youxuan2024-e6h.pages.dev Open in urlscan Pro
172.66.45.48 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Submission: On November 05 via api (November 5th 2024, 6:38:21 am UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 172.66.45.48, located in United States and belongs to CLOUDFLARENET, US. The main domain is youxuan2024-e6h.pages.dev.
TLS certificate: Issued by WE1 on September 30th 2024. Valid for: 3 months.

This is the only time youxuan2024-e6h.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	172.66.45.48 172.66.45.48	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:264... 2600:9000:2646:bc00:1:823d:f0c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:20e... 2600:9000:20eb:1c00:14:8ed:8000:93a1	16509 (AMAZON-02) (AMAZON-02)
1	171.8.167.90 171.8.167.90	137687 (CHINATELE...) (CHINATELECOM-HENAN-LUOYANG-IDC Luoyang)
13	5

7 172.66.45.48 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

youxuan2024-e6h.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2646:bc00:1:823d:f0c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ssl.qhimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:20eb:1c00:14:8ed:8000:93a1 (United States)

ASN16509 (AMAZON-02, US)

p.ssl.qhimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 171.8.167.90 (Zhengzhou, China)

ASN137687 (CHINATELECOM-HENAN-LUOYANG-IDC Luoyang, Henan Province, P.R.China., CN)
PTR: 8.171.broad.ha.dynamic.163data.com.cn

s.360.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pages.dev 1 redirects youxuan2024-e6h.pages.dev	21 KB
6	qhimg.com s.ssl.qhimg.com — Cisco Umbrella Rank: 313043 p.ssl.qhimg.com — Cisco Umbrella Rank: 478141	60 KB
1	360.cn s.360.cn — Cisco Umbrella Rank: 40168	172 B
13	3

	Domain	Requested by
7	youxuan2024-e6h.pages.dev	1 redirects youxuan2024-e6h.pages.dev
3	p.ssl.qhimg.com	youxuan2024-e6h.pages.dev
3	s.ssl.qhimg.com	youxuan2024-e6h.pages.dev
1	s.360.cn	youxuan2024-e6h.pages.dev
13	4

This site contains links to these domains. Also see Links.

Domain
news.so.com
www.so.com
wenda.so.com
tv.360kan.com
image.so.com
map.so.com
baike.so.com
ly.so.com
soft.so.com
info.so.com
www.baidu.com
www.bing.com
www.google.com.hk
mse.360.cn
bbs.360safe.com
e.360.cn

Subject Issuer	Validity	Valid
youxuan2024-e6h.pages.dev WE1	`2024-09-30` - `2024-12-29`	3 months	crt.sh
*.ssl.qhimg.com WoTrus DV Server CA [Run by the Issuer]	`2024-03-05` - `2025-04-05`	a year	crt.sh
*.s.360.cn WoTrus DV Server CA [Run by the Issuer]	`2023-12-04` - `2024-12-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Frame ID: 4A2268B966D25F89BB08D60E812E8250
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

360搜索

Page URL History Show full URLs

https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c Page URL
https://youxuan2024-e6h.pages.dev/cdn-cgi/phish-bypass?atok=OFIZymKeJxY80oKTQfylzD3u42f1JKFYpBcTwE1X1.I-173078... HTTP 301
https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c Page URL

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

81 kB
Transfer

121 kB
Size

3
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: http://news.so.com/ns?q=&src=tab_www
Title: 资讯

Search URL Search Domain Scan URL

URL: http://www.so.com/s?q=&src=tab_www
Title: 网页

Search URL Search Domain Scan URL

URL: https://wenda.so.com/search/?q=&src=tab_www
Title: 问答

Search URL Search Domain Scan URL

URL: http://tv.360kan.com/s?q=&src=tab_www
Title: 视频

Search URL Search Domain Scan URL

URL: http://image.so.com/i?q=&src=tab_www
Title: 图片

Search URL Search Domain Scan URL

URL: http://map.so.com/?k=&src=tab_www
Title: 地图

Search URL Search Domain Scan URL

URL: http://baike.so.com/doc/search?word=&src=tab_www
Title: 百科

Search URL Search Domain Scan URL

URL: http://ly.so.com/s?q=&src=tab_www
Title: 良医

Search URL Search Domain Scan URL

URL: http://soft.so.com/search?q=&src=tab_www
Title: 软件

Search URL Search Domain Scan URL

URL: http://info.so.com/feedback.html
Title: 反馈

Search URL Search Domain Scan URL

URL: http://www.baidu.com/s?wd=&ie=utf-8
Title: 百度

Search URL Search Domain Scan URL

URL: http://www.bing.com/search?q=&ie=utf-8
Title: 必应

Search URL Search Domain Scan URL

URL: http://www.google.com.hk/search?hl=zh-CN&ie=utf-8&q=
Title: 谷歌

Search URL Search Domain Scan URL

URL: http://mse.360.cn/
Title: 360浏览器客户端官网

Search URL Search Domain Scan URL

URL: http://info.so.com/feedback.html?src=anniu
Title: 意见反馈

Search URL Search Domain Scan URL

URL: http://info.so.com/web_report.html?src=report
Title: 违法举报

Search URL Search Domain Scan URL

URL: http://bbs.360safe.com/forum-137-1.html
Title: 产品论坛

Search URL Search Domain Scan URL

URL: http://info.so.com/site_submit.html
Title: 网站收录

Search URL Search Domain Scan URL

URL: https://www.so.com/help/help_1_1.html
Title: 使用帮助

Search URL Search Domain Scan URL

URL: http://e.360.cn/?src=srp465
Title: 推广合作

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c Page URL
https://youxuan2024-e6h.pages.dev/cdn-cgi/phish-bypass?atok=OFIZymKeJxY80oKTQfylzD3u42f1JKFYpBcTwE1X1.I-1730788688-0.0.1.1-%2Fnews%3Fkeywords%3D%25c3%25a8%25c2%25b4%25c2%25a2%25c3%25a5%25c2%25af%25c2%258c HTTP 301
https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 403 news Show response
youxuan2024-e6h.pages.dev/ 4 KB
2 KB 419ms
17ms Document
text/html 172.66.45.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.45.48 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f9daaf25537d58f00916ef68f5b552cb8ef4981f2bb8baf4c0a08fefa4b0fd7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8ddad6d7bff7d374-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 05 Nov 2024 06:38:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oIqhNthIEXF4OcZHkjyYxsC88YFEX%2FM989CoGRDsbuGOYnAVMxRyiigAMNt0OOgL5WHVltVqZfGmLZ7fGlmI4ZOJj8iAaU46kd%2F4%2Fj%2BR6EPXXzvjCm2HKG%2FepWI%2BWoJagSjnmqOO40H29iM7"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 cf.errors.css
youxuan2024-e6h.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 16ms
11ms Stylesheet
text/css 172.66.45.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://youxuan2024-e6h.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.45.48 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"672112ac-5df3"
x-content-type-options: nosniff
cf-ray: 8ddad6d7f875d374-FRA
expires: Tue, 05 Nov 2024 08:38:08 GMT
date: Tue, 05 Nov 2024 06:38:08 GMT
content-type: text/css
last-modified: Tue, 29 Oct 2024 16:51:56 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 200 icon-exclamation.png
youxuan2024-e6h.pages.dev/cdn-cgi/images/ 452 B
540 B 9ms
9ms Image
image/png 172.66.45.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://youxuan2024-e6h.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.45.48 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "672112ac-1c4"
x-content-type-options: nosniff
cf-ray: 8ddad6d828d2d374-FRA
expires: Tue, 05 Nov 2024 08:38:08 GMT
accept-ranges: bytes
content-length: 452
date: Tue, 05 Nov 2024 06:38:08 GMT
content-type: image/png
last-modified: Tue, 29 Oct 2024 16:51:56 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 403 favicon.ico
youxuan2024-e6h.pages.dev/ 4 KB
2 KB 12ms
12ms Other
text/html 172.66.45.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://youxuan2024-e6h.pages.dev/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.45.48 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

205b4a2fca3926c8257e4861c3dd6c972118da6087b67ecde6f838feedc448d5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9zok0O%2Fce7UqWzkmUlR%2FQt0TGEikOHRLk4shumNenXMVDCDP%2BUFVSN70fQ3T0Q1sAh3f3vsKmGt8qdGAPTDJrJnLZ2buoavbELszgU08dpRxThT5ptXYJZDo9GBbNDiuonNwixmOVwlImLO"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddad6d84914d374-FRA
date: Tue, 05 Nov 2024 06:38:08 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H2

404

Primary Request news Show response
youxuan2024-e6h.pages.dev/
Redirect Chain

https://youxuan2024-e6h.pages.dev/cdn-cgi/phish-bypass?atok=OFIZymKeJxY80oKTQfylzD3u42f1JKFYpBcTwE1X1.I-1730788688-0.0.1.1-%2Fnews%3Fkeywords%3D%25c3%25a8%25c2%25b4%25c2%25a2%25c3%25a5%25c2%25af%25...
https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c

25 KB
10 KB

2189ms
2189ms

Document
text/html

172.66.45.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.45.48 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca0a3414f7864d527c1a874ff104d27f568bbe9f74e0cb3fa95d18f6a422295e

Request headers

Referer: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ddad6f15e3fd374-FRA
content-encoding: br
content-type: text/html
date: Tue, 05 Nov 2024 06:38:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oK%2BBKg3QW2fgODOBPm%2FwkhdxKkc0AWb6oIQX3AT7kVRE0xzL5jZcAw%2FF3tjfJbEt1laMudQuO7wL12tLA5yfCXf%2Bu2WKJ0ddurROyK4tUGzXWvLgNYXkddAO6uDV336wXmaD5w6LN9obR2fD"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=6695&sent=33&recv=24&lost=0&retrans=0&sent_bytes=14419&recv_bytes=3124&delivery_rate=1867898&cwnd=250&unsent_bytes=0&cid=303b2f0d531f8d4b&ts=6365&x=0"
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8ddad6f14e1ed374-FRA
content-length: 167
content-type: text/html
date: Tue, 05 Nov 2024 06:38:12 GMT
location: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 f6f47ae12bdcbd71.js Show response
s.ssl.qhimg.com/static/ 2 KB
2 KB 1171ms
7ms Script
application/javascript 2600:9000:2646:bc00:1:823d:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ssl.qhimg.com/static/f6f47ae12bdcbd71.js
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:bc00:1:823d:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: a3fde2432ec82b64ecf6297fd54a98a555a29029f8ff03d311028db26431d9f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

etag: W/"7b01048287aed930"
kcs-via: MISS from w-fc01.lato;MISS from w-sc01.lyct
age: 31354408
expires: Sat, 05 Nov 2033 09:04:48 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: lefsSCM9L6SDqbPgXQuUwuEsJNoU4dWdJyzAVMTPGYyPl-M1SNNINA==
date: Wed, 08 Nov 2023 09:04:48 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 01 Jan 2018 00:00:00 GMT
cache-control: s-maxage=315360000, max-age=315360000, immutable
timing-allow-origin: *
x-qstatic-hit: 1
via: 1.1 934815569b3b6127560be81f148ef706.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1700
x-amz-cf-pop: FRA60-P5

GET
H2 200 t01c5c894da473336a2.png
p.ssl.qhimg.com/ 5 KB
6 KB 872ms
9ms Image
image/png 2600:9000:20eb:1c00:14:8ed:8000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.ssl.qhimg.com/t01c5c894da473336a2.png
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1c00:14:8ed:8000:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: cfac82baca5fd84d72e9308f3e6d86c7676e894fd64a75066846986af6976c64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

kcs-via: HIT from w-fc01.lato;MISS from w-sc01.bjwdt
age: 5218988
expires: Wed, 04 Dec 2024 20:55:06 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: udPe-sUzD1EHNMLcSlN9XQYV8NMhy9QW8GDgbZ1i1IqD3PVnoYfWPQ==
date: Thu, 05 Sep 2024 20:55:06 GMT
content-type: image/png
last-modified: Tue, 03 Sep 2024 21:49:11 GMT
xcs: HIT
cache-control: s-maxage=7776000, max-age=7776000
timing-allow-origin: *
xzp: zmcmrmmzmweize
via: 1.1 24c299c0a6423c6f96984a85fb014108.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5434
x-amz-cf-pop: FRA2-C1

GET
H2 200 73d56cb3aa573b96.js Show response
s.ssl.qhimg.com/ssl/ 6 KB
6 KB 1175ms
12ms Script
application/javascript 2600:9000:2646:bc00:1:823d:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ssl.qhimg.com/ssl/73d56cb3aa573b96.js
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:bc00:1:823d:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e53c3a2af68d959570cd799d673a35c10a525bbbe6a64ced82f4386ccb2ed917

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

etag: W/"a9b90f7c13159074"
kcs-via: HIT from w-fc03.lato;MISS from w-sc02.lyct
age: 4001116
expires: Sun, 17 Sep 2034 23:13:00 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: CKdyzLgUKIf2a9FcRGwCYcaoOtLJANA7nRL4jy79aj_R4jeflvga-g==
date: Thu, 19 Sep 2024 23:13:00 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 01 Jan 2018 00:00:00 GMT
cache-control: s-maxage=315360000, max-age=315360000, immutable
timing-allow-origin: *
x-qstatic-hit: 1
via: 1.1 934815569b3b6127560be81f148ef706.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5948
x-amz-cf-pop: FRA60-P5

GET
H2 200 4f1853e5.js Show response
s.ssl.qhimg.com/monitor/;monitor/ 6 KB
7 KB 291ms
9ms Script
application/javascript 2600:9000:2646:bc00:1:823d:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ssl.qhimg.com/monitor/;monitor/4f1853e5.js
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2646:bc00:1:823d:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 0fe66c41a9584862e69331f40f4e9b24307a80c73d93806712086a85a7ec6c49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

cache-control: s-maxage=315360000, max-age=315360000, immutable
timing-allow-origin: *
etag: W/"03a5150c524380a2"
kcs-via: MISS from w-fc03.lato;MISS from w-sc01.lyct
age: 3434866
x-qstatic-hit: 1
via: 1.1 934815569b3b6127560be81f148ef706.cloudfront.net (CloudFront)
expires: Sun, 24 Sep 2034 12:30:29 GMT
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: u9eLshfWAL_DG86geQhIjlEfi2X7qAfmtm4YIXpgAoibiLYLm4EOxg==
date: Thu, 26 Sep 2024 12:30:29 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 01 Jan 2018 00:00:00 GMT
x-amz-cf-pop: FRA60-P5

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44535e199726ec386ecc502b2b97399dcaee9b09767e6d963f0b827de5b0419b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 t019016be2616bba0f8.png
p.ssl.qhimg.com/ 38 KB
38 KB 9ms
8ms Image
image/png 2600:9000:20eb:1c00:14:8ed:8000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.ssl.qhimg.com/t019016be2616bba0f8.png
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1c00:14:8ed:8000:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f0ef286aaeb364b4b822650cf510e08c01bbe690044a1d97cd4eeb4ec004457e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

kcs-via: HIT from w-fc03.lato;MISS from w-sc03.bjwdt
age: 1345021
expires: Sat, 18 Jan 2025 17:01:15 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: XP3MBMnwiN-oSfGyi6k3-6BXesAQBqePV-lT5H1lKVF3peNuAxDp6A==
date: Sun, 20 Oct 2024 17:01:15 GMT
content-type: image/png
last-modified: Wed, 27 Dec 2023 06:41:43 GMT
xcs: HIT
cache-control: s-maxage=7776000, max-age=7776000
timing-allow-origin: *
xzp: zmvhqplsmreiovovmvmlml
via: 1.1 24c299c0a6423c6f96984a85fb014108.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 38863
x-amz-cf-pop: FRA2-C1

GET
H2 200 t016e66672bbb448908.png
p.ssl.qhimg.com/ 651 B
1 KB 9ms
9ms Image
image/png 2600:9000:20eb:1c00:14:8ed:8000:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.ssl.qhimg.com/t016e66672bbb448908.png
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:1c00:14:8ed:8000:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: deb3c97a076b8c0042818567bb826248d1a88dabe2019da3dc9b016ec162c745

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

kcs-via: HIT from w-fc03.lato;MISS from w-sc05.bjwdt
age: 1475442
expires: Fri, 17 Jan 2025 04:47:34 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: HoRmmUSeu-yuIl0zOf8X-Fu3zliMnShEFbCC2WbJPLeqtJWgf3J3TQ==
date: Sat, 19 Oct 2024 04:47:34 GMT
content-type: image/png
last-modified: Thu, 12 Sep 2024 11:32:40 GMT
xcs: HIT
cache-control: s-maxage=7776000, max-age=7776000
timing-allow-origin: *
xzp: ovmrmrovnlsmlml
via: 1.1 24c299c0a6423c6f96984a85fb014108.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 651
x-amz-cf-pop: FRA2-C1

GET
H2 200 click.gif
s.360.cn/so/ 43 B
172 B 936ms
181ms Image
image/gif 171.8.167.90
CHINATELECOM-HENA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.360.cn/so/click.gif?p=&u=https%3A%2F%2Fyouxuan2024-e6h.pages.dev%2Fnews%2F&id=268796153.81030996157283710.1730788696089.3896&guid=268796153.81030996157283710.1730788696089.3896&pro=so&pid=www&mod=404&url=https%3A%2F%2Fyouxuan2024-e6h.pages.dev%2Fnews%3Fkeywords%3D%25c3%25a8%25c2%25b4%25c2%25a2%25c3%25a5%25c2%25af%25c2%258c&t=1730788696089
Requested by: Host: youxuan2024-e6h.pages.dev
URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 171.8.167.90 Zhengzhou, China, ASN137687 (CHINATELECOM-HENAN-LUOYANG-IDC Luoyang, Henan Province, P.R.China., CN),
Reverse DNS: 8.171.broad.ha.dynamic.163data.com.cn
Software: openresty/1.15.8.2 /
Resource Hash: 52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/

Response headers

accept-ranges: bytes
content-length: 43
date: Tue, 05 Nov 2024 06:38:16 GMT
etag: "5d36b945-2b"
content-type: image/gif
last-modified: Tue, 23 Jul 2019 07:37:41 GMT
server: openresty/1.15.8.2

GET
H2 200 favicon.ico
youxuan2024-e6h.pages.dev/ 1 KB
2 KB 1529ms
1528ms Other
image/x-icon 172.66.45.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://youxuan2024-e6h.pages.dev/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.66.45.48 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68e8242c84796935397c4b7f36c9a4e66334f98472a7120701f6b4b8411bda59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: BYPASS
etag: W/"67288175-4e4"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o8txKMKTQCWlVhwsL6mBCsC0FEqXSuG6oWJ7T2JPqXw%2B2Xa0QQ61%2FKrK6qXA9PZeMcOiZV5%2FJi11MSw%2FHSPyHAFzJJ0Q9DuVANFSiHEijyIZfA5p5zbEg0PFjzjAt7zYLuEUA2cE95ZXBaYm"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ddad70cce35d374-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6393&sent=50&recv=31&lost=0&retrans=0&sent_bytes=24555&recv_bytes=3267&delivery_rate=2006947&cwnd=250&unsent_bytes=0&cid=303b2f0d531f8d4b&ts=10096&x=0"
date: Tue, 05 Nov 2024 06:38:18 GMT
content-type: image/x-icon
last-modified: Mon, 04 Nov 2024 08:10:29 GMT
vary: Accept-Encoding
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youxuan2024-e6h.pages.dev/	1970-01-21 00:47:55	Name: __cf_mw_byp Value: OFIZymKeJxY80oKTQfylzD3u42f1JKFYpBcTwE1X1.I-1730788688-0.0.1.1-/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c
youxuan2024-e6h.pages.dev/	1970-01-21 07:58:28	Name: __guid Value: 268796153.81030996157283710.1730788696089.3896
youxuan2024-e6h.pages.dev/	1970-01-21 00:47:55	Name: count Value: 1

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://youxuan2024-e6h.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://youxuan2024-e6h.pages.dev/news?keywords=%c3%a8%c2%b4%c2%a2%c3%a5%c2%af%c2%8c Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

p.ssl.qhimg.com
s.360.cn
s.ssl.qhimg.com
youxuan2024-e6h.pages.dev
171.8.167.90
172.66.45.48
2600:9000:20eb:1c00:14:8ed:8000:93a1
2600:9000:2646:bc00:1:823d:f0c0:93a1
0fe66c41a9584862e69331f40f4e9b24307a80c73d93806712086a85a7ec6c49
205b4a2fca3926c8257e4861c3dd6c972118da6087b67ecde6f838feedc448d5
3f9daaf25537d58f00916ef68f5b552cb8ef4981f2bb8baf4c0a08fefa4b0fd7
44535e199726ec386ecc502b2b97399dcaee9b09767e6d963f0b827de5b0419b
52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b
68e8242c84796935397c4b7f36c9a4e66334f98472a7120701f6b4b8411bda59
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
a3fde2432ec82b64ecf6297fd54a98a555a29029f8ff03d311028db26431d9f4
ca0a3414f7864d527c1a874ff104d27f568bbe9f74e0cb3fa95d18f6a422295e
cfac82baca5fd84d72e9308f3e6d86c7676e894fd64a75066846986af6976c64
deb3c97a076b8c0042818567bb826248d1a88dabe2019da3dc9b016ec162c745
e53c3a2af68d959570cd799d673a35c10a525bbbe6a64ced82f4386ccb2ed917
f0ef286aaeb364b4b822650cf510e08c01bbe690044a1d97cd4eeb4ec004457e
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

youxuan2024-e6h.pages.dev Open in urlscan Pro 172.66.45.48 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

81 kBTransfer

121 kBSize

3 Cookies

20 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

3 Cookies

3 Console Messages

Security Headers

Indicators

youxuan2024-e6h.pages.dev Open in urlscan Pro
172.66.45.48 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

81 kB
Transfer

121 kB
Size

3
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!