urlscan.io logo urlscan.io
SecurityTrails logo

www.hpa.org.cn Open in urlscan Pro
211.149.241.147  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.ly/MFJbv
Effective URL: http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
Submission: On August 27 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 211.149.241.147, located in China and belongs to CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN. The main domain is www.hpa.org.cn.
This is the only time www.hpa.org.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 172.67.75.122 13335 (CLOUDFLAR...)
3 211.149.241.147 38283 (CHINANET-...)
4 2
Apex Domain
Subdomains		 Transfer
3 hpa.org.cn
www.hpa.org.cn
10 KB
1 t.ly
t.ly — Cisco Umbrella Rank: 150500
1 KB
0 jdevcloud.com Failed
syrvk.jdevcloud.com Failed
4 3
Domain Requested by
3 www.hpa.org.cn www.hpa.org.cn
1 t.ly 1 redirects
0 syrvk.jdevcloud.com Failed
4 3

This site contains links to these domains. Also see Links.

Domain
syrvk.jdevcloud.com
Subject Issuer Validity Valid

This page contains 1 frames:

Frame: https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
Frame ID: 591130FF68719D2AFDAF9B0F0C2148C6
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

automatically jump after 5 seconds...

Page URL History Show full URLs

  1. https://t.ly/MFJbv HTTP 302
    http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

10 kB
Transfer

24 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.ly/MFJbv HTTP 302
    http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request goto.php
www.hpa.org.cn/
Redirect Chain
  • https://t.ly/MFJbv
  • http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
988 B
941 B 		Document
General
Check archive.org
Download Go to
Full URL
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
Protocol
HTTP/1.1
Server
211.149.241.147 , China, ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 / PHP/5.4.28 ASP.NET
Resource Hash
0de8a2058248add708925bd30f686aa634451a3e68405421bc445590f37dc095

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Content-Encoding
gzip
Content-Length
702
Content-Type
text/html;charset=utf-8
Date
Sun, 27 Aug 2023 22:37:41 GMT
Server
Microsoft-IIS/8.5
Vary
Accept-Encoding
X-Powered-By
PHP/5.4.28 ASP.NET

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
7fd7cce88d6aaaf5-SYD
content-type
text/html; charset=UTF-8
date
Sun, 27 Aug 2023 22:37:40 GMT
location
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2MeNFt3ZNGhbL0UyrIFN4pavb2JOs21%2BcO0xtOaAh%2FAG25IPWVI%2FIWGgBqX1tY%2Fm3YJTbHUZrRI5Kq7Eb%2B%2BmHCnXWHbO%2BDRFk4gAye0NzVrYarFahtY%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-whom
tly-2
x-xss-protection
1; mode=block
style.css
www.hpa.org.cn/public/en/css/ 		21 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.hpa.org.cn/public/en/css/style.css
Requested by
Host: www.hpa.org.cn
URL: http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
Protocol
HTTP/1.1
Server
211.149.241.147 , China, ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
fade191d7dc6cf97bd6794ef3e579fd1fb1b3be598ccae7236c000ba77626d8c

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sun, 27 Aug 2023 22:37:42 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Jan 2021 03:11:12 GMT
Server
Microsoft-IIS/8.5
ETag
"968d28bf59e9d61:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
6806
loading.gif
www.hpa.org.cn/public/dialog/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.hpa.org.cn/public/dialog/loading.gif
Requested by
Host: www.hpa.org.cn
URL: http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
Protocol
HTTP/1.1
Server
211.149.241.147 , China, ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
5af5f042cb4b1cdbe1f108b8f339cb5830bb36685249b0c02a9b7e13bf460ac6

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sun, 27 Aug 2023 22:37:42 GMT
Last-Modified
Sat, 18 Aug 2012 13:43:31 GMT
Server
Microsoft-IIS/8.5
ETag
"303ba74477dcd1:0"
X-Powered-By
ASP.NET
Content-Type
image/gif
Accept-Ranges
bytes
Content-Length
1922
g5eSIreQZEDg.php
syrvk.jdevcloud.com/ffg3FGRZxdfZQ/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
syrvk.jdevcloud.com
URL
https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/g5eSIreQZEDg.php?e=66gvGGf

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
t.ly/ Name: XSRF-TOKEN
Value: eyJpdiI6IlV6cVhBdGpJWE4zZ2RmQUVNZUNnVlE9PSIsInZhbHVlIjoibDk5Z05JTXVuS2llaVIyNlB3c1J1Z1VoNlhjaURheGpsRWtDZ0NrSHRoVzhSTTBnYmd1ZGc3bE9oMHhteWFvaUg4Vk1VV090ajNKRm1laEtQMVo2N29rdjlaVEVIc0lPR3BJckNEZDFvd24ySUtOK3VLWkZ1ZHBWU0pFdTRFc2ciLCJtYWMiOiIyNmU3NmRiNDU0ZWNiNWQyNjg5ZjFhMThlZTE2ZTk4NWFjNDg4MDBiMjJjMmU4ZTMyNTM1MWIzYzc4NGQ3YmM4IiwidGFnIjoiIn0%3D
t.ly/ Name: tly_session
Value: eyJpdiI6ImRXR2k3Mk10UU4zTUV6NkRHb1ZpTWc9PSIsInZhbHVlIjoiUkJPM2xCSWI5QnU0N3UwVE56UjdHVHJaejVBREIveSt2ZEpWUkp3Rm1qbDdKYVBsSVQ5MklobVI4VVNOQk5mOEc2bzY1djI5OG9YYllMUW5JRWJvRFVDbnVGWU9TS3FzZnpYT01DTXdBZkFCam94WFZiVGpobUJGWlVCMi9rakUiLCJtYWMiOiI0OWI1NWQ1YzAzMDdhYjE5YzkwZWZkODIzNGYwYjlhNjE1OWExZTY2MGM5YmVjYzk0NjFkMDYyN2UyMDIzMWNlIiwidGFnIjoiIn0%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

syrvk.jdevcloud.com
t.ly
www.hpa.org.cn
syrvk.jdevcloud.com
172.67.75.122
211.149.241.147
0de8a2058248add708925bd30f686aa634451a3e68405421bc445590f37dc095
5af5f042cb4b1cdbe1f108b8f339cb5830bb36685249b0c02a9b7e13bf460ac6
fade191d7dc6cf97bd6794ef3e579fd1fb1b3be598ccae7236c000ba77626d8c