urlscan.io logo urlscan.io
SecurityTrails logo

down.sandai.net Open in urlscan Pro
36.25.241.84  Public Scan

Go To Rescan Add Verdict Report
URL: https://down.sandai.net/thunder11/XunLeiWebSetup11.4.7.2104gw.exe
Submission: On June 26 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 36.25.241.84, located in China and belongs to CT-HANGZHOU-IDC No.288,Fu-chun Road, CN. The main domain is down.sandai.net. The Cisco Umbrella rank of the primary domain is 789492.
TLS certificate: Issued by RapidSSL Global TLS RSA4096 SHA256 20... on February 7th 2023. Valid for: a year.
This is the only time down.sandai.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

XunLeiWebSetup11.4.7.2104gw.exe 5 MB application/x-dosexec
MIME: PE32 executable (GUI) Intel 80386, for MS Windows
Size: 5 MB (5426224 bytes, 100% done)
Downloaded from: https://down.sandai.net/thunder11/XunLeiWebSetup11.4.7.2104gw.exe

Domain & IP information

IP Address AS Autonomous System
1 36.25.241.84 58461 (CT-HANGZH...)
1 1
Apex Domain
Subdomains		 Transfer
1 sandai.net
down.sandai.net — Cisco Umbrella Rank: 789492
1 1
Domain Requested by
1 down.sandai.net
1 1

This site contains no links.

Subject Issuer Validity Valid
*.sandai.net
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2023-02-07 -
2024-03-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://down.sandai.net/thunder11/XunLeiWebSetup11.4.7.2104gw.exe
Frame ID: CCF40CFFB3A49E1E6516A17F397EAEEF
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request XunLeiWebSetup11.4.7.2104gw.exe
down.sandai.net/thunder11/ 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://down.sandai.net/thunder11/XunLeiWebSetup11.4.7.2104gw.exe
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
36.25.241.84 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN),
Reverse DNS
Software
openresty /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
ali-swift-global-savetime
1685673744
content-length
5426224
content-md5
ickIE41CFZl1vZIlFru2Sg==
content-type
application/octet-stream
date
Mon, 26 Jun 2023 08:01:15 GMT
eagleid
7ae1d13a16856737444727805e
etag
"89C908138D42159975BD922516BBB64A"
last-modified
Fri, 02 Jun 2023 02:33:59 GMT
server
openresty
timing-allow-origin
*
x-cache
MISS TCP_MISS dirn:-2:-2 HIT from BC60_dx-zhejiang-huzhou-11-cache-6(baishan)
x-m-log
QNM:xs1170;SRCPROXY:xs486;SRC:90;SRCPROXY:90;QNM3:102
x-m-reqid
rLwAAOnveD3otmQX
x-oss-cdn-auth
success
x-oss-hash-crc64ecma
153316552171746688
x-oss-object-type
Normal
x-oss-request-id
6479571095CBF137398274A1
x-oss-server-time
29
x-oss-storage-class
Standard
x-qnm-cache
Validate as miss: no-header,MissValidate
x-ser
BC150_dx-lt-yd-jiangsu-taizhou-4-cache-6, BC60_dx-zhejiang-huzhou-11-cache-6
x-swift-cachetime
7776000
x-swift-savetime
Fri, 02 Jun 2023 02:42:24 GMT

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

down.sandai.net
36.25.241.84