Submitted URL: https://qr20.cn/CyiUx6
Effective URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL...
Submission: On September 26 via manual from CN — Scanned from DE

Summary

This website contacted 5 IPs in 6 countries across 6 domains to perform 7 HTTP transactions. The main IP is 47.110.175.101, located in Hangzhou, China and belongs to ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN. The main domain is targurl.clewm.net.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on July 3rd 2023. Valid for: a year.
This is the only time targurl.clewm.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: Zip archive data, at least v2.0 to extract
Size: 41 MB (43332983 bytes, 100% done)
Downloaded from: http://w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/fileDownload?apkType=huawei

Domain & IP information

IP Address AS Autonomous System
1 1 47.98.169.181 37963 (ALIBABA-C...)
1 47.110.175.101 37963 (ALIBABA-C...)
2 163.181.92.237 24429 (TAOBAO Zh...)
2 103.235.46.191 55967 (BAIDU Bei...)
1 14.137.139.105 136907 (HWCLOUDS-...)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 5
Apex Domain
Subdomains
Transfer
3 clewm.net
targurl.clewm.net
static.clewm.net — Cisco Umbrella Rank: 515793
16 KB
2 baidu.com
hm.baidu.com — Cisco Umbrella Rank: 7955
12 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 175
337 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 96
345 B
1 huawei.com
w3m.huawei.com — Cisco Umbrella Rank: 332082
1 qr20.cn
qr20.cn
575 B
7 6
Domain Requested by
2 hm.baidu.com targurl.clewm.net
2 static.clewm.net targurl.clewm.net
static.clewm.net
1 stats.g.doubleclick.net
1 www.google-analytics.com 1 redirects
1 w3m.huawei.com targurl.clewm.net
1 targurl.clewm.net
1 qr20.cn 1 redirects
7 7

This site contains no links.

Subject Issuer Validity Valid
*.clewm.net
Encryption Everywhere DV TLS CA - G1
2023-07-03 -
2024-07-03
a year crt.sh
baidu.com
GlobalSign RSA OV SSL CA 2018
2023-07-06 -
2024-08-06
a year crt.sh

This page contains 1 frames:

Frame: http://w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/fileDownload?apkType=huawei
Frame ID: B61F45CDAD1CC0BA16AE717286A11CD4
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://qr20.cn/CyiUx6 HTTP 301
    https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZ... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • hm\.baidu\.com/hm\.js

Overall confidence: 100%
Detected patterns

Page Statistics

7
Requests

71 %
HTTPS

29 %
IPv6

6
Domains

7
Subdomains

5
IPs

6
Countries

29 kB
Transfer

58 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://qr20.cn/CyiUx6 HTTP 301
    https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=799af168b884a76b995700c7969d5a988793e7e989 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://www.google-analytics.com/r/collect?v=1&_v=j46&a=173376320&t=pageview&_s=1&dl=https%3A%2F%2Ftargurl.clewm.net%2Fjump%3Fcoding%3DCyiUx6%26targurl%3DaHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%252FYXBrVHlwZT1odWF3ZWk%253D%26key%3D799af168b884a76b995700c7969d5a988793e7e989&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=AEAAAEABI~&jid=539287726&cid=1966300512.1695700991&tid=UA-84134968-1&_r=1&z=1090115216 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1966300512.1695700991&jid=539287726&_v=j46&z=1090115216

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request jump
targurl.clewm.net/
Redirect Chain
  • https://qr20.cn/CyiUx6
  • https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key...
819 B
2 KB
Document
General
Full URL
https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=799af168b884a76b995700c7969d5a988793e7e989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.110.175.101 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software
morrighan /
Resource Hash
4133ca465aeac7ab0176adbd97507d7e7aec181df9cb379117a95e22da5a2479

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
ctoken,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,request_type,Auth-CL,Caoliao-Identity-Flag,sentry-trace
Access-Control-Allow-Methods
PUT,POST,GET,OPTIONS
Cache-Control
private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Date
Tue, 26 Sep 2023 04:03:10 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
morrighan
Transfer-Encoding
chunked

Redirect headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 26 Sep 2023 04:03:09 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=799af168b884a76b995700c7969d5a988793e7e989
pragma
no-cache
server
morrighan
cli_analytics.js
static.clewm.net/public/
1 KB
1 KB
Script
General
Full URL
https://static.clewm.net/public/cli_analytics.js
Requested by
Host: targurl.clewm.net
URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=799af168b884a76b995700c7969d5a988793e7e989
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
163.181.92.237 San Mateo, United States, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
e6d0c92f1ad7ce7ed7e2585a6c4ba0190d1382356f2598651bef0f7fe2b3becd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date
Thu, 27 Jul 2023 13:36:33 GMT
via
cache5.l2de2[0,0,200-0,H], cache11.l2de2[1,0], ens-cache15.de5[0,0,200-0,H], ens-cache5.de5[1,0]
content-encoding
br
age
5235996
x-swift-cachetime
7609220
x-cache
HIT TCP_MEM_HIT dirn:12:885958761
x-swift-savetime
Sat, 29 Jul 2023 11:56:14 GMT
last-modified
Tue, 16 May 2023 17:05:37 GMT
server
Tengine
etag
W/"6463b7e1-473"
vary
Accept-Encoding
ali-swift-global-savetime
1690464994
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-methods
GET,POST,PUT,HEAD,OPTIONS
timing-allow-origin
*
eagleid
a3b55c9916957009908977222e
hm.js
hm.baidu.com/
29 KB
12 KB
Script
General
Full URL
https://hm.baidu.com/hm.js?702c43c086294cf6b0a2474d75381e26
Requested by
Host: targurl.clewm.net
URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=799af168b884a76b995700c7969d5a988793e7e989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),
Reverse DNS
Software
apache /
Resource Hash
750c44621a86daa1db7b1f00189a2830542cd1225aaf125281d13cc4cf37ab2e
Security Headers
Name Value
Strict-Transport-Security max-age=172800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date
Tue, 26 Sep 2023 04:03:12 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=172800
Server
apache
Etag
a13e9d0a3df619f7fd9535979861df79
P3p
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type
application/javascript
Cache-Control
max-age=0, must-revalidate
Content-Length
11306
analytics.js
static.clewm.net/public/
27 KB
14 KB
Script
General
Full URL
https://static.clewm.net/public/analytics.js
Requested by
Host: static.clewm.net
URL: https://static.clewm.net/public/cli_analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
163.181.92.237 San Mateo, United States, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
4344462fab66b7d9d12cdbcf54b45fc2f366f305ef7c1b19b7e7a8f7f4e67603

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date
Thu, 29 Jun 2023 11:13:51 GMT
via
cache7.l2de2[0,0,200-0,H], cache1.l2de2[1,0], ens-cache16.de5[0,0,200-0,H], ens-cache5.de5[1,0]
content-encoding
br
age
7663759
x-swift-cachetime
741342
x-cache
HIT TCP_MEM_HIT dirn:12:561965660
x-swift-savetime
Mon, 18 Sep 2023 21:18:09 GMT
last-modified
Tue, 16 May 2023 17:05:37 GMT
server
Tengine
etag
W/"6463b7e1-6ca0"
vary
Accept-Encoding
ali-swift-global-savetime
1688037231
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-methods
GET,POST,PUT,HEAD,OPTIONS
timing-allow-origin
*
eagleid
a3b55c9916957009909217255e
fileDownload
w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/
0
0
Document
General
Full URL
http://w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/fileDownload?apkType=huawei
Requested by
Host: targurl.clewm.net
URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=799af168b884a76b995700c7969d5a988793e7e989
Protocol
HTTP/1.1
Server
14.137.139.105 , Australia, ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
keep-alive
Content-Disposition
attachment; filename=iCareAPP.apk
Content-Type
application/vnd.android.package-archive;charset=utf-8
Date
Tue, 26 Sep 2023 04:03:28 GMT
Expires
0
Keep-Alive
timeout=60
MAG_icaremp_nosoa_LEVEL
0
Pragma
no-cache
Transfer-Encoding
chunked
X-ALB-SERVER
ALB/1.0.9.002
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Server-Process-Time
17.187
X-Upstream-Process-Time
17.1819
X-XSS-Protection
1; mode=block
processtime
0.283 0.491
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j46&a=173376320&t=pageview&_s=1&dl=https%3A%2F%2Ftargurl.clewm.net%2Fjump%3Fcoding%3DCyiUx6%26targurl%3DaHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWc...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1966300512.1695700991&jid=539287726&_v=j46&z=1090115216
35 B
337 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1966300512.1695700991&jid=539287726&_v=j46&z=1090115216
Protocol
H2
Server
2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 26 Sep 2023 04:03:11 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 26 Sep 2023 04:03:11 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/html; charset=UTF-8
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1966300512.1695700991&jid=539287726&_v=j46&z=1090115216
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
368
expires
Fri, 01 Jan 1990 00:00:00 GMT
hm.gif
hm.baidu.com/
43 B
299 B
Image
General
Full URL
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=493890670&si=702c43c086294cf6b0a2474d75381e26&v=1.3.0&lv=1&sn=48403&r=0&ww=1600&u=https%3A%2F%2Ftargurl.clewm.net%2Fjump%3Fcoding%3DCyiUx6%26targurl%3DaHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%252FYXBrVHlwZT1odWF3ZWk%253D%26key%3D799af168b884a76b995700c7969d5a988793e7e989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),
Reverse DNS
Software
apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=172800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 26 Sep 2023 04:03:13 GMT
Strict-Transport-Security
max-age=172800
X-Content-Type-Options
nosniff
Server
apache
Content-Type
image/gif
Cache-Control
private, max-age=0, no-cache
Content-Length
43

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| _hmt string| GoogleAnalyticsObject function| ga number| c_start string| jump_url object| gaplugins object| gaGlobal object| gaData boolean| _bdhm_loaded_702c43c086294cf6b0a2474d75381e26 object| mini_tangram_log_y7p2fg

13 Cookies

Domain/Path Name / Value
qr20.cn/ Name: PHPSESSID
Value: lmcbshhetkth13caneos7idbv0
qr20.cn/ Name: _uvmark[ffeb90603faecff92c8481270539b409]
Value: c5fa0613997ac64ac608d535ae8ea67c
qr20.cn/ Name: _uvmask[ffeb90603faecff92c8481270539b409]
Value: 9b9d552701dd074fed0de7c3d80d9785
targurl.clewm.net/ Name: acw_tc
Value: 707c9fd816957009906421477e34d542cfcfd51bde1ea90e38e8cb4076145c
targurl.clewm.net/ Name: PHPSESSID
Value: qj45vho2mhg99nlce80mtlvrg6
.clewm.net/ Name: _ga
Value: GA1.2.1966300512.1695700991
.clewm.net/ Name: _gat
Value: 1
.hm.baidu.com/ Name: HMACCOUNT_BFESS
Value: 5D01F519E1502306
.targurl.clewm.net/ Name: Hm_lvt_702c43c086294cf6b0a2474d75381e26
Value: 1695700993
.targurl.clewm.net/ Name: Hm_lpvt_702c43c086294cf6b0a2474d75381e26
Value: 1695700993
.huawei.com/ Name: hwssotinter
Value: 87-D1-B4-48-54-B5-D8-BD-22-3F-7C-30-F2-77-38-A6
.huawei.com/ Name: hwssot
Value: 87-D1-B4-48-54-B5-D8-BD-22-3F-7C-30-F2-77-38-A6
.huawei.com/ Name: magot3
Value: 30531751736024