zhangtom1989.cn Open in urlscan Pro
111.230.248.113 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ecom.e-srv.com/74391//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924
Effective URL:
http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924
Submission: On December 11 via manual (December 11th 2019, 4:00:33 pm UTC) from EG

Summary HTTP 2 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 111.230.248.113, located in Beijing, China and belongs to CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN. The main domain is zhangtom1989.cn.

This is the only time zhangtom1989.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 1	67.227.229.244 67.227.229.244		32244 (LIQUIDWEB) (LIQUIDWEB - Liquid Web)
1	111.230.248.113 111.230.248.113		45090 (CNNIC-TEN...) (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
2	2

1 67.227.229.244 (Lansing, United States) 1 redirects

ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US)

ecom.e-srv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 111.230.248.113 (Beijing, China)

ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

zhangtom1989.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	zhangtom1989.cn zhangtom1989.cn	518 B
1	e-srv.com 1 redirects ecom.e-srv.com	334 B
0	newphaseelectrical.co.uk Failed www.newphaseelectrical.co.uk Failed
2	3

	Domain	Requested by
1	zhangtom1989.cn
1	ecom.e-srv.com	1 redirects
0	www.newphaseelectrical.co.uk Failed	zhangtom1989.cn
2	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924
Frame ID: 52DC5FCF68A7D474DF54025A102E8F83
Requests: 1 HTTP requests in this frame

Frame: http://www.newphaseelectrical.co.uk///MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924
Frame ID: F0471664CFDB8F3C586C5B4267850494
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ecom.e-srv.com/74391//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 HTTP 302
http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Perl (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /\bPerl\b(?: ?\/?v?([\d.]+))?/i
headers server /mod_perl(?:\/([\d\.]+))?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_perl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
headers server /mod_perl(?:\/([\d\.]+))?/i

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ecom.e-srv.com/74391//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 HTTP 302
http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response zhangtom1989.cn/41695728//MZmiF/ Redirect Chain http://ecom.e-srv.com/74391//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924	228 B 518 B	1617ms 883ms	Document text/html	111.230.248.113 CNNIC-TENCENT-NET...
General Check archive.org Show headers Download Go to Full URL http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 Protocol HTTP/1.1 Server 111.230.248.113 Beijing, China, ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_perl/2.0.10 Perl/v5.16.3 / PHP/5.4.16 Resource Hash `44d5970b00d0e978dd4393b163395c157fd264931a94010b78a57f364fcda2a5` Request headers Host zhangtom1989.cn Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 11 Dec 2019 16:00:06 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_perl/2.0.10 Perl/v5.16.3 X-Powered-By PHP/5.4.16 Content-Length 228 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Wed, 11 Dec 2019 16:00:04 GMT Server Apache/2.4.41 (cPanel) OpenSSL/1.0.2t mod_bwlimited/1.4 Location http://zhangtom1989.cn/41695728//MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924 Keep-Alive timeout=1, max=50 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET		/ www.newphaseelectrical.co.uk///MZmiF/ Frame F047	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.newphaseelectrical.co.uk
URL: http://www.newphaseelectrical.co.uk///MZmiF/?sc=1&sc=1&l=2&ppy=6371924&i=6371924

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ecom.e-srv.com
www.newphaseelectrical.co.uk
zhangtom1989.cn
www.newphaseelectrical.co.uk
111.230.248.113
67.227.229.244
44d5970b00d0e978dd4393b163395c157fd264931a94010b78a57f364fcda2a5