70365app.net
Open in
urlscan Pro
216.83.58.44
Malicious Activity!
Public Scan
Submitted URL: http://39982375365.com/
Effective URL: https://70365app.net/
Submission: On May 15 via api from BE — Scanned from DE
Effective URL: https://70365app.net/
Submission: On May 15 via api from BE — Scanned from DE
Summary
This website contacted 4 IPs
in 3 countries
across 5 domains to perform 14 HTTP transactions.
The main IP is 216.83.58.44, located in
United States and
belongs to CTGSERVERLIMITED-AS-AP CTG Server Limited, HK.
The main domain is 70365app.net.
TLS certificate: Issued by Certum Domain Validation CA SHA2 on November 12th 2023. Valid for: a year.
This is the only time 70365app.net was scanned on urlscan.io!
TLS certificate: Issued by Certum Domain Validation CA SHA2 on November 12th 2023. Valid for: a year.
This is the only time 70365app.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bet365 (Entertainment)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 149.115.228.176 149.115.228.176 | 32558 (ADG-76-32558) (ADG-76-32558) | |
| 1 1 | 118.107.15.121 118.107.15.121 | 152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited) | |
| 10 | 216.83.58.44 216.83.58.44 | 152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited) | |
| 1 | 240e:f7:7c00:... 240e:f7:7c00:10a:3::3f2 | 136190 (CHINATELE...) (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA) | |
| 2 | 183.240.98.228 183.240.98.228 | 56040 (CMNET-GUA...) (CMNET-GUANGDONG-AP China Mobile communications corporation) | |
| 14 | 4 |
1
118.107.15.121
(Singapore)
ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)
ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)
| class.9wsudfp5at.com |
10
216.83.58.44
(United States)
ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)
ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)
| 70365app.net |
1
240e:f7:7c00:10a:3::3f2
(China)
ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN)
ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN)
| v1.cnzz.com |
2
183.240.98.228
(China)
ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN)
ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN)
| hm.baidu.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
70365app.net
70365app.net |
545 KB |
| 2 |
baidu.com
hm.baidu.com — Cisco Umbrella Rank: 10507 |
12 KB |
| 1 |
cnzz.com
v1.cnzz.com — Cisco Umbrella Rank: 112814 |
369 B |
| 1 |
9wsudfp5at.com
1 redirects
class.9wsudfp5at.com |
232 B |
| 1 |
39982375365.com
39982375365.com |
620 B |
| 14 | 5 |
| Domain | Requested by | |
|---|---|---|
| 10 | 70365app.net |
39982375365.com
70365app.net |
| 2 | hm.baidu.com |
70365app.net
|
| 1 | v1.cnzz.com |
70365app.net
|
| 1 | class.9wsudfp5at.com | 1 redirects |
| 1 | 39982375365.com | |
| 14 | 5 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.ub66.io |
| ha0fp4elyy.1fhei9ev.com |
| www.app25365.com |
| r25365.com |
| 67144975365.com |
| 70365hhh.com |
| 15050975365.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 2021-08-13 - 2022-08-13 |
a year | crt.sh | |
| 70365app.net Certum Domain Validation CA SHA2 |
2023-11-12 - 2024-12-11 |
a year | crt.sh |
| *.cnzz.com GlobalSign Organization Validation CA - SHA256 - G3 |
2024-02-17 - 2025-03-20 |
a year | crt.sh |
| baidu.com GlobalSign RSA OV SSL CA 2018 |
2023-07-06 - 2024-08-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://70365app.net/
Frame ID: 17AEAD67CF7BEC315BC8AD8D814319EC
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
bet365最快线路检测中心Page URL History Show full URLs
-
http://39982375365.com/
HTTP 307
https://39982375365.com/ Page URL
-
https://class.9wsudfp5at.com:4562/?u=https://39982375365.com/&p=/
HTTP 302
https://70365app.net/ Page URL
Detected technologies
Baidu Analytics (百度统计)
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- hm\.baidu\.com/hm\.js
CNZZ
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //[^./]+\.cnzz\.com/(?:z_stat.php|core)\?
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
URL: https://www.ub66.io/
Search URL Search Domain Scan URL
URL: https://ha0fp4elyy.1fhei9ev.com/043c242e598e9jkfle-keli37252051809060e060e0905040b0a0a09020c00090d0a89e90f054ec24ee292e
Search URL Search Domain Scan URL
URL: https://www.app25365.com/
Search URL Search Domain Scan URL
URL: https://r25365.com/
Title: 我们的最新网址r25365.Com请一秒记住
Title: 我们的最新网址r25365.Com请一秒记住
Search URL Search Domain Scan URL
URL: https://67144975365.com/
Title: 点击进入
Title: 点击进入
Search URL Search Domain Scan URL
URL: https://70365hhh.com/
Title: 点击进入
Title: 点击进入
Search URL Search Domain Scan URL
URL: https://15050975365.com/
Title: 点击进入
Title: 点击进入
Search URL Search Domain Scan URL
URL: http://www.app25365.com/
Title: 【app】
Title: 【app】
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://39982375365.com/
HTTP 307
https://39982375365.com/ Page URL
-
https://class.9wsudfp5at.com:4562/?u=https://39982375365.com/&p=/
HTTP 302
https://70365app.net/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://39982375365.com/ HTTP 307
- https://39982375365.com/
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
39982375365.com/ Redirect Chain
|
434 B 620 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
70365app.net/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flash.css
70365app.net/css/ |
54 KB 54 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
70365app.net/css/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.7.1.min.js
70365app.net/js/ |
92 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
z_stat.php
v1.cnzz.com/ |
0 369 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ewm.png
70365app.net/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bodyimg.png
70365app.net/img/ |
356 KB 357 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hm.js
hm.baidu.com/ |
29 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rss.png
70365app.net/img/ |
66 KB 67 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
yelang.png
70365app.net/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dxx.png
70365app.net/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hm.gif
hm.baidu.com/ |
43 B 299 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
70365app.net/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bet365 (Entertainment)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| _hmt function| sc function| browserRedirect number| len number| rnd object| txt object| url object| url2 object| url3 object| url9 object| url29 object| url39 string| str string| str2 string| str3 string| str9 string| str29 string| str39 boolean| _bdhm_loaded_7a1582cc8f44113ce21248a0f1b73203 object| mini_tangram_log_taa613 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .hm.baidu.com/ | Name: HMACCOUNT_BFESS Value: A345754FB370C51F |
|
| .70365app.net/ | Name: Hm_lvt_7a1582cc8f44113ce21248a0f1b73203 Value: 1715739913 |
|
| .70365app.net/ | Name: Hm_lpvt_7a1582cc8f44113ce21248a0f1b73203 Value: 1715739913 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
39982375365.com
70365app.net
class.9wsudfp5at.com
hm.baidu.com
v1.cnzz.com
118.107.15.121
149.115.228.176
183.240.98.228
216.83.58.44
240e:f7:7c00:10a:3::3f2
10f24767fa61c73f55210e59428b3a684496fa9dcc6de46e3fe9256868b53ea9
1183af09aab2915ad1da55b60ad1c34c6948c13de0bca10da93caed6c7a91658
1cafa656d554956b948c7e59dd0411ac6eb9fa16ee71fc875b76fb71f36eabec
1e6327fed2333a1d60c96106853285e9004b8275946f99f023a8c5fcc8099d90
48ef7fb539ccc7d8186e8017283e3493b1d32497b445b8c7946363be989ff747
543b89ec01fb5a369af23bba4f3ab7d9c4957fe1d40dc223aabbcbe7a76a60d4
58d64bad8f43a6c332a2e1639a566bd482c812b3f892d4aba9ae15be8d06eb8f
6e09fb6e94c8054947adb4613326d69fc498a6c8ca9c81df02876a95a8df00f2
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
912689836f2c1a7adbaaf21c48b183f2cb615735f1927b955a8ad03740e36287
9430965726caeed564e5323141da4c47ab0031976ad450c326ac56489c9205d2
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855