www.hsbc-au.com Open in urlscan Pro
45.38.53.74 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.hsbc-au.com/
Effective URL:
https://www.hsbc-au.com/dan.php
Submission: On January 07 via automatic, source certstream-suspicious (January 7th 2020, 8:18:17 am UTC)

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 45.38.53.74, located in San Jose, United States and belongs to EGIHOSTING - EGIHosting, US. The main domain is www.hsbc-au.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 7th 2020. Valid for: 3 months.

This is the only time www.hsbc-au.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 4	45.38.53.74 45.38.53.74	18779 (EGIHOSTING) (EGIHOSTING - EGIHosting)
3	220.242.140.187 220.242.140.187	54994 (QUANTILNE...) (QUANTILNETWORKS - QUANTIL NETWORKS INC)
1 2	154.215.157.148 154.215.157.148	134548 (DXTL-HK D...) (DXTL-HK DXTL Tseung Kwan O Service)
11	4

4 45.38.53.74 (San Jose, United States) 1 redirects

ASN18779 (EGIHOSTING - EGIHosting, US)

www.hsbc-au.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 220.242.140.187 (France)

ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US)

js.users.51.la	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 154.215.157.148 (Los Angeles, United States) 1 redirects

ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK)

dandan6868.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.dandan6868.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	hsbc-au.com 1 redirects www.hsbc-au.com	2 KB
3	51.la js.users.51.la ia.51.la Failed	10 KB
2	dandan6868.com 1 redirects dandan6868.com www.dandan6868.com	2 KB
0	zoudayun66.com Failed zoudayun66.com Failed
11	4

	Domain	Requested by
4	www.hsbc-au.com	1 redirects www.hsbc-au.com
3	js.users.51.la	www.hsbc-au.com
1	www.dandan6868.com	www.hsbc-au.com
1	dandan6868.com	1 redirects
0	zoudayun66.com Failed	www.dandan6868.com
0	ia.51.la Failed	www.hsbc-au.com
11	6

This site contains links to these domains. Also see Links.

Domain
www.51.la

Subject Issuer	Validity	Valid
hsbc-au.com Let's Encrypt Authority X3	`2020-01-07` - `2020-04-06`	3 months	crt.sh
*.users.51.la GlobalSign Domain Validation CA - SHA256 - G2	`2018-01-15` - `2021-03-19`	3 years	crt.sh
dandan6868.com Go Daddy Secure Certificate Authority - G2	`2019-08-03` - `2020-05-31`	10 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.hsbc-au.com/dan.php
Frame ID: 7D6B5C6BCE1442D4E9BE8818703AF7B1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.hsbc-au.com/ HTTP 301
https://www.hsbc-au.com/dan.php Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

64 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

4
IPs

2
Countries

13 kB
Transfer

19 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.51.la/?comId=19923841
Title: 51La

Search URL Search Domain Scan URL

URL: https://www.51.la/?comId=20568401
Title: 51La

Search URL Search Domain Scan URL

URL: https://www.51.la/?comId=20556177
Title: 51La

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.hsbc-au.com/ HTTP 301
https://www.hsbc-au.com/dan.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://dandan6868.com/danteng.js HTTP 301
https://www.dandan6868.com/danteng.js

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request dan.php Show response www.hsbc-au.com/ Redirect Chain https://www.hsbc-au.com/ https://www.hsbc-au.com/dan.php	455 B 543 B	161ms 160ms	Document text/html	45.38.53.74 EGIHosting
General Check archive.org Show headers Download Go to Full URL https://www.hsbc-au.com/dan.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 45.38.53.74 San Jose, United States, ASN18779 (EGIHOSTING - EGIHosting, US), Reverse DNS Software nginx / PHP/5.4.41 Resource Hash `e99a30f4b4035bb7bae1a711e811c9557584e5d40f0d86ceff18c8e492630f9e` Request headers Host www.hsbc-au.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Sec-Fetch-Mode navigate Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Response headers Server nginx Date Tue, 07 Jan 2020 08:17:55 GMT Content-Type text/html;charset=utf-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Powered-By PHP/5.4.41 Content-Encoding gzip Redirect headers Server nginx Date Tue, 07 Jan 2020 08:17:55 GMT Content-Type text/html Content-Length 178 Location https://www.hsbc-au.com/dan.php Connection keep-alive
GET H/1.1	200 OK	tj.js Show response www.hsbc-au.com/	253 B 565 B	160ms 160ms	Script application/javascript	45.38.53.74 EGIHosting
General Check archive.org Show headers Download Go to Full URL https://www.hsbc-au.com/tj.js Requested by Host: www.hsbc-au.com URL: https://www.hsbc-au.com/dan.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 45.38.53.74 San Jose, United States, ASN18779 (EGIHOSTING - EGIHosting, US), Reverse DNS Software nginx / Resource Hash `ebd402432f84b784c2510f38a8d458b1890c4bc751d3c93da0f3b1f48cba246a` Request headers Referer https://www.hsbc-au.com/dan.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Tue, 07 Jan 2020 08:17:55 GMT Last-Modified Tue, 07 Jan 2020 07:37:01 GMT Server nginx ETag "5e14351d-fd" Content-Type application/javascript Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 253 Expires Tue, 07 Jan 2020 09:17:55 GMT
GET H/1.1	200 OK	jquery.min.js Show response www.hsbc-au.com/	423 B 736 B	162ms 162ms	Script application/javascript	45.38.53.74 EGIHosting
General Check archive.org Show headers Download Go to Full URL https://www.hsbc-au.com/jquery.min.js Requested by Host: www.hsbc-au.com URL: https://www.hsbc-au.com/dan.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 45.38.53.74 San Jose, United States, ASN18779 (EGIHOSTING - EGIHosting, US), Reverse DNS Software nginx / Resource Hash `781f4fdca7dffe5a8580bb6e320441e1b35b3516094d419ea06040076b209750` Request headers Referer https://www.hsbc-au.com/dan.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Tue, 07 Jan 2020 08:17:55 GMT Last-Modified Tue, 07 Jan 2020 07:37:01 GMT Server nginx ETag "5e14351d-1a7" Content-Type application/javascript Cache-Control max-age=3600 Connection keep-alive Accept-Ranges bytes Content-Length 423 Expires Tue, 07 Jan 2020 09:17:55 GMT
GET H/1.1	200 OK	19923841.js Show response js.users.51.la/	5 KB 3 KB	85ms 20ms	Script application/javascript	220.242.140.187 QUANTIL NETWORKS INC
General Check archive.org Show headers Download Go to Full URL https://js.users.51.la/19923841.js Requested by Host: www.hsbc-au.com URL: https://www.hsbc-au.com/tj.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 220.242.140.187 , France, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US), Reverse DNS Software nginx/1.14.0 / Resource Hash `0334487b9aa074c687f1e5f50f6963cbbbe4186f2363f26a52b42ac936d32719` Request headers Referer https://www.hsbc-au.com/dan.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers x-id 19923841 Date Tue, 07 Jan 2020 08:17:48 GMT Content-Encoding gzip Age 28065 Transfer-Encoding chunked X-Via 1.1 PSxgHKG8yn104:1 (Cdn Cache Server V2.0)[197 200 2], 1.1 ld86:2 (Cdn Cache Server V2.0)[83 200 0], 1.1 PSfgblPAR1vw78:6 (Cdn Cache Server V2.0)[0 200 0] Content-Disposition inline;filename=f.txt Connection keep-alive Request-Id 0000016F0A53C1BC9413782A6EDD43C2 x-reserved amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc id-2 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCS6MqWIQ3C05S24n/dYnFWgQymznRfqI Last-Modified Thu Mar 14 10:24:39 CST 2019 Server nginx/1.14.0 ETag "4acf556d0e66299d8fbd1217a05d513e" Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 version-id G00111697A040BC1FFFF901401F2A7DC
GET H/1.1	200 OK	20568401.js Show response js.users.51.la/	5 KB 3 KB	756ms 692ms	Script application/javascript	220.242.140.187 QUANTIL NETWORKS INC
General Check archive.org Show headers Download Go to Full URL https://js.users.51.la/20568401.js Requested by Host: www.hsbc-au.com URL: https://www.hsbc-au.com/tj.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 220.242.140.187 , France, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US), Reverse DNS Software nginx/1.14.0 / Resource Hash `b5f6e69c5f2ed417a679ed86098bb94849c04f87f3c95234fa746fc1c9b59df0` Request headers Referer https://www.hsbc-au.com/dan.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers x-id 20568401 Date Tue, 07 Jan 2020 08:17:49 GMT Content-Encoding gzip Transfer-Encoding chunked X-Via 1.1 PSxgHKG8zt114:3 (Cdn Cache Server V2.0)[30 200 2], 1.1 ld92:8 (Cdn Cache Server V2.0)[654 200 2], 1.1 PSfgblPAR1vw78:5 (Cdn Cache Server V2.0)[672 200 2] Content-Disposition inline;filename=f.txt Connection keep-alive Request-Id 0000016F7F14D5C09054BE86EA3ABCF3 x-reserved amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc id-2 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSIGMa903IrCNY5KmkHoJr7N/mS0w2vq Last-Modified Thu Jan 02 09:51:58 CST 2020 Server nginx/1.14.0 ETag "20e2e441e3b1f3e1e10a06aff9e49add" Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 version-id G001116F63F3C7E3FFFF94130A62D7ED
GET H/1.1	200 OK	20556177.js Show response js.users.51.la/	5 KB 3 KB	817ms 753ms	Script application/javascript	220.242.140.187 QUANTIL NETWORKS INC
General Check archive.org Show headers Download Go to Full URL https://js.users.51.la/20556177.js Requested by Host: www.hsbc-au.com URL: https://www.hsbc-au.com/tj.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 220.242.140.187 , France, ASN54994 (QUANTILNETWORKS - QUANTIL NETWORKS INC, US), Reverse DNS Software nginx/1.14.0 / Resource Hash `c57785c2b45f4ae4dee914ecada293c8ff9aac1d210a444f5250c807e61345af` Request headers Referer https://www.hsbc-au.com/dan.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers x-id 20556177 Date Tue, 07 Jan 2020 08:17:49 GMT Content-Encoding gzip Transfer-Encoding chunked X-Via 1.1 PSxgHKG8zt114:7 (Cdn Cache Server V2.0)[47 200 2], 1.1 ld88:0 (Cdn Cache Server V2.0)[714 200 2], 1.1 PSfgblPAR1gi79:6 (Cdn Cache Server V2.0)[733 200 2] Content-Disposition inline;filename=f.txt Connection keep-alive Request-Id 0000016F7F14D5FB9054C075D4D4F228 x-reserved amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc id-2 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCS0P1jrFZrE7sKW5m1jcRupjXW/bZJcE Last-Modified Wed Dec 25 10:43:13 CST 2019 Server nginx/1.14.0 ETag "317a5426e9f4d112b6387b2db3d3ffc1" Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 version-id G001116F3AEFD3A9FFFF90151671AFE1
GET		go1 ia.51.la/	0 0

GET		go1 ia.51.la/	0 0

GET		go1 ia.51.la/	0 0

GET H/1.1	200 OK	danteng.js Show response www.dandan6868.com/ Redirect Chain https://dandan6868.com/danteng.js https://www.dandan6868.com/danteng.js	3 KB 1 KB	8235ms 215ms	Script application/javascript	154.215.157.148 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.dandan6868.com/danteng.js Requested by Host: www.hsbc-au.com URL: https://www.hsbc-au.com/dan.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 154.215.157.148 Los Angeles, United States, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software nginx / Resource Hash `bf569bc410606f671c5a3607ba56fb771e03110b6daf3826eb676ef9c593e051` Request headers Referer https://www.hsbc-au.com/dan.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Sat, 09 Nov 2019 08:17:20 GMT Content-Encoding gzip Last-Modified Sun, 29 Sep 2019 11:05:10 GMT Server nginx ETag W/"5d908fe6-a71" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=3600 Transfer-Encoding chunked Connection keep-alive Expires Sat, 09 Nov 2019 09:17:20 GMT Redirect headers Location https://www.dandan6868.com/danteng.js Date Sat, 09 Nov 2019 08:17:11 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET		ajax.php zoudayun66.com/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ia.51.la
URL: https://ia.51.la/go1?id=19923841&rt=1578385069019&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1578385069019&tt=%25E6%25BE%25B3%25E9%2597%25A8%25E5%25A4%25AA%25E9%2598%25B3%25E9%259B%2586%25E5%259B%25A2%25E5%25A8%25B1%25E4%25B9%2590138-%25E5%25AE%2598%25E6%2596%25B9%25E9%25A6%2596%25E9%25A1%25B5&kw=&cu=https%253A%252F%252Fwww.hsbc-au.com%252Fdan.php&pu=

Domain: ia.51.la
URL: https://ia.51.la/go1?id=20568401&rt=1578385069679&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=2&ekc=&sid=1578385069679&tt=%25E6%25BE%25B3%25E9%2597%25A8%25E5%25A4%25AA%25E9%2598%25B3%25E9%259B%2586%25E5%259B%25A2%25E5%25A8%25B1%25E4%25B9%2590138-%25E5%25AE%2598%25E6%2596%25B9%25E9%25A6%2596%25E9%25A1%25B5&kw=&cu=https%253A%252F%252Fwww.hsbc-au.com%252Fdan.php&pu=

Domain: ia.51.la
URL: https://ia.51.la/go1?id=20556177&rt=1578385069740&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=3&ekc=&sid=1578385069740&tt=%25E6%25BE%25B3%25E9%2597%25A8%25E5%25A4%25AA%25E9%2598%25B3%25E9%259B%2586%25E5%259B%25A2%25E5%25A8%25B1%25E4%25B9%2590138-%25E5%25AE%2598%25E6%2596%25B9%25E9%25A6%2596%25E9%25A1%25B5&kw=&cu=https%253A%252F%252Fwww.hsbc-au.com%252Fdan.php&pu=

Domain: zoudayun66.com
URL: https://zoudayun66.com/ajax.php?keyword=%E6%BE%B3%E9%97%A8%E5%A4%AA%E9%98%B3%E9%9B%86%E5%9B%A2%E5%A8%B1%E4%B9%90138-%E5%AE%98%E6%96%B9%E9%A6%96%E9%A1%B5&from=pc&originurl=https%3A%2F%2Fwww.hsbc-au.com%2Fdan.php&referer=&userAgent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_6)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F79.0.3945.88%20Safari%2F537.36&v=6985

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dandan6868.com
ia.51.la
js.users.51.la
www.dandan6868.com
www.hsbc-au.com
zoudayun66.com
ia.51.la
zoudayun66.com
154.215.157.148
220.242.140.187
45.38.53.74
0334487b9aa074c687f1e5f50f6963cbbbe4186f2363f26a52b42ac936d32719
781f4fdca7dffe5a8580bb6e320441e1b35b3516094d419ea06040076b209750
b5f6e69c5f2ed417a679ed86098bb94849c04f87f3c95234fa746fc1c9b59df0
bf569bc410606f671c5a3607ba56fb771e03110b6daf3826eb676ef9c593e051
c57785c2b45f4ae4dee914ecada293c8ff9aac1d210a444f5250c807e61345af
e99a30f4b4035bb7bae1a711e811c9557584e5d40f0d86ceff18c8e492630f9e
ebd402432f84b784c2510f38a8d458b1890c4bc751d3c93da0f3b1f48cba246a

www.hsbc-au.com Open in urlscan Pro 45.38.53.74 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

64 %HTTPS

0 %IPv6

4 Domains

6 Subdomains

4 IPs

2 Countries

13 kBTransfer

19 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

Indicators

www.hsbc-au.com Open in urlscan Pro
45.38.53.74 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

64 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

4
IPs

2
Countries

13 kB
Transfer

19 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions