyun.com/connectTest.json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.68.128.21 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://29.baidubtcn.cafe
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Sun, 21 Jan 2024 16:10:09 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

OPTIONS
H/1.1 200 connectTest.json
america.api.translate.zvo.cn/ 0
0 773ms
435ms Preflight 108.186.255.86
PEG-SV

General

Check archive.org

Show headers Download Go to

Full URL: https://america.api.translate.zvo.cn/connectTest.json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.186.255.86 , United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://29.baidubtcn.cafe
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Sun, 21 Jan 2024 16:10:08 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

OPTIONS
H/1.1 200 version.json
api.translate.zvo.cn/ 0
0 963ms
244ms Preflight 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/version.json?v=2.11.5.20240120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://29.baidubtcn.cafe
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Sun, 21 Jan 2024 16:09:51 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

OPTIONS
H/1.1 200 language.json
api.translate.zvo.cn/ 0
0 981ms
250ms Preflight 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/language.json?v=2.11.5.20240120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://29.baidubtcn.cafe
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Sun, 21 Jan 2024 16:09:51 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

POST
H/1.1 200 connectTest.json Show response
api.translate.zvo.cn/ 51 B
328 B 243ms
242ms XHR
application/json 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/connectTest.json
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: a670968373e972f89338087f326333d31360fb696807844101b789451d98300e

Request headers

Referer: https://29.baidubtcn.cafe/
currentpage: https://29.baidubtcn.cafe/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Sun, 21 Jan 2024 16:09:52 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

POST
H/1.1 200 connectTest.json Show response
api.kefu.leimingyun.com/ 54 B
331 B 405ms
404ms XHR
application/json 81.68.128.21
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.kefu.leimingyun.com/connectTest.json
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.68.128.21 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: aac8d99ecc637dd365a91d829a2c2bf1a4cb0a0195f1b2cd62283cd724d5542f

Request headers

Referer: https://29.baidubtcn.cafe/
currentpage: https://29.baidubtcn.cafe/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Sun, 21 Jan 2024 16:10:09 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

POST
H/1.1 200 connectTest.json Show response
america.api.translate.zvo.cn/ 59 B
336 B 415ms
414ms XHR
application/json 108.186.255.86
PEG-SV

General

Check archive.org

Show headers Download Go to

Full URL: https://america.api.translate.zvo.cn/connectTest.json
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.186.255.86 , United States, ASN54600 (PEG-SV, US),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: f3ea102f42eea7f05e2f8d529c848751928f259a7a729c249d82205afbeacf30

Request headers

Referer: https://29.baidubtcn.cafe/
currentpage: https://29.baidubtcn.cafe/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Sun, 21 Jan 2024 16:10:09 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

POST
H/1.1 200 version.json Show response
api.translate.zvo.cn/ 37 B
314 B 245ms
245ms XHR
application/json 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/version.json?v=2.11.5.20240120
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: 1bc964165c2c370711d0c5eed03816c96cc5b8e943bc7a975b0c069a52c5cfe4

Request headers

Referer: https://29.baidubtcn.cafe/
currentpage: https://29.baidubtcn.cafe/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Sun, 21 Jan 2024 16:09:52 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

POST
H/1.1 200 language.json Show response
api.translate.zvo.cn/ 4 KB
5 KB 251ms
250ms XHR
application/json 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/language.json?v=2.11.5.20240120
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: 19a9619f1c701b0a8e1c7375345c4c4f92a7ad93ee2410a6da2849e939001a85

Request headers

Referer: https://29.baidubtcn.cafe/
currentpage: https://29.baidubtcn.cafe/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Sun, 21 Jan 2024 16:09:52 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

GET
H2 200 layer.css
29.baidubtcn.cafe/static/admin/js/plugins/layer/skin/default/ 14 KB
3 KB 326ms
325ms Stylesheet
text/css 103.171.34.215
VH-GLOBAL VH Glob...

General

Check archive.org

Show headers Download Go to

Full URL

https://29.baidubtcn.cafe/static/admin/js/plugins/layer/skin/default/layer.css?v=3.0.11110

Requested by

Host: 29.baidubtcn.cafe
URL: https://29.baidubtcn.cafe/static/admin/js/plugins/layer/layer.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.171.34.215 , Hong Kong, ASN42960 (VH-GLOBAL VH Global Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

651f64dffeb4354d09c720e83d62e5d6d0376bc8b973588ad8036150864e2bc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://29.baidubtcn.cafe/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 16:10:08 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Sat, 15 Jul 2023 16:25:08 GMT
server: nginx
etag: W/"64b2c864-37d8"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Mon, 22 Jan 2024 04:10:08 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

29.baidubtcn.cafe
america.api.translate.zvo.cn
api.kefu.leimingyun.com
api.translate.zvo.cn
res.zvo.cn
103.171.34.215
108.186.255.86
149.88.81.9
81.68.128.21
0c63e15197df0cd9b982f34aa70fc940d6c26892646aec56e611246706c7a240
19a9619f1c701b0a8e1c7375345c4c4f92a7ad93ee2410a6da2849e939001a85
1bc964165c2c370711d0c5eed03816c96cc5b8e943bc7a975b0c069a52c5cfe4
651f64dffeb4354d09c720e83d62e5d6d0376bc8b973588ad8036150864e2bc9
65c9a7079063c28a4e7eb45ba7967b8857aa08d1f26f8a3b735dc565f3f6fc5c
68b69105673fbb64096c34b060f900d2731d4f19202ad8f2c11274f3d6f59126
69f8fc22e7169bfcc0313609478b5c0dd60af9d6732d33b17f40e990f00b20e1
8e959729c9fcb9dd35689649da2a143252443400eed1e255fc5adf2c2b6f209b
a670968373e972f89338087f326333d31360fb696807844101b789451d98300e
aac8d99ecc637dd365a91d829a2c2bf1a4cb0a0195f1b2cd62283cd724d5542f
b8fecebcff79b47cf15214232b96927b5b7b57d9bdd9035d87407b4faaf29f42
de4b3c3d1dc2506b6693f0f98884e1dc074cda9d66cab39b7b48a115fdfc4c0f
f30176fc4a100abe22f2da63c43fa24a847903bab422ccd037f8035531db1cfa
f3ea102f42eea7f05e2f8d529c848751928f259a7a729c249d82205afbeacf30
fcc9f7034648d7b2d71965603efbe54122245cac1a9532b3dc3b5acece1b2f9c
fd8f3a227ff1476d3d7fb5dd45d8dda480dd894737f5fb55c3ed181a8ede64d2
fe5ccee402aa4f07fbd643779e74ef9efd012c75376bfdd83dd5902b802b7d81

29.baidubtcn.cafe Open in urlscan Pro 103.171.34.215 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

22 Requests

50 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

4 IPs

4 Countries

1051 kBTransfer

1219 kBSize

0 Cookies

0 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

29.baidubtcn.cafe Open in urlscan Pro
103.171.34.215 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

4
Countries

1051 kB
Transfer

1219 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!