Submitted URL: http://b91.asia/
Effective URL: https://js.t4lover.com/download1/2655_0.html
Submission Tags: phishingrod
Submission: On March 05 via api from DE — Scanned from NL

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 27.221.3.188, located in China and belongs to CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN. The main domain is js.t4lover.com.
TLS certificate: Issued by R3 on March 4th 2023. Valid for: 3 months.
This is the only time js.t4lover.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 1 23.225.104.210 40065 (CNSERVERS)
5 27.221.3.188 4837 (CHINA169-...)
4 122.227.201.1 136188 (CHINATELE...)
1 183.240.166.132 56040 (CMNET-GUA...)
10 3
Apex Domain
Subdomains
Transfer
5 t4lover.com
js.t4lover.com
61 KB
4 slgfjzz.com
i.slgfjzz.com
268 KB
1 51.la
ia.51.la — Cisco Umbrella Rank: 71082
73 B
1 bustc.com
js.bustc.com
114 B
1 b91.asia
b91.asia
716 B
10 5
Domain Requested by
5 js.t4lover.com js.t4lover.com
4 i.slgfjzz.com js.t4lover.com
1 ia.51.la js.t4lover.com
1 js.bustc.com 1 redirects
1 b91.asia 1 redirects
10 5

This site contains no links.

Subject Issuer Validity Valid
*.t4lover.com
R3
2023-03-04 -
2023-06-02
3 months crt.sh
*.slgfjzz.com
R3
2023-02-28 -
2023-05-29
3 months crt.sh
*.51.la
GlobalSign GCC R3 DV TLS CA 2020
2022-04-19 -
2023-05-21
a year crt.sh

This page contains 1 frames:

Primary Page: https://js.t4lover.com/download1/2655_0.html
Frame ID: C10ED0427077FDA64586240007AA31DB
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

小黄书视频

Page URL History Show full URLs

  1. http://b91.asia/ HTTP 301
    https://js.bustc.com/download1/2655_0.html HTTP 301
    https://js.t4lover.com/download1/2655_0.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

329 kB
Transfer

399 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://b91.asia/ HTTP 301
    https://js.bustc.com/download1/2655_0.html HTTP 301
    https://js.t4lover.com/download1/2655_0.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 2655_0.html
js.t4lover.com/download1/
Redirect Chain
  • http://b91.asia/
  • https://js.bustc.com/download1/2655_0.html
  • https://js.t4lover.com/download1/2655_0.html
18 KB
19 KB
Document
General
Full URL
https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
27.221.3.188 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
openresty /
Resource Hash
7a76cc7cfcae63b92e161f25822fabcc04a5e3d140b4399a94c112fff14101b5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Accept-Ranges
bytes
Age
9100
Connection
keep-alive
Content-Length
18879
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Mar 2023 12:48:18 GMT
Server
openresty
X-CCDN-CacheTTL
2592000
X-CCDN-Expires
2582911
nginx-hit
1
via
CHN-SDqingdao-AREACUCC1-CACHE45[2],CHN-SDqingdao-AREACUCC1-CACHE42[0,TCP_HIT,1],CHN-TJ-GLOBAL1-CACHE9[4],CHN-TJ-GLOBAL1-CACHE106[0,TCP_HIT,2]
x-hcs-proxy-type
1

Redirect headers

content-length
167
content-type
text/html; charset=UTF-8
date
Sun, 05 Mar 2023 12:48:09 GMT
location
https://js.t4lover.com/download1/2655_0.html
server
Microsoft-IIS/10.0
jquery.min.js
js.t4lover.com/js/two/js/
94 KB
33 KB
Script
General
Full URL
https://js.t4lover.com/js/two/js/jquery.min.js
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
27.221.3.188 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
openresty /
Resource Hash
3271ee25750483e699e1d8d87643af527e9680630d41e08861a0d4b8effd1a33

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/download1/2655_0.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

nginx-hit
1
Date
Sun, 05 Mar 2023 12:48:19 GMT
Content-Encoding
gzip
via
CHN-SDqingdao-AREACUCC1-CACHE45[3],CHN-SDqingdao-AREACUCC1-CACHE46[0,TCP_HIT,1],CHN-TJ-GLOBAL1-CACHE83[54],CHN-TJ-GLOBAL1-CACHE46[0,TCP_HIT,52]
X-CCDN-CacheTTL
2592000
Age
9392
Connection
keep-alive
Content-Length
33285
Last-Modified
Mon, 01 Jan 1601 00:00:00 GMT
Server
openresty
ETag
"e0275cc10eada69c"
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public
X-CCDN-Expires
2584236
Accept-Ranges
bytes
x-hcs-proxy-type
1
zhutongji.js
js.t4lover.com/js/two/js/
5 KB
3 KB
Script
General
Full URL
https://js.t4lover.com/js/two/js/zhutongji.js
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
27.221.3.188 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
openresty /
Resource Hash
2736ea93f2820e598c9c4a681a1bba08dde1a8810913c04e9d7668c54124115e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/download1/2655_0.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

nginx-hit
1
Date
Sun, 05 Mar 2023 12:48:19 GMT
Content-Encoding
gzip
via
CHN-SDqingdao-AREACUCC1-CACHE52[3],CHN-SDqingdao-AREACUCC1-CACHE67[0,TCP_HIT,1],CHN-TJ-GLOBAL1-CACHE75[6],CHN-TJ-GLOBAL1-CACHE106[0,TCP_HIT,3]
X-CCDN-CacheTTL
2592000
Age
9390
Connection
keep-alive
Content-Length
2316
Last-Modified
Mon, 01 Jan 1601 00:00:00 GMT
Server
openresty
ETag
"3b62847c6f4ae3b9"
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public
X-CCDN-Expires
2584238
Accept-Ranges
bytes
x-hcs-proxy-type
1
278949dfc4f962e81b8df57fd09aef89.pgs
i.slgfjzz.com/20220102/
45 KB
46 KB
Image
General
Full URL
https://i.slgfjzz.com/20220102/278949dfc4f962e81b8df57fd09aef89.pgs
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
122.227.201.1 Ningbo, China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
Default-server-KS-CLOUD-WH-MP-01-03 /
Resource Hash
06045c479a5b6d4c6443711156773680e96ba7f5a5b1f3f597d8342f6ee06f8b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 03:48:29 GMT
Age
464394
x-link-via
nbct05:443;whmp01:80;
X-Cache-Status
HIT from KS-CLOUD-WH-MP-01-03, HIT from KS-CLOUD-NB-CT-05-05
Connection
keep-alive
Content-Length
46080
Server
Default-server-KS-CLOUD-WH-MP-01-03
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
X-Cdn-Request-ID
49bc31af09be4628c2320b3f5d79e69d
Access-Control-Allow-Headers
Content-Type,AccessToken,X-CSRF-Token, Authorization, Token, X-Token
Expires
Thu, 30 Mar 2023 03:48:29 GMT
479abc23111894ef3f67b61653549550.pgs
i.slgfjzz.com/20220915/
12 KB
13 KB
Image
General
Full URL
https://i.slgfjzz.com/20220915/479abc23111894ef3f67b61653549550.pgs
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
122.227.201.1 Ningbo, China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
Default-server-KS-CLOUD-HF-MP-64-15 /
Resource Hash
c0ce6ba60bc825f851e0e78805820bed2c7db2b0f3d086d96f750e65bcc5cd6f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 03:48:29 GMT
Age
464394
x-link-via
nbct05:443;hfmp64:80;
X-Cache-Status
HIT from KS-CLOUD-HF-MP-64-15, HIT from KS-CLOUD-NB-CT-05-07
Connection
keep-alive
Content-Length
12288
Server
Default-server-KS-CLOUD-HF-MP-64-15
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
X-Cdn-Request-ID
177edfa9d0528fc6d3406b65eb6f393b
Access-Control-Allow-Headers
Content-Type,AccessToken,X-CSRF-Token, Authorization, Token, X-Token
Expires
Thu, 30 Mar 2023 03:48:29 GMT
fbbcbe2f81ed3a6d2ec7883e11a5e97c.jps
i.slgfjzz.com/20220608/
98 KB
99 KB
Image
General
Full URL
https://i.slgfjzz.com/20220608/fbbcbe2f81ed3a6d2ec7883e11a5e97c.jps
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
122.227.201.1 Ningbo, China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
Default-server-KS-CLOUD-LYG-MP-21-01 /
Resource Hash
dba3b49e59b24a3c811c94cfbb055aab6dbd11210b7713b3a4b9289d9ad14608

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 03:48:43 GMT
Age
464380
x-link-via
nbct05:443;lygmp21:80;
X-Cache-Status
HIT from KS-CLOUD-LYG-MP-21-01, HIT from KS-CLOUD-NB-CT-05-05
Connection
keep-alive
Content-Length
100352
Server
Default-server-KS-CLOUD-LYG-MP-21-01
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
X-Cdn-Request-ID
aa2b769fb6cd3d2bac594b05076a96ee
Access-Control-Allow-Headers
Content-Type,AccessToken,X-CSRF-Token, Authorization, Token, X-Token
Expires
Thu, 30 Mar 2023 03:48:43 GMT
33170e232e823b8bf64e793a710449ac.pgs
i.slgfjzz.com/20220601/
110 KB
111 KB
Image
General
Full URL
https://i.slgfjzz.com/20220601/33170e232e823b8bf64e793a710449ac.pgs
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
122.227.201.1 Ningbo, China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
Default-server-KS-CLOUD-JIAOZ-MP-04-07 /
Resource Hash
d69d2a783c3f8ff424da20ce62f15a3e34be078a16365a0706559d1c2f676208

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 03:48:29 GMT
Age
464394
x-link-via
nbct05:443;jiaozmp04:80;
X-Cache-Status
HIT from KS-CLOUD-JIAOZ-MP-04-07, HIT from KS-CLOUD-NB-CT-05-08
Connection
keep-alive
Content-Length
112640
Server
Default-server-KS-CLOUD-JIAOZ-MP-04-07
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
X-Cdn-Request-ID
f666c2fde233572b7ae61733f519cfaf
Access-Control-Allow-Headers
Content-Type,AccessToken,X-CSRF-Token, Authorization, Token, X-Token
Expires
Thu, 30 Mar 2023 03:48:29 GMT
md5.js
js.t4lover.com/js/five/js/
9 KB
3 KB
Script
General
Full URL
https://js.t4lover.com/js/five/js/md5.js
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
27.221.3.188 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
openresty /
Resource Hash
dc0df8d67a1cd007a197171d3c5594dbc0635e47e18c67ba3487ce90f183e474

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/download1/2655_0.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

nginx-hit
1
Date
Sun, 05 Mar 2023 12:48:19 GMT
Content-Encoding
gzip
via
CHN-SDqingdao-AREACUCC1-CACHE45[3],CHN-SDqingdao-AREACUCC1-CACHE40[0,TCP_HIT,1],CHN-TJ-GLOBAL1-CACHE41[5],CHN-TJ-GLOBAL1-CACHE104[0,TCP_HIT,2]
X-CCDN-CacheTTL
2592000
Age
9389
Connection
keep-alive
Content-Length
2942
Last-Modified
Mon, 01 Jan 1601 00:00:00 GMT
Server
openresty
ETag
"ffda5da30ac811d2"
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public
X-CCDN-Expires
2584239
Accept-Ranges
bytes
x-hcs-proxy-type
1
twojs.js
js.t4lover.com/js/two/js/
8 KB
3 KB
Script
General
Full URL
https://js.t4lover.com/js/two/js/twojs.js
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
27.221.3.188 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
openresty /
Resource Hash
5952ea2a7533a6a83215e652dfb19b48802e774358cfb9686ab4a4158305aef2

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/download1/2655_0.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

nginx-hit
1
Date
Sun, 05 Mar 2023 12:48:19 GMT
Content-Encoding
gzip
via
CHN-SDqingdao-AREACUCC1-CACHE52[2],CHN-SDqingdao-AREACUCC1-CACHE59[0,TCP_HIT,1],CHN-TJ-GLOBAL1-CACHE93[4],CHN-TJ-GLOBAL1-CACHE59[0,TCP_HIT,2]
X-CCDN-CacheTTL
2592000
Age
9388
Connection
keep-alive
Content-Length
2585
Last-Modified
Mon, 01 Jan 1601 00:00:00 GMT
Server
openresty
ETag
"15d0df19bcec5c0b"
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public
X-CCDN-Expires
2584392
Accept-Ranges
bytes
x-hcs-proxy-type
1
go1
ia.51.la/
0
73 B
Image
General
Full URL
https://ia.51.la/go1?id=21240093&rt=1678020499311&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1678020499311&tt=%25E5%25B0%258F%25E9%25BB%2584%25E4%25B9%25A6%25E8%25A7%2586%25E9%25A2%2591&kw=%25E5%25B0%258F%25E9%25BB%2584%25E4%25B9%25A6%25E8%25A7%2586%25E9%25A2%2591&cu=https%253A%252F%252Fjs.t4lover.com%252Fdownload1%252F2655_0.html&pu=
Requested by
Host: js.t4lover.com
URL: https://js.t4lover.com/download1/2655_0.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
183.240.166.132 , China, ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://js.t4lover.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Sun, 05 Mar 2023 12:48:12 GMT
Content-Length
0

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery number| hexcase string| b64pad number| chrsz function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 string| sddpc object| myDate number| randCode number| randLast number| time string| machine string| androidDomains string| androidName string| androidChanl string| h5name string| waih5name string| waih5 string| neih5 string| androidUrl string| iosJump string| iosh5 string| waiiosh5 string| iosUrl object| body string| ua string| os object| devices function| do_j2lx function| getPackage function| getPackage1 function| Openkefu function| install function| closetutorial function| copyUrl function| Onalert function| myBrowser function| fadeIn

3 Cookies

Domain/Path Name / Value
js.t4lover.com/ Name: __tins__21240093
Value: %7B%22sid%22%3A%201678020499311%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201678022299311%7D
js.t4lover.com/ Name: __51cke__
Value:
js.t4lover.com/ Name: __51laig__
Value: 1