Submitted URL: https://down.sandai.net/thunder11
Effective URL: http://down.sandai.net/404/404.html
Submission: On September 14 via manual from DE — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 240e:f7:8e00:504::1:13, located in China and belongs to CT-HANGZHOU-IDC No.288,Fu-chun Road, CN. The main domain is down.sandai.net. The Cisco Umbrella rank of the primary domain is 373251.
This is the only time down.sandai.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 240e:f7:8e00:... 58461 (CT-HANGZH...)
2 1
Apex Domain
Subdomains
Transfer
3 sandai.net
down.sandai.net — Cisco Umbrella Rank: 373251
10 KB
2 1
Domain Requested by
3 down.sandai.net 1 redirects down.sandai.net
2 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://down.sandai.net/404/404.html
Frame ID: 9763A540B3DACC5ECE7FC624A8FE35A4
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

迅雷

Page URL History Show full URLs

  1. https://down.sandai.net/thunder11 HTTP 302
    http://down.sandai.net/404/404.html Page URL

Page Statistics

2
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

9 kB
Transfer

7 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://down.sandai.net/thunder11 HTTP 302
    http://down.sandai.net/404/404.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 404.html
down.sandai.net/404/
Redirect Chain
  • https://down.sandai.net/thunder11
  • http://down.sandai.net/404/404.html
449 B
1 KB
Document
General
Full URL
http://down.sandai.net/404/404.html
Protocol
HTTP/1.1
Server
240e:f7:8e00:504::1:13 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN),
Reverse DNS
Software
openresty /
Resource Hash
0b5fd889519a24a90716a37aee0c13f6729a0dd8d777dc5634177513e7b3bab1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Ali-Swift-Global-Savetime
1661932218
Connection
keep-alive
Content-Length
449
Content-MD5
xrrLhekL7Ojm693uWNIQ+w==
Content-Type
text/html
Date
Wed, 14 Sep 2022 23:20:32 GMT
ETag
"C6BACB85E90BECE8E6EBDDEE58D210FB"
Eagleid
dde751a316619322218014268e
Last-Modified
Tue, 23 Mar 2021 07:14:10 GMT
Server
openresty
Timing-Allow-Origin
*
Vary
Accept-Encoding
X-Cache
HIT TCP_MEM_HIT dirn:10:841793752 HIT from BC10_dx-zhejiang-huzhou-11-cache-1(baishan)
X-M-Log
QNM:jjh1987;QNM3
X-M-Reqid
b4IAABQtvT-6XhAX
X-Oss-Cdn-Auth
success
X-Oss-Hash-Crc64ecma
16562017834954875749
X-Oss-Meta-Md5
c6bacb85e90bece8e6ebddee58d210fb
X-Oss-Object-Type
Normal
X-Oss-Request-Id
630F12BA177724353736FA1B
X-Oss-Server-Time
6
X-Oss-Storage-Class
Standard
X-Qnm-Cache
Hit
X-Ser
BC143_dx-lt-yd-jiangsu-taizhou-4-cache-6, BC10_dx-zhejiang-huzhou-11-cache-1
X-Swift-Cachetime
3600
X-Swift-Savetime
Wed, 31 Aug 2022 07:50:18 GMT

Redirect headers

ali-swift-global-savetime
1663197631
content-length
268
content-type
application/xml
date
Wed, 14 Sep 2022 23:20:31 GMT
eagleid
dde7518f16631976313264080e
location
http://down.sandai.net/404/404.html
server
openresty
timing-allow-origin
*
x-cache
MISS TCP_MISS dirn:-2:-2 MISS from BC10_dx-zhejiang-huzhou-11-cache-1(baishan)
x-m-log
QNM:jjh1986;SRCPROXY:jjh1532;SRC:40/302;SRCPROXY:40/302;QNM3:41/302
x-m-reqid
rDcAAIRFvQZv3RQX
x-oss-cdn-auth
success
x-oss-request-id
632261BF6EBEB93137FF2A41
x-oss-server-time
3
x-qnm-cache
Validate as miss: no-header,MissValidate
x-ser
BC184_dx-lt-yd-jiangsu-yancheng-8-cache-7, BC10_dx-zhejiang-huzhou-11-cache-1
x-swift-cachetime
10
x-swift-error
orig response 4XX error
x-swift-savetime
Wed, 14 Sep 2022 23:20:31 GMT
img404.png
down.sandai.net/404/
7 KB
8 KB
Image
General
Full URL
http://down.sandai.net/404/img404.png
Requested by
Host: down.sandai.net
URL: http://down.sandai.net/404/404.html
Protocol
HTTP/1.1
Server
240e:f7:8e00:504::1:13 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN),
Reverse DNS
Software
openresty /
Resource Hash
8b2af3f6ce2d92354a2e9e97217866fe75fac81a5b2d7dc357f3d52f81699fb1

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://down.sandai.net/404/404.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Wed, 14 Sep 2022 23:20:32 GMT
X-Oss-Request-Id
630F12BE6D612F3630252122
Content-MD5
XVx52MuoTk42x9WE8/sEdg==
X-Swift-Cachetime
7776000
X-Swift-Savetime
Wed, 31 Aug 2022 07:50:22 GMT
X-Cache
HIT TCP_MEM_HIT dirn:12:820392313, HIT from BC10_dx-zhejiang-huzhou-11-cache-1(baishan)
X-Oss-Cdn-Auth
success
Connection
keep-alive
Content-Length
6951
X-M-Reqid
b0wAAAJkxVK6XhAX
X-Oss-Object-Type
Normal
X-M-Log
QNM:xs474;SRCPROXY:xs491;SRC:31;SRCPROXY:31;QNM3:35
Last-Modified
Tue, 23 Mar 2021 07:14:10 GMT
Server
openresty
X-Oss-Meta-Md5
5d5c79d8cba84e4e36c7d584f3fb0476
ETag
"5D5C79D8CBA84E4E36C7D584F3FB0476"
Ali-Swift-Global-Savetime
1661932222
Content-Type
image/png
X-Oss-Storage-Class
Standard
Accept-Ranges
bytes
Timing-Allow-Origin
*
X-Oss-Hash-Crc64ecma
5630517472644116329
X-Qnm-Cache
Miss
Eagleid
dcb9a58616619324168255035e
X-Oss-Server-Time
77
X-Ser
BC171_dx-lt-yd-jiangsu-zhenjiang-6-cache-4, BC10_dx-zhejiang-huzhou-11-cache-1

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

down.sandai.net
240e:f7:8e00:504::1:13
0b5fd889519a24a90716a37aee0c13f6729a0dd8d777dc5634177513e7b3bab1
8b2af3f6ce2d92354a2e9e97217866fe75fac81a5b2d7dc357f3d52f81699fb1