ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz

Summary

This website contacted 4 IPs in 4 countries across 6 domains to perform 6 HTTP transactions. The main IP is 47.245.107.193, located in Singapore and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz.

This is the only time ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	20.205.141.95 20.205.141.95	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 3	47.245.107.193 47.245.107.193	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	157.185.160.33 157.185.160.33	54994 (ML-1432-5...) (ML-1432-54994)
2	183.240.98.228 183.240.98.228	56040 (CMNET-GUA...) (CMNET-GUANGDONG-AP China Mobile communications corporation)
6	4

1 20.205.141.95 (Hong Kong, Hong Kong) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

9tig.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 47.245.107.193 (Singapore) 1 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

3242f.ngrye.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.185.160.33 (Ashburn, United States)

ASN54994 (ML-1432-54994, CA)

analytics-zh002.handjob.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 183.240.98.228 (China)

ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 10209	12 KB
2	zdgyj.xyz ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz	2 KB
1	handjob.tw analytics-zh002.handjob.tw	241 B
1	ngrye.xyz 1 redirects 3242f.ngrye.xyz	353 B
1	9tig.app 1 redirects 9tig.app	91 B
0	uyrbf.xyz Failed ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz Failed
6	6

	Domain	Requested by
2	hm.baidu.com	ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
2	ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
1	analytics-zh002.handjob.tw	ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
1	3242f.ngrye.xyz	1 redirects
1	9tig.app	1 redirects
0	ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz Failed
6	6

This site contains links to these domains. Also see Links.

Domain
ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz

Subject Issuer	Validity	Valid
analytics-zh002.handjob.tw R11	`2024-09-04` - `2024-12-03`	3 months	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2024-07-08` - `2025-08-09`	a year	crt.sh

This page contains 1 frames:

Frame: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync
Frame ID: 9FCDAADF5967BE8BD841D08911914D95
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://9tig.app/ HTTP 307
http://3242f.ngrye.xyz:8099/LyelE HTTP 307
https://3242f.ngrye.xyz:8099/LyelE HTTP 307
http://3242f.ngrye.xyz:8099/LyelE HTTP 302
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync HTTP 307
https://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync HTTP 307
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync Page URL

Detected technologies

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

4
IPs

4
Countries

14 kB
Transfer

55 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync
Title: 33%

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://9tig.app/ HTTP 307
http://3242f.ngrye.xyz:8099/LyelE HTTP 307
https://3242f.ngrye.xyz:8099/LyelE HTTP 307
http://3242f.ngrye.xyz:8099/LyelE HTTP 302
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync HTTP 307
https://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync HTTP 307
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync HTTP 307
https://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync HTTP 307
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request RedirectAsync Show response
ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz/
Redirect Chain

https://9tig.app/
http://3242f.ngrye.xyz:8099/LyelE
https://3242f.ngrye.xyz:8099/LyelE
http://3242f.ngrye.xyz:8099/LyelE
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync
https://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync

4 KB
2 KB

609ms
337ms

Document
text/html

47.245.107.193
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync
Protocol: HTTP/1.1
Server: 47.245.107.193 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx/1.20.1 / ASP.NET
Resource Hash: cfa1818293ac8336a4b5d0e7a1933891bee16a2c52f6bb105a4afb1a4df150cf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: private
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1764
Content-Type: text/html; charset=utf-8
Date: Thu, 19 Sep 2024 13:42:11 GMT
Server: nginx/1.20.1
Vary: Accept-Encoding
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

Redirect headers

Location: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 index-zh.php Show response
analytics-zh002.handjob.tw/ 0
241 B 570ms
42ms Script
application/octet-stream 157.185.160.33
ML-1432-54994

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics-zh002.handjob.tw/index-zh.php?a=v
Requested by: Host: ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 157.185.160.33 Ashburn, United States, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/

Response headers

x-px: ht PS-IAD-0455N220IAD
x-ws-request-id: 66ec2a34_PS-IAD-04SSt219_31297-17341
age: 2149770
via: 1.1 PS-SIN-04c8L165:1 (W), 1.1 PSmglsjLAX2ay162:5 (W), 1.1 PS-IAD-0455N220:0 (W)
access-control-allow-origin: *
content-length: 0
date: Thu, 19 Sep 2024 13:42:12 GMT
content-type: application/octet-stream
server: PWS/8.3.1.0.8

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 1624ms
389ms Script
application/javascript 183.240.98.228
CMNET-GUANGDONG-A...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?f1594ab993496d6cc8ea91e79e373a0e

Requested by

Host: ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

183.240.98.228 , China, ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN),

Reverse DNS

Software

apache /

Resource Hash

39f3c0d459a3d65b4903027032a27e8087de84b6dd37bca4e01512acafcb451e

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/

Response headers

Strict-Transport-Security: max-age=172800
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Etag: 5b3e28eb6d275f9f44507362674066ae
Content-Length: 11338
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 19 Sep 2024 13:42:14 GMT
Content-Type: application/javascript
Server: apache

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 399ms
398ms Image
image/gif 183.240.98.228
CMNET-GUANGDONG-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?hca=49C2B57A85F6AB0C&cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-ca&lo=0&rnd=497104453&si=f1594ab993496d6cc8ea91e79e373a0e&v=1.3.2&lv=1&sn=37155&r=0&ww=1600&u=http%3A%2F%2Fltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz%3A8099%2FRedirectAsync

Requested by

Host: ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

183.240.98.228 , China, ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/

Response headers

Strict-Transport-Security: max-age=172800
Cache-Control: private, max-age=0, no-cache
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Length: 43
Date: Thu, 19 Sep 2024 13:42:14 GMT
Content-Type: image/gif
Server: apache

GET
H/1.1 200
OK favicon.ico
ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz/ 22 KB
0 1097ms
1078ms Other
image/x-icon 47.245.107.193
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/favicon.ico
Protocol: HTTP/1.1
Server: 47.245.107.193 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx/1.20.1 / ASP.NET
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz:8099/RedirectAsync

Response headers

ETag: "abab7ed69613d61:0"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32038
Date: Thu, 19 Sep 2024 13:42:16 GMT
Content-Type: image/x-icon
Last-Modified: Thu, 16 Apr 2020 02:29:21 GMT
Server: nginx/1.20.1
X-Powered-By: ASP.NET

GET

GoToLinkAsync
ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz/
Redirect Chain

http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync
https://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync
http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz
URL: http://ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz:8099/GoToLinkAsync

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.hm.baidu.com/	1970-01-21 09:15:13	Name: HMACCOUNT_BFESS Value: 49C2B57A85F6AB0C
.ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz/	1970-01-21 08:24:49	Name: Hm_lvt_f1594ab993496d6cc8ea91e79e373a0e Value: 1726753335
.ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz/	1969-12-31 23:59:59	Name: Hm_lpvt_f1594ab993496d6cc8ea91e79e373a0e Value: 1726753335
.ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz/	1969-12-31 23:59:59	Name: HMACCOUNT Value: 49C2B57A85F6AB0C

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3242f.ngrye.xyz
9tig.app
analytics-zh002.handjob.tw
hm.baidu.com
ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz
ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz
ltf1.02ad5babc16d315bb1f39b10c64bb083.uyrbf.xyz
157.185.160.33
183.240.98.228
20.205.141.95
47.245.107.193
39f3c0d459a3d65b4903027032a27e8087de84b6dd37bca4e01512acafcb451e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfa1818293ac8336a4b5d0e7a1933891bee16a2c52f6bb105a4afb1a4df150cf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz Open in urlscan Pro 47.245.107.193 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

4 IPs

4 Countries

14 kBTransfer

55 kBSize

4 Cookies

1 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

4 Cookies

Indicators

ltf1.02ad5babc16d315bb1f39b10c64bb083.zdgyj.xyz Open in urlscan Pro
47.245.107.193 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

4
IPs

4
Countries

14 kB
Transfer

55 kB
Size

4
Cookies

6 HTTP transactions
0 data transactions