urlscan.io logo urlscan.io
SecurityTrails logo

pikpak2.fanfu.workers.dev Open in urlscan Pro
2606:4700:3031::ac43:d180  Public Scan

Go To Rescan Add Verdict Report
URL: https://pikpak2.fanfu.workers.dev/
Submission: On February 04 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3031::ac43:d180, located in United States and belongs to CLOUDFLARENET, US. The main domain is pikpak2.fanfu.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on December 30th 2023. Valid for: 3 months.
This is the only time pikpak2.fanfu.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:303... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a04:4e42:600... 54113 (FASTLY)
2 2 121.62.22.52 148981 (CHINANET-...)
1 240e:c2:1800:... ()
1 240e:96c:1100... 4134 (CHINANET-...)
8 5
2    2606:4700:3031::ac43:d180 (United States)

ASN13335 (CLOUDFLARENET, US)
pikpak2.fanfu.workers.dev
2    2606:4700:3034::ac43:8f07 (United States)

ASN13335 (CLOUDFLARENET, US)
paperkiteidleplus.top
2    2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
2    121.62.22.52 (China)

ASN148981 (CHINANET-HUBEI-SHIYAN-IDC China Telecom, CN)
pic.imgdb.cn
1    240e:c2:1800:103:8000:0:b00:100 (None, )

ASN- ()
p5.toutiaoimg.com
1    240e:96c:1100:5a02:3::3f7 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
mooc-image.nosdn.127.net
Apex Domain
Subdomains		 Transfer
2 imgdb.cn
pic.imgdb.cn — Cisco Umbrella Rank: 481612
204 B
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 324
86 KB
2 paperkiteidleplus.top
paperkiteidleplus.top
51 KB
2 workers.dev
pikpak2.fanfu.workers.dev
2 KB
1 127.net
mooc-image.nosdn.127.net — Cisco Umbrella Rank: 664965
2 MB
1 toutiaoimg.com
p5.toutiaoimg.com
30 KB
8 6
Domain Requested by
2 pic.imgdb.cn 2 redirects
2 cdn.jsdelivr.net pikpak2.fanfu.workers.dev
2 paperkiteidleplus.top pikpak2.fanfu.workers.dev
2 pikpak2.fanfu.workers.dev cdn.jsdelivr.net
1 mooc-image.nosdn.127.net paperkiteidleplus.top
1 p5.toutiaoimg.com pikpak2.fanfu.workers.dev
8 6

This site contains links to these domains. Also see Links.

Domain
paperkiteblog.xyz
Subject Issuer Validity Valid
fanfu.workers.dev
GTS CA 1P5		 2023-12-30 -
2024-03-29		 3 months crt.sh
paperkiteidleplus.top
GTS CA 1P5		 2024-01-12 -
2024-04-11		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://pikpak2.fanfu.workers.dev/
Frame ID: 02EAEE124F7590A1F50AE996846BB146
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-
Overall confidence: 100%
Detected patterns
  • /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

75 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

2095 kB
Transfer

2352 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://pic.imgdb.cn/item/6524101cc458853aef6953d4.jpg HTTP 302
  • https://p5.toutiaoimg.com/origin/ff0600016ebe2893a170
Request Chain 5
  • https://pic.imgdb.cn/item/65bba67f871b83018a59c948.jpg HTTP 302
  • https://mooc-image.nosdn.127.net/5b6f39f031eb4075bb2550fd35ee6f3f.jpg

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
pikpak2.fanfu.workers.dev/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pikpak2.fanfu.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d180 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ebf9ed333b5b60ca6703d48c387924dda582f9aebd5b36270a82cdc307745c1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
85040afe6b269ab9-MIA
content-encoding
br
content-type
text/html
date
Sun, 04 Feb 2024 15:45:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3WftiURvZxJrD6czJ17dvBJtc1Uk2%2Bia%2BOybJ1jBnIGkraUyjAYbeNOQk4UNPUBMfiyIJ9ZabfBrYqqjLpKzSEqvwW6qcKPyz5v6a2yVJPbrZY9DGSctRy5l3QUdS5THkdHs0%2F%2Buk9zdyonkqjw6FlgH1GkX00go"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
pikpakEncrypt120.css
paperkiteidleplus.top/sources/pikpak/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://paperkiteidleplus.top/sources/pikpak/css/pikpakEncrypt120.css
Requested by
Host: pikpak2.fanfu.workers.dev
URL: https://pikpak2.fanfu.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:8f07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1d396c39a420c2c7ea290933d7ea66f04aa62bba5efcb409a657aca10bbd5ee

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pikpak2.fanfu.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Sun, 04 Feb 2024 15:45:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 01 Feb 2024 15:27:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6856
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AI%2F9co99C%2BZReeuu8A1ql0hATWYv%2BkCcyeeQee1Uq9mSNzYBqAM8IdwxqTXtZNsZBBYsDTewDTFl9XHMxwGk6ntb3VTiD2F%2F42MWyS2lnPpCyy2O5tieG%2BlI9aF%2BDf%2FR2Tf03O8EB7PmX0KrNWEHhANK%2F5c%3D"}],"group":"cf-nel","max_age":604800}
x-cache
HIT from kangle web server
content-type
text/css
cache-control
max-age=14400
cf-ray
85040aff6d278dd6-MIA
alt-svc
h3=":443"; ma=86400
axios.min.js
cdn.jsdelivr.net/npm/axios@1.6.5/dist/ 		33 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/axios@1.6.5/dist/axios.min.js
Requested by
Host: pikpak2.fanfu.workers.dev
URL: https://pikpak2.fanfu.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ad11a265acf7060a7d86dabc6ae0f3b32f135f096a6e35be748a001393d71541
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pikpak2.fanfu.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 04 Feb 2024 15:45:49 GMT
x-content-type-options
nosniff
content-encoding
br
age
1068535
x-jsd-version
1.6.5
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
13156
x-served-by
cache-fra-etou8220056-FRA, cache-mia-kmia1760046-MIA
x-jsd-version-type
version
etag
W/"8377-sJR9VQcibeO0sE4OfGCP6SP7nGs"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
vue.global.min.js
cdn.jsdelivr.net/npm/vue@3.4.15/dist/ 		189 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/vue@3.4.15/dist/vue.global.min.js
Requested by
Host: pikpak2.fanfu.workers.dev
URL: https://pikpak2.fanfu.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8ac523168ff2a3bea84264d7223400a79547860c8e1ac275386271db55a61674
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pikpak2.fanfu.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sun, 04 Feb 2024 15:45:49 GMT
x-content-type-options
nosniff
content-encoding
br
age
749985
x-jsd-version
3.4.15
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
74210
x-served-by
cache-fra-etou8220023-FRA, cache-mia-kmia1760046-MIA
x-jsd-version-type
version
etag
W/"2f2a6-QZv1Zf+aRUOtWlRi9/Wy2UgPavk"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
ff0600016ebe2893a170
p5.toutiaoimg.com/origin/
Redirect Chain
  • https://pic.imgdb.cn/item/6524101cc458853aef6953d4.jpg
  • https://p5.toutiaoimg.com/origin/ff0600016ebe2893a170
29 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p5.toutiaoimg.com/origin/ff0600016ebe2893a170
Requested by
Host: pikpak2.fanfu.workers.dev
URL: https://pikpak2.fanfu.workers.dev/
Protocol
H2
Server
240e:c2:1800:103:8000:0:b00:100 -, , ASN (),
Reverse DNS
Software
Byte-nginx / ImageX
Resource Hash
6fb325b3f5b5e82a3b2923dced339a8c6fa9d38457043288dfe14c48a7464aa4

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pikpak2.fanfu.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Sun, 04 Feb 2024 15:45:59 GMT
x-response-lb
image
via
cache05.hncsct02
x-tt-trace-tag
id=5
x-tt-trace-id
2023042816564301000605704704C13D78
age
24389356
nw-session-id
202304281656432EBA3DAEEB1AEF83B2A0xgv4h01tt
x-powered-by
ImageX
x-bdcdn-cache-status
TCP_HIT
server-timing
inner; dur=45
x-length
30094
content-length
30094
x-request-id
b110fa48f778c631416998a4f93aa260
last-modified
Fri, 28 Apr 2023 08:56:43 GMT
server
Byte-nginx
x-tt-logid
202304281656432EBA3DAEEB1AEF83B2A0
x-response-date
Fri, 28 Apr 2023 16:56:43 GMT
content-type
image/jpeg
access-control-allow-origin
*
nw-session-trace
2023-04-28T16:56:43.826419547+08:00 37
cache-control
max-age=31536000
x-request-ip
2001:550:1d05:1::9
x-response-cinfo
2001:550:1d05:1::9
imagex-fmt
jpeg2jpeg
x-response-cache
edge_hit
timing-allow-origin
*
x-tt-trace-host
01e511cca21949ec6babbd12094d17052079d767721e59d81c8015cf3f8547c3f01453019a2cd093b67813a596a3c341a55436aecd1bfdc90bc49c96487a58f3f072a09fb45b8e888c54dd81eff3aeecedaf62eb5ac692d589896c97ce738c73453d0823fc32a39fe30e716cab5881791ea22477d651fac42b0c351b33f9299832

Redirect headers

location
https://p5.toutiaoimg.com/origin/ff0600016ebe2893a170
access-control-allow-origin
*
content-type
text/html
pikpakEncrypt122.js
paperkiteidleplus.top/sources/pikpak/js/ 		169 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://paperkiteidleplus.top/sources/pikpak/js/pikpakEncrypt122.js
Requested by
Host: pikpak2.fanfu.workers.dev
URL: https://pikpak2.fanfu.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:8f07 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f5e4d014ecc8d65b70f7c3fbf2a1624d80397f1d70853e2e5be7ebe98dab398

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pikpak2.fanfu.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Sun, 04 Feb 2024 15:45:52 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Sat, 03 Feb 2024 11:46:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aArF0pCiPYopLjbmNvTF0J7yRika09MV6aRzTyryq1AqPP%2FZ8Jlg84xSxiOBna6LgRdgYX19o7P1PN65RmztMxanYq1nx7rZSEh%2Fncvh68931TXJTqM0jSq%2Fcp9szIN79zZmhZkwFH3zHhWUxpyYXXFk%2Fjw%3D"}],"group":"cf-nel","max_age":604800}
x-cache
HIT from kangle web server
content-type
application/x-javascript
cache-control
max-age=14400
cf-ray
85040aff6d298dd6-MIA
alt-svc
h3=":443"; ma=86400
5b6f39f031eb4075bb2550fd35ee6f3f.jpg
mooc-image.nosdn.127.net/
Redirect Chain
  • https://pic.imgdb.cn/item/65bba67f871b83018a59c948.jpg
  • https://mooc-image.nosdn.127.net/5b6f39f031eb4075bb2550fd35ee6f3f.jpg
2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mooc-image.nosdn.127.net/5b6f39f031eb4075bb2550fd35ee6f3f.jpg
Requested by
Host: paperkiteidleplus.top
URL: https://paperkiteidleplus.top/sources/pikpak/css/pikpakEncrypt120.css
Protocol
H2
Server
240e:96c:1100:5a02:3::3f7 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
Tengine /
Resource Hash
7fe732b21988bb07706de03495ffeae86e0a394a6efd06ba3b64916f3dec8e7d

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Sun, 04 Feb 2024 04:47:22 GMT
via
cache26.l2cn1827[0,0,206-0,H], cache57.l2cn1827[0,0], ens-vcache21.cn5923[0,0,200-0,H], ens-vcache5.cn5923[3,0]
x-nos-object-name
5b6f39f031eb4075bb2550fd35ee6f3f.jpg
x-nos-request-id
f173ea23-ae4a-49e0-8b32-708cedac27a8
cdn-ip
240e:96c:1100:5a02:3::3f7
age
39510
x-swift-cachetime
2560927
x-cache
HIT TCP_HIT dirn:9:306976829 mlen:0
cdn-user-ip
2001:550:1d05:1::9
content-disposition
inline; filename="5b6f39f031eb4075bb2550fd35ee6f3f.jpg"
x-swift-savetime
Sun, 04 Feb 2024 13:25:15 GMT
x-nos-storage-class
STANDARD
content-length
1969161
last-modified
Sun, 04 Feb 2024 12:45:09 Asia/Shanghai
server
Tengine
cdn-source
ali
etag
bbc3afd834337565d9daf99de663ec16
x-nos-requesttype
GetObject
ali-swift-global-savetime
1707022042
content-type
image/jpeg;charset=UTF-8
timing-allow-origin
*
eagleid
b4a3cf0a17070615522374779e

Redirect headers

location
https://mooc-image.nosdn.127.net/5b6f39f031eb4075bb2550fd35ee6f3f.jpg
access-control-allow-origin
*
referrer-policy
no-referrer
checkServer.php
pikpak2.fanfu.workers.dev/php/ 		391 B
586 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pikpak2.fanfu.workers.dev/php/checkServer.php?code=check
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios@1.6.5/dist/axios.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d180 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59e2289fa5110fedccec33fa01576b2e9f3edbd2e840e8d8f9422e03dae4442c

Request headers

Accept
application/json, text/plain, */*
Referer
https://pikpak2.fanfu.workers.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Sun, 04 Feb 2024 15:45:53 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ntnNYBDvyLVTkyG9XMQveTiNx3WMUQ2ZbLb8m9zSghJyMorYALy820oA3nFlqh547Rdy2JXpwf7Kqzia4SYQIr6GekAyclH5iwKtuycIw%2Fg4wKQBgZ%2BtRHrZZjb%2F05%2FdZBPvUAoA7KCsDuePJNwUizchu%2F9y2Lxt"}],"group":"cf-nel","max_age":604800}
content-type
text/plain
cf-ray
85040b0e79699ab9-MIA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| axios object| Vue object| __VUE_HMR_RUNTIME__ object| devtoolsFormatters function| _0x4830 function| _0x2897 function| _0x3313 function| _0xdfa7 boolean| __VUE__ object| __VUE_DEVTOOLS_HOOK_REPLAY__

0 Cookies