1111-bud.pages.dev Open in urlscan Pro
188.114.96.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://1111-bud.pages.dev/
Effective URL:
https://1111-bud.pages.dev/
Submission Tags: threatview.io malwar3ninja rule: suspected phishing scam automated-submission Search All
Submission: On November 16 via api (November 16th 2024, 2:12:47 am UTC) from DE — Scanned from NL

Summary HTTP 11 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 188.114.96.9, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is 1111-bud.pages.dev.
TLS certificate: Issued by WE1 on October 29th 2024. Valid for: 3 months.

This is the only time 1111-bud.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	188.114.96.9 188.114.96.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2404:2280:1cc... 2404:2280:1cc:0:3::a	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
3	2404:2280:1cc... 2404:2280:1cc:0:3::b	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
11	3

7 188.114.96.9 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

1111-bud.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:2280:1cc:0:3::a (Singapore)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

static.ws.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:2280:1cc:0:3::b (Singapore)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

cms-bucket.ws.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pages.dev 1 redirects 1111-bud.pages.dev	25 KB
5	126.net static.ws.126.net — Cisco Umbrella Rank: 112771 cms-bucket.ws.126.net — Cisco Umbrella Rank: 184603	152 KB
11	2

	Domain	Requested by
7	1111-bud.pages.dev	1 redirects 1111-bud.pages.dev
3	cms-bucket.ws.126.net	1111-bud.pages.dev
2	static.ws.126.net	1111-bud.pages.dev
11	3

This site contains links to these domains. Also see Links.

Domain
www.163.com
corp.163.com
ir.netease.com
game.163.com
www.youdao.com
music.163.com
you.163.com
beian.miit.gov.cn
help.163.com
jubao.163.com

Subject Issuer	Validity	Valid
1111-bud.pages.dev WE1	`2024-10-29` - `2025-01-27`	3 months	crt.sh
*.ws.126.net TrustAsia RSA OV TLS CA G2	`2023-11-15` - `2024-12-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://1111-bud.pages.dev/
Frame ID: 1D3D68266B1524DE6C6572E6C643AEB1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

网易

Page URL History Show full URLs

http://1111-bud.pages.dev/ HTTP 307
https://1111-bud.pages.dev/ Page URL
https://1111-bud.pages.dev/cdn-cgi/phish-bypass?atok=oLiUC4uYXCkSWTovDZU5Qo_rMzjslI2B1SPwNhmr8xk-173172... HTTP 301
https://1111-bud.pages.dev/ Page URL

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

177 kB
Transfer

243 kB
Size

2
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: http://www.163.com/
Title: 网易

Search URL Search Domain Scan URL

URL: https://corp.163.com/gb/about/overview.html
Title: 公司简介

Search URL Search Domain Scan URL

URL: https://corp.163.com/gb/about/management.html
Title: 管理团队及董事会

Search URL Search Domain Scan URL

URL: https://ir.netease.com/zh-hans/company-overview/management-team
Title: 管理团队

Search URL Search Domain Scan URL

URL: https://ir.netease.com/zh-hans/company-overview/board-of-directors
Title: 董事会

Search URL Search Domain Scan URL

URL: http://corp.163.com/special/008397SO/neteasenews.html
Title: 公司新闻

Search URL Search Domain Scan URL

URL: https://ir.netease.com/
Title: 投资者关系

Search URL Search Domain Scan URL

URL: https://corp.163.com/gb/contactus.html
Title: 联系我们

Search URL Search Domain Scan URL

URL: http://game.163.com/
Title: 网易游戏官网

Search URL Search Domain Scan URL

URL: https://www.youdao.com/
Title: 有道

Search URL Search Domain Scan URL

URL: https://music.163.com/
Title: 网易云音乐

Search URL Search Domain Scan URL

URL: https://you.163.com/
Title: 严选

Search URL Search Domain Scan URL

URL: https://www.163.com/
Title: 网易新闻

Search URL Search Domain Scan URL

URL: https://www.163.com/necc/#/
Title: 网易文创

Search URL Search Domain Scan URL

URL: http://beian.miit.gov.cn/
Title: 工业和信息化部备案管理系统网站粤B2-20090191-2

Search URL Search Domain Scan URL

URL: https://corp.163.com/
Title: About NetEase

Search URL Search Domain Scan URL

URL: https://corp.163.com/gb/job/job.html
Title: 招聘信息

Search URL Search Domain Scan URL

URL: https://help.163.com/
Title: 客户服务

Search URL Search Domain Scan URL

URL: https://corp.163.com/gb/legal.html
Title: 隐私政策

Search URL Search Domain Scan URL

URL: https://www.163.com/special/0077jt/tipoff.html
Title: 不良信息举报 Complaint Center

Search URL Search Domain Scan URL

URL: https://jubao.163.com/
Title: 廉正举报

Search URL Search Domain Scan URL

URL: https://corp.163.com/special/008397U0/reporting_infringements.html
Title: 侵权投诉

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://1111-bud.pages.dev/ HTTP 307
https://1111-bud.pages.dev/ Page URL
https://1111-bud.pages.dev/cdn-cgi/phish-bypass?atok=oLiUC4uYXCkSWTovDZU5Qo_rMzjslI2B1SPwNhmr8xk-1731723156-0.0.1.1-%2F HTTP 301
https://1111-bud.pages.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://1111-bud.pages.dev/ HTTP 307
https://1111-bud.pages.dev/

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

403

/ Show response
1111-bud.pages.dev/
Redirect Chain

http://1111-bud.pages.dev/
https://1111-bud.pages.dev/

4 KB
2 KB

71ms
18ms

Document
text/html

188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1111-bud.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49c9d4d88e511c380e7f106844755cb04ec9683f5dba010b3837414262b65270

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8e33f50138476720-AMS
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 16 Nov 2024 02:12:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bw4MyOb0cVpEZa%2BbTneFqICklCBJsUbMPVooLXF8EEGT9WhfXNjbrWXX5fVUkxEl%2B%2B%2FluLLTnimMli1KUGiVGFkgxZjPgJ3QTLv3AnSFX8ye37ubip8QQ1cBCTA0871%2BRaSagUk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://1111-bud.pages.dev/
Non-Authoritative-Reason: HSTS

GET
H3 200 cf.errors.css
1111-bud.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 26ms
25ms Stylesheet
text/css 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1111-bud.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"673379a7-5df3"
x-content-type-options: nosniff
cf-ray: 8e33f50198d36720-AMS
expires: Sat, 16 Nov 2024 04:12:36 GMT
date: Sat, 16 Nov 2024 02:12:36 GMT
content-type: text/css
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
1111-bud.pages.dev/cdn-cgi/images/ 452 B
635 B 18ms
17ms Image
image/png 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1111-bud.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "673379a7-1c4"
x-content-type-options: nosniff
cf-ray: 8e33f501c8eb6720-AMS
expires: Sat, 16 Nov 2024 04:12:36 GMT
accept-ranges: bytes
content-length: 452
date: Sat, 16 Nov 2024 02:12:36 GMT
content-type: image/png
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 favicon.ico
1111-bud.pages.dev/ 10 KB
3 KB 1301ms
1301ms Other
image/x-icon 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1111-bud.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

533d15f5335a6fe7760f39cc65727023b80fa25c022605a0b904094f4a708122

Security Headers

Name

Value

Content-Security-Policy

default-src * 'unsafe-inline' data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.lietou-static.com *.liepin.com *.alipay.com *.pstatp.com *.liepin.cn *.aliyuncs.com *.baidu.com *.tencent-cloud.com *.qcloud.com *.qq.com *.bdstatic.com *.s2.udesk.cn unpkg.com lyra-wv-rpc://resource lyra-wv-rpc://rpc https://appx https://appx-t2 *.bytegoofy.com js.cdn.aliyun.dcloud.net.cn *.amap.com captcha.gtimg.com captcha.myqcloud.com *.qcloud.com *.gtimg.com cdn.jsdelivr.net www.googletagmanager.com https://g.alicdn.com https://wkbrs1.tingyun.com https://ssl-cdn.static.browser.mi-img.com data: blob:; child-src * data: blob: ; img-src * android-webview-video-poster: data: blob:; font-src * data: blob: moz-extension:; frame-src * bytedance://dispatch_message data: blob: wvjbscheme:; worker-src * data: blob: ; media-src * data: blob: ; report-uri https://log.liepin.com/lpsoc/lpsoc-save-csp.json

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

content-encoding: gzip
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rpo1EDaiMDECbFhzba7PdkVSHY0iPELxtX1FgSYJQ%2Fk2zYs%2B2L%2F%2BBbSEJx4XS6H5NWmFw9WfcCXfbBGktaKvcmXkP5foqobNYtGl%2Bd6uDrFpO3hlFucszOicJ3vrm9lLJFvUPak%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=17426&sent=23&recv=17&lost=0&retrans=0&sent_bytes=11992&recv_bytes=5717&delivery_rate=49170&cwnd=12000&unsent_bytes=0&cid=8cc301b88f89ee12&ts=1442&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 16 Nov 2024 02:12:38 GMT
content-type: image/x-icon
last-modified: Thu, 14 Nov 2024 10:47:20 GMT
vary: accept-encoding
priority: u=1,i
content-security-policy: default-src * 'unsafe-inline' data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.lietou-static.com *.liepin.com *.alipay.com *.pstatp.com *.liepin.cn *.aliyuncs.com *.baidu.com *.tencent-cloud.com *.qcloud.com *.qq.com *.bdstatic.com *.s2.udesk.cn unpkg.com lyra-wv-rpc://resource lyra-wv-rpc://rpc https://appx https://appx-t2 *.bytegoofy.com js.cdn.aliyun.dcloud.net.cn *.amap.com captcha.gtimg.com captcha.myqcloud.com *.qcloud.com *.gtimg.com cdn.jsdelivr.net www.googletagmanager.com https://g.alicdn.com https://wkbrs1.tingyun.com https://ssl-cdn.static.browser.mi-img.com data: blob:; child-src * data: blob: ; img-src * android-webview-video-poster: data: blob:; font-src * data: blob: moz-extension:; frame-src * bytedance://dispatch_message data: blob: wvjbscheme:; worker-src * data: blob: ; media-src * data: blob: ; report-uri https://log.liepin.com/lpsoc/lpsoc-save-csp.json
cache-control: no-cache
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8e33f50209436720-AMS
server: cloudflare

GET
H3

200

Primary Request / Show response
1111-bud.pages.dev/
Redirect Chain

https://1111-bud.pages.dev/cdn-cgi/phish-bypass?atok=oLiUC4uYXCkSWTovDZU5Qo_rMzjslI2B1SPwNhmr8xk-1731723156-0.0.1.1-%2F
https://1111-bud.pages.dev/

22 KB
8 KB

870ms
869ms

Document
text/html

188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1111-bud.pages.dev/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29aaeaf1bbe5beedbfbd5694abeb1915d41aed1f9111e1d84dd35582f28e2e4c

Request headers

Referer: https://1111-bud.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=240
cf-cache-status: DYNAMIC
cf-ray: 8e33f51ab9fd6720-AMS
content-encoding: br
content-type: text/html; charset=GBK
date: Sat, 16 Nov 2024 02:12:41 GMT
expires: Sat, 16 Nov 2024 02:16:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p: CP=CAO PSA OUR
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQC3wtG7H6qtI8UDskmgGLNz7zweepxfg%2FDNgMGSWJKskvQM8hs9K6PluRbnMrsERLbz4iJXp68cWmCGtGc3ZyaxM8XUj9lFZoxckxLr%2FJdIazSdFq%2FqCzbZdP2limFqBhMUquM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=17159&sent=31&recv=23&lost=0&retrans=0&sent_bytes=15153&recv_bytes=6930&delivery_rate=711&cwnd=12000&unsent_bytes=0&cid=8cc301b88f89ee12&ts=4965&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8e33f51a99ed6720-AMS
content-length: 167
content-type: text/html
date: Sat, 16 Nov 2024 02:12:40 GMT
location: https://1111-bud.pages.dev/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 commonnav_headcss-e017654fb2.css
static.ws.126.net/163/f2e/commonnav2019/css/ 35 KB
7 KB 1285ms
21ms Stylesheet
text/css 2404:2280:1cc:0:3::a
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ws.126.net/163/f2e/commonnav2019/css/commonnav_headcss-e017654fb2.css
Requested by: Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2404:2280:1cc:0:3::a , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 2543f3416e1a0ae0bde58b2358a5e1b4867dfd46496dc7fa1528baccbb11daf2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

x-nos-storage-class: STANDARD
content-encoding: gzip
x-cache-remote: HIT
age: 867319
x-nos-object-name: 163%2Ff2e%2Fcommonnav2019%2Fcss%2Fcommonnav_headcss-e017654fb2.css
x-nos-request-id: 0d23c96a-3789-4d22-b68b-c154e99a36be
access-control-allow-methods: GET,POST
cdn-user-ip: 2001:1af8:5000:a026:5::3
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
date: Wed, 06 Nov 2024 01:17:23 GMT
content-type: text/css
x-nos-requesttype: GetObject
vary: Accept-Encoding
content-disposition: inline; filename="163%2Ff2e%2Fcommonnav2019%2Fcss%2Fcommonnav_headcss-e017654fb2.css"
last-modified: Tue, 13 Jul 2021 07:16:33 GMT
cache-control: max-age=5184000
x-swift-cachetime: 4773649
timing-allow-origin: *
access-control-allow-credentials: false
via: cache8.l2nu20-8[0,1,200-0,H], cache36.l2nu20-8[2,0], cache11.l2hk3[34,34,200-0,M], cache17.l2hk3[35,0], ens-cache16.l2de3[0,2,200-0,H], ens-cache7.l2de3[5,0], ens-cache10.de5[0,0,200-0,H], ens-cache8.de5[2,0]
ali-swift-global-savetime: 1730855843
x-swift-savetime: Sun, 10 Nov 2024 19:16:34 GMT
access-control-allow-origin: *
eagleid: a3b55c9c17317231629003081e
content-length: 6839
cdn-source: ali
server: Tengine
cdn-ip: 2404:2280:1cc:0:3::a

GET
H2 200 3727da50j00seje7a001gc000qe00alc.jpg
cms-bucket.ws.126.net/2024/0604/ 52 KB
53 KB 1276ms
27ms Image
image/jpeg 2404:2280:1cc:0:3::b
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-bucket.ws.126.net/2024/0604/3727da50j00seje7a001gc000qe00alc.jpg
Requested by: Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2404:2280:1cc:0:3::b , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 2bb580e222eef16d8051769dcd4e862476d2c2cef27b1d365d656ca784bc17de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

x-nos-storage-class: STANDARD_IA
etag: 3727da5041e958446a02061d4e77cbe4
age: 4502385
x-nos-object-name: 2024%2F0604%2F3727da50j00seje7a001gc000qe00alc.jpg
x-cache-remote: HIT
x-nos-request-id: d02c3505-8025-4647-98ce-97c2ca4ee664
cdn-user-ip: 2001:1af8:5000:a026:5::3
x-cache: HIT TCP_HIT dirn:12:516674830
date: Tue, 24 Sep 2024 23:32:57 GMT
content-type: image/jpeg;charset=UTF-8
x-nos-requesttype: GetObject
content-disposition: inline; filename="2024%2F0604%2F3727da50j00seje7a001gc000qe00alc.jpg"
last-modified: Tue, 04 Jun 2024 11:40:22 Asia/Shanghai
x-swift-cachetime: 26963972
timing-allow-origin: *
via: cache62.l2nu20-8[72,71,200-0,M], cache51.l2nu20-8[73,0], cache2.l2hk3[106,106,200-0,M], cache14.l2hk3[107,0], ens-cache12.l2de3[0,0,200-0,H], ens-cache4.l2de3[1,0], ens-cache10.de5[0,0,200-0,H], ens-cache6.de5[4,0]
ali-swift-global-savetime: 1727220777
x-swift-savetime: Mon, 11 Nov 2024 21:33:25 GMT
x-content-from: netease
eagleid: a3b55c9a17317231628991213e
content-length: 53548
cdn-source: ali
server: Tengine
x-nos-meta-docid: 0083_jelly_liu_
cdn-ip: 2404:2280:1cc:0:3::b

GET
H2 200 nav_bg2.png
static.ws.126.net/img09/netease/ 947 B
1 KB 22ms
20ms Image
image/png 2404:2280:1cc:0:3::a
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ws.126.net/img09/netease/nav_bg2.png
Requested by: Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2404:2280:1cc:0:3::a , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 42f9e283995cd504c8f3db073ee46a32808213a05ec7e5e6590cd5376b409762

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

x-cache-remote: HIT
age: 3937057
access-control-allow-methods: GET
expires: Wed, 02 Oct 2024 12:35:05 GMT
cdn-user-ip: 2001:1af8:5000:a026:5::3
x-cache: HIT TCP_HIT dirn:12:712420066
date: Tue, 01 Oct 2024 12:35:05 GMT
content-type: image/png
last-modified: Wed, 28 Mar 2018 06:11:31 GMT
cache-control: max-age=86400, max-age=5184000, max-age=5184000
x-swift-cachetime: 2870428
timing-allow-origin: *
access-control-allow-credentials: false
via: cache68.l2nu20-8[0,6,200-0,H], cache15.l2nu20-8[8,0], cache28.l2hk3[0,15,200-0,H], cache14.l2hk3[16,0], ens-cache5.l2de3[0,0,200-0,H], ens-cache17.l2de3[1,0], ens-cache13.de5[0,0,200-0,H], ens-cache8.de5[2,0]
ali-swift-global-savetime: 1727786105
x-content-from: netease
x-swift-savetime: Mon, 28 Oct 2024 07:14:37 GMT
accept-ranges: bytes
access-control-allow-origin: *
eagleid: a3b55c9c17317231629283164e
content-length: 947
cdn-source: ali
server: Tengine
cdn-ip: 2404:2280:1cc:0:3::a

GET
H2 200 cf143f1465dc403c86cb7dc5e86a2c90.png
cms-bucket.ws.126.net/2019/12/19/ 64 KB
64 KB 47ms
46ms Image
image/png 2404:2280:1cc:0:3::b
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-bucket.ws.126.net/2019/12/19/cf143f1465dc403c86cb7dc5e86a2c90.png
Requested by: Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2404:2280:1cc:0:3::b , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: c190aa32accf6209bff7b3408387a01d0902a12d5935a7ecc1521321e877d85c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

x-nos-storage-class: STANDARD_IA
etag: ffed19f0dca39f163506965c1fb2bad5
age: 1341084
x-nos-object-name: 2019%2F12%2F19%2Fcf143f1465dc403c86cb7dc5e86a2c90.png
x-cache-remote: HIT
x-nos-request-id: d513dd23-df1d-40b5-984f-a65361a3c6d7
cdn-user-ip: 2001:1af8:5000:a026:5::3
x-cache: HIT TCP_HIT dirn:11:684873208
date: Thu, 31 Oct 2024 13:41:18 GMT
content-type: image/png;charset=UTF-8
content-disposition: inline; filename="2019%2F12%2F19%2Fcf143f1465dc403c86cb7dc5e86a2c90.png"
x-nos-requesttype: GetObject
last-modified: Thu, 19 Dec 2019 18:27:03 Asia/Shanghai
x-swift-cachetime: 30759380
timing-allow-origin: *
via: cache52.l2nu20-8[89,89,200-0,M], cache9.l2nu20-8[91,0], cache32.l2hk3[0,0,200-0,H], cache29.l2hk3[1,0], ens-cache12.l2de3[0,0,200-0,H], ens-cache11.l2de3[2,0], ens-cache13.de5[0,0,200-0,H], ens-cache6.de5[3,0]
ali-swift-global-savetime: 1730382078
x-swift-savetime: Mon, 04 Nov 2024 13:24:58 GMT
x-content-from: netease
eagleid: a3b55c9a17317231629271317e
content-length: 65316
cdn-source: ali
server: Tengine
cdn-ip: 2404:2280:1cc:0:3::b

GET
H2 200 ebb71f81p00s54y7u000pc000dw00dwc.png
cms-bucket.ws.126.net/2023/1204/ 25 KB
26 KB 81ms
80ms Image
image/png 2404:2280:1cc:0:3::b
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-bucket.ws.126.net/2023/1204/ebb71f81p00s54y7u000pc000dw00dwc.png
Requested by: Host: 1111-bud.pages.dev
URL: https://1111-bud.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2404:2280:1cc:0:3::b , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 0098dfe20d4e755417588797f329a08430912f4ec0ac0f81036919f0229666f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

x-nos-storage-class: STANDARD
etag: ebb71f81649bf227bd3aa1e2bbc946b9
age: 30040255
x-nos-object-name: 2023%2F1204%2Febb71f81p00s54y7u000pc000dw00dwc.png
x-cache-remote: HIT
x-nos-request-id: 785ce9f0-799f-4a89-ad40-19d56d1fa681
cdn-user-ip: 2001:1af8:5000:a026:5::3
x-cache: HIT TCP_HIT dirn:11:646019141
date: Mon, 04 Dec 2023 09:41:47 GMT
content-type: image/png;charset=UTF-8
x-nos-requesttype: GetObject
content-disposition: inline; filename="2023%2F1204%2Febb71f81p00s54y7u000pc000dw00dwc.png"
last-modified: Mon, 04 Dec 2023 17:26:18 Asia/Shanghai
x-swift-cachetime: 1557357
timing-allow-origin: *
via: cache17.l2nu20-8[0,0,200-0,H], cache69.l2nu20-8[1,0], cache35.l2hk2[0,0,200-0,H], cache30.l2hk2[1,0], ens-cache7.l2de3[0,0,200-0,H], ens-cache1.l2de3[1,0], ens-cache7.de5[0,0,200-0,H], ens-cache6.de5[3,0]
ali-swift-global-savetime: 1701682907
x-swift-savetime: Sun, 10 Nov 2024 09:05:50 GMT
x-content-from: netease
eagleid: a3b55c9a17317231629271322e
content-length: 25809
cdn-source: ali
server: Tengine
x-nos-meta-docid: 0083_jelly_liu_
cdn-ip: 2404:2280:1cc:0:3::b

GET
H3 521 favicon.ico
1111-bud.pages.dev/ 7 KB
7 KB 285ms
284ms Other
text/html 188.114.96.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1111-bud.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dffd13a71539d9842ce869256333ea413c0d049de59bd8cea7091a43f21a4c4f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://1111-bud.pages.dev/

Response headers

cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2FC06mUrAMjZMOFnLVFqXUEE8cfqnHkQunlNDoZMoVTUKLbKfeVYEDlG3XgGqdNAI4FBuz7keJ23JjsOOAxnyCo69RbhLVs5TM4n%2Fsuk73Fj%2BgwVERXswVnpt1Dr3q5%2FcuV47ek%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: same-origin
cf-ray: 8e33f528eb5e6720-AMS
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=17016&sent=43&recv=30&lost=0&retrans=0&sent_bytes=23517&recv_bytes=7675&delivery_rate=154563&cwnd=12000&unsent_bytes=0&cid=8cc301b88f89ee12&ts=6641&x=1", cfExtPri, cfHdrFlush;dur=0
date: Sat, 16 Nov 2024 02:12:43 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=1,i
x-frame-options: SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| hostname

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			1111-bud.pages.dev/	1970-01-21 01:02:04	Name: acw_tc Value: 1a0c660217317231579901157e00fca461d7f79b5b56ba8fe446c2b7d28e3b
			.1111-bud.pages.dev/	1970-01-21 01:03:29	Name: __cf_mw_byp Value: oLiUC4uYXCkSWTovDZU5Qo_rMzjslI2B1SPwNhmr8xk-1731723156-0.0.1.1-/

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://1111-bud.pages.dev/ Message: Failed to load resource: the server responded with a status of 403 ()
security	warning	URL: https://1111-bud.pages.dev/(Line 489) Message: Mixed Content: The page at 'https://1111-bud.pages.dev/' was loaded over HTTPS, but requested an insecure element 'http://static.ws.126.net/img09/netease/nav_bg2.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://1111-bud.pages.dev/(Line 489) Message: Mixed Content: The page at 'https://1111-bud.pages.dev/' was loaded over HTTPS, but requested an insecure element 'http://cms-bucket.ws.126.net/2019/12/19/cf143f1465dc403c86cb7dc5e86a2c90.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://1111-bud.pages.dev/(Line 489) Message: Mixed Content: The page at 'https://1111-bud.pages.dev/' was loaded over HTTPS, but requested an insecure element 'http://cms-bucket.ws.126.net/2023/1204/ebb71f81p00s54y7u000pc000dw00dwc.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://1111-bud.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 521 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1111-bud.pages.dev
cms-bucket.ws.126.net
static.ws.126.net
188.114.96.9
2404:2280:1cc:0:3::a
2404:2280:1cc:0:3::b
0098dfe20d4e755417588797f329a08430912f4ec0ac0f81036919f0229666f7
2543f3416e1a0ae0bde58b2358a5e1b4867dfd46496dc7fa1528baccbb11daf2
29aaeaf1bbe5beedbfbd5694abeb1915d41aed1f9111e1d84dd35582f28e2e4c
2bb580e222eef16d8051769dcd4e862476d2c2cef27b1d365d656ca784bc17de
42f9e283995cd504c8f3db073ee46a32808213a05ec7e5e6590cd5376b409762
49c9d4d88e511c380e7f106844755cb04ec9683f5dba010b3837414262b65270
533d15f5335a6fe7760f39cc65727023b80fa25c022605a0b904094f4a708122
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
c190aa32accf6209bff7b3408387a01d0902a12d5935a7ecc1521321e877d85c
dffd13a71539d9842ce869256333ea413c0d049de59bd8cea7091a43f21a4c4f
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

1111-bud.pages.dev Open in urlscan Pro 188.114.96.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

177 kBTransfer

243 kBSize

2 Cookies

22 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

2 Cookies

5 Console Messages

Security Headers

Indicators

1111-bud.pages.dev Open in urlscan Pro
188.114.96.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

177 kB
Transfer

243 kB
Size

2
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!