Submitted URL: http://donggeshen.pages.dev/
Effective URL: https://donggeshen.pages.dev/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On November 27 via api from IT — Scanned from US

Summary

This website contacted 6 IPs in 1 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2606:4700:310c::ac42:2ce3, located in United States and belongs to CLOUDFLARENET, US. The main domain is donggeshen.pages.dev.
TLS certificate: Issued by WE1 on November 27th 2024. Valid for: 3 months.
This is the only time donggeshen.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:310... 13335 (CLOUDFLAR...)
3 172.66.44.227 13335 (CLOUDFLAR...)
2 2620:1ec:bdf::40 8075 (MICROSOFT...)
1 2 20.110.205.119 8075 (MICROSOFT...)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
2 20.57.85.160 8075 (MICROSOFT...)
10 6
Apex Domain
Subdomains
Transfer
6 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 625
c.clarity.ms — Cisco Umbrella Rank: 1269
e.clarity.ms — Cisco Umbrella Rank: 8266
30 KB
4 pages.dev
donggeshen.pages.dev
6 KB
1 bing.com
c.bing.com — Cisco Umbrella Rank: 205
771 B
10 3
Domain Requested by
4 donggeshen.pages.dev donggeshen.pages.dev
2 e.clarity.ms www.clarity.ms
2 c.clarity.ms 1 redirects
2 www.clarity.ms donggeshen.pages.dev
www.clarity.ms
1 c.bing.com 1 redirects
10 5

This site contains no links.

Subject Issuer Validity Valid
donggeshen.pages.dev
WE1
2024-11-27 -
2025-02-25
3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2024-09-04 -
2025-09-04
a year crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08
2024-06-23 -
2025-06-18
a year crt.sh

This page contains 1 frames:

Primary Page: https://donggeshen.pages.dev/
Frame ID: 284531637307CB73D3C56C1851666126
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

上海东格商贸有限公司

Page URL History Show full URLs

  1. http://donggeshen.pages.dev/ HTTP 307
    https://donggeshen.pages.dev/ Page URL

Page Statistics

10
Requests

80 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

6
IPs

1
Countries

35 kB
Transfer

72 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://donggeshen.pages.dev/ HTTP 307
    https://donggeshen.pages.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=C4467DEA80694E85BD79DB76E16DFA97&RedC=c.clarity.ms&MXFR=02D659ED0F7668941C164CA90B76667C HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C4467DEA80694E85BD79DB76E16DFA97&MUID=1E1BEEDE485A69501993FB9A49A16815

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
donggeshen.pages.dev/
Redirect Chain
  • http://donggeshen.pages.dev/
  • https://donggeshen.pages.dev/
1 KB
1 KB
Document
General
Full URL
https://donggeshen.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2ce3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bae414dcc1826c41efb1b9b8be460b242ce68ee9972e34941a88249896aeb3c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8e93657afedc83f7-LAX
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 27 Nov 2024 16:11:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t9XK02iNrnUXlSWmMDzrTAx3%2BGPeXpoOR%2FBr5jtpvKo33TxbLwUM%2Fo75gMtQQBHqo22%2Bq4zfeXleqZHKlYvE2rvRn5V24g5B9LkCpgxjNVztMmQ9mYiRVeI%2FE8v93S40CuadET0jOblJpVnAzvO7Y%2FMBMw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=82310&min_rtt=78452&rtt_var=14894&sent=9&recv=10&lost=0&retrans=0&sent_bytes=3922&recv_bytes=2292&delivery_rate=47547&cwnd=253&unsent_bytes=0&cid=777049ef78c8f4eb&ts=196&x=0"
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://donggeshen.pages.dev/
Non-Authoritative-Reason
HSTS
index.63b34199.css
donggeshen.pages.dev/shen/static/
0
0

chunk-vendors.48efd9d2.js
donggeshen.pages.dev/shen/static/js/
1 KB
1 KB
Script
General
Full URL
https://donggeshen.pages.dev/shen/static/js/chunk-vendors.48efd9d2.js
Requested by
Host: donggeshen.pages.dev
URL: https://donggeshen.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bae414dcc1826c41efb1b9b8be460b242ce68ee9972e34941a88249896aeb3c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://donggeshen.pages.dev/

Response headers

cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kR13cbK8l8V7t%2FWWEtaMSo2y5oTW7LDehEpU%2FR12X%2FYzSPFH3cJnt%2BtSNDcs7NTM0wy0bmSX%2BIfsCJZ%2FfVugJUO4u1ilOFtZyNYMSh%2FTxvbtZC04HIIVPrOb44wwNwzzM8lHr34ktg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e93657c6e1428f3-LAX
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=99577&min_rtt=74120&rtt_var=36567&sent=14&recv=12&lost=0&retrans=0&sent_bytes=5677&recv_bytes=5058&delivery_rate=163&cwnd=12000&unsent_bytes=0&cid=440ed8300d68c950&ts=392&x=1", cfHdrFlush;dur=0
date
Wed, 27 Nov 2024 16:11:51 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
index.683d6909.js
donggeshen.pages.dev/shen/static/js/
1 KB
1 KB
Script
General
Full URL
https://donggeshen.pages.dev/shen/static/js/index.683d6909.js
Requested by
Host: donggeshen.pages.dev
URL: https://donggeshen.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bae414dcc1826c41efb1b9b8be460b242ce68ee9972e34941a88249896aeb3c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://donggeshen.pages.dev/

Response headers

cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YTKrOnDcO%2Bvhfs%2ByGyOpVlm%2FSTxZJ8o1%2FtSfYnTlwJK0U6aaMHeiHJUMwnDjgN73RzlnKBy2o25rUi9D2PJNoCskRosR7BzcHlds1Ar6lbxF%2Fn%2B8sWlZ60XIeLpR%2B4jAlNVBi7p6g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e93657c6e1628f3-LAX
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=99577&min_rtt=74120&rtt_var=36567&sent=17&recv=12&lost=0&retrans=0&sent_bytes=7176&recv_bytes=5058&delivery_rate=163&cwnd=12000&unsent_bytes=0&cid=440ed8300d68c950&ts=398&x=1", cfHdrFlush;dur=0
date
Wed, 27 Nov 2024 16:11:51 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
hejfck90xk
www.clarity.ms/tag/
689 B
1 KB
Script
General
Full URL
https://www.clarity.ms/tag/hejfck90xk
Requested by
Host: donggeshen.pages.dev
URL: https://donggeshen.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f72264d55fc6afb3e6ed1b0909eaada7d12132a844d2f0d227d587d57856565a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://donggeshen.pages.dev/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
689
date
Wed, 27 Nov 2024 16:11:51 GMT
content-type
application/x-javascript
x-azure-ref
20241127T161151Z-166fdcf7d95sls8hhC1LAX09xg00000001n000000000k5fb
clarity.js
www.clarity.ms/s/0.7.56/
66 KB
28 KB
Script
General
Full URL
https://www.clarity.ms/s/0.7.56/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/hejfck90xk
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dc1da692990307185621fd661b7305e29d3a0a5ba0f0d998e5a1463a17c57044

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://donggeshen.pages.dev/

Response headers

x-azure-ref
20241127T161151Z-166fdcf7d95sls8hhC1LAX09xg00000001n000000000k5fn
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DD041B2B98F09E"
x-fd-int-roxy-purgeid
79034942
x-ms-request-id
a86b62b6-f01e-0052-1d86-3c5233000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Wed, 27 Nov 2024 16:11:51 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Wed, 13 Nov 2024 19:41:29 GMT
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=C4467DEA80694E85BD79DB76E16DFA97&RedC=c.clarity.ms&MXFR=02D659ED0F7668941C164CA90B76667C
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C4467DEA80694E85BD79DB76E16DFA97&MUID=1E1BEEDE485A69501993FB9A49A16815
42 B
464 B
Image
General
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C4467DEA80694E85BD79DB76E16DFA97&MUID=1E1BEEDE485A69501993FB9A49A16815
Protocol
H2
Server
20.110.205.119 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://donggeshen.pages.dev/

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"8d3dafd6e71fdb1:0"
accept-ranges
bytes
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
42
date
Wed, 27 Nov 2024 16:11:52 GMT
content-type
image/gif
last-modified
Wed, 16 Oct 2024 16:24:13 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET

Redirect headers

cache-control
private, no-cache, proxy-revalidate, no-store
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C4467DEA80694E85BD79DB76E16DFA97&MUID=1E1BEEDE485A69501993FB9A49A16815
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: E0CFDE5620434431AC89E33DE75E6543 Ref B: LAXEDGE1516 Ref C: 2024-11-27T16:11:52Z
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
0
date
Wed, 27 Nov 2024 16:11:52 GMT
x-powered-by
ASP.NET
favicon.ico
donggeshen.pages.dev/
1 KB
1 KB
Other
General
Full URL
https://donggeshen.pages.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bae414dcc1826c41efb1b9b8be460b242ce68ee9972e34941a88249896aeb3c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://donggeshen.pages.dev/

Response headers

cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h60%2FiYBwX3ultd%2F8HIsWPklkTm0zwxz5CSGNFVMcquQHijUWxqK24r0onCymk66dwFTWYYav8ZuI%2FZX%2Bv0iwjVORq1n6vLB9dSWE6r9T7Gi7m8ndTVEcN2ifiqjqelh8KMqqm0vO%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
cf-ray
8e9365814bad28f3-LAX
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=112775&min_rtt=74120&rtt_var=30416&sent=21&recv=17&lost=0&retrans=0&sent_bytes=8698&recv_bytes=5610&delivery_rate=36999&cwnd=12000&unsent_bytes=0&cid=440ed8300d68c950&ts=1172&x=1", cfHdrFlush;dur=0
date
Wed, 27 Nov 2024 16:11:51 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
collect
e.clarity.ms/
0
284 B
XHR
General
Full URL
https://e.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.57.85.160 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://donggeshen.pages.dev/

Response headers

Request-Context
appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
Access-Control-Allow-Origin
https://donggeshen.pages.dev
Date
Wed, 27 Nov 2024 16:11:53 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
collect
e.clarity.ms/
0
284 B
XHR
General
Full URL
https://e.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.56/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.57.85.160 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://donggeshen.pages.dev/

Response headers

Request-Context
appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608
Access-Control-Allow-Origin
https://donggeshen.pages.dev
Date
Wed, 27 Nov 2024 16:11:53 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
donggeshen.pages.dev
URL
https://donggeshen.pages.dev/shen/static/index.63b34199.css

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| clarity boolean| coverSupport

10 Cookies

Domain/Path Name / Value
www.clarity.ms/ Name: CLID
Value: af500634937a4e62b96d460c2c32a3fc.20241127.20251127
.donggeshen.pages.dev/ Name: _clck
Value: 1b2cxzr%7C2%7Cfr8%7C0%7C1792
.bing.com/ Name: MUID
Value: 1E1BEEDE485A69501993FB9A49A16815
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 1E1BEEDE485A69501993FB9A49A16815
.donggeshen.pages.dev/ Name: _clsk
Value: 2gyd7j%7C1732723913266%7C1%7C1%7Ce.clarity.ms%2Fcollect
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 1E1BEEDE485A69501993FB9A49A16815
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0

3 Console Messages

Source Level URL
Text
security error URL: https://donggeshen.pages.dev/
Message:
Refused to apply style from 'https://donggeshen.pages.dev/shen/static/index.63b34199.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security error URL: https://donggeshen.pages.dev/
Message:
Refused to execute script from 'https://donggeshen.pages.dev/shen/static/js/chunk-vendors.48efd9d2.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security error URL: https://donggeshen.pages.dev/
Message:
Refused to execute script from 'https://donggeshen.pages.dev/shen/static/js/index.683d6909.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff