ghszw5.com Open in urlscan Pro
206.238.42.126 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ghszw5.com/
Submission: On October 15 via api (October 15th 2024, 9:04:27 am UTC) from BE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 10 HTTP transactions. The main IP is 206.238.42.126, located in Hong Kong and belongs to TERAEXCH, US. The main domain is ghszw5.com.
TLS certificate: Issued by R11 on October 9th 2024. Valid for: 3 months.

This is the only time ghszw5.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	206.238.42.126 206.238.42.126	399077 (TERAEXCH) (TERAEXCH)
2	59.110.190.52 59.110.190.52	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
1	154.85.69.101 154.85.69.101	139057 (LDPL-AS-A...) (LDPL-AS-AP LEGEND DYNASTY PTE. LTD.)
3	170.33.13.110 170.33.13.110	134963 (ASEPL-AS-...) (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited)
10	5

2 206.238.42.126 (Hong Kong)

ASN399077 (TERAEXCH, US)

ghszw5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 59.110.190.52 (Beijing, China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

japicture.oss-cn-beijing.aliyuncs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.85.69.101 (Singapore, Singapore)

ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG)

czokcc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 170.33.13.110 (Singapore)

ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG)

gfxcqpddqyfb.hrblsdgjg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	hrblsdgjg.com gfxcqpddqyfb.hrblsdgjg.com	1 KB
2	aliyuncs.com japicture.oss-cn-beijing.aliyuncs.com	710 KB
2	ghszw5.com ghszw5.com	3 KB
1	czokcc.com czokcc.com	19 KB
0	xclvwag.com Failed zlff.xclvwag.com Failed
10	5

	Domain	Requested by
3	gfxcqpddqyfb.hrblsdgjg.com	czokcc.com
2	japicture.oss-cn-beijing.aliyuncs.com	ghszw5.com
2	ghszw5.com
1	czokcc.com	ghszw5.com
0	zlff.xclvwag.com Failed	czokcc.com
10	5

This site contains no links.

Subject Issuer	Validity	Valid
ghszw5.com R11	`2024-10-09` - `2025-01-07`	3 months	crt.sh
cn-beijing.oss.aliyuncs.com GlobalSign Organization Validation CA - SHA256 - G3	`2024-09-02` - `2025-09-04`	a year	crt.sh
czokcc.com Certum Domain Validation CA SHA2	`2024-09-10` - `2025-10-10`	a year	crt.sh
*.hrblsdgjg.com Sectigo RSA Domain Validation Secure Server CA	`2024-08-21` - `2025-08-21`	a year	crt.sh

This page contains 1 frames:

Frame: https://zlff.xclvwag.com:7107/default/ja/j169a.apk
Frame ID: 2EA82F4D8D80C6FF4BD4A70F9A80006B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

久爱直播

Page Statistics

10
Requests

80 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

733 kB
Transfer

761 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://gfxcqpddqyfb.hrblsdgjg.com:6443/page/sp8cqc/install/c/eyJtIjoiS244aTBucUYzQlFBQUFHU2oydTFPMGNuLU9wNkRnak83RWZmWGpKTEhhQ3RjWmxXcDhYSXhZRlRncWd3djA5VGlGR09pVEhaSDJjNW82M2M0TUpsU2htSkJQYjNQNTExQmstNUdPeXB1Q0hGX2Izcm9HOE9PUDBORWo4RU1NUSJ9?p=0 HTTP 302
https://zlff.xclvwag.com:7107/default/ja/j169a.apk

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ghszw5.com/ 5 KB
2 KB 963ms
300ms Document
text/html 206.238.42.126
TERAEXCH

General

Check archive.org

Show headers Download Go to

Full URL

https://ghszw5.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

206.238.42.126 , Hong Kong, ASN399077 (TERAEXCH, US),

Reverse DNS

Software

nginx /

Resource Hash

07748b8da2a18294b86e274f61275d0335d9346a1cf7ed738573aea53108af12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Tue, 15 Oct 2024 09:04:11 GMT
etag: W/"66f29d48-1272"
last-modified: Tue, 24 Sep 2024 11:06:48 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H/1.1 200
OK up.png
japicture.oss-cn-beijing.aliyuncs.com/picture/ 74 KB
74 KB 609ms
215ms Image
image/png 59.110.190.52
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://japicture.oss-cn-beijing.aliyuncs.com/picture/up.png
Requested by: Host: ghszw5.com
URL: https://ghszw5.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 59.110.190.52 Beijing, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash: a3c802a61d75de994f54f3fe3ae4a2dc157c95011e7534e3daabaa5cc9a9d34d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ghszw5.com/

Response headers

Content-MD5: tMn/y4D3dAGgakJ7gx2AlA==
x-oss-storage-class: Standard
ETag: "B4C9FFCB80F77401A06A427B831D8094"
x-oss-object-type: Normal
Date: Tue, 15 Oct 2024 09:04:11 GMT
x-oss-server-time: 59
Content-Disposition: attachment
Content-Type: image/png
Last-Modified: Sun, 20 Jun 2021 06:46:32 GMT
x-oss-ec: 0048-00000104
x-oss-version-id: CAEQEBiBgID8uteg0RciIDA2ZTY5MzhmODZhNTQwM2ZiNmMwNjJhOTY3ZDFlYTJk
x-oss-hash-crc64ecma: 11789691009109711863
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 75349
x-oss-request-id: 670E300B77F3A93632E529D1
x-oss-force-download: true
Server: AliyunOSS

GET
H/1.1 200
OK ja.gif
japicture.oss-cn-beijing.aliyuncs.com/picture/ 636 KB
636 KB 621ms
222ms Image
image/gif 59.110.190.52
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://japicture.oss-cn-beijing.aliyuncs.com/picture/ja.gif
Requested by: Host: ghszw5.com
URL: https://ghszw5.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 59.110.190.52 Beijing, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: AliyunOSS /
Resource Hash: d92dbe9d26b43528134a4bee996797f27a51579f9a2e403bdb0dedaa66666782

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ghszw5.com/

Response headers

Content-MD5: t9+i1S87qtlWc3HLoR/KvA==
x-oss-storage-class: Standard
ETag: "B7DFA2D52F3BAAD9567371CBA11FCABC"
x-oss-object-type: Normal
Date: Tue, 15 Oct 2024 09:04:11 GMT
x-oss-server-time: 67
Content-Disposition: attachment
Content-Type: image/gif
Last-Modified: Sun, 20 Jun 2021 05:12:52 GMT
x-oss-ec: 0048-00000104
x-oss-version-id: CAEQEBiBgMCR.quf0RciIDZkYjM5NWE2Zjc5MzRmODk5OTFmZDk0M2I0MTk3ZmU1
x-oss-hash-crc64ecma: 14078741630563855531
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 650816
x-oss-request-id: 670E300B478AB3383214F847
x-oss-force-download: true
Server: AliyunOSS

GET
H2 200 appinstall.js Show response
czokcc.com/ 46 KB
19 KB 1164ms
17ms Script
text/javascript 154.85.69.101
LDPL-AS-AP LEGEND...

General

Check archive.org

Show headers Download Go to

Full URL: https://czokcc.com/appinstall.js
Requested by: Host: ghszw5.com
URL: https://ghszw5.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 154.85.69.101 Singapore, Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software: openresty /
Resource Hash: 7c9895f2e57140b2a429c2b5df1eb51b2c0bf49f56365e198fb20a92fe79c1dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ghszw5.com/

Response headers

content-md5: ihSRM2DNifCBLqSXHfWhaw==
x-ser: BC100_dx-lt-yd-neimenggu-huhehaote-21-cache-7, BC130_IT-Lombardia-Milan-1-cache-1, BC85_DE-Frankfurt-Frankfurt-11-cache-5
access-control-max-age: 2592000
access-control-expose-headers: X-Log, X-Reqid
x-reqid: mCoAAADXA1BZ0_cX
content-encoding: gzip
etag: "FkCaSVF9_DEnOoSXfhqFLvXM1gBj.gz"
x-qnm-cache: Hit
x-m-reqid: dv0AAN7A0vJZ0_cX
x-cache: HIT from BC85_DE-Frankfurt-Frankfurt-11-cache-5(cloudsvr)
date: Tue, 15 Oct 2024 09:04:12 GMT
content-type: text/javascript
content-disposition: inline; filename="appinstall.js"; filename*=utf-8''appinstall.js
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 08:44:34 GMT
cache-control: public, max-age=31536000
x-qiniu-zone: 0
x-m-log: QNM:yzh154;QNM3
content-transfer-encoding: binary
accept-ranges: bytes
access-control-allow-origin: *
x-log: X-Log
x-svr: IO
server: openresty

POST
H2 200 init Show response
gfxcqpddqyfb.hrblsdgjg.com/web/sp8cqc/_/ 708 B
881 B 747ms
180ms XHR
application/json 170.33.13.110
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://gfxcqpddqyfb.hrblsdgjg.com:6443/web/sp8cqc/_/init?av=0&cv=0&hash=&server=https%3A%2F%2Fgfxcqpddqyfb.hrblsdgjg.com%3A6443&sw=p6Cmpg&sh=p6Smpg&sp=1&li=p6GkuKehuKa4paQ

Requested by

Host: czokcc.com
URL: https://czokcc.com/appinstall.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

170.33.13.110 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG),

Reverse DNS

Software

NgxFence /

Resource Hash

3e285aa23446972ce5273757d3fe19c65490455d71693f86d83295cfd132b7fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://ghszw5.com/

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
access-control-allow-credentials: true
access-control-allow-origin: https://ghszw5.com
date: Tue, 15 Oct 2024 09:04:13 GMT
content-type: application/json;charset=utf-8
vary: Origin, Origin
server: NgxFence

GET
H2 404 favicon.ico
ghszw5.com/ 548 B
611 B 319ms
294ms Other
text/html 206.238.42.126
TERAEXCH

General

Check archive.org

Show headers Download Go to

Full URL: https://ghszw5.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 206.238.42.126 , Hong Kong, ASN399077 (TERAEXCH, US),
Reverse DNS
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ghszw5.com/

Response headers

content-length: 548
date: Tue, 15 Oct 2024 09:04:14 GMT
content-type: text/html
server: nginx

POST
H2 200 eyJtIjoiTnNOQTdPWWpfNWdBQUFHU2oydTFPMTBxcE5fLXZoSU1KWm4wb25DajNLeVRUQWJtUDlhNUtHVG1HZlN0UTRWM3lMWk9POGlMcVpDSjd2WjJEb0w0Tm1UNFhQQTJSVE90MzZxT0hfMEVnTTdRVXBKaGROMGZ6X3FRb1VUQ1FuRSJ9
gfxcqpddqyfb.hrblsdgjg.com/web/sp8cqc/_/clicked/c/ 0
279 B 213ms
182ms Ping
text/plain 170.33.13.110
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://gfxcqpddqyfb.hrblsdgjg.com:6443/web/sp8cqc/_/clicked/c/eyJtIjoiTnNOQTdPWWpfNWdBQUFHU2oydTFPMTBxcE5fLXZoSU1KWm4wb25DajNLeVRUQWJtUDlhNUtHVG1HZlN0UTRWM3lMWk9POGlMcVpDSjd2WjJEb0w0Tm1UNFhQQTJSVE90MzZxT0hfMEVnTTdRVXBKaGROMGZ6X3FRb1VUQ1FuRSJ9?p=0&ref=https%3A%2F%2Fghszw5.com%2F&ac=0&cc=0

Requested by

Host: czokcc.com
URL: https://czokcc.com/appinstall.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

170.33.13.110 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG),

Reverse DNS

Software

NgxFence /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ghszw5.com/

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-origin: https://ghszw5.com
content-length: 0
date: Tue, 15 Oct 2024 09:04:21 GMT
vary: Origin, Origin
server: NgxFence

GET eyJtIjoiS244aTBucUYzQlFBQUFHU2oydTFPMGNuLU9wNkRnak83RWZmWGpKTEhhQ3RjWmxXcDhYSXhZRlRncWd3djA5VGlGR09pVEhaSDJjNW82M2M0TUpsU2htSkJQYjNQNTExQmstNUdPeXB1Q0hGX2Izcm9HOE9PUDBORWo4RU1NUSJ9
gfxcqpddqyfb.hrblsdgjg.com/page/sp8cqc/install/c/ 0
0

POST
H2 200 eyJtIjoiTnNOQTdPWWpfNWdBQUFHU2oydTFPMTBxcE5fLXZoSU1KWm4wb25DajNLeVRUQWJtUDlhNUtHVG1HZlN0UTRWM3lMWk9POGlMcVpDSjd2WjJEb0w0Tm1UNFhQQTJSVE90MzZxT0hfMEVnTTdRVXBKaGROMGZ6X3FRb1VUQ1FuRSJ9
gfxcqpddqyfb.hrblsdgjg.com/web/sp8cqc/_/clicked/c/ 0
279 B 213ms
183ms Ping
text/plain 170.33.13.110
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: czokcc.com
URL: https://czokcc.com/appinstall.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

170.33.13.110 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba Cloud Singapore Private Limited, SG),

Reverse DNS

Software

NgxFence /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://ghszw5.com/

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-origin: https://ghszw5.com
content-length: 0
date: Tue, 15 Oct 2024 09:04:21 GMT
vary: Origin, Origin
server: NgxFence

GET

j169a.apk
zlff.xclvwag.com/default/ja/
Redirect Chain

https://gfxcqpddqyfb.hrblsdgjg.com:6443/page/sp8cqc/install/c/eyJtIjoiS244aTBucUYzQlFBQUFHU2oydTFPMGNuLU9wNkRnak83RWZmWGpKTEhhQ3RjWmxXcDhYSXhZRlRncWd3djA5VGlGR09pVEhaSDJjNW82M2M0TUpsU2htSkJQYjNQNTE...
https://zlff.xclvwag.com:7107/default/ja/j169a.apk

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: gfxcqpddqyfb.hrblsdgjg.com
URL: https://gfxcqpddqyfb.hrblsdgjg.com:6443/page/sp8cqc/install/c/eyJtIjoiS244aTBucUYzQlFBQUFHU2oydTFPMGNuLU9wNkRnak83RWZmWGpKTEhhQ3RjWmxXcDhYSXhZRlRncWd3djA5VGlGR09pVEhaSDJjNW82M2M0TUpsU2htSkJQYjNQNTExQmstNUdPeXB1Q0hGX2Izcm9HOE9PUDBORWo4RU1NUSJ9?p=0

Domain: zlff.xclvwag.com
URL: https://zlff.xclvwag.com:7107/default/ja/j169a.apk

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| AppInstall object| data object| button object| button2

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ghszw5.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

czokcc.com
gfxcqpddqyfb.hrblsdgjg.com
ghszw5.com
japicture.oss-cn-beijing.aliyuncs.com
zlff.xclvwag.com
gfxcqpddqyfb.hrblsdgjg.com
zlff.xclvwag.com
154.85.69.101
170.33.13.110
206.238.42.126
59.110.190.52
07748b8da2a18294b86e274f61275d0335d9346a1cf7ed738573aea53108af12
3e285aa23446972ce5273757d3fe19c65490455d71693f86d83295cfd132b7fd
7c9895f2e57140b2a429c2b5df1eb51b2c0bf49f56365e198fb20a92fe79c1dd
a3c802a61d75de994f54f3fe3ae4a2dc157c95011e7534e3daabaa5cc9a9d34d
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d92dbe9d26b43528134a4bee996797f27a51579f9a2e403bdb0dedaa66666782

ghszw5.com Open in urlscan Pro 206.238.42.126 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

80 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

733 kBTransfer

761 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

ghszw5.com Open in urlscan Pro
206.238.42.126 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

80 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

733 kB
Transfer

761 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions