Report - tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A

Report Overview

Submitted URL
tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A
IP
60.190.243.166
ASN
#58461 CT-HangZhou-IDC
Submitted
2024-04-18 11:33:24
Access
public
Website Title
盾集域名停放-全球优质行业导航备案网站
Final URL
tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.365.com	unknown	2001-08-06	2012-08-24	2024-04-13	418 B	123 kB	60.190.243.166
pos.baidu.com	23488	1999-10-11	2012-05-24	2024-04-13	1.7 kB	579 B	103.235.47.190
cpro.baidustatic.com	23298	2012-03-28	2012-08-26	2024-04-06	410 B	117 kB	220.169.152.35
tf.click.com.cn	unknown	2006-07-04	2023-01-14	2024-04-13	2.1 kB	213 kB	60.190.243.166

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 11:33:02	low	60.190.243.166	Client IP	ET INFO Observed ZeroSSL SSL/TLS Certificate
2024-04-18 11:33:03	low	60.190.243.166	Client IP	ET INFO Observed ZeroSSL SSL/TLS Certificate

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	cpro.baidustatic.com/cpro/ui/cm.js	116 kB	2023-08-31	2024-04-30
Pretty URL cpro.baidustatic.com/cpro/ui/cm.js IP 220.169.152.35 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-31 08:58:28 Last Seen2024-04-30 01:14:31 Times Seen891 Hash c25fd34b2d79281d556fd8ee89e195de 2afbd212c78e23fc338d4e304485c7c4fdbff3e2 1cc1b80d4c8d0827137e8ef1d12ca63549848ae4ca3fe3fa361e073bbf01ee9a Loading...

	pos.baidu.com/auto_dup?di=0&uuid=037a57335c482cdb&dri=0&dis=0&dai=0&ps=0x0&enu=encoding&exps=110011&ant=0&psi=1c6470cc8a7c7a4e&dcb=___baidu_union_callback&dtm=AUTO_JSONP&dvi=0.0&dci=-1&dpt=none&tpr=1713439983618&ti=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE-%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E5%AF%BC%E8%88%AA%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99&ari=2&ver=0830&kws=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%EF%BC%8C%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E7%BD%91%E7%AB%99%EF%BC%8C%E8%A1%8C%E4%B8%9A%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99%2C%E5%85%8D%E8%B4%B9%E6%8F%90%E4%BA%A4%E9%93%BE%E6%8E%A5%2C&dps=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%E3%80%90dns1.dopa.com%2Cdns2.dopa.com%E3%80%91%E6%9C%AC%E7%9D%80%E8%AE%A9%E8%B5%84%E6%BA%90%E5%88%9B%E9%80%A0%E4%BB%B7%E5%80%BC%E7%9A%84%E4%BD%BF%E5%91%BD%2C%E5%8A%A9%E5%8A%9B%E6%8E%A8%E5%8A%A8%E7%BD%91%E7%BB%9C%E8%B5%84%E6%BA%90%E5%BA%94%E7%94%A8%E5%85%B1%E4%BA%AB&dbv=0&drs=3&pcs=1280x1024&pss=1280x1506&cfv=0&cpl=5&chi=2&cce=true&cec=UTF-8&tlm=1712457201&prot=2&rw=1024&ltu=https%3A%2F%2Ftf.click.com.cn%2Fshu.html%3Fpoprequest%3D1%26dm%3Dbestream.cn%26acc%3D0BC527E5-0AAB-4FFE-BA95-D51296715A6A&ecd=1&dft=0&uc=1280x1024&pis=-1x-1&sr=1280x1024&tcn=1713439984&dc=4&aa=1	59 B	2024-04-18	2024-04-18
Pretty URL pos.baidu.com/auto_dup?di=0&uuid=037a57335c482cdb&dri=0&dis=0&dai=0&ps=0x0&enu=encoding&exps=110011&ant=0&psi=1c6470cc8a7c7a4e&dcb=___baidu_union_callback&dtm=AUTO_JSONP&dvi=0.0&dci=-1&dpt=none&tpr=1713439983618&ti=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE-%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E5%AF%BC%E8%88%AA%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99&ari=2&ver=0830&kws=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%EF%BC%8C%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E7%BD%91%E7%AB%99%EF%BC%8C%E8%A1%8C%E4%B8%9A%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99%2C%E5%85%8D%E8%B4%B9%E6%8F%90%E4%BA%A4%E9%93%BE%E6%8E%A5%2C&dps=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%E3%80%90dns1.dopa.com%2Cdns2.dopa.com%E3%80%91%E6%9C%AC%E7%9D%80%E8%AE%A9%E8%B5%84%E6%BA%90%E5%88%9B%E9%80%A0%E4%BB%B7%E5%80%BC%E7%9A%84%E4%BD%BF%E5%91%BD%2C%E5%8A%A9%E5%8A%9B%E6%8E%A8%E5%8A%A8%E7%BD%91%E7%BB%9C%E8%B5%84%E6%BA%90%E5%BA%94%E7%94%A8%E5%85%B1%E4%BA%AB&dbv=0&drs=3&pcs=1280x1024&pss=1280x1506&cfv=0&cpl=5&chi=2&cce=true&cec=UTF-8&tlm=1712457201&prot=2&rw=1024&ltu=https%3A%2F%2Ftf.click.com.cn%2Fshu.html%3Fpoprequest%3D1%26dm%3Dbestream.cn%26acc%3D0BC527E5-0AAB-4FFE-BA95-D51296715A6A&ecd=1&dft=0&uc=1280x1024&pis=-1x-1&sr=1280x1024&tcn=1713439984&dc=4&aa=1 IP 103.235.47.190 ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 13:33:25 Last Seen2024-04-18 13:33:25 Times Seen2 Hash e4e0af2ae5bfe2724eff33c2a0953d8b c0aa0c7c7fb086557e0ea425a3b641cb08345755 30d410baffcb95ac81b15a64c097a7887563bfb661b8cbd7fd5ac15ee85ac525 Loading...

HTTP Transactions (7)

	URL	IP	Response	Size
	tf.click.com.cn/img/left_banner.png	60.190.243.166	200 OK	15 kB
URL GET HTTP/2 tf.click.com.cn/img/left_banner.png IP 60.190.243.166:443 ASN #58461 CT-HangZhou-IDC Requested by https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Certificate IssuerLet's Encrypt Subjectclick.com.cn Fingerprint88:A5:D6:19:42:1A:53:6A:8D:71:3D:C2:48:35:24:B4:B5:E7:F2:36 ValidityFri, 01 Mar 2024 00:28:52 GMT - Thu, 30 May 2024 00:28:51 GMT File type PNG image data, 554 x 168, 8-bit colormap, non-interlaced Size 15 kB (15173 bytes) Hash 7a4f795627e03c659ac2c823e9126c29 ab670db9cd82ee8a7cab668b0cd570be86a6c6b7 251d3311dcc8d06ab641f43a1be5650830bb30a457261de3312d15ddd663290c HTTP Headers GET /img/left_banner.png HTTP/1.1 Host: tf.click.com.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers `HTTP/2 200 OK server: openresty date: Thu, 18 Apr 2024 11:33:00 GMT content-type: image/png content-length: 15173 last-modified: Sun, 07 Apr 2024 02:23:37 GMT expires: Sat, 18 May 2024 11:33:00 GMT accept-ranges: bytes pragma: no-cache cache-control: max-age=2592000, no-store X-Firefox-Spdy: h2`

	tf.click.com.cn/img/main_bot.jpg	60.190.243.166	200 OK	180 kB
URL GET HTTP/2 tf.click.com.cn/img/main_bot.jpg IP 60.190.243.166:443 ASN #58461 CT-HangZhou-IDC Requested by https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Certificate IssuerLet's Encrypt Subjectclick.com.cn Fingerprint88:A5:D6:19:42:1A:53:6A:8D:71:3D:C2:48:35:24:B4:B5:E7:F2:36 ValidityFri, 01 Mar 2024 00:28:52 GMT - Thu, 30 May 2024 00:28:51 GMT File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x396, components 3 Size 180 kB (179852 bytes) Hash c58a3d3cef5e0bf7163496e630c887d8 5556a6292d5ebf021557c51fb2d3fb647b6eebae 614b09a9fa7a1e150b22f06443ecffd70174c102357d83bc5c9be71818a858db HTTP Headers GET /img/main_bot.jpg HTTP/1.1 Host: tf.click.com.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers `HTTP/2 200 OK server: openresty date: Thu, 18 Apr 2024 11:33:00 GMT content-type: image/jpeg content-length: 179852 last-modified: Sun, 07 Apr 2024 02:23:37 GMT expires: Sat, 18 May 2024 11:33:00 GMT accept-ranges: bytes pragma: no-cache cache-control: max-age=2592000, no-store X-Firefox-Spdy: h2`

	www.365.com/tg2024.jpeg	60.190.243.166	200 OK	123 kB
URL GET HTTP/2 www.365.com/tg2024.jpeg IP 60.190.243.166:443 ASN #58461 CT-HangZhou-IDC Requested by https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Certificate IssuerZeroSSL Subject365.com Fingerprint43:A8:C5:67:0D:FC:D7:EF:D1:4C:C9:AC:B0:52:DD:ED:7A:E8:87:48 ValidityTue, 02 Apr 2024 00:00:00 GMT - Mon, 01 Jul 2024 23:59:59 GMT File type JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1700x100, components 3 Size 123 kB (122650 bytes) Hash 5c331f7c961c8c47347c8a96e4f1fec1 0995eeeac9656230cb10252e8d17e51aaf769218 4926433ac48be2e8b237df9a3ab166dc8a8bf469b7d4733ab8c5ba2c308f051a HTTP Headers `GET /tg2024.jpeg HTTP/1.1 Host: www.365.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://tf.click.com.cn/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: openresty date: Thu, 18 Apr 2024 11:33:04 GMT content-type: image/jpeg content-length: 122650 last-modified: Tue, 02 Apr 2024 03:48:05 GMT etag: "660b7ff5-1df1a" accept-ranges: bytes X-Firefox-Spdy: h2`

	pos.baidu.com/auto_dup?di=0&uuid=037a57335c482cdb&dri=0&dis=0&dai=0&ps=0x0&enu=encoding&exps=110011&ant=0&psi=1c6470cc8a7c7a4e&dcb=___baidu_union_callback&dtm=AUTO_JSONP&dvi=0.0&dci=-1&dpt=none&tpr=1713439983618&ti=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE-%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E5%AF%BC%E8%88%AA%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99&ari=2&ver=0830&kws=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%EF%BC%8C%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E7%BD%91%E7%AB%99%EF%BC%8C%E8%A1%8C%E4%B8%9A%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99%2C%E5%85%8D%E8%B4%B9%E6%8F%90%E4%BA%A4%E9%93%BE%E6%8E%A5%2C&dps=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%E3%80%90dns1.dopa.com%2Cdns2.dopa.com%E3%80%91%E6%9C%AC%E7%9D%80%E8%AE%A9%E8%B5%84%E6%BA%90%E5%88%9B%E9%80%A0%E4%BB%B7%E5%80%BC%E7%9A%84%E4%BD%BF%E5%91%BD%2C%E5%8A%A9%E5%8A%9B%E6%8E%A8%E5%8A%A8%E7%BD%91%E7%BB%9C%E8%B5%84%E6%BA%90%E5%BA%94%E7%94%A8%E5%85%B1%E4%BA%AB&dbv=0&drs=3&pcs=1280x1024&pss=1280x1506&cfv=0&cpl=5&chi=2&cce=true&cec=UTF-8&tlm=1712457201&prot=2&rw=1024&ltu=https%3A%2F%2Ftf.click.com.cn%2Fshu.html%3Fpoprequest%3D1%26dm%3Dbestream.cn%26acc%3D0BC527E5-0AAB-4FFE-BA95-D51296715A6A&ecd=1&dft=0&uc=1280x1024&pis=-1x-1&sr=1280x1024&tcn=1713439984&dc=4&aa=1	103.235.47.190	200 OK	59 B
URL GET HTTP/1.1 pos.baidu.com/auto_dup?di=0&uuid=037a57335c482cdb&dri=0&dis=0&dai=0&ps=0x0&enu=encoding&exps=110011&ant=0&psi=1c6470cc8a7c7a4e&dcb=___baidu_union_callback&dtm=AUTO_JSONP&dvi=0.0&dci=-1&dpt=none&tpr=1713439983618&ti=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE-%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E5%AF%BC%E8%88%AA%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99&ari=2&ver=0830&kws=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%EF%BC%8C%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E7%BD%91%E7%AB%99%EF%BC%8C%E8%A1%8C%E4%B8%9A%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99%2C%E5%85%8D%E8%B4%B9%E6%8F%90%E4%BA%A4%E9%93%BE%E6%8E%A5%2C&dps=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%E3%80%90dns1.dopa.com%2Cdns2.dopa.com%E3%80%91%E6%9C%AC%E7%9D%80%E8%AE%A9%E8%B5%84%E6%BA%90%E5%88%9B%E9%80%A0%E4%BB%B7%E5%80%BC%E7%9A%84%E4%BD%BF%E5%91%BD%2C%E5%8A%A9%E5%8A%9B%E6%8E%A8%E5%8A%A8%E7%BD%91%E7%BB%9C%E8%B5%84%E6%BA%90%E5%BA%94%E7%94%A8%E5%85%B1%E4%BA%AB&dbv=0&drs=3&pcs=1280x1024&pss=1280x1506&cfv=0&cpl=5&chi=2&cce=true&cec=UTF-8&tlm=1712457201&prot=2&rw=1024&ltu=https%3A%2F%2Ftf.click.com.cn%2Fshu.html%3Fpoprequest%3D1%26dm%3Dbestream.cn%26acc%3D0BC527E5-0AAB-4FFE-BA95-D51296715A6A&ecd=1&dft=0&uc=1280x1024&pis=-1x-1&sr=1280x1024&tcn=1713439984&dc=4&aa=1 IP 103.235.47.190:443 ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd. Requested by https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Certificate IssuerGlobalSign nv-sa Subjectbaidu.com Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT File type ASCII text, with no line terminators Size 59 B (59 bytes) Hash e4e0af2ae5bfe2724eff33c2a0953d8b c0aa0c7c7fb086557e0ea425a3b641cb08345755 30d410baffcb95ac81b15a64c097a7887563bfb661b8cbd7fd5ac15ee85ac525 HTTP Headers GET /auto_dup?di=0&uuid=037a57335c482cdb&dri=0&dis=0&dai=0&ps=0x0&enu=encoding&exps=110011&ant=0&psi=1c6470cc8a7c7a4e&dcb=___baidu_union_callback&dtm=AUTO_JSONP&dvi=0.0&dci=-1&dpt=none&tpr=1713439983618&ti=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE-%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E5%AF%BC%E8%88%AA%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99&ari=2&ver=0830&kws=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%EF%BC%8C%E5%85%A8%E7%90%83%E4%BC%98%E8%B4%A8%E8%A1%8C%E4%B8%9A%E7%BD%91%E7%AB%99%EF%BC%8C%E8%A1%8C%E4%B8%9A%E5%A4%87%E6%A1%88%E7%BD%91%E7%AB%99%2C%E5%85%8D%E8%B4%B9%E6%8F%90%E4%BA%A4%E9%93%BE%E6%8E%A5%2C&dps=%E7%9B%BE%E9%9B%86%E5%9F%9F%E5%90%8D%E5%81%9C%E6%94%BE%E3%80%90dns1.dopa.com%2Cdns2.dopa.com%E3%80%91%E6%9C%AC%E7%9D%80%E8%AE%A9%E8%B5%84%E6%BA%90%E5%88%9B%E9%80%A0%E4%BB%B7%E5%80%BC%E7%9A%84%E4%BD%BF%E5%91%BD%2C%E5%8A%A9%E5%8A%9B%E6%8E%A8%E5%8A%A8%E7%BD%91%E7%BB%9C%E8%B5%84%E6%BA%90%E5%BA%94%E7%94%A8%E5%85%B1%E4%BA%AB&dbv=0&drs=3&pcs=1280x1024&pss=1280x1506&cfv=0&cpl=5&chi=2&cce=true&cec=UTF-8&tlm=1712457201&prot=2&rw=1024&ltu=https%3A%2F%2Ftf.click.com.cn%2Fshu.html%3Fpoprequest%3D1%26dm%3Dbestream.cn%26acc%3D0BC527E5-0AAB-4FFE-BA95-D51296715A6A&ecd=1&dft=0&uc=1280x1024&pis=-1x-1&sr=1280x1024&tcn=1713439984&dc=4&aa=1 HTTP/1.1 Host: pos.baidu.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://tf.click.com.cn/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Cache-Control: post-check=0, pre-check=0 Connection: keep-alive Content-Length: 59 Content-Type: application/javascript;charset=UTF-8 Date: Thu, 18 Apr 2024 11:33:13 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Last-Modified: Thu Apr 18 19:33:13 2024 P3p: CP=" OTI DSP COR IVA OUR IND COM " Pragma: no-cache Server: nginx Set-Cookie: BAIDUID=8FE67A1AFD13C3317DCE364759D22A56:FG=1; expires=Fri, 18-Apr-55 11:33:13 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 X-Xss-Protection: 0

	tf.click.com.cn/favicon.ico	60.190.243.166	404 Not Found	138 B
URL GET HTTP/2 tf.click.com.cn/favicon.ico IP 60.190.243.166:443 ASN #58461 CT-HangZhou-IDC Requested by https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Certificate IssuerLet's Encrypt Subjectclick.com.cn Fingerprint88:A5:D6:19:42:1A:53:6A:8D:71:3D:C2:48:35:24:B4:B5:E7:F2:36 ValidityFri, 01 Mar 2024 00:28:52 GMT - Thu, 30 May 2024 00:28:51 GMT File type HTML document, ASCII text, with no line terminators Size 138 B (138 bytes) Hash 3b46d87e0e86d52ea0d2f8fab44c53d6 667cfb6b3452b96310c6a9d791b7e452b77e2174 62de828a32e36ab676f57d291690df36bce3eed05a6693b009ac147c27d5a606 HTTP Headers `GET /favicon.ico HTTP/1.1 Host: tf.click.com.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` `HTTP/2 404 Not Found server: openresty date: Thu, 18 Apr 2024 11:33:01 GMT content-type: text/html content-encoding: gzip X-Firefox-Spdy: h2`

	tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A	60.190.243.166	200 OK	16 kB
URL User Request GET HTTP/2 tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A IP 60.190.243.166:443 ASN #58461 CT-HangZhou-IDC Certificate IssuerLet's Encrypt Subjectclick.com.cn Fingerprint88:A5:D6:19:42:1A:53:6A:8D:71:3D:C2:48:35:24:B4:B5:E7:F2:36 ValidityFri, 01 Mar 2024 00:28:52 GMT - Thu, 30 May 2024 00:28:51 GMT File type Size 16 kB (16415 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A HTTP/1.1 Host: tf.click.com.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 200 OK server: openresty date: Thu, 18 Apr 2024 11:33:00 GMT content-type: text/html last-modified: Sun, 07 Apr 2024 02:33:21 GMT vary: Accept-Encoding content-encoding: gzip pragma: no-cache cache-control: no-store X-Firefox-Spdy: h2`

	cpro.baidustatic.com/cpro/ui/cm.js	220.169.152.35	200 OK	116 kB
URL GET HTTP/2 cpro.baidustatic.com/cpro/ui/cm.js IP 220.169.152.35:443 ASN #4134 Chinanet Requested by https://tf.click.com.cn/shu.html?poprequest=1&dm=bestream.cn&acc=0BC527E5-0AAB-4FFE-BA95-D51296715A6A Certificate IssuerGlobalSign nv-sa Subjectbaidu.com Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT File type Size 116 kB (116257 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /cpro/ui/cm.js HTTP/1.1 Host: cpro.baidustatic.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://tf.click.com.cn/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: JSP3/2.0.14 date: Thu, 18 Apr 2024 11:33:03 GMT content-type: text/javascript; charset=utf-8 expires: Thu, 18 Apr 2024 11:40:34 GMT last-modified: Wed, 30 Aug 2023 02:38:15 GMT cache-control: max-age=3600 content-encoding: br age: 3149 accept-ranges: bytes ohc-global-saved-time: Thu, 18 Apr 2024 10:40:34 GMT ohc-cache-hit: yy2ct72 [2], czix162 [2] ohc-file-size: 38994 x-cache-status: HIT X-Firefox-Spdy: h2`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (7)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN