4022-com.a77c6a.men Open in urlscan Pro
23.102.236.134 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://a4022-com.abc4022dh26.men/
Effective URL:
https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif
Submission: On September 25 via automatic, source certstream-suspicious (September 25th 2024, 4:39:05 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 23.102.236.134, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is 4022-com.a77c6a.men.
TLS certificate: Issued by R10 on September 10th 2024. Valid for: 3 months.

This is the only time 4022-com.a77c6a.men was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	23.186.216.125 23.186.216.125	61368 (DAFEIYUN_AS) (DAFEIYUN_AS)
2	122.225.212.209 122.225.212.209	58461 (CT-HANGZH...) (CT-HANGZHOU-IDC No.288)
1	240e:97b:500:... 240e:97b:500:2000::6	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
2	23.102.236.134 23.102.236.134	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
11	5

3 23.186.216.125 (None, )

ASN61368 (DAFEIYUN_AS, GB)
PTR: ddos.dafeiyun.com

a4022-com.abc4022dh26.men	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 122.225.212.209 (China)

ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN)

s9.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240e:97b:500:2000::6 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

z12.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.102.236.134 (Hong Kong, Hong Kong)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

4022-com.a77c6a.men	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cnzz.com s9.cnzz.com — Cisco Umbrella Rank: 79521 z12.cnzz.com — Cisco Umbrella Rank: 96746 c.cnzz.com — Cisco Umbrella Rank: 59215	5 KB
3	abc4022dh26.men a4022-com.abc4022dh26.men	8 KB
2	a77c6a.men 4022-com.a77c6a.men Failed	1 KB
0	s8a9z9c82.men Failed 4022-com.s8a9z9c82.men Failed
0	qwercd96.men Failed 4022-com.qwercd96.men Failed
11	5

	Domain	Requested by
3	a4022-com.abc4022dh26.men	a4022-com.abc4022dh26.men
2	4022-com.a77c6a.men	a4022-com.abc4022dh26.men
1	c.cnzz.com	s9.cnzz.com
1	z12.cnzz.com	s9.cnzz.com
1	s9.cnzz.com	a4022-com.abc4022dh26.men
0	4022-com.s8a9z9c82.men Failed	a4022-com.abc4022dh26.men
0	4022-com.qwercd96.men Failed	a4022-com.abc4022dh26.men
11	7

This site contains no links.

Subject Issuer	Validity	Valid
a4022-com.abc4022dh26.men R11	`2024-09-25` - `2024-12-24`	3 months	crt.sh
*.cnzz.com GlobalSign Organization Validation CA - SHA256 - G3	`2024-02-17` - `2025-03-20`	a year	crt.sh
4022-com.fge97a1963.men R10	`2024-09-10` - `2024-12-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif
Frame ID: C2B1F27AB5E97737F48E769E16A53316
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden

Page URL History Show full URLs

https://a4022-com.abc4022dh26.men/ Page URL
https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

73 %
HTTPS

25 %
IPv6

5
Domains

7
Subdomains

5
IPs

3
Countries

15 kB
Transfer

42 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://a4022-com.abc4022dh26.men/ Page URL
https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response a4022-com.abc4022dh26.men/	26 KB 6 KB	4808ms 3435ms	Document text/html	23.186.216.125 DAFEIYUN_AS
General Check archive.org Show headers Download Go to Full URL https://a4022-com.abc4022dh26.men/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.186.216.125 -, , ASN61368 (DAFEIYUN_AS, GB), Reverse DNS ddos.dafeiyun.com Software aliyuncdn / Resource Hash `ce09d04a21cd55f292db6543a33bb1a74b5353844cff4feac1914e2c82a176ab` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/html date Wed, 25 Sep 2024 16:38:53 GMT etag W/"66ab5ad6-6640" last-modified Thu, 01 Aug 2024 09:52:22 GMT server aliyuncdn vary Accept-Encoding
GET H2	200	jquery.min.js Show response a4022-com.abc4022dh26.men/	3 KB 1 KB	598ms 598ms	Script application/javascript	23.186.216.125 DAFEIYUN_AS
General Check archive.org Show headers Download Go to Full URL https://a4022-com.abc4022dh26.men/jquery.min.js?47751 Requested by Host: a4022-com.abc4022dh26.men URL: https://a4022-com.abc4022dh26.men/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.186.216.125 -, , ASN61368 (DAFEIYUN_AS, GB), Reverse DNS ddos.dafeiyun.com Software aliyuncdn / Resource Hash `72c93e2c334dbacfe7f1e41ad38e3eb37038a9a08d712e1755db659617cb62ab` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://a4022-com.abc4022dh26.men/ Response headers cache-control max-age=43200 content-encoding gzip etag W/"66aa4217-d91" expires Thu, 26 Sep 2024 04:38:56 GMT date Wed, 25 Sep 2024 16:38:57 GMT content-type application/javascript last-modified Wed, 31 Jul 2024 13:54:31 GMT vary Accept-Encoding server aliyuncdn
GET H2	200	z.js Show response s9.cnzz.com/	10 KB 4 KB	2641ms 318ms	Script application/javascript	122.225.212.209 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://s9.cnzz.com/z.js?id=1281374815&async=1 Requested by Host: a4022-com.abc4022dh26.men URL: https://a4022-com.abc4022dh26.men/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 122.225.212.209 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software Tengine / Resource Hash `7bfa53b3b03080bc6ba1dd0f386a07848a0417343d9adc1f20d9ba0aff903e08` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://a4022-com.abc4022dh26.men/ Response headers content-encoding br etag W/"9603541534176775501" age 0 x-cache HIT TCP_REFRESH_HIT dirn:-2:-2 date Wed, 25 Sep 2024 16:38:58 GMT content-type application/javascript vary accept-encoding cache-control public, max-age=300 x-swift-cachetime 300 timing-allow-origin * via cache3.l2cn3130[82,82,304-0,H], cache29.l2cn3130[83,0], cache66.cn3960[88,87,200-0,H], cache46.cn3960[89,0] ali-swift-global-savetime 1727282339 x-swift-savetime Wed, 25 Sep 2024 16:38:59 GMT eagleid 7ae1d14217272823390358929e content-length 3883 server Tengine
GET H2	200	jq.json Show response a4022-com.abc4022dh26.men/	2 KB 730 B	465ms 464ms	XHR application/json	23.186.216.125 DAFEIYUN_AS
General Check archive.org Show headers Download Go to Full URL https://a4022-com.abc4022dh26.men/jq.json?v2.23 Requested by Host: a4022-com.abc4022dh26.men URL: https://a4022-com.abc4022dh26.men/jquery.min.js?47751 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.186.216.125 -, , ASN61368 (DAFEIYUN_AS, GB), Reverse DNS ddos.dafeiyun.com Software aliyuncdn / Resource Hash `2342147966db5967b5a79b9eb9d203b00c2db6c0253a92c2b5d92d2297f20dc3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://a4022-com.abc4022dh26.men/ Response headers content-encoding gzip date Wed, 25 Sep 2024 16:38:57 GMT etag W/"66e53c72-6ca" content-type application/json last-modified Sat, 14 Sep 2024 07:34:10 GMT vary Accept-Encoding server aliyuncdn
GET		ads-news-22da2516.gif 4022-com.a77c6a.men/assets/	0 0

GET		ads-news-22da2516.gif 4022-com.qwercd96.men/assets/	0 0

GET		ads-news-22da2516.gif 4022-com.s8a9z9c82.men/assets/	0 0

POST H2	200	stat.htm z12.cnzz.com/	2 B 123 B	1637ms 335ms	Ping text/html	240e:97b:500:2000::6 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://z12.cnzz.com/stat.htm?id=1281374815&r=&lg=de-de&ntime=none&cnzz_eid=1794543754-1727282339-&showp=1600x1200&p=https%3A%2F%2Fa4022-com.abc4022dh26.men%2F&t=%E6%88%91%E4%BB%AC%E8%A6%81%E5%8F%8B%E5%96%84%E3%80%81%E5%B9%B3%E7%AD%89%E3%80%81%E8%AF%9A%E4%BF%A1%E3%80%81%E6%B3%95%E6%B2%BB%E3%80%81%E7%88%B1%E5%9B%BD%E3%80%81%E5%AF%8C%E5%BC%BA%E3%80%81%E6%95%AC%E4%B8%9A%E3%80%81%E6%96%87%E6%98%8E%E3%80%81%E5%96%84%E8%89%AF%E3%80%81%E5%85%89%E6%98%8E%E3%80%81%E5%8B%87%E6%95%A2%E3%80%81%E7%A7%AF%E6%9E%81%E3%80%81%E5%BF%AB...&umuuid=1922a0cddb190d-0dbf941067df5c-1e462c6f-1d4c00-1922a0cddb270d&h=1 Requested by Host: s9.cnzz.com URL: https://s9.cnzz.com/z.js?id=1281374815&async=1 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305 Server 240e:97b:500:2000::6 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Tengine / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://a4022-com.abc4022dh26.men/ Response headers content-encoding gzip date Wed, 25 Sep 2024 16:39:00 GMT content-type text/html; charset=utf-8 vary Accept-Encoding server Tengine
GET H2	200	c.js Show response c.cnzz.com/	907 B 793 B	311ms 306ms	Script application/javascript	122.225.212.209 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://c.cnzz.com/c.js?web_id=1281374815&t=z Requested by Host: s9.cnzz.com URL: https://s9.cnzz.com/z.js?id=1281374815&async=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 122.225.212.209 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software Tengine / Resource Hash `69353c2683491398faeea44da1261a72f548761751658b93f3dee223ad10ecd2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://a4022-com.abc4022dh26.men/ Response headers content-encoding gzip etag W/"619636815656140240" age 0 x-cache HIT TCP_REFRESH_HIT dirn:-2:-2 date Wed, 25 Sep 2024 16:38:58 GMT content-type application/javascript vary accept-encoding cache-control public, max-age=321 x-swift-cachetime 321 timing-allow-origin * via cache54.l2cn3130[84,83,304-0,H], cache31.l2cn3130[85,0], cache128.cn3960[95,95,200-0,H], cache46.cn3960[96,0] ali-swift-global-savetime 1727282339 x-swift-savetime Wed, 25 Sep 2024 16:38:59 GMT eagleid 7ae1d14217272823393681204e content-length 591 server Tengine
GET H/1.1	403 Forbidden	Primary Request ads-news-22da2516.gif Show response 4022-com.a77c6a.men/assets/	404 B 528 B	1676ms 1227ms	Document text/html	23.102.236.134 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif Requested by Host: a4022-com.abc4022dh26.men URL: https://a4022-com.abc4022dh26.men/jquery.min.js?47751 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.102.236.134 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `f37e22d35fabf0368694be13c13dc3a4919dcd5800781aed157c2399826f5012` Request headers Referer https://a4022-com.abc4022dh26.men/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Content-Length 404 Content-Type text/html; charset=utf-8 Date Wed, 25 Sep 2024 16:39:01 GMT
GET H/1.1	403 Forbidden	favicon.ico 4022-com.a77c6a.men/	404 B 528 B	1226ms 1226ms	Other text/html	23.102.236.134 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://4022-com.a77c6a.men/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 23.102.236.134 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `779ee322101bff6167d889c3d0034f091c7f1716311562488e5b6e9e60b39c10` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif Response headers Date Wed, 25 Sep 2024 16:39:03 GMT Content-Type text/html; charset=utf-8 Content-Length 404

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 4022-com.a77c6a.men
URL: https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif

Domain: 4022-com.qwercd96.men
URL: https://4022-com.qwercd96.men/assets/ads-news-22da2516.gif

Domain: 4022-com.s8a9z9c82.men
URL: https://4022-com.s8a9z9c82.men/assets/ads-news-22da2516.gif

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.abc4022dh26.men/	1970-01-21 04:10:07	Name: UM_distinctid Value: 1922a0cddb190d-0dbf941067df5c-1e462c6f-1d4c00-1922a0cddb270d
			a4022-com.abc4022dh26.men/	1970-01-21 04:10:07	Name: CNZZDATA1281374815 Value: 1794543754-1727282339-%7C1727282339

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://4022-com.a77c6a.men/assets/ads-news-22da2516.gif Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://4022-com.a77c6a.men/favicon.ico Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4022-com.a77c6a.men
4022-com.qwercd96.men
4022-com.s8a9z9c82.men
a4022-com.abc4022dh26.men
c.cnzz.com
s9.cnzz.com
z12.cnzz.com
4022-com.a77c6a.men
4022-com.qwercd96.men
4022-com.s8a9z9c82.men
122.225.212.209
23.102.236.134
23.186.216.125
240e:97b:500:2000::6
2342147966db5967b5a79b9eb9d203b00c2db6c0253a92c2b5d92d2297f20dc3
69353c2683491398faeea44da1261a72f548761751658b93f3dee223ad10ecd2
72c93e2c334dbacfe7f1e41ad38e3eb37038a9a08d712e1755db659617cb62ab
779ee322101bff6167d889c3d0034f091c7f1716311562488e5b6e9e60b39c10
7bfa53b3b03080bc6ba1dd0f386a07848a0417343d9adc1f20d9ba0aff903e08
ce09d04a21cd55f292db6543a33bb1a74b5353844cff4feac1914e2c82a176ab
f37e22d35fabf0368694be13c13dc3a4919dcd5800781aed157c2399826f5012

4022-com.a77c6a.men Open in urlscan Pro 23.102.236.134 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

73 %HTTPS

25 %IPv6

5 Domains

7 Subdomains

5 IPs

3 Countries

15 kBTransfer

42 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

4022-com.a77c6a.men Open in urlscan Pro
23.102.236.134 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

73 %
HTTPS

25 %
IPv6

5
Domains

7
Subdomains

5
IPs

3
Countries

15 kB
Transfer

42 kB
Size

2
Cookies

11 HTTP transactions
0 data transactions