flarum.star-skin.cn Open in urlscan Pro
154.40.58.154 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://flarum.star-skin.cn/
Submission Tags: phishingrod
Submission: On June 20 via api (June 20th 2023, 7:53:06 am UTC) from DE — Scanned from DE

Summary HTTP 7 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 154.40.58.154, located in United States and belongs to NETLAB-SDN, US. The main domain is flarum.star-skin.cn.

This is the only time flarum.star-skin.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	154.40.58.154 154.40.58.154	979 (NETLAB-SDN) (NETLAB-SDN)
2 7	141.11.108.204 141.11.108.204	40065 (CNSERVERS) (CNSERVERS)
1	104.21.9.66 104.21.9.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	4

1 154.40.58.154 (United States)

ASN979 (NETLAB-SDN, US)

flarum.star-skin.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 141.11.108.204 (New York, United States) 2 redirects

ASN40065 (CNSERVERS, US)

tx.hk47.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ip.hk47.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.9.66 (None, )

ASN13335 (CLOUDFLARENET, US)

tenapi.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	hk47.cc 2 redirects tx.hk47.cc ip.hk47.cc	3 MB
1	tenapi.cn tenapi.cn	501 B
1	star-skin.cn flarum.star-skin.cn	1 KB
7	3

	Domain	Requested by
4	tx.hk47.cc	flarum.star-skin.cn tx.hk47.cc
3	ip.hk47.cc	2 redirects tx.hk47.cc
1	tenapi.cn	flarum.star-skin.cn
1	flarum.star-skin.cn
7	4

This site contains links to these domains. Also see Links.

Domain
www.locyanfrp.cn

Subject Issuer	Validity	Valid
hk47.cc GTS CA 1P5	`2023-05-18` - `2023-08-16`	3 months	crt.sh
tenapi.cn GTS CA 1P5	`2023-05-12` - `2023-08-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://flarum.star-skin.cn/
Frame ID: 30A25A44552C4E0ED17C7826E5D38BC6
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

无法找到你的请求的网站！

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

3526 kB
Transfer

3563 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.locyanfrp.cn/
Title: LoCyanFrp

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://ip.hk47.cc/mt/img.php HTTP 302
https://ip.hk47.cc/mt/tx-img.php HTTP 302
https://ip.hk47.cc/mt/img/23.png

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 404
Not Found Primary Request / Show response
flarum.star-skin.cn/ 1 KB
1 KB 408ms
176ms Document
text/html 154.40.58.154
NETLAB-SDN

General

Check archive.org

Show headers Download Go to

Full URL: http://flarum.star-skin.cn/
Protocol: HTTP/1.1
Server: 154.40.58.154 , United States, ASN979 (NETLAB-SDN, US),
Reverse DNS
Software: /
Resource Hash: e6b760d7cb97986e571115df9c7f8c48abdec092930ea3836a29019e0802cd93

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 1187
Content-Type: text/html; charset=utf-8
Date: Tue, 20 Jun 2023 07:52:57 GMT

GET
H2 200 404-bootstrap.css
tx.hk47.cc/ 156 KB
156 KB 1535ms
334ms Stylesheet
text/css 141.11.108.204
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://tx.hk47.cc/404-bootstrap.css

Requested by

Host: flarum.star-skin.cn
URL: http://flarum.star-skin.cn/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

141.11.108.204 New York, United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

Tengine /

Resource Hash

a98de7f79af22bd534296f9a1779bc76876282d7e55b6e65975b9946b31f5f5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://flarum.star-skin.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:52:58 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 25 Nov 2022 07:19:30 GMT
server: Tengine
etag: "63806c82-26eed"
content-type: text/css
cache-control: max-age=43200
accept-ranges: bytes
content-length: 159469
expires: Tue, 20 Jun 2023 19:52:58 GMT

GET
H2 200 404-style.css
tx.hk47.cc/ 4 KB
4 KB 1811ms
611ms Stylesheet
text/css 141.11.108.204
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://tx.hk47.cc/404-style.css

Requested by

Host: flarum.star-skin.cn
URL: http://flarum.star-skin.cn/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

141.11.108.204 New York, United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

Tengine /

Resource Hash

82539641e87e7d7b3f4d7903ede04160ed23de2c350f3d7988d192c732bbfe53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://flarum.star-skin.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:52:58 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 21 Mar 2022 10:48:10 GMT
server: Tengine
etag: "623857ea-e1c"
content-type: text/css
cache-control: max-age=43200
accept-ranges: bytes
content-length: 3612
expires: Tue, 20 Jun 2023 19:52:58 GMT

GET
H2 200 / Show response
tenapi.cn/yiyan/ 63 B
501 B 530ms
296ms Script
text/html 104.21.9.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tenapi.cn/yiyan/?format=js
Requested by: Host: flarum.star-skin.cn
URL: http://flarum.star-skin.cn/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.9.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 302729eb19fd3492a3bca861862e434eac5efcd5ed257844585a9985ed9f7b71

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://flarum.star-skin.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:52:57 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LktnYeV3UkgkYoJfINAk9TRpA9DJa9F1pxovyb11oEztjNPCZCiaM9dEFC3gQ3Z1qtgAcvI7C%2BKE5Rnte7Y35zGDCvZ0c4MgYuhSDhExgw9Ccg6qroqXLA6aWFU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cf-ray: 7da26f6fdfdd927a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 sakura.js Show response
tx.hk47.cc/ 62 KB
62 KB 1810ms
612ms Script
application/javascript 141.11.108.204
CNSERVERS

General

Check archive.org

Show headers Download Go to

Full URL

https://tx.hk47.cc/sakura.js

Requested by

Host: flarum.star-skin.cn
URL: http://flarum.star-skin.cn/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

141.11.108.204 New York, United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

Tengine /

Resource Hash

7a01a12877c4070e3bf5700a9144e062dd3f94a30e3136a84f9561b54ef1236d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://flarum.star-skin.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:52:58 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 25 Nov 2022 07:05:42 GMT
server: Tengine
etag: "63806946-f826"
content-type: application/javascript
cache-control: max-age=43200
accept-ranges: bytes
content-length: 63526
expires: Tue, 20 Jun 2023 19:52:58 GMT

GET
H2

200

23.png
ip.hk47.cc/mt/img/
Redirect Chain

https://ip.hk47.cc/mt/img.php
https://ip.hk47.cc/mt/tx-img.php
https://ip.hk47.cc/mt/img/23.png

3 MB
3 MB

202ms
202ms

Image
image/png

141.11.108.204
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ip.hk47.cc/mt/img/23.png

Requested by

Host: tx.hk47.cc
URL: https://tx.hk47.cc/404-style.css

Protocol

Server

141.11.108.204 New York, United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

Tengine /

Resource Hash

d17271db406ebd459e9f045e9f3808a302027f4b833ac07e885da839b32d5ecf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tx.hk47.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:53:00 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 08 Jan 2023 15:34:06 GMT
server: Tengine
etag: "63bae26e-2c8c7f"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2919551
expires: Thu, 20 Jul 2023 07:53:00 GMT

Redirect headers

location: img/23.png
date: Tue, 20 Jun 2023 07:53:00 GMT
strict-transport-security: max-age=31536000
server: Tengine
content-type: text/html; charset=UTF-8

GET
H2 200 tx-me.jpg
tx.hk47.cc/ 447 KB
448 KB 177ms
176ms Image
image/jpeg 141.11.108.204
CNSERVERS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tx.hk47.cc/tx-me.jpg

Requested by

Host: tx.hk47.cc
URL: https://tx.hk47.cc/404-style.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

141.11.108.204 New York, United States, ASN40065 (CNSERVERS, US),

Reverse DNS

Software

Tengine /

Resource Hash

6e773bb97268da07c81389ec868260fd0adedb14a2b2bbf09e8f1f41f38f26be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tx.hk47.cc/404-style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 07:52:59 GMT
strict-transport-security: max-age=31536000
last-modified: Sat, 31 Jul 2021 00:32:17 GMT
server: Tengine
etag: "61049a11-6fb75"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 457589
expires: Thu, 20 Jul 2023 07:52:59 GMT

GET
DATA 200
OK truncated
/ 43 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 427f7a363b07e17ab7900d38d315c2bb2e4e66f8239f837c72de4321931117d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://flarum.star-skin.cn/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://flarum.star-skin.cn/ Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

flarum.star-skin.cn
ip.hk47.cc
tenapi.cn
tx.hk47.cc
104.21.9.66
141.11.108.204
154.40.58.154
302729eb19fd3492a3bca861862e434eac5efcd5ed257844585a9985ed9f7b71
427f7a363b07e17ab7900d38d315c2bb2e4e66f8239f837c72de4321931117d9
6e773bb97268da07c81389ec868260fd0adedb14a2b2bbf09e8f1f41f38f26be
7a01a12877c4070e3bf5700a9144e062dd3f94a30e3136a84f9561b54ef1236d
82539641e87e7d7b3f4d7903ede04160ed23de2c350f3d7988d192c732bbfe53
a98de7f79af22bd534296f9a1779bc76876282d7e55b6e65975b9946b31f5f5b
d17271db406ebd459e9f045e9f3808a302027f4b833ac07e885da839b32d5ecf
e6b760d7cb97986e571115df9c7f8c48abdec092930ea3836a29019e0802cd93

flarum.star-skin.cn Open in urlscan Pro 154.40.58.154 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

71 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

3526 kBTransfer

3563 kBSize

0 Cookies

1 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

flarum.star-skin.cn Open in urlscan Pro
154.40.58.154 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

71 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

3526 kB
Transfer

3563 kB
Size

0
Cookies

7 HTTP transactions
1 data transactions