open.weixin.qq.com
Open in
urlscan Pro
240d:c040:0:40::116
Public Scan
Submitted URL: https://product-auth.whgaty.com/
Effective URL: https://open.weixin.qq.com/connect/oauth2/authorize?appid=wx0f8a43bef1e50f31&redirect_uri=https%3A%2F%2Frisk.whgaty.com&res...
Submission: On November 04 via automatic, source certstream-suspicious
Effective URL: https://open.weixin.qq.com/connect/oauth2/authorize?appid=wx0f8a43bef1e50f31&redirect_uri=https%3A%2F%2Frisk.whgaty.com&res...
Submission: On November 04 via automatic, source certstream-suspicious
Summary
This website contacted 4 IPs
in 3 countries
across 2 domains to perform 10 HTTP transactions.
The main IP is 240d:c040:0:40::116, located in
Singapore and
belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN.
The main domain is open.weixin.qq.com.
TLS certificate: Issued by Secure Site CA G2 on April 10th 2020. Valid for: a year.
This is the only time open.weixin.qq.com was scanned on urlscan.io!
TLS certificate: Issued by Secure Site CA G2 on April 10th 2020. Valid for: a year.
This is the only time open.weixin.qq.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 119.97.245.119 119.97.245.119 | 4134 (CHINANET-...) (CHINANET-BACKBONE No.31) | |
| 1 | 240d:c040:0:4... 240d:c040:0:40::116 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
| 1 | 150.109.206.154 150.109.206.154 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
| 10 | 4 |
8
119.97.245.119
(Wuhan, China)
ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
| product-auth.whgaty.com | |
| riskjk.whgaty.com |
1
240d:c040:0:40::116
(Singapore)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
| open.weixin.qq.com |
1
150.109.206.154
(Japan)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
| res.wx.qq.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
whgaty.com
product-auth.whgaty.com riskjk.whgaty.com |
122 KB |
| 2 |
qq.com
open.weixin.qq.com res.wx.qq.com |
10 KB |
| 10 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | product-auth.whgaty.com |
product-auth.whgaty.com
|
| 1 | res.wx.qq.com |
open.weixin.qq.com
|
| 1 | open.weixin.qq.com |
product-auth.whgaty.com
|
| 1 | riskjk.whgaty.com |
product-auth.whgaty.com
|
| 10 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| risk.whgaty.com Encryption Everywhere DV TLS CA - G1 |
2020-02-29 - 2021-02-28 |
a year | crt.sh |
| riskjk.whgaty.com Encryption Everywhere DV TLS CA - G1 |
2020-02-29 - 2021-02-28 |
a year | crt.sh |
| mp.weixin.qq.com Secure Site CA G2 |
2020-04-10 - 2021-04-15 |
a year | crt.sh |
| res.wx.qq.com DigiCert SHA2 Secure Server CA |
2020-08-31 - 2021-09-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://open.weixin.qq.com/connect/oauth2/authorize?appid=wx0f8a43bef1e50f31&redirect_uri=https%3A%2F%2Frisk.whgaty.com&response_type=code&scope=snsapi_userinfo&state=&connect_redirect=1
Frame ID: DCD71D15E5CB6C5E56B0C6CBDCF2FD3E
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://product-auth.whgaty.com/ Page URL
- https://open.weixin.qq.com/connect/oauth2/authorize?appid=wx0f8a43bef1e50f31&redirect_uri=https%3A%2F%2... Page URL
Detected technologies
Tengine
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Tengine/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://product-auth.whgaty.com/ Page URL
- https://open.weixin.qq.com/connect/oauth2/authorize?appid=wx0f8a43bef1e50f31&redirect_uri=https%3A%2F%2Frisk.whgaty.com&response_type=code&scope=snsapi_userinfo&state=&connect_redirect=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
product-auth.whgaty.com/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.b7a81e18cd8e826b07e1ac2c4502dc2d.css
product-auth.whgaty.com/static/css/ |
126 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
manifest.79b364226b9d50fb4ea0.js
product-auth.whgaty.com/static/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendor.c1b33214ba9207dbee7c.js
product-auth.whgaty.com/static/js/ |
138 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.a689dc0a6d8628a61a0d.js
product-auth.whgaty.com/static/js/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.21246eb2ed065eaa4795.js
product-auth.whgaty.com/static/js/ |
97 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
6.e50219f4b6d9a58f8f73.js
product-auth.whgaty.com/static/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mpOath2
riskjk.whgaty.com/wxMp/ |
232 B 539 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
authorize
open.weixin.qq.com/connect/oauth2/ |
749 B 867 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
weui.css
res.wx.qq.com/open/libs/weui/0.4.1/ |
44 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 4 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
open.weixin.qq.com
product-auth.whgaty.com
res.wx.qq.com
riskjk.whgaty.com
119.97.245.119
150.109.206.154
240d:c040:0:40::116
1317259888e0998cea540831b8f59eb62b306bf4f9f13d6ea3d1eb28afb7ec29
3d0b46627a9c0b53e53b6fc86be513040d8529b2ea829f229307cff00999fe9c
89eeea93e0cebcea17694ea52a27cf51b41529db7852514bc8563bcc4cdc789c
8cd83305714bed77c0cdf39441dc0c7d1a7d4c34960dc80b2c3b29b9ce03e3ab
c7057318f6a350f7960ee525d8760556776ee946d42b007d3a48a1f412721fdc
d17c52f21a8750eda9f59e9c3e7dd87f2ba4b4edbc552e1adaacbe9db5df3137
dcf3872aecafdf545514d6056dbf6b9dffb833510f9537354837e0cd471c40c5
f1b69e162ebfac6dda6d5174f43b032dcc3740de9fc5ce54a52e91940a8af582
f7c6eca30edeb4ea91016213281bd7a911a5ea27622bd81d1d7389a9718667d2
fad42ed2694bf0790c0468f5ec36f2ec6f59a84bf3e608cc7fb4189e5593d9bd