Report - down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131

Report Overview

Visited public
2025-02-05 22:54:10
Tags
URL
down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe
Finishing URL
down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe
IP / ASN
156.226.123.142
#135097 LUOGELANG FRANCE LIMITED
Title
down.6lugq4fy.com/cx/22/1/å°é¹éç´æå©æå¦çç«¯_131_1147305.exe

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
down.6lugq4fy.com	unknown	2020-06-29	2021-01-12	2025-02-01	2.0 kB	1.9 kB	156.226.123.142
hm.baidu.com	8254	1999-10-11	2012-05-26	2025-02-05	1.4 kB	12 kB	14.215.183.79
168.ying888.top	unknown	2025-01-14	2025-02-01	2025-02-01	3.2 kB	205 kB	168.206.204.221

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-02-05 22:53:44	medium	168.206.204.221	Client IP	ET DROP Spamhaus DROP Listed Traffic Inbound group 29

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (8)

	URL	From	Size	First Seen	Last Seen
	unknown	Function	37 B	2023-04-11	2025-06-15
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49 Last Seen2025-06-15 09:58 Times Seen37336 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	168.ying888.top/link.js	ScriptElement	2.2 kB	2025-02-02	2025-02-05
Pretty URL 168.ying888.top/link.js IP 168.206.204.221 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-02 21:02 Last Seen2025-02-05 22:54 Times Seen10 Hash 81d5491f1c5f7e5175abbbb9211f6b2c a4c042531fab968eb53dd3391922292a95176edb e914102415fd372e7b5cda902b7455fe795c5a3279887c34bc98277c2f742693 Loading...

	unknown	Function	595 B	2025-02-05	2025-02-05
Pretty Introduced by Function Embedded in HTML false Observations First Seen2025-02-05 22:54 Last Seen2025-02-05 22:54 Times Seen1 Hash a9a801d36ba15ad3be0505dcf5df5c6c 2941509009114c5bad982c4413c89a294a40bc91 063be41ea372b19ffa30386014cea3fb2501b431a1b4abfd719c88a456a99817 Loading...

	down.6lugq4fy.com/tz.js	ScriptElement	1.2 kB	2025-02-01	2025-02-08
Pretty URL down.6lugq4fy.com/tz.js IP 156.226.123.142 ASN #135097 LUOGELANG FRANCE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-01 22:47 Last Seen2025-02-08 23:26 Times Seen18 Hash 8324ce47d293b1bfc3aa90d71fc8d83f d823593708eb27a2dbd0238edf576736c544b895 296af7e1df95674c01aac1572baf8c2a6ecbbc8c3c67bd0d22c192b95a97b22e Loading...

	168.ying888.top/static/code.js	ScriptElement	74 B	2025-02-01	2025-03-14
Pretty URL 168.ying888.top/static/code.js IP 168.206.204.221 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-01 22:47 Last Seen2025-03-14 01:52 Times Seen97 Hash 3eb7226e4128c6314bfdcd987feffad5 7d14690bca472948ebada51dabb6b59f63321b34 d8123d81cc580c2528d8d0f3c701961777678e75c5c6b56bf7afe5dc4655e847 Loading...

	hm.baidu.com/hm.js?f39d2bce62dc94cc77bdde410dce8c38	ScriptElement	30 kB	2025-02-05	2025-02-05
Pretty URL hm.baidu.com/hm.js?f39d2bce62dc94cc77bdde410dce8c38 IP 14.215.183.79 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-05 22:54 Last Seen2025-02-05 22:54 Times Seen1 Hash 5837b7a4ae5121bf58a6cc4f6682d5dd bfd6fe6b81a6cd0612f85ea12e19f65e9a9666fa f449c15882dd8ca829bad2395d60dc36cd72f77f0d0f5ff0bcb333bfff823647 Loading...

		Size	First Seen	Last Seen
	#1 Write - 74312d9fd3d0d77a65b4edf6f7a9d543	169 B	2023-03-07 12:43	2025-06-15 06:58
Pretty Observations First Seen2023-03-07 12:43 Last Seen2025-06-15 06:58 Times Seen1130 Hash 74312d9fd3d0d77a65b4edf6f7a9d543 f8f99b78a90612dba2ab0f2f96d35ef3c77cd3c6 e3932ed210d0dfb6820eacc496a3e5a609b8f011515b9324fe93b5d956a11f08 Loading...

	#2 Write - 9fdf55f7bf4885c1320768c183f34dcf	278 B	2025-02-01 22:47	2025-03-14 01:52
Pretty Observations First Seen2025-02-01 22:47 Last Seen2025-03-14 01:52 Times Seen97 Hash 9fdf55f7bf4885c1320768c183f34dcf bd257e1ae1cb526c9a03c2c8720ed3d536afce0c 1b3b21f1d65ab0cb243311351006d42f6c73239ece863dc59ffe2acb0347e38b Loading...

HTTP Transactions (13)

	URL	IP	Response	Size
	down.6lugq4fy.com/	156.226.123.142	200 OK	64 B
URL down.6lugq4fy.com/ IP 156.226.123.142:0 ASN #135097 LUOGELANG FRANCE LIMITED File type HTML document, ASCII text, with no line terminators Size 64 B (64 bytes) Hash 6ef5e94ac8a048654bbb0e332e1f4d26 90e2fa9edafc8dce78cb7044127f8e4778c4c6ac b1aa2b3d2e44bf0e0efd02f846bd91fc62ee44487a240e769ef07f158a85875a HTTP Headers `GET / HTTP/1.1 Host: down.6lugq4fy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Feb 2025 22:53:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip`

	down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe	156.226.123.142	200 OK	64 B
URL User Request GET HTTP/1.1 down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe IP 156.226.123.142:80 ASN #135097 LUOGELANG FRANCE LIMITED File type HTML document, ASCII text, with no line terminators Size 64 B (64 bytes) Hash 6ef5e94ac8a048654bbb0e332e1f4d26 90e2fa9edafc8dce78cb7044127f8e4778c4c6ac b1aa2b3d2e44bf0e0efd02f846bd91fc62ee44487a240e769ef07f158a85875a HTTP Headers GET /cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe HTTP/1.1 Host: down.6lugq4fy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Feb 2025 22:53:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip`

	down.6lugq4fy.com/tz.js	156.226.123.142	200 OK	743 B
URL GET HTTP/1.1 down.6lugq4fy.com/tz.js IP 156.226.123.142:80 ASN #135097 LUOGELANG FRANCE LIMITED Requested by http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe File type JavaScript source, Unicode text, UTF-8 text Size 743 B (743 bytes) Hash 8324ce47d293b1bfc3aa90d71fc8d83f d823593708eb27a2dbd0238edf576736c544b895 296af7e1df95674c01aac1572baf8c2a6ecbbc8c3c67bd0d22c192b95a97b22e HTTP Headers GET /tz.js HTTP/1.1 Host: down.6lugq4fy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Feb 2025 22:53:44 GMT Content-Type: application/javascript Last-Modified: Sun, 19 Jan 2025 08:53:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"678cbd8a-4d7" Expires: Thu, 06 Feb 2025 10:53:44 GMT Cache-Control: max-age=43200 Content-Encoding: gzip`

	down.6lugq4fy.com/favicon.ico	156.226.123.142	200 OK	0 B
URL GET HTTP/1.1 down.6lugq4fy.com/favicon.ico IP 156.226.123.142:80 ASN #135097 LUOGELANG FRANCE LIMITED Requested by http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /favicon.ico HTTP/1.1 Host: down.6lugq4fy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Server: nginx Date: Wed, 05 Feb 2025 22:53:44 GMT Content-Type: image/x-icon Content-Length: 0 Last-Modified: Tue, 30 Jul 2019 15:51:36 GMT Connection: keep-alive ETag: "5d406788-0" Accept-Ranges: bytes`

	hm.baidu.com/hm.js?f39d2bce62dc94cc77bdde410dce8c38	14.215.183.79	200 OK	11 kB
URL GET HTTP/1.1 hm.baidu.com/hm.js?f39d2bce62dc94cc77bdde410dce8c38 IP 14.215.183.79:443 ASN #4134 Chinanet Requested by http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe Certificate IssuerGlobalSign nv-sa Subjectbaidu.com FingerprintEF:0F:BE:13:02:E2:C4:D4:89:BA:8F:BA:88:EF:6F:95:DC:CF:7B:E0 ValidityMon, 08 Jul 2024 01:41:02 GMT - Sat, 09 Aug 2025 01:41:01 GMT File type JavaScript source, ASCII text, with very long lines (617) Size 11 kB (11287 bytes) Hash 5837b7a4ae5121bf58a6cc4f6682d5dd bfd6fe6b81a6cd0612f85ea12e19f65e9a9666fa f449c15882dd8ca829bad2395d60dc36cd72f77f0d0f5ff0bcb333bfff823647 HTTP Headers `GET /hm.js?f39d2bce62dc94cc77bdde410dce8c38 HTTP/1.1 Host: hm.baidu.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: http://down.6lugq4fy.com/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Cache-Control: max-age=0, must-revalidate Content-Encoding: gzip Content-Length: 11287 Content-Type: application/javascript Date: Wed, 05 Feb 2025 22:53:45 GMT Etag: 8f724042a681e5c0c1f847f5301d1539 P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Server: apache Set-Cookie: HMACCOUNT=3D3742978FAD488E; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT Strict-Transport-Security: max-age=172800`

	168.ying888.top/static/code.js	168.206.204.221	200 OK	116 B
URL GET HTTP/2 168.ying888.top/static/code.js IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by https://168.ying888.top/ Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type gzip compressed data, from Unix Size 116 B (116 bytes) Hash 58a0170b927a9fa5a7e0064ce9767b7c e1c87ebaa05aeae70f340b37caa0cd0b73536b29 15de3d0f7d23845973145129bb86bddaf5e9563e3707bc1f99cb4283f01b4f3b HTTP Headers `GET /static/code.js HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://168.ying888.top/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers` HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: application/javascript last-modified: Tue, 14 Jan 2025 13:57:08 GMT vary: Accept-Encoding etag: W/"67866d34-4a" expires: Thu, 06 Feb 2025 10:53:45 GMT cache-control: max-age=43200 strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2

	168.ying888.top/static/picture/kaiyun.png	168.206.204.221	200 OK	24 kB
URL GET HTTP/2 168.ying888.top/static/picture/kaiyun.png IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by https://168.ying888.top/ Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type PNG image data, 918 x 220, 8-bit colormap, non-interlaced Size 24 kB (23779 bytes) Hash 5ac1aae1401f4abd5ab81f8741e44ee9 67e8bdf179f4b0fda1c1e3f5ddccaed51dd961ca bbf1492b152a535d42b16c0c3b2dde9de8aa5b0afea11d2beefcd7c9aef066e0 HTTP Headers `GET /static/picture/kaiyun.png HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://168.ying888.top/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: image/png last-modified: Tue, 02 Apr 2024 12:20:01 GMT vary: Accept-Encoding etag: W/"660bf7f1-5ce3" expires: Fri, 07 Mar 2025 22:53:45 GMT cache-control: max-age=2592000 strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2

	168.ying888.top/static/picture/jy1.png	168.206.204.221	200 OK	62 kB
URL GET HTTP/2 168.ying888.top/static/picture/jy1.png IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by https://168.ying888.top/ Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type PNG image data, 918 x 220, 8-bit/color RGBA, non-interlaced Size 62 kB (62541 bytes) Hash dbebb8da9fe8fa1f603761cd7924c89b 53e77c74152e66387b4ae7164c110b043e32d117 70805887f90c05c5c21c9955386f0d3f186fb4fc4a723ce1fee22a138c76607b HTTP Headers `GET /static/picture/jy1.png HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://168.ying888.top/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: image/png last-modified: Tue, 02 Apr 2024 12:20:00 GMT vary: Accept-Encoding etag: W/"660bf7f0-f44d" expires: Fri, 07 Mar 2025 22:53:45 GMT cache-control: max-age=2592000 strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2

	168.ying888.top/link.js	168.206.204.221	200 OK	2.2 kB
URL GET HTTP/2 168.ying888.top/link.js IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by https://168.ying888.top/ Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type Unicode text, UTF-8 text, with very long lines (2306), with no line terminators Size 2.2 kB (2196 bytes) Hash f619178744555e100269e51b444633c0 3e0dd540bdf67a1c427993572d8d43bdd6694a99 b5ca0be849baebf713010f306fb92d731bb1f8754fe7f90b4efe373531517a6e HTTP Headers `GET /link.js HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://168.ying888.top/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: application/javascript last-modified: Sun, 02 Feb 2025 11:05:57 GMT vary: Accept-Encoding etag: W/"679f5195-894" expires: Thu, 06 Feb 2025 10:53:45 GMT cache-control: max-age=43200 strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2

	hm.baidu.com/hm.gif?hca=3D3742978FAD488E&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1711183811&si=f39d2bce62dc94cc77bdde410dce8c38&v=1.3.2&lv=1&sn=21406&r=0&ww=1280&u=http%3A%2F%2Fdown.6lugq4fy.com%2Fcx%2F22%2F1%2F%25C3%25A5%25C2%25B0%25C2%258F%25C3%25A9%25C2%25B9%25C2%2585%25C3%25A9%25C2%2580%25C2%259A%25C3%25A7%25C2%259B%25C2%25B4%25C3%25A6%25C2%2592%25C2%25AD%25C3%25A5%25C2%258A%25C2%25A9%25C3%25A6%25C2%2589%25C2%258B%25C3%25A5%25C2%25AD%25C2%25A6%25C3%25A7%25C2%2594%25C2%259F%25C3%25A7%25C2%25AB%25C2%25AF_131_1147305.exe	14.215.183.79	200 OK	43 B
URL GET HTTP/1.1 hm.baidu.com/hm.gif?hca=3D3742978FAD488E&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1711183811&si=f39d2bce62dc94cc77bdde410dce8c38&v=1.3.2&lv=1&sn=21406&r=0&ww=1280&u=http%3A%2F%2Fdown.6lugq4fy.com%2Fcx%2F22%2F1%2F%25C3%25A5%25C2%25B0%25C2%258F%25C3%25A9%25C2%25B9%25C2%2585%25C3%25A9%25C2%2580%25C2%259A%25C3%25A7%25C2%259B%25C2%25B4%25C3%25A6%25C2%2592%25C2%25AD%25C3%25A5%25C2%258A%25C2%25A9%25C3%25A6%25C2%2589%25C2%258B%25C3%25A5%25C2%25AD%25C2%25A6%25C3%25A7%25C2%2594%25C2%259F%25C3%25A7%25C2%25AB%25C2%25AF_131_1147305.exe IP 14.215.183.79:443 ASN #4134 Chinanet Requested by http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe Certificate IssuerGlobalSign nv-sa Subjectbaidu.com FingerprintEF:0F:BE:13:02:E2:C4:D4:89:BA:8F:BA:88:EF:6F:95:DC:CF:7B:E0 ValidityMon, 08 Jul 2024 01:41:02 GMT - Sat, 09 Aug 2025 01:41:01 GMT File type GIF image data, version 89a, 1 x 1 Size 43 B (43 bytes) Hash ad4b0f606e0f8465bc4c4c170b37e1a3 50b30fd5f87c85fe5cba2635cb83316ca71250d7 cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda HTTP Headers GET /hm.gif?hca=3D3742978FAD488E&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1711183811&si=f39d2bce62dc94cc77bdde410dce8c38&v=1.3.2&lv=1&sn=21406&r=0&ww=1280&u=http%3A%2F%2Fdown.6lugq4fy.com%2Fcx%2F22%2F1%2F%25C3%25A5%25C2%25B0%25C2%258F%25C3%25A9%25C2%25B9%25C2%2585%25C3%25A9%25C2%2580%25C2%259A%25C3%25A7%25C2%259B%25C2%25B4%25C3%25A6%25C2%2592%25C2%25AD%25C3%25A5%25C2%258A%25C2%25A9%25C3%25A6%25C2%2589%25C2%258B%25C3%25A5%25C2%25AD%25C2%25A6%25C3%25A7%25C2%2594%25C2%259F%25C3%25A7%25C2%25AB%25C2%25AF_131_1147305.exe HTTP/1.1 Host: hm.baidu.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: http://down.6lugq4fy.com/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Cache-Control: private, max-age=0, no-cache Content-Length: 43 Content-Type: image/gif Date: Wed, 05 Feb 2025 22:53:46 GMT P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Pragma: no-cache Server: apache Set-Cookie: HMACCOUNT=C57C423F7787F1E2; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT Strict-Transport-Security: max-age=172800 X-Content-Type-Options: nosniff`

	168.ying888.top/	168.206.204.221	200 OK	2.0 kB
URL GET HTTP/2 168.ying888.top/ IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by http://down.6lugq4fy.com/cx/22/1/%C3%A5%C2%B0%C2%8F%C3%A9%C2%B9%C2%85%C3%A9%C2%80%C2%9A%C3%A7%C2%9B%C2%B4%C3%A6%C2%92%C2%AD%C3%A5%C2%8A%C2%A9%C3%A6%C2%89%C2%8B%C3%A5%C2%AD%C2%A6%C3%A7%C2%94%C2%9F%C3%A7%C2%AB%C2%AF_131_1147305.exe Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type HTML document, Unicode text, UTF-8 text, with very long lines (2092), with no line terminators Size 2.0 kB (1976 bytes) Hash 800148d08dd5f5682907150baf6c6ebe 5dc3794a84960f78e9688bb37bdb579b00478d76 0433541480dbfe029caa9c60cd925cf82e5c7f391433760a8e7341a915ceb16d HTTP Headers `GET / HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: http://down.6lugq4fy.com/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: iframe Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: text/html; charset=UTF-8 vary: Accept-Encoding strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2`

	168.ying888.top/static/picture/bg1.jpg	168.206.204.221	200 OK	86 kB
URL GET HTTP/2 168.ying888.top/static/picture/bg1.jpg IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by https://168.ying888.top/ Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3840x2160, components 3 Size 86 kB (86545 bytes) Hash ea68b88baf20c974aca2dfc04c3d2260 5b32700ad6ccec9ab72ff036fc0eb7a590b94e49 346245dbeb20cb69fe0b18a656607d02ee9f4a309512ffaf4e0d62bbaec27496 HTTP Headers `GET /static/picture/bg1.jpg HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://168.ying888.top/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: image/jpeg last-modified: Tue, 02 Apr 2024 12:20:00 GMT vary: Accept-Encoding etag: W/"660bf7f0-15211" expires: Fri, 07 Mar 2025 22:53:45 GMT cache-control: max-age=2592000 strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2

	168.ying888.top/static/picture/ayx.png	168.206.204.221	200 OK	24 kB
URL GET HTTP/2 168.ying888.top/static/picture/ayx.png IP 168.206.204.221:443 ASN #137951 ASLINE LIMITED Requested by https://168.ying888.top/ Certificate IssuerLet's Encrypt Subject168.ying888.top Fingerprint00:5E:10:26:1B:50:84:8E:99:E5:E6:01:04:62:55:1D:9B:C1:CA:C9 ValidityTue, 14 Jan 2025 13:13:06 GMT - Mon, 14 Apr 2025 13:13:05 GMT File type PNG image data, 918 x 220, 8-bit colormap, non-interlaced Size 24 kB (24464 bytes) Hash 553c082a1103cfc44f9813dcb343600f 930cca7568d14b8523fe966f891c6dd761dc63ed 6a25744e4e31c7dff4d2f2b8584a5ee1e74be7ba317782dd38bd5e262b12b9dc HTTP Headers `GET /static/picture/ayx.png HTTP/1.1 Host: 168.ying888.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://168.ying888.top/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: nginx date: Wed, 05 Feb 2025 22:53:45 GMT content-type: image/png last-modified: Tue, 02 Apr 2024 12:20:00 GMT vary: Accept-Encoding etag: W/"660bf7f0-5f90" expires: Fri, 07 Mar 2025 22:53:45 GMT cache-control: max-age=2592000 strict-transport-security: max-age=31536000 alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" content-encoding: gzip X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (8)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (13)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type