cdnqq.newsafe.xyz - urlscan.io

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 59.47.5.134, located in Shenyang, China and belongs to CHINANET-BACKBONE No.31,Jin-rong Street, CN. The main domain is cdnqq.newsafe.xyz.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 15th 2020. Valid for: 3 months.

This is the only time cdnqq.newsafe.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	59.47.5.134 59.47.5.134	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
1	59.47.0.208 59.47.0.208	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
2	58.215.155.250 58.215.155.250	23650 (CHINANET-...) (CHINANET-JIANGSU-PROVINCE-IDC AS Number for CHINANET jiangsu province backbone)
1	203.119.206.139 203.119.206.139	37963 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.)
1	198.11.132.221 198.11.132.221	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
1	59.47.232.78 59.47.232.78	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
7	6

1 59.47.5.134 (Shenyang, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
PTR: 134.5.47.59.broad.bx.ln.dynamic.163data.com.cn

cdnqq.newsafe.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 59.47.0.208 (Shenyang, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
PTR: 208.0.47.59.broad.bx.ln.dynamic.163data.com.cn

m208.zzcm5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 58.215.155.250 (China)

ASN23650 (CHINANET-JIANGSU-PROVINCE-IDC AS Number for CHINANET jiangsu province backbone, CN)

s4.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 203.119.206.139 (China)

ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN)

z3.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.11.132.221 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

cnzz.mmstat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 59.47.232.78 (Benxi, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cnzz.com s4.cnzz.com c.cnzz.com z3.cnzz.com	5 KB
1	hunlaife.cn www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn	69 B
1	mmstat.com cnzz.mmstat.com	432 B
1	zzcm5.com m208.zzcm5.com	143 B
1	newsafe.xyz cdnqq.newsafe.xyz	804 B
7	5

	Domain	Requested by
1	www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn	cdnqq.newsafe.xyz
1	cnzz.mmstat.com	cdnqq.newsafe.xyz
1	z3.cnzz.com	cdnqq.newsafe.xyz
1	c.cnzz.com	s4.cnzz.com
1	s4.cnzz.com	cdnqq.newsafe.xyz
1	m208.zzcm5.com	cdnqq.newsafe.xyz
1	cdnqq.newsafe.xyz
7	7

This site contains no links.

Subject Issuer	Validity	Valid
m134.newsafe.xyz Let's Encrypt Authority X3	`2020-09-15` - `2020-12-14`	3 months	crt.sh
m208.zzcm5.com Encryption Everywhere DV TLS CA - G1	`2019-09-16` - `2020-09-15`	a year	crt.sh
*.cnzz.com GlobalSign Organization Validation CA - SHA256 - G2	`2020-02-04` - `2021-02-04`	a year	crt.sh
*.mmstat.com GlobalSign Organization Validation CA - SHA256 - G2	`2020-07-16` - `2021-07-17`	a year	crt.sh
www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn TrustAsia TLS RSA CA	`2020-05-16` - `2021-05-17`	a year	crt.sh

This page contains 1 frames:

Frame: https://www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn/llq_97/pundefinedz.html?&ip=185.212.171.67
Frame ID: B22F7F502CC45F3E2941EF0EE05296F5
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

5
Domains

7
Subdomains

6
IPs

2
Countries

7 kB
Transfer

14 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	Primary Request / Show response cdnqq.newsafe.xyz/	2 KB 804 B	1296ms 214ms	Document text/html	59.47.5.134 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://cdnqq.newsafe.xyz/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 59.47.5.134 Shenyang, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS 134.5.47.59.broad.bx.ln.dynamic.163data.com.cn Software nginx / Resource Hash `738dee8157bb031b81b4b9bd98d2ed9ef1b0df2683210310022abc19f9f79c38` Request headers :method GET :authority cdnqq.newsafe.xyz :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 403 server nginx date Tue, 15 Sep 2020 09:38:11 GMT content-type text/html vary Accept-Encoding etag W/"5ed10dd1-602" content-encoding gzip
GET H2	200	ip.php Show response m208.zzcm5.com/	24 B 143 B	718ms 212ms	Script text/html	59.47.0.208 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://m208.zzcm5.com/ip.php Requested by Host: cdnqq.newsafe.xyz URL: https://cdnqq.newsafe.xyz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 59.47.0.208 Shenyang, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS 208.0.47.59.broad.bx.ln.dynamic.163data.com.cn Software nginx / Resource Hash `dfa9693d9d0618e286af9caca24a6eca2c84db61ffe15d09cdd7e7f43c9081f9` Request headers Referer https://cdnqq.newsafe.xyz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Tue, 15 Sep 2020 09:38:12 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=UTF-8
GET H2	200	z_stat.php Show response s4.cnzz.com/	12 KB 4 KB	1011ms 506ms	Script application/javascript	58.215.155.250 CHINANET-JIANGSU-...
General Check archive.org Show headers Download Go to Full URL https://s4.cnzz.com/z_stat.php?id=1278551818&web_id=1278551818 Requested by Host: cdnqq.newsafe.xyz URL: https://cdnqq.newsafe.xyz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 58.215.155.250 , China, ASN23650 (CHINANET-JIANGSU-PROVINCE-IDC AS Number for CHINANET jiangsu province backbone, CN), Reverse DNS Software Tengine / PHP/5.5.25 Resource Hash `c1fa9d2a976148be89b92c090624b2fefac906afec1a50683a557a05099b26a6` Request headers Referer https://cdnqq.newsafe.xyz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 15 Sep 2020 08:19:58 GMT content-encoding gzip age 4695 x-powered-by PHP/5.5.25 x-cache MISS TCP_MISS dirn:13:97947667 status 200 x-swift-cachetime 705 x-swift-savetime Tue, 15 Sep 2020 09:38:13 GMT content-length 4082 last-modified Tue, 15 Sep 2020 08:19:58 GMT server Tengine vary Accept-Encoding ali-swift-global-savetime 1600157998 content-type application/javascript via cache49.l2cn1807[0,200-0,H], cache3.l2cn1807[0,0], cache2.cn2176[5,200-0,M], cache3.cn2176[6,0] cache-control max-age=5400,s-maxage=5400 timing-allow-origin * eagleid 3ad79b1716001626931497514e
GET H2	200	core.php Show response c.cnzz.com/	969 B 872 B	277ms 276ms	Script application/javascript	58.215.155.250 CHINANET-JIANGSU-...
General Check archive.org Show headers Download Go to Full URL https://c.cnzz.com/core.php?web_id=1278551818&t=z Requested by Host: s4.cnzz.com URL: https://s4.cnzz.com/z_stat.php?id=1278551818&web_id=1278551818 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 58.215.155.250 , China, ASN23650 (CHINANET-JIANGSU-PROVINCE-IDC AS Number for CHINANET jiangsu province backbone, CN), Reverse DNS Software Tengine / PHP/5.5.25 Resource Hash `74e51c290328b5dd28be15e456b063e22f5b7bf3218b52ffa99c72b12ad990f5` Request headers Referer https://cdnqq.newsafe.xyz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 15 Sep 2020 09:38:13 GMT content-encoding gzip x-swift-cachetime 900 x-powered-by PHP/5.5.25 x-cache MISS TCP_MISS dirn:12:12801031 status 200 x-swift-savetime Tue, 15 Sep 2020 09:38:13 GMT last-modified Tue, 15 Sep 2020 09:38:13 GMT server Tengine vary Accept-Encoding ali-swift-global-savetime 1600162693 content-type application/javascript via cache25.l2cn1807[38,200-0,M], cache50.l2cn1807[38,0], cache5.cn2176[44,200-0,M], cache3.cn2176[45,0] timing-allow-origin * eagleid 3ad79b1716001626933897754e expires Tue, 15 Sep 2020 09:53:13 GMT
GET H2	200	stat.htm z3.cnzz.com/	2 B 112 B	1153ms 206ms	Image text/html	203.119.206.139 CNNIC-ALIBABA-CN-...
General Check archive.org Show headers Download Go to Show image Full URL https://z3.cnzz.com/stat.htm?id=1278551818&r=&lg=en-us&ntime=none&cnzz_eid=1878708001-1600157998-&showp=1600x1200&p=https%3A%2F%2Fcdnqq.newsafe.xyz%2F&t=&umuuid=1749121009e5db-0b62b22e39ba01-1b396256-1d4c00-1749121009f7fc&h=1&rnd=478004051 Requested by Host: cdnqq.newsafe.xyz URL: https://cdnqq.newsafe.xyz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 203.119.206.139 , China, ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN), Reverse DNS Software nginx / Resource Hash Request headers Referer https://cdnqq.newsafe.xyz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Tue, 15 Sep 2020 09:38:14 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	200	9.gif cnzz.mmstat.com/	43 B 432 B	471ms 157ms	Image image/gif	198.11.132.221 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://cnzz.mmstat.com/9.gif?abc=1&rnd=836774642 Requested by Host: cdnqq.newsafe.xyz URL: https://cdnqq.newsafe.xyz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 198.11.132.221 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash Request headers Referer https://cdnqq.newsafe.xyz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 15 Sep 2020 09:38:13 GMT server nginx p3p CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV" status 200 cache-control no-cache content-type image/gif content-length 43 expires Thu, 01 Jan 1970 00:00:01 GMT
GET H2	404	pundefinedz.html Show response www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn/llq_97/	0 69 B	619ms 202ms	Document text/html	59.47.232.78 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn/llq_97/pundefinedz.html?&ip=185.212.171.67 Requested by Host: cdnqq.newsafe.xyz URL: https://cdnqq.newsafe.xyz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 59.47.232.78 Benxi, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software nginx / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers :method GET :authority www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn :scheme https :path /llq_97/pundefinedz.html?&ip=185.212.171.67 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://cdnqq.newsafe.xyz/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cdnqq.newsafe.xyz/ Response headers status 404 server nginx date Tue, 15 Sep 2020 09:37:57 GMT content-type text/html content-length 0 etag "5d157701-0"

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdnqq.newsafe.xyz/(Line 44) Message:
console-api	log	URL: https://cdnqq.newsafe.xyz/(Line 55) Message: undefined
console-api	log	URL: https://cdnqq.newsafe.xyz/(Line 59) Message: https://www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn/llq_97/pundefinedz.html?&ip=185.212.171.67

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.cnzz.com
cdnqq.newsafe.xyz
cnzz.mmstat.com
m208.zzcm5.com
s4.cnzz.com
www.baidu.com.sogou.360.cn.qq.com.hunlaife.cn
z3.cnzz.com
198.11.132.221
203.119.206.139
58.215.155.250
59.47.0.208
59.47.232.78
59.47.5.134
738dee8157bb031b81b4b9bd98d2ed9ef1b0df2683210310022abc19f9f79c38
74e51c290328b5dd28be15e456b063e22f5b7bf3218b52ffa99c72b12ad990f5
c1fa9d2a976148be89b92c090624b2fefac906afec1a50683a557a05099b26a6
dfa9693d9d0618e286af9caca24a6eca2c84db61ffe15d09cdd7e7f43c9081f9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

cdnqq.newsafe.xyz Open in urlscan Pro 59.47.5.134 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

0 %IPv6

5 Domains

7 Subdomains

6 IPs

2 Countries

7 kBTransfer

14 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

cdnqq.newsafe.xyz Open in urlscan Pro
59.47.5.134 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

0 %
IPv6

5
Domains

7
Subdomains

6
IPs

2
Countries

7 kB
Transfer

14 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions