hiwhjzywem.com Open in urlscan Pro
13.94.41.81 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://hiwhjzywem.com/
Effective URL:
https://hiwhjzywem.com/?channelCode=41203
Submission: On December 04 via api (December 4th 2024, 11:44:31 am UTC) from US — Scanned from CH

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 23 HTTP transactions. The main IP is 13.94.41.81, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is hiwhjzywem.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on December 4th 2024. Valid for: 3 months.

This is the only time hiwhjzywem.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	13.94.41.81 13.94.41.81	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2407:2440:2d::c 2407:2440:2d::c	139057 (LDPL-AS-A...) (LDPL-AS-AP LEGEND DYNASTY PTE. LTD.)
2	240e:cf:8800:... 240e:cf:8800:53:3::7ea	134238 (CT-JIANGX...) (CT-JIANGXI-IDC CHINANET Jiangx province IDC network)
2	170.33.12.233 170.33.12.233	134963 (ASEPL-AS-...) (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited)
1	240e:97b:500:... 240e:97b:500:2000::4	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
23	6

12 13.94.41.81 (Hong Kong, Hong Kong)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

hiwhjzywem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2407:2440:2d::c (Singapore)

ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG)

czokcc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 240e:cf:8800:53:3::7ea (China)

ASN134238 (CT-JIANGXI-IDC CHINANET Jiangx province IDC network, CN)

s9.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 170.33.12.233 (Singapore)

ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG)

potg3q0350io3t7ezq40.unionchemicar-sh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240e:97b:500:2000::4 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

z12.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	hiwhjzywem.com hiwhjzywem.com	2 MB
4	czokcc.com czokcc.com	21 KB
3	cnzz.com s9.cnzz.com — Cisco Umbrella Rank: 137146 Failed z12.cnzz.com — Cisco Umbrella Rank: 199702 c.cnzz.com — Cisco Umbrella Rank: 91025	5 KB
2	unionchemicar-sh.com potg3q0350io3t7ezq40.unionchemicar-sh.com	1 KB
0	drkjncw.com Failed mspc00419.xz.drkjncw.com Failed
23	5

	Domain	Requested by
12	hiwhjzywem.com	hiwhjzywem.com
4	czokcc.com	hiwhjzywem.com
2	potg3q0350io3t7ezq40.unionchemicar-sh.com	czokcc.com
1	c.cnzz.com	s9.cnzz.com
1	z12.cnzz.com	s9.cnzz.com
1	s9.cnzz.com	hiwhjzywem.com
0	mspc00419.xz.drkjncw.com Failed	czokcc.com
23	7

This site contains no links.

Subject Issuer	Validity	Valid
hiwhjzywem.com ZeroSSL RSA Domain Secure Site CA	`2024-12-04` - `2025-03-04`	3 months	crt.sh
czokcc.com Certum Domain Validation CA SHA2	`2024-09-10` - `2025-10-10`	a year	crt.sh
*.cnzz.com GlobalSign Organization Validation CA - SHA256 - G3	`2024-02-17` - `2025-03-20`	a year	crt.sh
*.unionchemicar-sh.com E6	`2024-11-20` - `2025-02-18`	3 months	crt.sh

This page contains 1 frames:

Frame: https://mspc00419.xz.drkjncw.com/default/1204/194/ms/177nc.apk
Frame ID: 4B6A42F529C4882AA35A42DFABB73500
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

霓裳直播

Page URL History Show full URLs

https://hiwhjzywem.com/ Page URL
https://hiwhjzywem.com/?channelCode=41203 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

23
Requests

91 %
HTTPS

60 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

2439 kB
Transfer

3748 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hiwhjzywem.com/ Page URL
https://hiwhjzywem.com/?channelCode=41203 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://potg3q0350io3t7ezq40.unionchemicar-sh.com:6443/page/ufpu2u/install/c/eyJjIjoiNDEyMDMiLCJtIjoiMU5Ya21KVnlGbUFBQUFHVGtYeGRIU3VoZFNwMVlmNm5Nb3Z2c2VPRjA1VXdiVzRxUDJVMUdhVmNxdEc2VzU2MzNnYl9xUXlXR0ZlV0o3ck0ybzFIbGl5SGpXMFpKLTlmeFB0Zm0tTDljVFRUNjY0NnpsMlFGdW9xaEVUbHAxWjFhc2xSSFBSOU1JTXNDVTUtX0NFIn0=?p=0 HTTP 302
https://zlff.mewivnf.com:7108/default/ms/177nc.apk HTTP 302
https://mspc00419.xz.drkjncw.com/default/1204/194/ms/177nc.apk

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
hiwhjzywem.com/ 2 KB
1 KB 1119ms
347ms Document
text/html 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: 32a0e39f90c21af675e0300930405a1094e57854437a4e07a145633201d3de07

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 04 Dec 2024 11:43:24 GMT
etag: W/"674f0664-93a"
last-modified: Tue, 03 Dec 2024 13:23:48 GMT
server: nginx
vary: Accept-Encoding
x-cache-status: BYPASS
x-country: CH
x-via: paesano55000000

GET
H2 200 zb.css
hiwhjzywem.com/images/ 1 KB
860 B 199ms
198ms Stylesheet
text/css 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/images/zb.css
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5139841817a373c75fb01e4b16c750f964c937baa364e28b8ebdfcded6c8acbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

x-cache-status: HIT
cache-control: max-age=43200
content-encoding: gzip
x-via: paesano55000000
etag: W/"6183ce22-49b"
x-cache-key: hiwhjzywem.com/images/zb.css~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Wed, 04 Dec 2024 22:14:05 GMT
content-length: 543
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: text/css
last-modified: Thu, 04 Nov 2021 12:12:18 GMT
vary: Accept-Encoding

GET
H2 200 jquery-3.4.1.min.js Show response
hiwhjzywem.com/js/ 86 KB
34 KB 283ms
282ms Script
application/javascript 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/js/jquery-3.4.1.min.js
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

x-cache-status: HIT
cache-control: max-age=43200
content-encoding: gzip
x-via: paesano55000000
etag: W/"6183ce22-15851"
x-cache-key: hiwhjzywem.com/js/jquery-3.4.1.min.js~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Wed, 04 Dec 2024 22:14:05 GMT
content-length: 34489
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 04 Nov 2021 12:12:18 GMT

GET
H2 200 appinstall.js Show response
czokcc.com/ 46 KB
19 KB 7004ms
125ms Script
text/javascript 2407:2440:2d::c
LDPL-AS-AP LEGEND...

General

Check archive.org

Show headers Download Go to

Full URL: https://czokcc.com/appinstall.js
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2407:2440:2d::c , Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software: openresty /
Resource Hash: 7c9895f2e57140b2a429c2b5df1eb51b2c0bf49f56365e198fb20a92fe79c1dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-md5: ihSRM2DNifCBLqSXHfWhaw==
x-ser: i29949_c15259, i2020983_c24893, i1932517_c23621
access-control-max-age: 2592000
access-control-expose-headers: X-Log, X-Reqid
x-reqid: N0cAAAB34e-KjwYY
content-encoding: gzip
etag: "FkCaSVF9_DEnOoSXfhqFLvXM1gBj.gz"
x-qnm-cache: Miss
x-m-reqid: E-MAAGGv1u-KjwYY
x-cache: HIT from i1932517_c23621(cloudsvr)
date: Wed, 04 Dec 2024 11:44:25 GMT
content-type: text/javascript
content-disposition: inline; filename="appinstall.js"; filename*=utf-8''appinstall.js
vary: Accept-Encoding
last-modified: Sun, 10 Nov 2024 07:49:30 GMT
cache-control: public, max-age=31536000
x-qiniu-zone: 0
x-m-log: QNM:yzh154;SRCPROXY:yzh150;SRC:51;SRCPROXY:51;QNM3:55
content-transfer-encoding: binary
accept-ranges: bytes
access-control-allow-origin: *
x-log: X-Log
x-svr: IO
server: openresty

GET
H2 200 1.jpg
hiwhjzywem.com/images/ 103 KB
104 KB 584ms
583ms Image
image/jpeg 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hiwhjzywem.com/images/1.jpg
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8d099aeb56ad62d3049b8d6338a5f0b992f6c58794d25a0c18849eb90f2217ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

x-cache-status: HIT
cache-control: max-age=2592000
x-via: paesano55000000
etag: "64537102-19d69"
x-cache-key: hiwhjzywem.com/images/1.jpg~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Fri, 03 Jan 2025 10:14:05 GMT
accept-ranges: bytes
content-length: 105833
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: image/jpeg
last-modified: Thu, 04 May 2023 08:46:58 GMT

GET
H2 200 index.gif
hiwhjzywem.com/images/ 882 KB
883 KB 511ms
511ms Image
image/gif 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hiwhjzywem.com/images/index.gif
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 81c47df06c42535d9957c17a6738a0c2b40509e628c94206e8c9971b334d7c39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

x-cache-status: HIT
cache-control: max-age=2592000
x-via: paesano55000000
etag: "6183ce22-dc826"
x-cache-key: hiwhjzywem.com/images/index.gif~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Fri, 03 Jan 2025 10:14:06 GMT
accept-ranges: bytes
content-length: 903206
date: Wed, 04 Dec 2024 10:14:06 GMT
x-country: CH
content-type: image/gif
last-modified: Thu, 04 Nov 2021 12:12:18 GMT

GET
H2 200 xz.js Show response
czokcc.com/ 2 KB
2 KB 6169ms
116ms Script
text/javascript 2407:2440:2d::c
LDPL-AS-AP LEGEND...

General

Check archive.org

Show headers Download Go to

Full URL: https://czokcc.com/xz.js
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2407:2440:2d::c , Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software: openresty /
Resource Hash: 726b2b83c577bfe57d80c7bb20ad625508dbb2c0eebdc490798d6a65795c2376

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-md5: t03d7cBXfGXof3H68XvTMQ==
x-ser: i27209_c3189, i2020997_c24893, i1932605_c23621
access-control-max-age: 2592000
access-control-expose-headers: X-Log, X-Reqid
x-reqid: 2cUAAACEyeammQ0Y
content-encoding: gzip
etag: "FttAWNuAD6wYoErfKBw6qV8_0fiS.gz"
x-qnm-cache: Miss
x-m-reqid: DswAABkP0-ammQ0Y
x-cache: HIT from i1932605_c23621(cloudsvr)
date: Wed, 04 Dec 2024 11:44:25 GMT
content-type: text/javascript
content-disposition: inline; filename="xz.js"; filename*=utf-8''xz.js
vary: Accept-Encoding
last-modified: Tue, 03 Dec 2024 07:17:47 GMT
cache-control: public, max-age=31536000
x-qiniu-zone: 0
x-m-log: QNM:cz20;SRCPROXY:cz17;SRC_10.70.57.30:15;SRCPROXY:15;QNM3:16
content-transfer-encoding: binary
accept-ranges: bytes
access-control-allow-origin: *
x-log: X-Log
content-length: 1012
x-svr: IO
server: openresty

GET
H2 200 1.jpg
hiwhjzywem.com/images/ 103 KB
0 1ms
1ms Image
image/jpeg 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hiwhjzywem.com/images/1.jpg
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

x-cache-status: HIT
cache-control: max-age=2592000
x-via: paesano55000000
etag: "64537102-19d69"
x-cache-key: hiwhjzywem.com/images/1.jpg~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Fri, 03 Jan 2025 10:14:05 GMT
accept-ranges: bytes
content-length: 105833
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: image/jpeg
last-modified: Thu, 04 May 2023 08:46:58 GMT

GET z.js
s9.cnzz.com/ 0
0

GET
H2 200 Primary Request / Show response
hiwhjzywem.com/ 2 KB
1 KB 347ms
347ms Document
text/html 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/?channelCode=41203
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: 32a0e39f90c21af675e0300930405a1094e57854437a4e07a145633201d3de07

Request headers

Referer: https://hiwhjzywem.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 04 Dec 2024 11:43:32 GMT
etag: W/"674f0664-93a"
last-modified: Tue, 03 Dec 2024 13:23:48 GMT
server: nginx
vary: Accept-Encoding
x-cache-status: BYPASS
x-country: CH
x-via: paesano55000000

GET
H2 200 zb.css
hiwhjzywem.com/images/ 1 KB
0 1ms
1ms Stylesheet
text/css 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/images/zb.css
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5139841817a373c75fb01e4b16c750f964c937baa364e28b8ebdfcded6c8acbd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/?channelCode=41203

Response headers

x-cache-status: HIT
cache-control: max-age=43200
content-encoding: gzip
x-via: paesano55000000
etag: W/"6183ce22-49b"
x-cache-key: hiwhjzywem.com/images/zb.css~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Wed, 04 Dec 2024 22:14:05 GMT
content-length: 543
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: text/css
last-modified: Thu, 04 Nov 2021 12:12:18 GMT
vary: Accept-Encoding

GET
H2 200 jquery-3.4.1.min.js Show response
hiwhjzywem.com/js/ 86 KB
0 2ms
2ms Script
application/javascript 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/js/jquery-3.4.1.min.js
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/?channelCode=41203

Response headers

x-cache-status: HIT
cache-control: max-age=43200
content-encoding: gzip
x-via: paesano55000000
etag: W/"6183ce22-15851"
x-cache-key: hiwhjzywem.com/js/jquery-3.4.1.min.js~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Wed, 04 Dec 2024 22:14:05 GMT
content-length: 34489
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 04 Nov 2021 12:12:18 GMT

GET
H2 200 appinstall.js Show response
czokcc.com/ 46 KB
0 3ms
3ms Script
text/javascript 2407:2440:2d::c
LDPL-AS-AP LEGEND...

General

Check archive.org

Show headers Download Go to

Full URL: https://czokcc.com/appinstall.js
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2407:2440:2d::c , Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software: openresty /
Resource Hash: 7c9895f2e57140b2a429c2b5df1eb51b2c0bf49f56365e198fb20a92fe79c1dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-md5: ihSRM2DNifCBLqSXHfWhaw==
x-ser: i29949_c15259, i2020983_c24893, i1932517_c23621
access-control-max-age: 2592000
access-control-expose-headers: X-Log, X-Reqid
x-reqid: N0cAAAB34e-KjwYY
content-encoding: gzip
etag: "FkCaSVF9_DEnOoSXfhqFLvXM1gBj.gz"
x-qnm-cache: Miss
x-m-reqid: E-MAAGGv1u-KjwYY
x-cache: HIT from i1932517_c23621(cloudsvr)
date: Wed, 04 Dec 2024 11:44:25 GMT
content-type: text/javascript
content-disposition: inline; filename="appinstall.js"; filename*=utf-8''appinstall.js
vary: Accept-Encoding
last-modified: Sun, 10 Nov 2024 07:49:30 GMT
cache-control: public, max-age=31536000
x-qiniu-zone: 0
x-m-log: QNM:yzh154;SRCPROXY:yzh150;SRC:51;SRCPROXY:51;QNM3:55
content-transfer-encoding: binary
accept-ranges: bytes
access-control-allow-origin: *
x-log: X-Log
x-svr: IO
server: openresty

GET
H2 200 1.jpg
hiwhjzywem.com/images/ 103 KB
0 1ms
1ms Image
image/jpeg 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hiwhjzywem.com/images/1.jpg
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8d099aeb56ad62d3049b8d6338a5f0b992f6c58794d25a0c18849eb90f2217ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/?channelCode=41203

Response headers

x-cache-status: HIT
cache-control: max-age=2592000
x-via: paesano55000000
etag: "64537102-19d69"
x-cache-key: hiwhjzywem.com/images/1.jpg~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Fri, 03 Jan 2025 10:14:05 GMT
accept-ranges: bytes
content-length: 105833
date: Wed, 04 Dec 2024 10:14:05 GMT
x-country: CH
content-type: image/jpeg
last-modified: Thu, 04 May 2023 08:46:58 GMT

GET
H2 200 index.gif
hiwhjzywem.com/images/ 882 KB
0 4ms
4ms Image
image/gif 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hiwhjzywem.com/images/index.gif
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 81c47df06c42535d9957c17a6738a0c2b40509e628c94206e8c9971b334d7c39

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/?channelCode=41203

Response headers

x-cache-status: HIT
cache-control: max-age=2592000
x-via: paesano55000000
etag: "6183ce22-dc826"
x-cache-key: hiwhjzywem.com/images/index.gif~GETd41d8cd98f00b204e9800998ecf8427e~D
expires: Fri, 03 Jan 2025 10:14:06 GMT
accept-ranges: bytes
content-length: 903206
date: Wed, 04 Dec 2024 10:14:06 GMT
x-country: CH
content-type: image/gif
last-modified: Thu, 04 Nov 2021 12:12:18 GMT

GET
H2 200 xz.js Show response
czokcc.com/ 2 KB
0 5ms
5ms Script
text/javascript 2407:2440:2d::c
LDPL-AS-AP LEGEND...

General

Check archive.org

Show headers Download Go to

Full URL: https://czokcc.com/xz.js
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2407:2440:2d::c , Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software: openresty /
Resource Hash: 726b2b83c577bfe57d80c7bb20ad625508dbb2c0eebdc490798d6a65795c2376

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-md5: t03d7cBXfGXof3H68XvTMQ==
x-ser: i27209_c3189, i2020997_c24893, i1932605_c23621
access-control-max-age: 2592000
access-control-expose-headers: X-Log, X-Reqid
x-reqid: 2cUAAACEyeammQ0Y
content-encoding: gzip
etag: "FttAWNuAD6wYoErfKBw6qV8_0fiS.gz"
x-qnm-cache: Miss
x-m-reqid: DswAABkP0-ammQ0Y
x-cache: HIT from i1932605_c23621(cloudsvr)
date: Wed, 04 Dec 2024 11:44:25 GMT
content-type: text/javascript
content-disposition: inline; filename="xz.js"; filename*=utf-8''xz.js
vary: Accept-Encoding
last-modified: Tue, 03 Dec 2024 07:17:47 GMT
cache-control: public, max-age=31536000
x-qiniu-zone: 0
x-m-log: QNM:cz20;SRCPROXY:cz17;SRC_10.70.57.30:15;SRCPROXY:15;QNM3:16
content-transfer-encoding: binary
accept-ranges: bytes
access-control-allow-origin: *
x-log: X-Log
content-length: 1012
x-svr: IO
server: openresty

GET
H2 200 z.js Show response
s9.cnzz.com/ 10 KB
4 KB 863ms
310ms Script
application/javascript 240e:cf:8800:53:3::7ea
CT-JIANGXI-IDC CH...

General

Check archive.org

Show headers Download Go to

Full URL: https://s9.cnzz.com/z.js?id=1281397195&async=1
Requested by: Host: hiwhjzywem.com
URL: https://hiwhjzywem.com/?channelCode=41203
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 240e:cf:8800:53:3::7ea , China, ASN134238 (CT-JIANGXI-IDC CHINANET Jiangx province IDC network, CN),
Reverse DNS
Software: Tengine /
Resource Hash: c6622ba952bcaf5480e01fedd84e23e800976233ecde68e44f9899a95d1084f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-encoding: br
etag: W/"7165206686632577322"
age: 170
x-cache: HIT TCP_REFRESH_HIT dirn:-2:-2
date: Wed, 04 Dec 2024 11:41:37 GMT
content-type: application/javascript
vary: accept-encoding
cache-control: public, max-age=300
x-swift-cachetime: 130
timing-allow-origin: *
via: cache17.l2cn7828[0,0,304-0,H], cache37.l2cn7828[1,0], cache2.cn3693[12,12,200-0,H], cache6.cn3693[13,0]
ali-swift-global-savetime: 1733312497
x-swift-savetime: Wed, 04 Dec 2024 11:44:27 GMT
eagleid: 6ae1f19a17333126671832567e
content-length: 3884
server: Tengine

POST
H2 200 init Show response
potg3q0350io3t7ezq40.unionchemicar-sh.com/web/ufpu2u/41203/ 833 B
1 KB 533ms
177ms XHR
application/json 170.33.12.233
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://potg3q0350io3t7ezq40.unionchemicar-sh.com:6443/web/ufpu2u/41203/init?channelCode=41203&av=0&cv=0&hash=&server=https%3A%2F%2Fpotg3q0350io3t7ezq40.unionchemicar-sh.com%3A6443&sw=p6Cmpg&sh=p6Smpg&sp=1&li=p6GkuKehuKa4p64

Requested by

Host: czokcc.com
URL: https://czokcc.com/appinstall.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

170.33.12.233 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG),

Reverse DNS

Software

NgxFence /

Resource Hash

ddd96c0db4012d97ddebf759cdd1b83e8574b6114e3c32a6917c1be423531d0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://hiwhjzywem.com/

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
access-control-allow-credentials: true
access-control-allow-origin: https://hiwhjzywem.com
date: Wed, 04 Dec 2024 11:44:26 GMT
content-type: application/json;charset=utf-8
vary: Origin, Origin
server: NgxFence

POST
H2 200 stat.htm
z12.cnzz.com/ 2 B
123 B 1752ms
267ms Ping
text/html 240e:97b:500:2000::4
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: https://z12.cnzz.com/stat.htm?id=1281397195&r=https%3A%2F%2Fhiwhjzywem.com%2F&lg=de-ch&ntime=none&cnzz_eid=1717114899-1733312667-https%3A%2F%2Fhiwhjzywem.com%2F&showp=1600x1200&p=https%3A%2F%2Fhiwhjzywem.com%2F%3FchannelCode%3D41203&t=%E9%9C%93%E8%A3%B3%E7%9B%B4%E6%92%AD&umuuid=193917c5ebe1fd3-00cab44da163fe-16462c6e-1d4c00-193917c5ebf2def&h=1
Requested by: Host: s9.cnzz.com
URL: https://s9.cnzz.com/z.js?id=1281397195&async=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server: 240e:97b:500:2000::4 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-encoding: gzip
date: Wed, 04 Dec 2024 11:44:28 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: Tengine

GET
H2 200 c.js Show response
c.cnzz.com/ 907 B
817 B 387ms
286ms Script
application/javascript 240e:cf:8800:53:3::7ea
CT-JIANGXI-IDC CH...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.cnzz.com/c.js?web_id=1281397195&t=z
Requested by: Host: s9.cnzz.com
URL: https://s9.cnzz.com/z.js?id=1281397195&async=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 240e:cf:8800:53:3::7ea , China, ASN134238 (CT-JIANGXI-IDC CHINANET Jiangx province IDC network, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 4cf53aae5533f10b87d5c38b5ddbd51ed6ea8951fc3c0db754d307e0109d988d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

content-encoding: br
etag: W/"9556404348855596676"
age: 56
x-cache: HIT TCP_REFRESH_HIT dirn:-2:-2
date: Wed, 04 Dec 2024 11:43:31 GMT
content-type: application/javascript
vary: accept-encoding
cache-control: public, max-age=321
x-swift-cachetime: 265
timing-allow-origin: *
via: cache67.l2cn7828[0,0,304-0,H], cache43.l2cn7828[0,0], cache8.cn3693[12,12,200-0,H], cache6.cn3693[14,0]
ali-swift-global-savetime: 1733312611
x-swift-savetime: Wed, 04 Dec 2024 11:44:27 GMT
eagleid: 6ae1f19a17333126676043694e
content-length: 586
server: Tengine

GET
H2 200 ico.ico
hiwhjzywem.com/images/ 1 MB
1 MB 201ms
201ms Other
image/x-icon 13.94.41.81
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://hiwhjzywem.com/images/ico.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.94.41.81 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a54476501ebf76453f4f33ee955587c6c3b24dd0955f5068dd3790b139281c6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/?channelCode=41203

Response headers

x-cache-status: HIT
x-via: paesano55000000
etag: "645370da-15a79c"
x-cache-key: hiwhjzywem.com/images/ico.ico~GETd41d8cd98f00b204e9800998ecf8427e~D
accept-ranges: bytes
content-length: 1419164
date: Wed, 04 Dec 2024 10:32:33 GMT
x-country: CH
content-type: image/x-icon
last-modified: Thu, 04 May 2023 08:46:18 GMT

POST
H2 200 eyJjIjoiNDEyMDMiLCJtIjoiT3ZtTFdvRWs1dFlBQUFHVGtYeGRIWmlQUkZpYjBBVWpPNDFoMEVKdXcycWZpVjJfd19VUUJSZFBqRWlCZ3h4ZlYzZTI3RWV0d1A4SEdTMjA0ZHZmNURGcTdFZmFMZ1YyQ20yN3hzUVVUNVdzTjVyRFVkUFN4Qk8yT3VWUTdlLWZLd...
potg3q0350io3t7ezq40.unionchemicar-sh.com/web/ufpu2u/41203/clicked/c/ 0
375 B 179ms
178ms Ping
text/plain 170.33.12.233
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://potg3q0350io3t7ezq40.unionchemicar-sh.com:6443/web/ufpu2u/41203/clicked/c/eyJjIjoiNDEyMDMiLCJtIjoiT3ZtTFdvRWs1dFlBQUFHVGtYeGRIWmlQUkZpYjBBVWpPNDFoMEVKdXcycWZpVjJfd19VUUJSZFBqRWlCZ3h4ZlYzZTI3RWV0d1A4SEdTMjA0ZHZmNURGcTdFZmFMZ1YyQ20yN3hzUVVUNVdzTjVyRFVkUFN4Qk8yT3VWUTdlLWZLd2YxUWE2bEhscVJEbXJ0eTFNIn0=?p=0&ref=https%3A%2F%2Fhiwhjzywem.com%2F%3FchannelCode%3D41203&ac=0&cc=0&channelCode=41203

Requested by

Host: czokcc.com
URL: https://czokcc.com/appinstall.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

170.33.12.233 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG),

Reverse DNS

Software

NgxFence /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hiwhjzywem.com/

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-origin: https://hiwhjzywem.com
content-length: 0
date: Wed, 04 Dec 2024 11:44:28 GMT
vary: Origin, Origin
server: NgxFence

GET

177nc.apk
mspc00419.xz.drkjncw.com/default/1204/194/ms/
Redirect Chain

https://potg3q0350io3t7ezq40.unionchemicar-sh.com:6443/page/ufpu2u/install/c/eyJjIjoiNDEyMDMiLCJtIjoiMU5Ya21KVnlGbUFBQUFHVGtYeGRIU3VoZFNwMVlmNm5Nb3Z2c2VPRjA1VXdiVzRxUDJVMUdhVmNxdEc2VzU2MzNnYl9xUXlX...
https://zlff.mewivnf.com:7108/default/ms/177nc.apk
https://mspc00419.xz.drkjncw.com/default/1204/194/ms/177nc.apk

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s9.cnzz.com
URL: https://s9.cnzz.com/z.js?id=1281397195&async=1

Domain: mspc00419.xz.drkjncw.com
URL: https://mspc00419.xz.drkjncw.com/default/1204/194/ms/177nc.apk

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.hiwhjzywem.com/	1970-01-21 05:50:37	Name: UM_distinctid Value: 193917c5ebe1fd3-00cab44da163fe-16462c6e-1d4c00-193917c5ebf2def
			hiwhjzywem.com/	1970-01-21 05:50:37	Name: CNZZDATA1281397195 Value: 1717114899-1733312667-https%253A%252F%252Fhiwhjzywem.com%252F%7C1733312667

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.cnzz.com
czokcc.com
hiwhjzywem.com
mspc00419.xz.drkjncw.com
potg3q0350io3t7ezq40.unionchemicar-sh.com
s9.cnzz.com
z12.cnzz.com
mspc00419.xz.drkjncw.com
s9.cnzz.com
13.94.41.81
170.33.12.233
2407:2440:2d::c
240e:97b:500:2000::4
240e:cf:8800:53:3::7ea
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
32a0e39f90c21af675e0300930405a1094e57854437a4e07a145633201d3de07
4cf53aae5533f10b87d5c38b5ddbd51ed6ea8951fc3c0db754d307e0109d988d
5139841817a373c75fb01e4b16c750f964c937baa364e28b8ebdfcded6c8acbd
726b2b83c577bfe57d80c7bb20ad625508dbb2c0eebdc490798d6a65795c2376
7c9895f2e57140b2a429c2b5df1eb51b2c0bf49f56365e198fb20a92fe79c1dd
81c47df06c42535d9957c17a6738a0c2b40509e628c94206e8c9971b334d7c39
8d099aeb56ad62d3049b8d6338a5f0b992f6c58794d25a0c18849eb90f2217ee
a54476501ebf76453f4f33ee955587c6c3b24dd0955f5068dd3790b139281c6c
c6622ba952bcaf5480e01fedd84e23e800976233ecde68e44f9899a95d1084f8
ddd96c0db4012d97ddebf759cdd1b83e8574b6114e3c32a6917c1be423531d0b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

hiwhjzywem.com Open in urlscan Pro 13.94.41.81 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

91 %HTTPS

60 %IPv6

5 Domains

7 Subdomains

6 IPs

3 Countries

2439 kBTransfer

3748 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

2 Cookies

Indicators

hiwhjzywem.com Open in urlscan Pro
13.94.41.81 Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

91 %
HTTPS

60 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

2439 kB
Transfer

3748 kB
Size

2
Cookies

23 HTTP transactions
0 data transactions