klsagemc.moo239832.cc

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 156.251.181.221, located in United States and belongs to CNSERVERS, US. The main domain is klsagemc.moo239832.cc.
TLS certificate: Issued by R11 on September 21st 2024. Valid for: 3 months.

This is the only time klsagemc.moo239832.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	23.224.222.137 23.224.222.137	40065 (CNSERVERS) (CNSERVERS)
1 1	38.145.216.153 38.145.216.153	18978 (ENZUINC-) (ENZUINC-)
3	156.251.181.221 156.251.181.221	40065 (CNSERVERS) (CNSERVERS)
1	240d:c000:201... 240d:c000:2010:1807:0:95aa:87eb:61d8	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
6	4

1 23.224.222.137 (United States)

ASN40065 (CNSERVERS, US)

md73.vip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.145.216.153 (Chicago, United States) 1 redirects

ASN18978 (ENZUINC-, US)
PTR: 153.216-145-38.rdns.scalabledns.com

38.145.216.153	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 156.251.181.221 (United States)

ASN40065 (CNSERVERS, US)

klsagemc.moo239832.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240d:c000:2010:1807:0:95aa:87eb:61d8 (Singapore)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

open.mobile.qq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	moo239832.cc klsagemc.moo239832.cc	10 KB
1	qq.com open.mobile.qq.com — Cisco Umbrella Rank: 159243	69 KB
1	md73.vip md73.vip	1 KB
0	yt51959.xyz Failed ggldcyc.yt51959.xyz Failed
6	4

	Domain	Requested by
3	klsagemc.moo239832.cc	md73.vip klsagemc.moo239832.cc
1	open.mobile.qq.com	klsagemc.moo239832.cc
1	md73.vip
0	ggldcyc.yt51959.xyz Failed	klsagemc.moo239832.cc
6	4

This site contains no links.

Subject Issuer	Validity	Valid
doudou68.top R11	`2024-09-21` - `2024-12-20`	3 months	crt.sh
*.aug18-2024-1.ias.qq.com GlobalSign RSA OV SSL CA 2018	`2024-08-17` - `2025-09-18`	a year	crt.sh

This page contains 1 frames:

Frame: https://ggldcyc.yt51959.xyz:39002/2_mddh/nice.htm
Frame ID: FCA3CD0BB1676D59871C5F533E8BF44B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://md73.vip/ HTTP 307
https://md73.vip/ HTTP 307
http://md73.vip/ Page URL
http://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== HTTP 307
https://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== HTTP 307
http://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== HTTP 302
https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Page URL

Page Statistics

6
Requests

67 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

85 kB
Transfer

88 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://md73.vip/ HTTP 307
https://md73.vip/ HTTP 307
http://md73.vip/ Page URL
http://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== HTTP 307
https://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== HTTP 307
http://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== HTTP 302
https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://md73.vip/ HTTP 307
https://md73.vip/ HTTP 307
http://md73.vip/

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ md73.vip/ Redirect Chain http://md73.vip/ https://md73.vip/ http://md73.vip/	1023 B 1 KB	1ms 1ms	Document text/html	23.224.222.137 CNSERVERS
General Check archive.org Show headers Download Go to Full URL http://md73.vip/ Protocol HTTP/1.1 Server 23.224.222.137 , United States, ASN40065 (CNSERVERS, US), Reverse DNS Software / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Cache-Control max-age=86400 Connection close Content-Length 1023 Content-Type text/html;charset=utf-8 Redirect headers Location http://md73.vip/ Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	Primary Request dh.htm Show response klsagemc.moo239832.cc/2_mddh/ Redirect Chain http://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== https://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== http://38.145.216.153:8080/?r=aHR0cDovL21kNzMudmlwLw== https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm	10 KB 5 KB	714ms 231ms	Document text/html	156.251.181.221 CNSERVERS
General Check archive.org Show headers Download Go to Full URL https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Requested by Host: md73.vip URL: http://md73.vip/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 156.251.181.221 , United States, ASN40065 (CNSERVERS, US), Reverse DNS Software nginx / Resource Hash `26112a52b52ff05d70c5733acf90933527881d81684e9e88c6cfc11133f0699f` Request headers Referer http://md73.vip/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Content-Encoding gzip Content-Type text/html Date Mon, 30 Sep 2024 01:06:35 GMT Etag W/"66f7a78d-26ec" Last-Modified Mon, 30 Sep 2024 01:06:35 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Cache HIT, policy, disk Redirect headers Content-Length 72 Content-Type text/html; charset=utf-8 Date Mon, 30 Sep 2024 03:35:25 GMT Location https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm
GET H/1.1	200 OK	qqapi.js Show response open.mobile.qq.com/sdk/	69 KB 69 KB	1957ms 357ms	Script application/x-javascript	240d:c000:2010:1807:0:95aa:87eb:61d8 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL https://open.mobile.qq.com/sdk/qqapi.js?_bid=152 Requested by Host: klsagemc.moo239832.cc URL: https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 240d:c000:2010:1807:0:95aa:87eb:61d8 , Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx/1.17.4 / Resource Hash `5ed54a54236d12b838952a5875652bb376a2bf54e127a6b30112760bdfcb030a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://klsagemc.moo239832.cc:39002/ Response headers X-Daa-Tunnel hop_count=1 Cache-Control max-age=86400 X-NWS-UUID-VERIFY ffa713b47482c0512abd799c14f3b5b6 X-NWS-LOG-UUID 8918556654240272983 Age 0 Connection keep-alive Expires Tue, 26 Mar 2024 10:13:00 GMT Content-Length 70472 Date Mon, 30 Sep 2024 03:35:27 GMT X-Verify-Code 2871bd7acf67c7e298e9c8d8c865e27d Content-Type application/x-javascript X-Cache-Lookup Hit From Disktank, Cache Miss Server nginx/1.17.4 Last-Modified Sat, 19 Nov 2022 10:35:43 GMT Vary Origin
GET DATA	200 OK	truncated /	5 KB 5 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b3b812720c532be020fff8ed451ce81c5bdcad52993cf88b0e0385fbdae1b2bd` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://klsagemc.moo239832.cc:39002 Referer Response headers Content-Type application/octet-stream
GET H/1.1	200 OK	favicon.ico klsagemc.moo239832.cc/	4 KB 4 KB	240ms 240ms	Other image/x-icon	156.251.181.221 CNSERVERS
General Check archive.org Show headers Download Go to Full URL https://klsagemc.moo239832.cc:39002/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 156.251.181.221 , United States, ASN40065 (CNSERVERS, US), Reverse DNS Software nginx / Resource Hash `7e52499274d61b185cf6fac54ffc8eddcb599eb3cf478bdc6e17a3ba42c2da99` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Response headers Etag "66639bac-10be" Accept-Ranges bytes X-Cache BYPASS Content-Length 4286 Date Mon, 30 Sep 2024 03:35:28 GMT Content-Type image/x-icon Last-Modified Fri, 07 Jun 2024 23:45:48 GMT Server nginx
GET H/1.1	200 OK	andjump.js Show response klsagemc.moo239832.cc/2_mddh/	206 B 523 B	233ms 233ms	Script application/javascript	156.251.181.221 CNSERVERS
General Check archive.org Show headers Download Go to Full URL https://klsagemc.moo239832.cc:39002/2_mddh/andjump.js Requested by Host: klsagemc.moo239832.cc URL: https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 156.251.181.221 , United States, ASN40065 (CNSERVERS, US), Reverse DNS Software nginx / Resource Hash `2a07d9855350bee9e4028a7bab74463090744ebee01d2f01a8c7414d097462ed` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://klsagemc.moo239832.cc:39002/2_mddh/dh.htm Response headers Cache-Control max-age=43200 Etag "66f698bd-ce" Expires Mon, 30 Sep 2024 13:10:27 GMT Accept-Ranges bytes X-Cache HIT, policy, disk Content-Length 206 Date Mon, 30 Sep 2024 01:10:27 GMT Content-Type application/javascript Last-Modified Mon, 30 Sep 2024 01:10:27 GMT Server nginx
GET		nice.htm ggldcyc.yt51959.xyz/2_mddh/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ggldcyc.yt51959.xyz
URL: https://ggldcyc.yt51959.xyz:39002/2_mddh/nice.htm?

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| mqq object| JsBridge function| clientCallback function| jump

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ggldcyc.yt51959.xyz
klsagemc.moo239832.cc
md73.vip
open.mobile.qq.com
ggldcyc.yt51959.xyz
156.251.181.221
23.224.222.137
240d:c000:2010:1807:0:95aa:87eb:61d8
38.145.216.153
26112a52b52ff05d70c5733acf90933527881d81684e9e88c6cfc11133f0699f
2a07d9855350bee9e4028a7bab74463090744ebee01d2f01a8c7414d097462ed
5ed54a54236d12b838952a5875652bb376a2bf54e127a6b30112760bdfcb030a
7e52499274d61b185cf6fac54ffc8eddcb599eb3cf478bdc6e17a3ba42c2da99
b3b812720c532be020fff8ed451ce81c5bdcad52993cf88b0e0385fbdae1b2bd

klsagemc.moo239832.cc Open in urlscan Pro 156.251.181.221 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

67 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

85 kBTransfer

88 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

0 Cookies

Indicators

klsagemc.moo239832.cc Open in urlscan Pro
156.251.181.221 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

85 kB
Transfer

88 kB
Size

0
Cookies

6 HTTP transactions
1 data transactions