zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top

Summary

This website contacted 4 IPs in 3 countries across 6 domains to perform 6 HTTP transactions. The main IP is 20.2.66.85, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top.

This is the only time zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	154.19.201.21 154.19.201.21	140224 (SGPL-AS-A...) (SGPL-AS-AP STARCLOUD GLOBAL PTE.)
1 3	20.2.66.85 20.2.66.85	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	138.113.147.185 138.113.147.185	54994 (ML-1432-5...) (ML-1432-54994)
2	14.215.182.140 14.215.182.140	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
6	4

1 154.19.201.21 (Hong Kong, Hong Kong) 1 redirects

ASN140224 (SGPL-AS-AP STARCLOUD GLOBAL PTE., LTD., SG)

nc54.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.2.66.85 (Hong Kong, Hong Kong) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

1f00c.kioor.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 138.113.147.185 (Canada)

ASN54994 (ML-1432-54994, CA)

analytics-zh002.handjob.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 14.215.182.140 (Guangzhou, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 10108	12 KB
2	hackstar.top zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top	35 KB
1	handjob.tw analytics-zh002.handjob.tw	214 B
1	kioor.top 1 redirects 1f00c.kioor.top	349 B
1	nc54.cc 1 redirects nc54.cc	209 B
0	atmjmh.xyz Failed zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz Failed
6	6

	Domain	Requested by
2	hm.baidu.com	zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
2	zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
1	analytics-zh002.handjob.tw	zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
1	1f00c.kioor.top	1 redirects
1	nc54.cc	1 redirects
0	zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz Failed
6	6

This site contains links to these domains. Also see Links.

Domain
zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz

Subject Issuer	Validity	Valid
analytics-zh002.handjob.tw R11	`2024-09-04` - `2024-12-03`	3 months	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2024-07-08` - `2025-08-09`	a year	crt.sh

This page contains 1 frames:

Frame: https://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync
Frame ID: FFB38DA959BD9793DDE2FA79A7C17F6C
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://nc54.cc/ HTTP 302
http://1f00c.kioor.top/arwUL HTTP 307
https://1f00c.kioor.top/arwUL HTTP 307
http://1f00c.kioor.top/arwUL HTTP 302
http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync HTTP 307
https://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync HTTP 307
http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync Page URL

Detected technologies

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

48 kB
Transfer

64 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync
Title: 33%

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://nc54.cc/ HTTP 302
http://1f00c.kioor.top/arwUL HTTP 307
https://1f00c.kioor.top/arwUL HTTP 307
http://1f00c.kioor.top/arwUL HTTP 302
http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync HTTP 307
https://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync HTTP 307
http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync HTTP 307
https://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request RedirectAsync Show response
zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/
Redirect Chain

https://nc54.cc/
http://1f00c.kioor.top/arwUL
https://1f00c.kioor.top/arwUL
http://1f00c.kioor.top/arwUL
http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync
https://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync
http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync

4 KB
4 KB

397ms
199ms

Document
text/html

20.2.66.85
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync
Protocol: HTTP/1.1
Server: 20.2.66.85 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.24.0 / ASP.NET
Resource Hash: a5e67eeca516eb28461a6514f98a3286ab989815be107c852b9758b81fcfd906

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: private
Connection: keep-alive
Content-Length: 3598
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Sep 2024 13:02:05 GMT
Server: nginx/1.24.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

Redirect headers

Location: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 index-zh.php Show response
analytics-zh002.handjob.tw/ 0
214 B 2208ms
1499ms Script
application/octet-stream 138.113.147.185
ML-1432-54994

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics-zh002.handjob.tw/index-zh.php?a=v
Requested by: Host: zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
URL: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 138.113.147.185 , Canada, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/

Response headers

x-px: ms PSdgflkfFRA2po75FRA,ht kf148FRA
x-ws-request-id: 66f6acce_PSdgflkfFRA2po75_8495-23424
via: 1.1 kf148:9 (W), 1.1 PSdgflkfFRA2po75:14 (W)
access-control-allow-origin: *
content-length: 0
date: Fri, 27 Sep 2024 13:02:07 GMT
content-type: application/octet-stream
server: PWS/8.3.1.0.8

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 1762ms
306ms Script
application/javascript 14.215.182.140
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?f1594ab993496d6cc8ea91e79e373a0e

Requested by

Host: zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
URL: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

14.215.182.140 Guangzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),

Reverse DNS

Software

apache /

Resource Hash

8485ee9f8f71c4816dac8eed59cc2c14ee4955088d484fc3bdf0653d18ace1f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/

Response headers

Strict-Transport-Security: max-age=172800
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Etag: 139211323a74d510c776ebeda3e99e69
Content-Length: 11338
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 27 Sep 2024 13:02:09 GMT
Content-Type: application/javascript
Server: apache

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 310ms
309ms Image
image/gif 14.215.182.140
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?hca=977B0B4780F840E9&cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=de-de&lo=0&rnd=1801825336&si=f1594ab993496d6cc8ea91e79e373a0e&v=1.3.2&lv=1&sn=5065&r=0&ww=1600&u=http%3A%2F%2Fzh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top%2FRedirectAsync

Requested by

Host: zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
URL: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

14.215.182.140 Guangzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/

Response headers

Strict-Transport-Security: max-age=172800
Cache-Control: private, max-age=0, no-cache
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Length: 43
Date: Fri, 27 Sep 2024 13:02:09 GMT
Content-Type: image/gif
Server: apache

GET
H/1.1 200
OK favicon.ico
zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/ 31 KB
32 KB 204ms
204ms Other
image/x-icon 20.2.66.85
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/favicon.ico
Protocol: HTTP/1.1
Server: 20.2.66.85 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.24.0 / ASP.NET
Resource Hash: a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/RedirectAsync

Response headers

ETag: "abab7ed69613d61:0"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32038
Date: Fri, 27 Sep 2024 13:02:09 GMT
Content-Type: image/x-icon
Last-Modified: Thu, 16 Apr 2020 02:29:21 GMT
Server: nginx/1.24.0
X-Powered-By: ASP.NET

GET

GoToLinkAsync
zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/
Redirect Chain

http://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync
https://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz
URL: https://zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz/GoToLinkAsync

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.hm.baidu.com/	1970-01-21 09:26:42	Name: HMACCOUNT_BFESS Value: 977B0B4780F840E9
.zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/	1970-01-21 08:36:18	Name: Hm_lvt_f1594ab993496d6cc8ea91e79e373a0e Value: 1727442130
.zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/	1969-12-31 23:59:59	Name: Hm_lpvt_f1594ab993496d6cc8ea91e79e373a0e Value: 1727442130
.zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top/	1969-12-31 23:59:59	Name: HMACCOUNT Value: 977B0B4780F840E9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1f00c.kioor.top
analytics-zh002.handjob.tw
hm.baidu.com
nc54.cc
zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz
zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top
zh.f186ceef874adfa1a3c3267c74e9a5a8.atmjmh.xyz
138.113.147.185
14.215.182.140
154.19.201.21
20.2.66.85
8485ee9f8f71c4816dac8eed59cc2c14ee4955088d484fc3bdf0653d18ace1f5
a5e67eeca516eb28461a6514f98a3286ab989815be107c852b9758b81fcfd906
a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top Open in urlscan Pro 20.2.66.85 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

4 IPs

3 Countries

48 kBTransfer

64 kBSize

4 Cookies

1 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

4 Cookies

Indicators

zh.f186ceef874adfa1a3c3267c74e9a5a8.hackstar.top Open in urlscan Pro
20.2.66.85 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

48 kB
Transfer

64 kB
Size

4
Cookies

6 HTTP transactions
0 data transactions