Overview

URL jeansexpo.com/hangyexinwen/14.html
IP104.222.239.106
ASNAS22552 eSited Solutions
Location United States
Report completed2018-12-04 17:42:58 CET
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2018-12-04 2 jeansexpo.com/hangyexinwen/14.html Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 7 reports on IP: 104.222.239.106

Date UQ / IDS / BL URL IP
2018-12-27 14:45:32 +0100
0 - 0 - 1 jeansexpo.com/attachments/2014/12/14187176605 (...) 104.222.239.106
2018-12-03 12:43:08 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/15.html 104.222.239.106
2018-11-03 03:36:37 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/11.html 104.222.239.106
2018-09-07 17:36:26 +0200
0 - 0 - 1 goldtripod.com.cn/ 104.222.239.106
2018-08-25 01:20:55 +0200
0 - 0 - 6 goldtripod.com.cn/gongsigonggao/52.html 104.222.239.106
2018-08-24 21:17:25 +0200
0 - 4 - 1 jeansexpo.com/hangyexinwen/12.html 104.222.239.106
2018-08-14 07:47:01 +0200
0 - 7 - 1 jeansexpo.com/hangyexinwen/55.html 104.222.239.106

Last 10 reports on ASN: AS22552 eSited Solutions

Date UQ / IDS / BL URL IP
2019-06-27 15:30:02 +0200
0 - 0 - 0 172.80.1.61 172.80.1.61
2019-06-10 17:55:18 +0200
0 - 0 - 1 dgzhaoxu.com/Index.html 66.254.175.133
2019-06-10 17:50:55 +0200
0 - 0 - 1 netuhaf.com/aura785668 192.119.136.53
2019-06-10 17:48:47 +0200
0 - 0 - 1 lyh123.com/a/zixun/list_2_1.html 104.171.188.230
2019-06-10 16:55:36 +0200
0 - 0 - 1 xyotc.com/index.html 104.222.225.56
2019-06-10 16:45:52 +0200
0 - 0 - 1 www.wangzhanzz.com/gongsigonggao/7.html 162.247.236.46
2019-06-10 15:51:01 +0200
0 - 0 - 1 rahasiajiwa.com/wp-content/plugins/akismete/i (...) 146.71.53.53
2019-06-10 09:30:44 +0200
0 - 0 - 1 gcslzp.com/product/class/2.html 104.221.148.30
2019-06-09 21:16:21 +0200
0 - 0 - 15 hacheyou.com/english/zhidao/gx1811302767.shtml 172.80.122.181
2019-06-09 21:15:36 +0200
0 - 0 - 1 www.hacheyou.com/english/zhidao/gx1811302767.shtml 172.80.122.181

Last 9 reports on domain: jeansexpo.com

Date UQ / IDS / BL URL IP
2019-06-05 21:54:04 +0200
0 - 0 - 1 https://www.jeansexpo.com/attachments/2014/12 (...) 157.52.204.108
2019-06-05 21:53:43 +0200
0 - 0 - 2 jeansexpo.com/attachments/2014/12/14187176605 (...) 157.52.204.108
2019-05-21 07:50:28 +0200
0 - 0 - 2 jeansexpo.com/attachments/2014/12/14187176605 (...) 157.52.204.108
2019-05-21 07:50:25 +0200
0 - 0 - 1 https://www.jeansexpo.com/attachments/2014/12 (...) 157.52.204.108
2018-12-27 14:45:32 +0100
0 - 0 - 1 jeansexpo.com/attachments/2014/12/14187176605 (...) 104.222.239.106
2018-12-03 12:43:08 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/15.html 104.222.239.106
2018-11-03 03:36:37 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/11.html 104.222.239.106
2018-08-24 21:17:25 +0200
0 - 4 - 1 jeansexpo.com/hangyexinwen/12.html 104.222.239.106
2018-08-14 07:47:01 +0200
0 - 7 - 1 jeansexpo.com/hangyexinwen/55.html 104.222.239.106


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (8)


Request Response
                                        
                                            GET /hangyexinwen/14.html HTTP/1.1 
Host: jeansexpo.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.222.239.106
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
                                        
Location: http://43.226.67.250/shagua/KF.php
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 04 Dec 2018 16:46:37 GMT
Content-Length: 157


--- Additional Info ---
Magic:  HTML document text
Size:   157
Md5:    d085d34b778279da02102e6c19b81fc1
Sha1:   78b5f7cbeaac264c9dbe01e4cb89c44a83a8b1a2
Sha256: 0ca2b04cebc472bb45cd80ac31402fa6740bde55b3d24617bb729cb840fdb16d

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /shagua/KF.php HTTP/1.1 
Host: 43.226.67.250
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         43.226.67.250
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                        
Date: Tue, 04 Dec 2018 16:43:02 GMT
Server: Apache
X-Powered-By: PHP/7.2.4
Upgrade: h2
Connection: Upgrade, close
Location: https://www.kf3333g.com/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 226


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   226
Md5:    2fbeb5cf80f85d94bce26e7838df1b87
Sha1:   f59b8778f0e9e72e5877825b9cdefabb0a6843a8
Sha256: f153c63a4d6f6760a3abbfda14bc045450b38571e8da80e986aeef0bc854587c
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 116
Content-Type: application/ocsp-request

                                         
                                         91.135.34.19
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Thu, 29 Nov 2018 01:32:35 GMT
Etag: AE905E0D30D89A7132B7141179B46D47EC0F9453
X-OCSP-Responder-ID: (null)
Content-Length: 472
Cache-Control: public, no-transform, must-revalidate, max-age=117581
Expires: Thu, 06 Dec 2018 01:22:09 GMT
Date: Tue, 04 Dec 2018 16:42:28 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   472
Md5:    15805db0e6c081f3cc81530f901f1163
Sha1:   ae905e0d30d89a7132b7141179b46d47ec0f9453
Sha256: 2a3466cc1bf73dbe619031be7baa0350fc4e92402e01606cc4032c1259fe11c9
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.19
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Sat, 01 Dec 2018 02:14:26 GMT
Etag: 8AAB8C318A96E7E193622914CF2FF3FEF399DE8C
X-OCSP-Responder-ID: mcdpcaocsp13
Content-Length: 727
Cache-Control: public, no-transform, must-revalidate, max-age=292903
Expires: Sat, 08 Dec 2018 02:04:11 GMT
Date: Tue, 04 Dec 2018 16:42:28 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   727
Md5:    1f86375bc41c03933cea204f3e94c3c7
Sha1:   8aab8c318a96e7e193622914cf2ff3fef399de8c
Sha256: 9354bd1f4646204706859cf9913cccde023fe61992a1a979c34a15c46c2fb588
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.18
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Sat, 01 Dec 2018 02:14:26 GMT
Etag: A69E78F9472C8AE7C72C5296DD78E86F9F149EEB
X-OCSP-Responder-ID: (null)
Content-Length: 471
Cache-Control: public, no-transform, must-revalidate, max-age=292931
Expires: Sat, 08 Dec 2018 02:04:39 GMT
Date: Tue, 04 Dec 2018 16:42:28 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   471
Md5:    b34f3d5e8ed56db65d7597e2ff3423ee
Sha1:   a69e78f9472c8ae7c72c5296dd78e86f9f149eeb
Sha256: 35af18481be74ef84ac92ee229325d524a973386ea8fec502baa27f348ec63bc
                                        
                                            GET / HTTP/1.1 
Host: www.kf3333g.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         161.202.61.251
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Server: salamart/250
Date: Tue, 04 Dec 2018 16:42:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Set-Cookie: PHPSESSID=p7s37vr8ksmn73hp9i9kl91u73; path=/ NSC_B02_XFC=ffffffff09a81c1345525d5f4f58455e445a4a42113f;expires=Tue, 04-Dec-2018 16:52:29 GMT;path=/;httponly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: http://www.uk-k8.com
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block


--- Additional Info ---
                                        
                                            GET / HTTP/1.1 
Host: www.uk-k8.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         192.230.77.200
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Location: https://www.uk-k8.com/
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 2.0
Set-Cookie: cmSession=Anonymous55f28376-6a6d-4136-b670-d723d1a74cbf; domain=uk-k8.com; path=/; secure; HttpOnly CMS_Language=en; domain=uk-k8.com; expires=Wed, 04-Dec-2019 16:42:30 GMT; path=/ visid_incap_1069017=hcM1uxJuTZ2ZWhsa3vfXEXWuBlwAAAAAQUIPAAAAAAA1S+z3jGi3hLZ+Yd2hw+/7; expires=Wed, 04 Dec 2019 10:06:00 GMT; path=/; Domain=.uk-k8.com incap_ses_722_1069017=ISNYKOGdZGrO2IxT4g8FCnWuBlwAAAAARZyBu9q59egt/seCibvHgA==; path=/; Domain=.uk-k8.com
X-Frame-Options: SAMEORIGIN
Date: Tue, 04 Dec 2018 16:42:30 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Connection: Keep-Alive
X-Iinfo: 5-849745-849746 NNNN CT(50 -1 0) RT(1543941749852 0) q(0 0 1 0) r(1 1) U11
X-CDN: Incapsula


--- Additional Info ---
Magic:  gzip compressed data, from Unix, max speed
Size:   20
Md5:    a4745abc5e7fdb89cc6df3069f3c6e69
Sha1:   74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
Sha256: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
                                        
                                            GET / HTTP/1.1 
Host: www.uk-k8.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: cmSession=Anonymous55f28376-6a6d-4136-b670-d723d1a74cbf; CMS_Language=en; visid_incap_1069017=hcM1uxJuTZ2ZWhsa3vfXEXWuBlwAAAAAQUIPAAAAAAA1S+z3jGi3hLZ+Yd2hw+/7; incap_ses_722_1069017=ISNYKOGdZGrO2IxT4g8FCnWuBlwAAAAARZyBu9q59egt/seCibvHgA==

                                         
                                         0.0.0.0
                                        


--- Additional Info ---