Submitted URL: http://qr20.cn/CyiUx6
Effective URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL...
Submission: On August 13 via manual from HK — Scanned from DE

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 7 HTTP transactions. The main IP is 47.110.175.101, located in Hangzhou, China and belongs to ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN. The main domain is targurl.clewm.net.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on July 3rd 2023. Valid for: a year.
This is the only time targurl.clewm.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: Zip archive data, at least v2.0 to extract
Size: 42 MB (43537670 bytes, 100% done)
Downloaded from: http://w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/fileDownload?apkType=huawei

Domain & IP information

IP Address AS Autonomous System
1 1 47.98.169.181 37963 (ALIBABA-C...)
1 47.110.175.101 37963 (ALIBABA-C...)
2 163.181.92.231 24429 (TAOBAO Zh...)
2 103.235.46.191 55967 (BAIDU Bei...)
1 14.137.139.105 136907 (HWCLOUDS-...)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 5
Apex Domain
Subdomains
Transfer
3 clewm.net
targurl.clewm.net
static.clewm.net — Cisco Umbrella Rank: 595299
16 KB
2 baidu.com
hm.baidu.com — Cisco Umbrella Rank: 9388
12 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 114
337 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 54
345 B
1 huawei.com
w3m.huawei.com — Cisco Umbrella Rank: 478736
1 qr20.cn
qr20.cn
878 B
7 6
Domain Requested by
2 hm.baidu.com targurl.clewm.net
2 static.clewm.net targurl.clewm.net
static.clewm.net
1 stats.g.doubleclick.net
1 www.google-analytics.com 1 redirects
1 w3m.huawei.com targurl.clewm.net
1 targurl.clewm.net
1 qr20.cn 1 redirects
7 7

This site contains no links.

Subject Issuer Validity Valid
*.clewm.net
Encryption Everywhere DV TLS CA - G1
2023-07-03 -
2024-07-03
a year crt.sh
baidu.com
GlobalSign RSA OV SSL CA 2018
2023-07-06 -
2024-08-06
a year crt.sh

This page contains 1 frames:

Frame: http://w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/fileDownload?apkType=huawei
Frame ID: 811B3C415DFE57BF592F233196218F19
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://qr20.cn/CyiUx6 HTTP 301
    https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZ... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • hm\.baidu\.com/hm\.js

Overall confidence: 100%
Detected patterns

Page Statistics

7
Requests

71 %
HTTPS

29 %
IPv6

6
Domains

7
Subdomains

5
IPs

4
Countries

28 kB
Transfer

58 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://qr20.cn/CyiUx6 HTTP 301
    https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=ec06316ed2fa7dbb091922964b27a47ee65c725875 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://www.google-analytics.com/r/collect?v=1&_v=j46&a=1828084562&t=pageview&_s=1&dl=https%3A%2F%2Ftargurl.clewm.net%2Fjump%3Fcoding%3DCyiUx6%26targurl%3DaHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%252FYXBrVHlwZT1odWF3ZWk%253D%26key%3Dec06316ed2fa7dbb091922964b27a47ee65c725875&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=AEAAAEABI~&jid=697550068&cid=1023542389.1691922879&tid=UA-84134968-1&_r=1&z=1883166151 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1023542389.1691922879&jid=697550068&_v=j46&z=1883166151

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request jump
targurl.clewm.net/
Redirect Chain
  • http://qr20.cn/CyiUx6
  • https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key...
819 B
2 KB
Document
General
Full URL
https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=ec06316ed2fa7dbb091922964b27a47ee65c725875
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.110.175.101 Hangzhou, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software
morrighan /
Resource Hash
4133ca465aeac7ab0176adbd97507d7e7aec181df9cb379117a95e22da5a2479

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
ctoken,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,request_type,Auth-CL,Caoliao-Identity-Flag,sentry-trace
Access-Control-Allow-Methods
PUT,POST,GET,OPTIONS
Cache-Control
private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Date
Sun, 13 Aug 2023 10:34:37 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
morrighan
Transfer-Encoding
chunked

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Sun, 13 Aug 2023 10:34:36 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=ec06316ed2fa7dbb091922964b27a47ee65c725875
Pragma
no-cache
Server
morrighan
cli_analytics.js
static.clewm.net/public/
1 KB
1 KB
Script
General
Full URL
https://static.clewm.net/public/cli_analytics.js
Requested by
Host: targurl.clewm.net
URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=ec06316ed2fa7dbb091922964b27a47ee65c725875
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
163.181.92.231 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
e6d0c92f1ad7ce7ed7e2585a6c4ba0190d1382356f2598651bef0f7fe2b3becd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 29 Jun 2023 14:33:37 GMT
via
cache5.l2de2[0,0,200-0,H], cache16.l2de2[1,0], ens-cache4.de5[0,0,200-0,H], ens-cache13.de5[1,0]
content-encoding
br
age
3873661
x-swift-cachetime
6312099
x-cache
HIT TCP_MEM_HIT dirn:3:587244548
x-swift-savetime
Sun, 16 Jul 2023 13:11:58 GMT
last-modified
Tue, 16 May 2023 17:05:37 GMT
server
Tengine
etag
W/"6463b7e1-473"
vary
Accept-Encoding
ali-swift-global-savetime
1688049217
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-methods
GET,POST,PUT,HEAD,OPTIONS
timing-allow-origin
*
eagleid
a3b55ca116919228786805166e
hm.js
hm.baidu.com/
29 KB
12 KB
Script
General
Full URL
https://hm.baidu.com/hm.js?702c43c086294cf6b0a2474d75381e26
Requested by
Host: targurl.clewm.net
URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=ec06316ed2fa7dbb091922964b27a47ee65c725875
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),
Reverse DNS
Software
apache /
Resource Hash
e79a451456ed58e766d57485798b177156089b7b58b3c36d75fcc74616dd04a9
Security Headers
Name Value
Strict-Transport-Security max-age=172800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Sun, 13 Aug 2023 10:34:38 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=172800
Server
apache
Etag
757aabaee8c0af5912f7eab3fb397f70
P3p
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type
application/javascript
Cache-Control
max-age=0, must-revalidate
Content-Length
11306
analytics.js
static.clewm.net/public/
27 KB
13 KB
Script
General
Full URL
https://static.clewm.net/public/analytics.js
Requested by
Host: static.clewm.net
URL: https://static.clewm.net/public/cli_analytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
163.181.92.231 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
4344462fab66b7d9d12cdbcf54b45fc2f366f305ef7c1b19b7e7a8f7f4e67603

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 29 Jun 2023 11:13:51 GMT
via
cache7.l2de2[0,0,200-0,H], cache12.l2de2[1,0], ens-cache12.de5[0,0,200-0,H], ens-cache13.de5[1,0]
content-encoding
br
age
3885647
x-swift-cachetime
4157685
x-cache
HIT TCP_MEM_HIT dirn:13:925569109
x-swift-savetime
Thu, 10 Aug 2023 08:19:06 GMT
last-modified
Tue, 16 May 2023 17:05:37 GMT
server
Tengine
etag
W/"6463b7e1-6ca0"
vary
Accept-Encoding
ali-swift-global-savetime
1688037231
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-methods
GET,POST,PUT,HEAD,OPTIONS
timing-allow-origin
*
eagleid
a3b55ca116919228786935255e
fileDownload
w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/
0
0
Document
General
Full URL
http://w3m.huawei.com/mcloud/mag/FreeProxyForUpload/icaremp_nosoa/api/apk/fileDownload?apkType=huawei
Requested by
Host: targurl.clewm.net
URL: https://targurl.clewm.net/jump?coding=CyiUx6&targurl=aHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%2FYXBrVHlwZT1odWF3ZWk%3D&key=ec06316ed2fa7dbb091922964b27a47ee65c725875
Protocol
HTTP/1.1
Server
14.137.139.105 Frankfurt am Main, Germany, ASN136907 (HWCLOUDS-AS-AP HUAWEI CLOUDS, HK),
Reverse DNS
ecs-14-137-139-105.compute.hwclouds-dns.com
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
keep-alive
Content-Disposition
attachment; filename=iCareAPP.apk
Content-Type
application/vnd.android.package-archive;charset=utf-8
Date
Sun, 13 Aug 2023 10:34:50 GMT
Expires
0
Keep-Alive
timeout=60
MAG_icaremp_nosoa_LEVEL
0
Pragma
no-cache
Transfer-Encoding
chunked
X-ALB-SERVER
ALB/1.0.9.002
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Server-Process-Time
11.4119
X-Upstream-Process-Time
11.4079
X-XSS-Protection
1; mode=block
processtime
0.444 0.652
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j46&a=1828084562&t=pageview&_s=1&dl=https%3A%2F%2Ftargurl.clewm.net%2Fjump%3Fcoding%3DCyiUx6%26targurl%3DaHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYW...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1023542389.1691922879&jid=697550068&_v=j46&z=1883166151
35 B
337 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1023542389.1691922879&jid=697550068&_v=j46&z=1883166151
Protocol
H2
Server
2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Sun, 13 Aug 2023 10:34:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 13 Aug 2023 10:34:38 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/html; charset=UTF-8
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-84134968-1&cid=1023542389.1691922879&jid=697550068&_v=j46&z=1883166151
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
368
expires
Fri, 01 Jan 1990 00:00:00 GMT
hm.gif
hm.baidu.com/
43 B
299 B
Image
General
Full URL
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=217728915&si=702c43c086294cf6b0a2474d75381e26&v=1.3.0&lv=1&sn=5784&r=0&ww=1600&u=https%3A%2F%2Ftargurl.clewm.net%2Fjump%3Fcoding%3DCyiUx6%26targurl%3DaHR0cDovL3czbS5odWF3ZWkuY29tL21jbG91ZC9tYWcvRnJlZVByb3h5Rm9yVXBsb2FkL2ljYXJlbXBfbm9zb2EvYXBpL2Fway9maWxlRG93bmxvYWQ%252FYXBrVHlwZT1odWF3ZWk%253D%26key%3Dec06316ed2fa7dbb091922964b27a47ee65c725875
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),
Reverse DNS
Software
apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=172800
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://targurl.clewm.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 13 Aug 2023 10:34:39 GMT
Strict-Transport-Security
max-age=172800
X-Content-Type-Options
nosniff
Server
apache
Content-Type
image/gif
Cache-Control
private, max-age=0, no-cache
Content-Length
43

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _hmt string| GoogleAnalyticsObject function| ga number| c_start string| jump_url object| gaplugins object| gaGlobal object| gaData boolean| _bdhm_loaded_702c43c086294cf6b0a2474d75381e26 object| mini_tangram_log_ry8n0j

13 Cookies

Domain/Path Name / Value
qr20.cn/ Name: PHPSESSID
Value: v0jht1te6ue7ug1ud423f1mml1
qr20.cn/ Name: _uvmark[212a242b5715dbd8784a691edb408a8d]
Value: d7292db87ba9e6db30fd423c498dde7a
qr20.cn/ Name: _uvmask[212a242b5715dbd8784a691edb408a8d]
Value: 3bbf7480d380702928b4294d795055fa
targurl.clewm.net/ Name: acw_tc
Value: 707c9fd816919228770825530e4fabe7c832113a0dd4f0fb9ab5cca9d6ab56
targurl.clewm.net/ Name: PHPSESSID
Value: 9li49p15tf5355duo98t3k6rn0
.hm.baidu.com/ Name: HMACCOUNT_BFESS
Value: 76A678D66ED6102C
.clewm.net/ Name: _ga
Value: GA1.2.1023542389.1691922879
.clewm.net/ Name: _gat
Value: 1
.targurl.clewm.net/ Name: Hm_lvt_702c43c086294cf6b0a2474d75381e26
Value: 1691922879
.targurl.clewm.net/ Name: Hm_lpvt_702c43c086294cf6b0a2474d75381e26
Value: 1691922879
.huawei.com/ Name: hwssotinter
Value: 54-B3-8E-38-69-05-85-BE-D6-42-FC-8B-E3-B4-C2-CF
.huawei.com/ Name: hwssot
Value: 54-B3-8E-38-69-05-85-BE-D6-42-FC-8B-E3-B4-C2-CF
.huawei.com/ Name: magot3
Value: 30475635450717