www.qihuys612.com - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 156.249.29.111, located in Seychelles and belongs to HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK. The main domain is www.qihuys612.com.

This is the only time www.qihuys612.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	156.254.164.26 156.254.164.26	135097 (MYCLOUD-A...) (MYCLOUD-AS-AP LUOGELANG FRANCE LIMITED)
1	43.229.214.154 43.229.214.154	132839 (POWERLINE...) (POWERLINE-AS-AP POWER LINE DATACENTER)
1	156.249.29.111 156.249.29.111	139646 (HKMTC-AS-...) (HKMTC-AS-AP HONG KONG Megalayer Technology Co.)
7	4

2 156.254.164.26 (Hong Kong) 1 redirects

ASN135097 (MYCLOUD-AS-AP LUOGELANG FRANCE LIMITED, HK)

buyfacebookstock.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.buyfacebookstock.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.229.214.154 (Hong Kong)

ASN132839 (POWERLINE-AS-AP POWER LINE DATACENTER, HK)

43.229.214.154	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 156.249.29.111 (Seychelles)

ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK)

www.qihuys612.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	buyfacebookstock.com 1 redirects buyfacebookstock.com www.buyfacebookstock.com	1 KB
1	qihuys612.com www.qihuys612.com	696 B
0	baidu.com Failed push.zhanzhang.baidu.com Failed hm.baidu.com Failed
7	3

	Domain	Requested by
1	www.qihuys612.com	43.229.214.154
1	www.buyfacebookstock.com
1	buyfacebookstock.com	1 redirects
0	hm.baidu.com Failed	www.buyfacebookstock.com 43.229.214.154
0	push.zhanzhang.baidu.com Failed	www.buyfacebookstock.com
7	5

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.qihuys612.com/
Frame ID: 941743F2529EB4D74DEA23E29063D66C
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

http://buyfacebookstock.com/ HTTP 301
http://www.buyfacebookstock.com/ Page URL
http://www.qihuys612.com/ Page URL

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

3 kB
Transfer

4 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://buyfacebookstock.com/ HTTP 301
http://www.buyfacebookstock.com/ Page URL
http://www.qihuys612.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://buyfacebookstock.com/ HTTP 301
http://www.buyfacebookstock.com/

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
www.buyfacebookstock.com/
Redirect Chain

http://buyfacebookstock.com/
http://www.buyfacebookstock.com/

2 KB
994 B

985ms
275ms

Document
text/html

156.254.164.26
MYCLOUD-AS-AP LUO...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.buyfacebookstock.com/
Protocol: HTTP/1.1
Server: 156.254.164.26 , Hong Kong, ASN135097 (MYCLOUD-AS-AP LUOGELANG FRANCE LIMITED, HK),
Reverse DNS
Software: Nginx Microsoft-HTTPAPI/2.0 / Nginx
Resource Hash: 2f7bf72651e3e5cdf466c7887fbb93de84a2f8ef868d44ca38d07ec807813c9e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Sep 2022 01:51:18 GMT
Server: Nginx Microsoft-HTTPAPI/2.0
Transfer-Encoding: chunked
X-Powered-By: Nginx

Redirect headers

Date: Thu, 01 Sep 2022 01:51:17 GMT
Location: http://www.buyfacebookstock.com/
Server: Nginx Microsoft-HTTPAPI/2.0
Transfer-Encoding: chunked
X-Powered-By: Nginx

GET push.js
push.zhanzhang.baidu.com/ 0
0

GET hm.js
hm.baidu.com/ 0
0

GET
H/1.1 200
OK tj.js Show response
43.229.214.154/ 2 KB
993 B 421ms
210ms Script
application/javascript 43.229.214.154
POWERLINE-AS-AP P...

General

Check archive.org

Show headers Download Go to

Full URL

http://43.229.214.154/tj.js

Requested by

Host: www.buyfacebookstock.com
URL: http://www.buyfacebookstock.com/

Protocol

HTTP/1.1

Server

43.229.214.154 , Hong Kong, ASN132839 (POWERLINE-AS-AP POWER LINE DATACENTER, HK),

Reverse DNS

Software

nginx /

Resource Hash

d411c64c9dbd9b46f2ccce65ec1d41327bf943e5e4149abe639cd26a8e1ed73d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://www.buyfacebookstock.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Thu, 01 Sep 2022 01:51:35 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 31 Aug 2022 10:56:51 GMT
Server: nginx
ETag: W/"630f3e73-6e4"
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Cache-Control: max-age=43200
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Sep 2022 13:51:35 GMT

GET hm.js
hm.baidu.com/ 0
0

GET
H/1.1 403
Forbidden Primary Request / Show response
www.qihuys612.com/ 548 B
696 B 512ms
167ms Document
text/html 156.249.29.111
HKMTC-AS-AP HONG ...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.qihuys612.com/
Requested by: Host: 43.229.214.154
URL: http://43.229.214.154/tj.js
Protocol: HTTP/1.1
Server: 156.249.29.111 , Seychelles, ASN139646 (HKMTC-AS-AP HONG KONG Megalayer Technology Co.,Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393

Request headers

Referer: http://www.buyfacebookstock.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Length: 548
Content-Type: text/html
Date: Thu, 01 Sep 2022 01:51:36 GMT
Server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: push.zhanzhang.baidu.com
URL: http://push.zhanzhang.baidu.com/push.js

Domain: hm.baidu.com
URL: https://hm.baidu.com/hm.js?c5fe066e0246d3b7264b0c43c6465812

Domain: hm.baidu.com
URL: https://hm.baidu.com/hm.js?38b9e08888a146c8f5eed04ca44ac985

Domain: hm.baidu.com
URL: https://hm.baidu.com/hm.js?52a3446c5f0d5bebb5b42948410df9d6

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: http://www.buyfacebookstock.com/(Line 54) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, http://43.229.214.154/tj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://www.buyfacebookstock.com/(Line 54) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, http://43.229.214.154/tj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: http://www.qihuys612.com/ Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buyfacebookstock.com
hm.baidu.com
push.zhanzhang.baidu.com
www.buyfacebookstock.com
www.qihuys612.com
hm.baidu.com
push.zhanzhang.baidu.com
156.249.29.111
156.254.164.26
43.229.214.154
25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393
2f7bf72651e3e5cdf466c7887fbb93de84a2f8ef868d44ca38d07ec807813c9e
d411c64c9dbd9b46f2ccce65ec1d41327bf943e5e4149abe639cd26a8e1ed73d

www.qihuys612.com Open in urlscan Pro 156.249.29.111 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

4 IPs

2 Countries

3 kBTransfer

4 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

www.qihuys612.com Open in urlscan Pro
156.249.29.111 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

3 kB
Transfer

4 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions