Overview

URL jeansexpo.com/hangyexinwen/15.html
IP104.222.239.106
ASNAS22552 eSited Solutions
Location United States
Report completed2018-12-03 12:43:08 CET
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2018-12-03 2 jeansexpo.com/hangyexinwen/15.html Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 7 reports on IP: 104.222.239.106

Date UQ / IDS / BL URL IP
2018-12-27 14:45:32 +0100
0 - 0 - 1 jeansexpo.com/attachments/2014/12/14187176605 (...) 104.222.239.106
2018-12-04 17:42:58 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/14.html 104.222.239.106
2018-11-03 03:36:37 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/11.html 104.222.239.106
2018-09-07 17:36:26 +0200
0 - 0 - 1 goldtripod.com.cn/ 104.222.239.106
2018-08-25 01:20:55 +0200
0 - 0 - 6 goldtripod.com.cn/gongsigonggao/52.html 104.222.239.106
2018-08-24 21:17:25 +0200
0 - 4 - 1 jeansexpo.com/hangyexinwen/12.html 104.222.239.106
2018-08-14 07:47:01 +0200
0 - 7 - 1 jeansexpo.com/hangyexinwen/55.html 104.222.239.106

Last 10 reports on ASN: AS22552 eSited Solutions

Date UQ / IDS / BL URL IP
2019-06-27 15:30:02 +0200
0 - 0 - 0 172.80.1.61 172.80.1.61
2019-06-10 17:55:18 +0200
0 - 0 - 1 dgzhaoxu.com/Index.html 66.254.175.133
2019-06-10 17:50:55 +0200
0 - 0 - 1 netuhaf.com/aura785668 192.119.136.53
2019-06-10 17:48:47 +0200
0 - 0 - 1 lyh123.com/a/zixun/list_2_1.html 104.171.188.230
2019-06-10 16:55:36 +0200
0 - 0 - 1 xyotc.com/index.html 104.222.225.56
2019-06-10 16:45:52 +0200
0 - 0 - 1 www.wangzhanzz.com/gongsigonggao/7.html 162.247.236.46
2019-06-10 15:51:01 +0200
0 - 0 - 1 rahasiajiwa.com/wp-content/plugins/akismete/i (...) 146.71.53.53
2019-06-10 09:30:44 +0200
0 - 0 - 1 gcslzp.com/product/class/2.html 104.221.148.30
2019-06-09 21:16:21 +0200
0 - 0 - 15 hacheyou.com/english/zhidao/gx1811302767.shtml 172.80.122.181
2019-06-09 21:15:36 +0200
0 - 0 - 1 www.hacheyou.com/english/zhidao/gx1811302767.shtml 172.80.122.181

Last 9 reports on domain: jeansexpo.com

Date UQ / IDS / BL URL IP
2019-06-05 21:54:04 +0200
0 - 0 - 1 https://www.jeansexpo.com/attachments/2014/12 (...) 157.52.204.108
2019-06-05 21:53:43 +0200
0 - 0 - 2 jeansexpo.com/attachments/2014/12/14187176605 (...) 157.52.204.108
2019-05-21 07:50:28 +0200
0 - 0 - 2 jeansexpo.com/attachments/2014/12/14187176605 (...) 157.52.204.108
2019-05-21 07:50:25 +0200
0 - 0 - 1 https://www.jeansexpo.com/attachments/2014/12 (...) 157.52.204.108
2018-12-27 14:45:32 +0100
0 - 0 - 1 jeansexpo.com/attachments/2014/12/14187176605 (...) 104.222.239.106
2018-12-04 17:42:58 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/14.html 104.222.239.106
2018-11-03 03:36:37 +0100
0 - 0 - 1 jeansexpo.com/hangyexinwen/11.html 104.222.239.106
2018-08-24 21:17:25 +0200
0 - 4 - 1 jeansexpo.com/hangyexinwen/12.html 104.222.239.106
2018-08-14 07:47:01 +0200
0 - 7 - 1 jeansexpo.com/hangyexinwen/55.html 104.222.239.106


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (8)


Request Response
                                        
                                            GET /hangyexinwen/15.html HTTP/1.1 
Host: jeansexpo.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.222.239.106
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
                                        
Location: http://43.226.67.250/shagua/KF.php
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 03 Dec 2018 11:43:36 GMT
Content-Length: 157


--- Additional Info ---
Magic:  HTML document text
Size:   157
Md5:    d085d34b778279da02102e6c19b81fc1
Sha1:   78b5f7cbeaac264c9dbe01e4cb89c44a83a8b1a2
Sha256: 0ca2b04cebc472bb45cd80ac31402fa6740bde55b3d24617bb729cb840fdb16d

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /shagua/KF.php HTTP/1.1 
Host: 43.226.67.250
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         43.226.67.250
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                        
Date: Mon, 03 Dec 2018 11:43:10 GMT
Server: Apache
X-Powered-By: PHP/7.2.4
Upgrade: h2
Connection: Upgrade, close
Location: https://www.kf6464g.com/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 226


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   226
Md5:    2fbeb5cf80f85d94bce26e7838df1b87
Sha1:   f59b8778f0e9e72e5877825b9cdefabb0a6843a8
Sha256: f153c63a4d6f6760a3abbfda14bc045450b38571e8da80e986aeef0bc854587c
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 116
Content-Type: application/ocsp-request

                                         
                                         91.135.34.24
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Sun, 02 Dec 2018 13:32:32 GMT
Etag: C161056D1CCE7A4C177756AAA3F6B068EE854038
X-OCSP-Responder-ID: (null)
Content-Length: 472
Cache-Control: public, no-transform, must-revalidate, max-age=524370
Expires: Sun, 09 Dec 2018 13:22:06 GMT
Date: Mon, 03 Dec 2018 11:42:36 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   472
Md5:    bae5d80a68a59902b02ca8fa6aca8e17
Sha1:   c161056d1cce7a4c177756aaa3f6b068ee854038
Sha256: 72e090d383be642b1a130c3e435e4e2cba9eca8d91b5789f27a6a449496f944a
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.24
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Tue, 27 Nov 2018 14:14:26 GMT
Etag: 6FA6B179CD614FE8A160C41580E33CE71C547952
X-OCSP-Responder-ID: (null)
Content-Length: 727
Cache-Control: public, no-transform, must-revalidate, max-age=94966
Expires: Tue, 04 Dec 2018 14:05:22 GMT
Date: Mon, 03 Dec 2018 11:42:36 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   727
Md5:    2104a67db4d344a5bfb3b37ad543a4f7
Sha1:   6fa6b179cd614fe8a160c41580e33ce71c547952
Sha256: ae4a997c6f6d517fa47a3454c746791e438388055f46ee8a43f81743d9809a78
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.18
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Last-Modified: Tue, 27 Nov 2018 14:14:26 GMT
Etag: 553C8792AD0C3E0A9A992944F8D02F21397A4F4B
X-OCSP-Responder-ID: (null)
Content-Length: 471
Cache-Control: public, no-transform, must-revalidate, max-age=94925
Expires: Tue, 04 Dec 2018 14:04:41 GMT
Date: Mon, 03 Dec 2018 11:42:36 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   471
Md5:    b1dd6bf93b975619ca9f8f915385a7af
Sha1:   553c8792ad0c3e0a9a992944f8d02f21397a4f4b
Sha256: 4638b368eed6bc1821c4631ef446139f80555f12500020a3b6716f43b7877cee
                                        
                                            GET / HTTP/1.1 
Host: www.kf6464g.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         103.99.61.193
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Server: salamart/250
Date: Mon, 03 Dec 2018 11:42:37 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Set-Cookie: PHPSESSID=rksp1e0sussk39r584i1brt8b1; path=/ NSC_B02_XFC=ffffffff09a81c1345525d5f4f58455e445a4a42113f;expires=Mon, 03-Dec-2018 11:52:37 GMT;path=/;httponly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: http://www.uk-k8.com
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block


--- Additional Info ---
                                        
                                            GET / HTTP/1.1 
Host: www.uk-k8.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         192.230.77.200
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Cache-Control: private
Location: https://www.uk-k8.com/
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 2.0
Set-Cookie: cmSession=Anonymousc62a6e8b-0ce6-4a3a-8a85-2019a714a277; domain=uk-k8.com; path=/; secure; HttpOnly CMS_Language=en; domain=uk-k8.com; expires=Tue, 03-Dec-2019 11:42:36 GMT; path=/ visid_incap_1069017=rJPOkzdxSpGtele3sNq2iq0WBVwAAAAAQUIPAAAAAABnyECiJPTSjjQKWizIBVv8; expires=Tue, 03 Dec 2019 08:42:45 GMT; path=/; Domain=.uk-k8.com incap_ses_722_1069017=xh+aV1OqRXzTD+QI4A8FCq0WBVwAAAAAO+/2RvWXAN9OZihNA+253w==; path=/; Domain=.uk-k8.com
X-Frame-Options: SAMEORIGIN
Date: Mon, 03 Dec 2018 11:42:35 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Connection: Keep-Alive
X-Iinfo: 12-15467506-15467507 NNNN CT(57 -1 0) RT(1543837357435 1) q(0 0 0 0) r(1 1) U2
X-CDN: Incapsula


--- Additional Info ---
Magic:  gzip compressed data, from Unix, max speed
Size:   20
Md5:    a4745abc5e7fdb89cc6df3069f3c6e69
Sha1:   74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
Sha256: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
                                        
                                            GET / HTTP/1.1 
Host: www.uk-k8.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: cmSession=Anonymousc62a6e8b-0ce6-4a3a-8a85-2019a714a277; CMS_Language=en; visid_incap_1069017=rJPOkzdxSpGtele3sNq2iq0WBVwAAAAAQUIPAAAAAABnyECiJPTSjjQKWizIBVv8; incap_ses_722_1069017=xh+aV1OqRXzTD+QI4A8FCq0WBVwAAAAAO+/2RvWXAN9OZihNA+253w==

                                         
                                         0.0.0.0
                                        


--- Additional Info ---