Report - www.tzsj.cc/

Report Overview

Submitted URL
www.tzsj.cc/
IP
182.16.85.115
ASN
#45753 Netsec Limited
Submitted
2022-12-27 18:10:06
Access
Website Title
Final URL
Tags
yahoo phishing
urlquery detections
Phishing - Yahoo

Detections

urlquery
45
Network Intrusion Detection
2
Threat Detection Systems
76

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	69 kB	34.120.237.76
s.yimg.jp	11015	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	408 B	798 B	183.79.249.124
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	7.1 kB	23.33.119.27
www.tzsj.cc	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	7.8 kB	425 kB	182.16.85.115
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	341 B	797 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	34.210.158.59
yads.yjtag.yahoo.co.jp	63990	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	371 B	14 kB	183.79.249.124
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2022-12-27 18:09:51	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2022-12-27 18:09:51	medium	Client IP	Internal IP	ET DNS Query for .cc TLD

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc
2022-12-27	medium	www.tzsj.cc/	Yahoo! Inc

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-12-27	medium	www.tzsj.cc/	Phishing
2022-12-27	medium	www.tzsj.cc/static/main/jquery.cookie.js	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/ytag.js	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/ya-1.4.4.min.js	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/tag.js	Phishing
2022-12-27	medium	www.tzsj.cc/static/main/jquery-1.9.1.min.js	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/tmual-2.11.0.min.js	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/yads-iframe.html	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/yads-async.js.%E4%B8%8B%E8%BD%BD	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/saved_resource	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/yads_vimps.js.%E4%B8%8B%E8%BD%BD	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/tag	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/tag	Phishing
2022-12-27	medium	www.tzsj.cc/static/file_pc/saved_resource	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (9)

	URL	Size	First Seen	Last Seen
	www.tzsj.cc/static/file_pc/yads-iframe.html	583 B	2023-03-08	2023-03-12
Pretty URL www.tzsj.cc/static/file_pc/yads-iframe.html IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:08:35 Last Seen2023-03-12 10:33:53 Times Seen1 Hash beb4ee0061d4e2113e54faf7ada3e7a2 bf8bf447c27cdc1f96eaab3954d0553f7d9dbf2e 84f9e49a1b3a96882ff8845a7427c7acc7079cff07d2a3b6ff373a5e49e076ab Loading...

	www.tzsj.cc/static/file_pc/ytag.js	24 kB	2023-03-07	2023-12-26
Pretty URL www.tzsj.cc/static/file_pc/ytag.js IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:43 Last Seen2023-12-26 08:25:41 Times Seen15 Hash 507a6b80908724b35a83e4731cc9e9bf cc18f8545badd64f2c8bc6e363a7c6a7be43ec5a fcb5ee7a8fcec48a11b7adf420332a9ff2cf49f99558795d6b7b810618573e35 Loading...

	www.tzsj.cc/static/file_pc/ya-1.4.4.min.js	80 kB	2023-03-07	2023-03-17
Pretty URL www.tzsj.cc/static/file_pc/ya-1.4.4.min.js IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:43 Last Seen2023-03-17 11:37:56 Times Seen1 Hash a2b11a9db80a1836f4283823e27f2f1c 4f9c4f4abf8829814f3c8f13d866745411fefa64 39d1a6a062ca07736e48cccd120fad151fdd7210ae241634958f3164ade83f32 Loading...

	www.tzsj.cc/static/main/jquery-1.9.1.min.js	93 kB	2023-03-07	2024-04-19
Pretty URL www.tzsj.cc/static/main/jquery-1.9.1.min.js IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:08 Last Seen2024-04-19 07:56:42 Times Seen23210 Hash 397754ba49e9e0cf4e7c190da78dda05 ae49e56999d82802727455f0ba83b63acd90a22b c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Loading...

	www.tzsj.cc/static/file_pc/tmual-2.11.0.min.js	81 kB	2023-03-07	2023-03-17
Pretty URL www.tzsj.cc/static/file_pc/tmual-2.11.0.min.js IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:43 Last Seen2023-03-17 11:37:56 Times Seen1 Hash bdf3dcb7b699ff3570b242c560e9791d fc0c08500131ab3c9a2479de219bcbd63da9e102 43871cdf87a533e9b66f045fc5cb7cf26c72a44fc85b864ff0ca4eeb5b7f29f2 Loading...

	www.tzsj.cc/static/main/jquery.cookie.js	3.1 kB	2023-03-07	2024-04-18
Pretty URL www.tzsj.cc/static/main/jquery.cookie.js IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:39 Last Seen2024-04-18 14:07:34 Times Seen9095 Hash d5528dde0006c78be04817327c2f9b6f 31e1bcc4cf805a2c2fee21f48ded1e598f64a2a8 b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8 Loading...

	www.tzsj.cc/	173 B	2023-03-08	2023-03-12
Pretty URL www.tzsj.cc/ IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:08:35 Last Seen2023-03-12 10:33:53 Times Seen1 Hash dac208be286523e6b144691941a3871e 65a3e34b8408811513aa84f87b51cbdb1e97c54a 7c86c61c9424dd5d86dedadb3316208e0c10d05e8411e433c3937d72c2d61339 Loading...

	www.tzsj.cc/static/file_pc/tag.js	38 kB	2023-03-07	2023-04-29
Pretty URL www.tzsj.cc/static/file_pc/tag.js IP 182.16.85.115 ASN #45753 Netsec Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:18:00 Last Seen2023-04-29 06:52:50 Times Seen78 Hash 830cee037cbd2937feb368104dc9a35f 5584dfe88cc570b7dc894072c8eb896ed58d7b5d 3ea1d47e294e438851d775f2eca7352b4d03cf662e3ad9410f18bae663a380e5 Loading...

		Size	First Seen	Last Seen
	#1 Write - aa9e7aedfdef3f180536f6eaef5cf03d	59 B	2023-03-08	2023-03-12
Pretty Observations First Seen2023-03-08 15:08:35 Last Seen2023-03-12 10:33:53 Times Seen1 Hash aa9e7aedfdef3f180536f6eaef5cf03d c46840fcbcc6318e5c6258ed5d5354f89d1f9492 0766fa1c87b51ed043f1286882de9e86b917620459f90a6f2aa9cad90c67cc2e Loading...

HTTP Transactions (44)

URL IP Response Size

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fb20c18681040b740ab1730562beb45c
abedefb801b0e13987d6619a77e0368771f9dfcb
288c1832db391da57e3d74ffa893ec2c47ef9c1945f85b88473c563b55a3dfb3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "288C1832DB391DA57E3D74FFA893EC2C47EF9C1945F85B88473C563B55A3DFB3"
Last-Modified: Sun, 25 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5430
Expires: Tue, 27 Dec 2022 19:40:25 GMT
Date: Tue, 27 Dec 2022 18:09:55 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
67f508aae634a023b587a7129a5b8039
2ff7e1d29b497147941d0abf581411cbd2722d7b
eee5fda5214bd4f75b0934bb1f14429fe01251628026fd0f18f117b38848601c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EEE5FDA5214BD4F75B0934BB1F14429FE01251628026FD0F18F117B38848601C"
Last-Modified: Sun, 25 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9718
Expires: Tue, 27 Dec 2022 20:51:53 GMT
Date: Tue, 27 Dec 2022 18:09:55 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b2d59bdbb1ca6324590988ec031cf1fc
bfd4e25af37dcde4bac38d9b178c5ac8e50f8834
cef2180120ef42ff09d54577229c058d41d2c569d485f5a6dcfadc74bf8aa647

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CEF2180120EF42FF09D54577229C058D41D2C569D485F5A6DCFADC74BF8AA647"
Last-Modified: Mon, 26 Dec 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3646
Expires: Tue, 27 Dec 2022 19:10:42 GMT
Date: Tue, 27 Dec 2022 18:09:56 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 27 Dec 2022 17:46:40 GMT
content-type: application/json
age: 1396
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: DjedPuAH34GI0uv7wLc0LbBod5VXWsG/nE0yh6UF3QmxH5Wa/LP+gGXM8GIvib2Lcehp8gNeeEk=
x-amz-request-id: E4NE1PFG8PSVKPJ7
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 27 Dec 2022 17:57:59 GMT
age: 717
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 27 Dec 2022 18:09:56 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

www.tzsj.cc/

182.16.85.115

200 OK

15 kB

URL HTTP/1.1
www.tzsj.cc/
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1249)
Size
15 kB (14831 bytes)
Hash
30e4be3bed381aae83c34f9f288244b8
671153506d3b79ec5c774e83330d0f90d4329d3b
9ccd0131d7a0adcde1d9d20388f03afbb9e1d4b0ea0ba20f29753d3eb596910c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET / HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Set-Cookie: Token_ID=418920019849087897
Content-Type: text/html
Content-Length: 14831
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Pragma, Alert, ETag, Content-Type, Last-Modified, Cache-Control, Expires, Content-Length, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 27 Dec 2022 17:33:30 GMT
age: 2186
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

www.tzsj.cc/static/main/jquery.cookie.js

182.16.85.115

200 OK

3.1 kB

URL HTTP/1.1
www.tzsj.cc/static/main/jquery.cookie.js
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
ASCII text
Size
3.1 kB (3121 bytes)
Hash
d5528dde0006c78be04817327c2f9b6f
31e1bcc4cf805a2c2fee21f48ded1e598f64a2a8
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/main/jquery.cookie.js HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 3121
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
60b8396db0bbfa5f2ae7e34c9d04ebcc
50b6c68aa2b2a459315a9989f5d3e326e8ad5539
c10a1e0f984b121958a5cfa3b45b746db85d33c9073fcacb019d9bb27ef3b073

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6398
Cache-Control: max-age=146616
Content-Type: application/ocsp-response
Date: Tue, 27 Dec 2022 18:09:56 GMT
Etag: "63aab5ae-1d7"
Expires: Thu, 29 Dec 2022 10:53:32 GMT
Last-Modified: Tue, 27 Dec 2022 09:06:54 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471

www.tzsj.cc/static/file_pc/ytag.js

182.16.85.115

200 OK

24 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/ytag.js
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
ASCII text, with very long lines (23465), with no line terminators
Size
24 kB (23465 bytes)
Hash
507a6b80908724b35a83e4731cc9e9bf
cc18f8545badd64f2c8bc6e363a7c6a7be43ec5a
fcb5ee7a8fcec48a11b7adf420332a9ff2cf49f99558795d6b7b810618573e35

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/ytag.js HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 23465
Connection: keep-alive

www.tzsj.cc/static/file_pc/login-min.css

182.16.85.115

200 OK

39 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/login-min.css
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
ASCII text, with very long lines (33348)
Size
39 kB (39343 bytes)
Hash
4c00201d37002ec48cfb028b6ad841ea
0ce52ed2dc07a7182370ff7fcc193666a3c7b3c3
7f1f21cfb9c83e14c3e5da8f12fe5e89f8092f67e47548ad54b549e86a9b9e66

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc

HTTP Headers

GET /static/file_pc/login-min.css HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 39343
Connection: keep-alive

push.services.mozilla.com/

34.210.158.59

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.210.158.59:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: g1RHWTk6K4PV03zPlvK13A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: M/Ekly6LdjOqzWgadYvlK9tIEyk=

www.tzsj.cc/static/file_pc/ya-1.4.4.min.js

182.16.85.115

200 OK

80 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/ya-1.4.4.min.js
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
Unicode text, UTF-8 text, with very long lines (64100), with no line terminators
Size
80 kB (79850 bytes)
Hash
a2b11a9db80a1836f4283823e27f2f1c
4f9c4f4abf8829814f3c8f13d866745411fefa64
39d1a6a062ca07736e48cccd120fad151fdd7210ae241634958f3164ade83f32

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/ya-1.4.4.min.js HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 79850
Connection: keep-alive

www.tzsj.cc/static/file_pc/tag.js

182.16.85.115

200 OK

38 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/tag.js
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
ASCII text, with very long lines (37537), with no line terminators
Size
38 kB (37537 bytes)
Hash
830cee037cbd2937feb368104dc9a35f
5584dfe88cc570b7dc894072c8eb896ed58d7b5d
3ea1d47e294e438851d775f2eca7352b4d03cf662e3ad9410f18bae663a380e5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/tag.js HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 37537
Connection: keep-alive

www.tzsj.cc/static/main/jquery-1.9.1.min.js

182.16.85.115

200 OK

93 kB

URL HTTP/1.1
www.tzsj.cc/static/main/jquery-1.9.1.min.js
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
ASCII text, with very long lines (32089)
Size
93 kB (92629 bytes)
Hash
397754ba49e9e0cf4e7c190da78dda05
ae49e56999d82802727455f0ba83b63acd90a22b
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/main/jquery-1.9.1.min.js HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 92629
Connection: keep-alive

www.tzsj.cc/static/file_pc/tmual-2.11.0.min.js

182.16.85.115

200 OK

81 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/tmual-2.11.0.min.js
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
Unicode text, UTF-8 text, with very long lines (64274), with no line terminators
Size
81 kB (81030 bytes)
Hash
bdf3dcb7b699ff3570b242c560e9791d
fc0c08500131ab3c9a2479de219bcbd63da9e102
43871cdf87a533e9b66f045fc5cb7cf26c72a44fc85b864ff0ca4eeb5b7f29f2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/tmual-2.11.0.min.js HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 81030
Connection: keep-alive

www.tzsj.cc/static/file_pc/clear(1).gif

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/clear(1).gif
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc

HTTP Headers

GET /static/file_pc/clear(1).gif HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/yj_r_34_2x.png

182.16.85.115

200 OK

3.3 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/yj_r_34_2x.png
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
PNG image data, 272 x 68, 8-bit/color RGBA, non-interlaced\012- data
Size
3.3 kB (3304 bytes)
Hash
aab7b3c081be44ca8cb728f71577f2b5
68bc2e9c7e4f5532987cfa92623ceb7e239bc7dd
479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc

HTTP Headers

GET /static/file_pc/yj_r_34_2x.png HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 3304
Connection: keep-alive

www.tzsj.cc/static/file_pc/clear.gif

182.16.85.115

200 OK

43 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/clear.gif
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
fc94fb0c3ed8a8f909dbc7630a0987ff
56d45f8a17f5078a20af9962c992ca4678450765
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc

HTTP Headers

GET /static/file_pc/clear.gif HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive

www.tzsj.cc/static/file_pc/yads-iframe.html

182.16.85.115

200 OK

1.8 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/yads-iframe.html
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1187)
Size
1.8 kB (1825 bytes)
Hash
ad02513f97162714efeca6efd440b0c4
1696fbcbfb95057b7efa9e2f57097a7926e56abb
e8e6ee4f84fd8e7603cf403676301fd8a1130bd0e0d3f36aaef4f63968f05335

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/yads-iframe.html HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1825
Connection: keep-alive

www.tzsj.cc/static/file_pc/yads-async.js.%E4%B8%8B%E8%BD%BD

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/yads-async.js.%E4%B8%8B%E8%BD%BD
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/yads-async.js.%E4%B8%8B%E8%BD%BD HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/saved_resource

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/saved_resource
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/saved_resource HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/yads_vimps.js.%E4%B8%8B%E8%BD%BD

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/yads_vimps.js.%E4%B8%8B%E8%BD%BD
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/yads_vimps.js.%E4%B8%8B%E8%BD%BD HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/tag

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/tag
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/tag HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/favicon.ico

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/favicon.ico
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/iicon.min.js.%E4%B8%8B%E8%BD%BD HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/8a701b176c_donation_bnr_300250.jpg

182.16.85.115

200 OK

46 kB

URL HTTP/1.1
www.tzsj.cc/static/file_pc/8a701b176c_donation_bnr_300250.jpg
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 300x250, components 3\012- data
Size
46 kB (45725 bytes)
Hash
db3596ac661495f29dfab4504c74a215
64ee147017fb82dfd56da5361dcb2907207e8ec7
42f6fa0e015f04b176a9b5358a42d52a98a49a2a1f45000c521fed15093369c0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc

HTTP Headers

GET /static/file_pc/8a701b176c_donation_bnr_300250.jpg HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 45725
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15240
Expires: Tue, 27 Dec 2022 22:23:58 GMT
Date: Tue, 27 Dec 2022 18:09:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15240
Expires: Tue, 27 Dec 2022 22:23:58 GMT
Date: Tue, 27 Dec 2022 18:09:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15240
Expires: Tue, 27 Dec 2022 22:23:58 GMT
Date: Tue, 27 Dec 2022 18:09:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15240
Expires: Tue, 27 Dec 2022 22:23:58 GMT
Date: Tue, 27 Dec 2022 18:09:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15240
Expires: Tue, 27 Dec 2022 22:23:58 GMT
Date: Tue, 27 Dec 2022 18:09:58 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b739b75-a9c5-402c-b5f2-61cb416f4622.jpeg

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b739b75-a9c5-402c-b5f2-61cb416f4622.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10796 bytes)
Hash
bf353b055c5b241dc127a5f348288bd7
967babae78ca060a48978d1a29a20b459fa89aa2
4def932d04f53426b80ac7f3f366e1e8af0c76670f94c9ebd613309e2982d433

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b739b75-a9c5-402c-b5f2-61cb416f4622.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10796
x-amzn-requestid: 46bf3684-b3d9-4948-ab4b-09477cf5af0d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dxg-TEd2IAMF9jA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63aa1528-4eebb1950a70fb2d3a718426;Sampled=0
x-amzn-remapped-date: Mon, 26 Dec 2022 21:42:00 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: t-fFjRek8hGyiY7C49TCIXNHjWLSjsyOh8duU4ZHsrRIhqNSwptK9g==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Mon, 26 Dec 2022 21:44:56 GMT
age: 73502
etag: "967babae78ca060a48978d1a29a20b459fa89aa2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa0792a3e-4f16-42e9-b578-b308064c166b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10279 bytes)
Hash
4b8e2f135d62691518db239f44428b34
adbf35fbf576cc522bae9a1afbdd135fdcf1047d
b79338ce5513c8c861ffa377de4fdb67f30d193ec0beaec9ee19478c11262947

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa0792a3e-4f16-42e9-b578-b308064c166b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10279
x-amzn-requestid: 3a0f0c4e-c1de-4c62-846a-5315618dc108
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: duzkpEySoAMFdUg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a8ffb7-487a4fe512df2ff64ecd60fb;Sampled=0
x-amzn-remapped-date: Mon, 26 Dec 2022 01:58:15 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: B3qu784S_4ciCfg76XwyCeWbTtnbM-wIVi5q-Lj_OiR2QlFsq7jpnQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 10:05:54 GMT
age: 29044
etag: "adbf35fbf576cc522bae9a1afbdd135fdcf1047d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

15 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9fad15f-1e28-43a3-83d8-06aeab608d9f.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
15 kB (15371 bytes)
Hash
a4b903e264b412e69e5f22091bf423ea
92d157f8b56dd0af2ce0f1f5c11b5c90969cf36f
8d5d90968489731604a2286d9e2b9a307147a3cc0b1ffd32f1186ceea9b8fcff

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9fad15f-1e28-43a3-83d8-06aeab608d9f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 15371
x-amzn-requestid: 63d10011-ae3d-48fb-b892-26d94dc6ef83
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: diVs8EVDIAMFTOw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a4031f-3da712a621773d56567c014f;Sampled=0
x-amzn-remapped-date: Thu, 22 Dec 2022 07:11:27 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 2dVU6KIg3WiMurg-pgSmReyT89IjMeJUptYrHaPJiDTOaPr0PqrO6Q==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 07:24:37 GMT
age: 38721
etag: "92d157f8b56dd0af2ce0f1f5c11b5c90969cf36f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F69c55865-95c6-4d05-a856-6d61c10bd012.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.9 kB (7924 bytes)
Hash
a4a7ec0fdc177ed09c8949dcd68efb35
8ad28905291f4a184c0f32292415d1af0db3cead
7862e695c7eea224263bccaabcc54fc337ea533d6f1fafe0426b8699f3880922

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F69c55865-95c6-4d05-a856-6d61c10bd012.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7924
x-amzn-requestid: 30d67a34-fa95-4aa8-84d7-7c769a9e7fc6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dxfYgEnNoAMF7ng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63aa129c-743b9f4845f2c6f312463662;Sampled=0
x-amzn-remapped-date: Mon, 26 Dec 2022 21:31:08 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: DARBFo3gGdqpiutH2AJvUFtxyaamlecRtekmlCERttcXoXZ9FNswGg==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Mon, 26 Dec 2022 21:45:05 GMT
age: 73493
etag: "8ad28905291f4a184c0f32292415d1af0db3cead"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff70fb5bc-19d9-433d-adc5-222fa8c0b134.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.5 kB (9452 bytes)
Hash
e38d94b0be1b10ecac941b497f57c861
12911cd039f5c7b05013ebbc369aec5613134906
38a41df0d4f4405e8ecf6b379431bdb87eaed40e20481262b43d1fd127c010fd

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff70fb5bc-19d9-433d-adc5-222fa8c0b134.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9452
x-amzn-requestid: 33cc3d31-2503-4bd4-86e0-cc0358331e8a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: duNblGXqoAMFn9Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a8c2b0-7e472adc455ed2536b6b2223;Sampled=0
x-amzn-remapped-date: Sun, 25 Dec 2022 21:37:52 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: A02ns_3LvPv6bo3V-FcJ-0_sN8LlMTk3OQInwaS0k-0-sAt5TsweSg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 26 Dec 2022 22:02:46 GMT
age: 72432
etag: "12911cd039f5c7b05013ebbc369aec5613134906"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d43b473-21c7-4775-9398-1bdecb4d7d28.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.0 kB (9007 bytes)
Hash
b373925ce249ca67e6984c436f5cd2b8
ddbc25025b933587990f8e9c32e91c9773256840
7d3c992b715283efeba9bee2e5c08042267017e76074ca6aad870e1dd45b4564

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d43b473-21c7-4775-9398-1bdecb4d7d28.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9007
x-amzn-requestid: 15b3b2e5-d493-4b54-aab4-7374bf892e83
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: drrFbESxIAMFikw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a7beef-37f4ab8e7738b186705bb1db;Sampled=0
x-amzn-remapped-date: Sun, 25 Dec 2022 03:09:35 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: SgjNBdI4lkk3DIdROxkZ8sdadoe-pewXA9Q5M55pGe-LNk012lLFmQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 03:27:32 GMT
age: 52946
etag: "ddbc25025b933587990f8e9c32e91c9773256840"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

s.yimg.jp/images/login/sp/img/theme/1.3.0/ico_palette.png

183.79.249.124

200 OK

512 B

URL HTTP/2
s.yimg.jp/images/login/sp/img/theme/1.3.0/ico_palette.png
IP
183.79.249.124:0
ASN
#24572 Yahoo Japan

File type
PNG image data, 36 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
512 B (512 bytes)
Hash
3317faacc4448db11396bf7c4a6c2a84
b9c58ea39a08c0ad2d163bf77995851f62e1e13a
9bdc87263763478099797018ae7f0ea332b466a7324bb67a08f83090856d5fb1

HTTP Headers

GET /images/login/sp/img/theme/1.3.0/ico_palette.png HTTP/1.1
Host: s.yimg.jp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.tzsj.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/png
content-length: 512
date: Tue, 27 Dec 2022 18:04:23 GMT
last-modified: Tue, 25 Jan 2022 16:32:38 GMT
accept-ranges: bytes
server: ATS
cache-control: public, max-age=600
age: 336
ats-carp-promotion: 1
x-z-chihaya: r=1
X-Firefox-Spdy: h2

yads.yjtag.yahoo.co.jp/tag?

183.79.249.124

403 Forbidden

14 kB

URL HTTP/2
yads.yjtag.yahoo.co.jp/tag?
IP
183.79.249.124:0
ASN
#24572 Yahoo Japan

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (486)
Size
14 kB (14275 bytes)
Hash
e986e7a04549f3bef16fe1bb24e61acd
b3ec35460824fae12cf6342ae42d27597ec94fb7
e8b72fe96bc96ffcfef2cdf8ebb503ac854e5c2997ae389b96d04bf78f478edd

HTTP Headers

GET /tag? HTTP/1.1
Host: yads.yjtag.yahoo.co.jp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.tzsj.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 403 Forbidden
date: Tue, 27 Dec 2022 18:09:59 GMT
server: ATS
x-z-chihaya: r=1
x-frame-options: SAMEORIGIN
content-length: 14275
content-type: text/html
X-Firefox-Spdy: h2

www.tzsj.cc/static/file_pc/tag

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/tag
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/tag HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

www.tzsj.cc/static/file_pc/saved_resource

182.16.85.115

404 Not Found

0 B

URL HTTP/1.1
www.tzsj.cc/static/file_pc/saved_resource
IP
182.16.85.115:0
ASN
#45753 Netsec Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	phishing	Phishing - Yahoo
openphish	Yahoo! Inc
fortinet	Phishing

HTTP Headers

GET /static/file_pc/saved_resource HTTP/1.1
Host: www.tzsj.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.tzsj.cc/static/file_pc/yads-iframe.html
Cookie: Token_ID=418920019849087897

HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 0
Connection: keep-alive

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations