Overview

URL ad.51pc114.cn/ad/dd2.htm
IP121.40.44.51
ASNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.
Location China
Report completed2018-06-23 01:56:03 CEST
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2018-06-23 2 ad.51pc114.cn/ad/dd2.htm Malware
2018-06-23 2 js.tongji.linezing.com/2048519/tongji.js Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 121.40.44.51

Date UQ / IDS / BL URL IP
2018-07-15 13:40:57 +0200
0 - 0 - 1 ad.51pc114.cn/ad9.htm 121.40.44.51
2018-07-15 13:40:49 +0200
0 - 0 - 1 ad.51pc114.cn/ad/td1.htm 121.40.44.51
2018-07-15 11:40:29 +0200
0 - 0 - 1 ad.51pc114.cn/ad/kj23.htm 121.40.44.51
2018-07-15 11:40:28 +0200
0 - 0 - 1 ad.51pc114.cn/ad/td1.htm 121.40.44.51
2018-07-15 05:42:50 +0200
0 - 0 - 2 ad.51pc114.cn/ad/ffdd24.htm 121.40.44.51
2018-07-15 05:42:48 +0200
0 - 0 - 1 ad.51pc114.cn/1.htm 121.40.44.51
2018-07-15 05:42:46 +0200
0 - 0 - 2 ad.51pc114.cn/ad/dd2.htm 121.40.44.51
2018-07-13 22:43:33 +0200
0 - 0 - 2 ad.51pc114.cn/ad/ffdd24.htm 121.40.44.51
2018-07-13 19:43:19 +0200
0 - 0 - 1 ad.51pc114.cn/1.htm 121.40.44.51
2018-07-13 15:43:22 +0200
0 - 0 - 1 ad.51pc114.cn/ad/td1.htm 121.40.44.51

Last 10 reports on ASN: AS37963 Hangzhou Alibaba Advertising Co.,Ltd.

Date UQ / IDS / BL URL IP
2018-07-15 14:32:55 +0200
0 - 0 - 1 www.365freesoft.com/downloadfiles/Tetris_Setup.zip 115.28.15.106
2018-07-15 14:17:04 +0200
0 - 1 - 0 ffmmvv.top/ 115.28.254.133
2018-07-15 14:03:26 +0200
0 - 0 - 0 greatbit.com 121.40.27.21
2018-07-15 13:40:57 +0200
0 - 0 - 1 ad.51pc114.cn/ad9.htm 121.40.44.51
2018-07-15 13:40:49 +0200
0 - 0 - 1 ad.51pc114.cn/ad/td1.htm 121.40.44.51
2018-07-15 13:39:38 +0200
0 - 4 - 1 22243.xc.tduou.com/xiaz/u82f1u96c4u8fde2u4e2d (...) 101.201.62.45
2018-07-15 13:31:16 +0200
2 - 0 - 1 wonpon.com/chongzhixitong 115.28.128.78
2018-07-15 13:30:49 +0200
0 - 0 - 1 www.365freesoft.com/downloadfiles/Tetris_Setup.zip 115.28.15.106
2018-07-15 13:20:26 +0200
0 - 0 - 1 www.365freesoft.com/downloadfiles/Tetris_Setup.zip 115.28.15.106
2018-07-15 12:46:45 +0200
0 - 4 - 0 22208.xc.17yyba.com/xiaz/codevisionavru7834u8 (...) 101.201.62.45

No other reports on domain: 51pc114.cn



JavaScript

Executed Scripts (2)


Executed Evals (0)


Executed Writes (2)

#1 JavaScript::Write (size: 81, repeated: 1) - SHA256: b48413f14d93d0827156baa957a2094ae84ce79df112514353a1600fd134cf6f

                                        < div style = "background:#F0F0F0;text-align:center" > 106: No match advertising. < /div>
                                    

#2 JavaScript::Write (size: 101, repeated: 1) - SHA256: db78619f769134048dd46a2f699a3c866635d8fac70ac7b2963cf5ffb4276d23

                                        < script type = "text/javascript"
src = "http://popup.jointreport-switch.com/close.php?uid=1130" > < /script>
                                    


HTTP Transactions (5)


Request Response
                                        
                                            GET /ad/dd2.htm HTTP/1.1 
Host: ad.51pc114.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         121.40.44.51
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Server: nginx
Date: Fri, 22 Jun 2018 23:51:02 GMT
Last-Modified: Fri, 16 Mar 2018 05:58:16 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Etag: W/"5aab5cf8-5d2"
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   791
Md5:    177f01caf2652556625fb9d1ce75a8ab
Sha1:   c86f45076fcc33a5e4cb97aa231647ad2c17d07b
Sha256: 3e90c51fb98f0a52a7dd98f809125cb61cee1c8f85a17e7ed9c2b403d20d5ba0

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /close.php?uid=1130 HTTP/1.1 
Host: popup.jointreport-switch.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ad.51pc114.cn/ad/dd2.htm

                                         
                                         115.238.244.82
HTTP/1.1 200 OK
Content-Type: text/html; charset=gb2312
                                        
Server: tengine
Date: Fri, 22 Jun 2018 23:55:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.28
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache, must-revalidate


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   102
Md5:    4994713b6ebaacb5f5b0b8ea931732d1
Sha1:   4ba5b275a009c60fb751fcaac3031ce705bdcf9f
Sha256: 65c6a52948c9dbb6927b5c69fd6f7fd33fd89ad089ab272918903d5a539ad174
                                        
                                            GET /2048519/tongji.js HTTP/1.1 
Host: js.tongji.linezing.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ad.51pc114.cn/ad/dd2.htm

                                         
                                         213.244.178.240
HTTP/1.1 504 Gateway Time-out
Content-Type: application/x-javascript
                                        
Server: Tengine
Content-Length: 0
Connection: keep-alive
Via: cache8.l2hk1[0,504-269,M], cache27.l2hk1[10001,0], cache6.nl1[10483,504-1281,M], cache5.nl1[10480,10484,504001]
X-Swift-Error: forward connect timeout, orig response 5xx error
Age: 0
X-Cache: MISS TCP_MISS dirn:-2:-2 mlen:-1
X-Swift-SaveTime: Fri, 22 Jun 2018 23:55:45 GMT
X-Swift-CacheTime: 1
Timing-Allow-Origin: *
EagleId: d5f4b28515297117248557290e


--- Additional Info ---

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: ad.51pc114.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         121.40.44.51
HTTP/1.1 200 OK
Content-Type: image/x-icon
                                        
Server: nginx
Date: Fri, 22 Jun 2018 23:51:24 GMT
Content-Length: 5558
Last-Modified: Mon, 02 Apr 2018 02:27:11 GMT
Connection: keep-alive
Etag: "5ac194ff-15b6"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  MS Windows icon resource - 1 icon
Size:   5558
Md5:    3abd37506e4577e502f7acafa694e606
Sha1:   575d50871cd155fca3bcf2281a3791324a10c12c
Sha256: a51222cf44af8ccced7b886975eb501abe60d1f7f4f7d9e816c64718b5c03bf0
                                        
                                            GET /fclose.php?id=152695 HTTP/1.1 
Host: u291014.778669.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://ad.51pc114.cn/ad/dd2.htm

                                         
                                         0.0.0.0
                                        


--- Additional Info ---