Report - visa-lowee.fgxzt.cn/pay-with-featured/

Report Overview

Visited public
2025-06-24 07:25:25
Tags
sinkhole suspicious cloudflare
Submit Tags
URL
visa-lowee.fgxzt.cn/pay-with-featured/
Finishing URL
visa-lowee.fgxzt.cn/pay-with-featured/
IP / ASN
172.67.217.4
#13335 CLOUDFLARENET
Title
Attention Required! | Cloudflare
Suspicious - Sinkholed / Blocked

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
visa-lowee.fgxzt.cn	unknown	2024-11-11	2025-06-24	2025-06-24	5.3 kB	89 kB	172.67.217.4
static.cloudflareinsights.com	1294	2019-08-30	2019-09-24	2025-06-18	476 B	20 kB	104.16.79.73

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	visa-lowee.fgxzt.cn/pay-with-featured/	ScriptElement	210 B	2023-03-07	2025-07-19
Pretty URL visa-lowee.fgxzt.cn/pay-with-featured/ IP 104.21.45.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:03 Last Seen2025-07-19 06:55 Times Seen150516 Hash ab1ac4cf0f484cc9f859c0a7983353e0 2da142b1135bd10cdbed4a7353e4483acc30ebe9 50e878a18b2b5be7071dc7c10297381bcfcb55f17c27760ee857af9e31133324 Loading...

	visa-lowee.fgxzt.cn/pay-with-featured/	ScriptElement	375 B	2023-03-07	2025-07-19
Pretty URL visa-lowee.fgxzt.cn/pay-with-featured/ IP 104.21.45.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:03 Last Seen2025-07-19 07:11 Times Seen155577 Hash 56df91490fa1984fa82b297dcb23c22d 2050f127b73f50d21eb9b0a2a3f2aea7d4372ba9 275407540ae2d5516300e4027ce994e1c97f958d464e137d0fff116d7acf0f24 Loading...

	about:blank	ScriptElement	236 B	2025-06-24	2025-06-24
Pretty URL about:blank IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2025-06-24 07:25 Last Seen2025-06-24 07:25 Times Seen1 Hash bdb910329531d5a2716fcb5609d3e805 76bd319c5ba2357cbb9fe079d9e26c8fcb26eb20 dec157d29e921b8489e311d7c44ce8db091fe63b48ba6c22db81ffa9d3572185 Loading...

	static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	ScriptElement	20 kB	2024-06-07	2025-07-19
Pretty URL static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 IP 104.16.79.73 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-06-07 09:21 Last Seen2025-07-19 07:07 Times Seen92319 Hash ec18af6d41f6f278b6aed3bdabffa7bc 62c9e2cab76b888829f3c5335e91c320b22329ae 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f Loading...

	visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js	ScriptElement	10 kB	2025-06-24	2025-06-24
Pretty URL visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 104.21.45.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-06-24 07:19 Last Seen2025-06-24 07:25 Times Seen2 Hash 74b48f67927d1ec2cf76557376e81eca 245e75b129760943c80f2a3fbdea0e269b6e7b52 c422ffcbb0fd450190f9204b839cbf46712457b846dd4b803311927779cc0b51 Loading...

	visa-lowee.fgxzt.cn/pay-with-featured/	ScriptElement	38 B	2023-03-07	2025-07-19
Pretty URL visa-lowee.fgxzt.cn/pay-with-featured/ IP 104.21.45.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:03 Last Seen2025-07-19 07:11 Times Seen123086 Hash eb2ee6e4b3d4e81bacdb2474d9b3c2f5 6588855b25c975b224e0fd1b50ca1b3f36cd46ed 3dd83a652b2e60d8dfc699cd2006f70007b826a92b49e61e9194bf422481ac05 Loading...

	visa-lowee.fgxzt.cn/pay-with-featured/	ScriptElement	921 B	2025-06-24	2025-06-24
Pretty URL visa-lowee.fgxzt.cn/pay-with-featured/ IP 104.21.45.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-06-24 07:25 Last Seen2025-06-24 07:25 Times Seen1 Hash 4dd9c3d3a3f2e2ef17fd76a61823206e dd045a92e0e30925d22cf9d454e83b0059f72dd3 12bfcc2fa73832247dd65c982fb27c1f86e547d3bb1012f09dff64b7ae18d8c8 Loading...

HTTP Transactions (13)

URL IP Response Size

POST visa-lowee.fgxzt.cn/cdn-cgi/rum?

172.67.217.4

403 Forbidden

4.5 kB

URL POST
visa-lowee.fgxzt.cn/cdn-cgi/rum?
IP
172.67.217.4:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type
HTML document, ASCII text, with very long lines (396)
Size
4.5 kB (4542 bytes)
Hash
9960bb29bbab6fa6630bb90f1fc5a5ec
7934fa7cfd26f3bfc87ae27b26fd1044c5dbc4f3
19620711ce8c43ec4a03d534abfea2b751be10297dea155ac103dccaf6e73f89

HTTP Headers

POST /cdn-cgi/rum? HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://visa-lowee.fgxzt.cn/pay-with-featured/
content-type: application/json
Content-Length: 1077
Origin: http://visa-lowee.fgxzt.cn
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UvQfNZ0nKHybcmoiTHgZdXAcQP4YBwkTSCgA3al1hWFJ1nn9c6u9lAVmPcGlfjCLxPVlR283LOD0AEol271eAJUt8iVqq6bMjNM3Gee0pJrV"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Content-Encoding: gzip
Server: cloudflare
CF-RAY: 954a7d31bc597131-OSL
alt-svc: h2=":443"; ma=60

GET visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.45.169

302 Found

10 kB

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.45.169:443
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/
Certificate
IssuerGoogle Trust Services
Subjectfgxzt.cn
Fingerprint6F:8A:81:75:FD:E2:8B:21:7B:63:06:0D:72:65:03:D7:0C:3A:6F:57
ValidityMon, 23 Jun 2025 12:33:03 GMT - Sun, 21 Sep 2025 13:31:13 GMT

File type

Size
10 kB (10040 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 24 Jun 2025 07:25:03 GMT
content-length: 0
cf-ray: 954a7d320e337130-OSL
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/180b6a431d85/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZLLej10Kk0MHUecnfSftu7yTXt1OFhl9mxlnMddR7eZ9TlTg%2BLbQOIUNFEW4aiuA3bClNr3taCLNif8SjlLTOdeu%2Ff9y9wy08LQWDoDUOxDdwq50DS3BSv1FqMZVNWVIr8RNhsv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=546&min_rtt=477&rtt_var=171&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3192&recv_bytes=1075&delivery_rate=6041724&cwnd=253&unsent_bytes=0&cid=28100d9d550e2f2e&ts=51&x=0"
X-Firefox-Spdy: h2

GET visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/scripts/jsd/180b6a431d85/main.js?

104.21.45.169

200 OK

10 kB

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/scripts/jsd/180b6a431d85/main.js?
IP
104.21.45.169:443
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/
Certificate
IssuerGoogle Trust Services
Subjectfgxzt.cn
Fingerprint6F:8A:81:75:FD:E2:8B:21:7B:63:06:0D:72:65:03:D7:0C:3A:6F:57
ValidityMon, 23 Jun 2025 12:33:03 GMT - Sun, 21 Sep 2025 13:31:13 GMT

File type
JavaScript source, ASCII text, with very long lines (10040), with no line terminators
Size
10 kB (10040 bytes)
Hash
74b48f67927d1ec2cf76557376e81eca
245e75b129760943c80f2a3fbdea0e269b6e7b52
c422ffcbb0fd450190f9204b839cbf46712457b846dd4b803311927779cc0b51

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/180b6a431d85/main.js? HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 24 Jun 2025 07:25:03 GMT
content-type: application/javascript; charset=UTF-8
content-encoding: br
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aE7QNx1t9MkD5O2o69tbMwoe0oLfBaYG5WsXLSowY%2FemRVQhC4cKhgvlzp%2FdJnj0nBsx8apkTbYhhheraxqbU4MrC4ywDFLiOa5j5TzmiAxqhBilEBBEB5EIIB0g%2BZicSU48nLYB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 954a7d325e987130-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=4086&min_rtt=477&rtt_var=7208&sent=7&recv=12&lost=0&retrans=0&sent_bytes=3864&recv_bytes=1187&delivery_rate=6041724&cwnd=255&unsent_bytes=0&cid=28100d9d550e2f2e&ts=81&x=0"
X-Firefox-Spdy: h2

GET visa-lowee.fgxzt.cn/pay-with-featured/

104.21.45.169

403 Forbidden

6.0 kB

URL User Request GET
visa-lowee.fgxzt.cn/pay-with-featured/
IP
104.21.45.169:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectfgxzt.cn
Fingerprint6F:8A:81:75:FD:E2:8B:21:7B:63:06:0D:72:65:03:D7:0C:3A:6F:57
ValidityMon, 23 Jun 2025 12:33:03 GMT - Sun, 21 Sep 2025 13:31:13 GMT

File type
HTML document, ASCII text, with very long lines (1439)
Size
6.0 kB (5950 bytes)
Hash
44ef70f2dcfb8efd051473de004350c4
fe062d657db6914ffd1a5d319bfa970748714f36
6d8a246e7036c3ef70278d020c4bf90eb2c8b35e7030c314ff8bb03e7293d9be

HTTP Headers

GET /pay-with-featured/ HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Tue, 24 Jun 2025 07:25:03 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Czi0ER3aqMLnIPVOfK5gl3hySycjSDRu3JVuU%2B0b%2BkatnKSIn4L31CPEWtqNbFMG0wKoBONU8g4IWLe1WBNyDschmg37bjrpeu96koyS3%2BwGthucygAtRLo6ZfQ72YKSSSd3Lvp5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 954a7d2e29750b4d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfOrigin;dur=0,cfEdge;dur=24, cfL4;desc="?proto=TCP&rtt=483&min_rtt=450&rtt_var=113&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3192&recv_bytes=1141&delivery_rate=7515570&cwnd=253&unsent_bytes=0&cid=98242c4d9511ec59&ts=48&x=0"
X-Firefox-Spdy: h2

GET visa-lowee.fgxzt.cn/cdn-cgi/images/browser-bar.png?1376755637

104.21.45.169

200 OK

715 B

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/images/browser-bar.png?1376755637
IP
104.21.45.169:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type
PNG image data, 960 x 53, 8-bit colormap, non-interlaced
Size
715 B (715 bytes)
Hash
226dcb8f6144bdaafdfbd8f2f354be64
3785cc5b3bf52f8e398177b0ff1020b24aa86b8c
8c873472f4925d5d47521db4d52532d2983e9cb1bde8b43143a6cc6db56c35db

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Sinkholed / Blocked

HTTP Headers

GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://visa-lowee.fgxzt.cn/cdn-cgi/styles/cf.errors.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hTgsdz5Y3XcWEeX40D8ykvv4p80Yl41E1bWCFHR1nipcpR6mBIrhijvrYhpNJEyxQzXrzn2P2X2ZEle4NYk28iK80NAlXma6YieiBZZTXNfF"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
CF-RAY: 954a7d312a0456a8-OSL

GET visa-lowee.fgxzt.cn/cdn-cgi/images/cf-no-screenshot-error.png

172.67.217.4

200 OK

3.2 kB

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/images/cf-no-screenshot-error.png
IP
172.67.217.4:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type
PNG image data, 178 x 175, 8-bit colormap, non-interlaced
Size
3.2 kB (3213 bytes)
Hash
0d768cbc261841d3affc933b9ac3130e
aff136a4c761e1df1ada7e5d9a6ed0ebea74a4b7
1c53772285052e52bb7c12ad46a85a55747ed7bf66963fe1993fcef91ff5b0d0

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Sinkholed / Blocked

HTTP Headers

GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://visa-lowee.fgxzt.cn/cdn-cgi/styles/cf.errors.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=futMrixV7Ckavt%2BRZ3flfBrmutEQQlaAIGGzUFb80Fqn1X88MZWcTDBIZYlue3JxEVwghqGNCxvLIs2l7Y0bgj1ph8QlZIW7yNEalQphcOOt"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
CF-RAY: 954a7d313bb07131-OSL

GET visa-lowee.fgxzt.cn/favicon.ico

172.67.217.4

403 Forbidden

4.5 kB

URL GET
visa-lowee.fgxzt.cn/favicon.ico
IP
172.67.217.4:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type
HTML document, ASCII text, with very long lines (396)
Size
4.5 kB (4542 bytes)
Hash
e3a99ae43f2d7587a3f42506d5d5494b
219eb8ea0fea5c48a14a1b788c3b366daf9f301a
bfacb19691567f01d5f8ae80ec0b83571196beb6378e686f70847f7a70bb361a

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://visa-lowee.fgxzt.cn/pay-with-featured/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pkBX7G9IMEu2Jp83N%2B%2Fm6UUXig6oE6lCBL56DPnTKygTQyB5TDaau6DhnrAM%2BYMvzBmHw8YYVRauQQYy1OJG3cpRPY9fHNXd%2Fy2Kg4gYgocb"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Content-Encoding: gzip
Server: cloudflare
CF-RAY: 954a7d316bf17131-OSL
alt-svc: h2=":443"; ma=60

GET visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js

172.67.217.4

302 Moved Temporarily

10 kB

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
172.67.217.4:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type

Size
10 kB (10040 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: text/html
Content-Length: 143
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/scripts/jsd/main.js
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kOtEaSwwcKOe%2Bf4EqrWqqRSMNIrZ2BRdyYu86V4F0n1vhmJ3cgWlG%2FRk9DQvOjncO0xURvRWCLu4%2BID8tq016Q6FMPSlhrKA6tAXvOoc7Ux0odmPg2pMGbO5B2FPAyqUGNFAEGYw"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
Cf-Ray: 954a7d317bfb7131-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=603&min_rtt=444&rtt_var=269&sent=8&recv=10&lost=0&retrans=0&sent_bytes=6086&recv_bytes=1140&delivery_rate=8262482&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

GET visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8

104.21.45.169

405 Method Not Allowed

0 B

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8
IP
104.21.45.169:443
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/
Certificate
IssuerGoogle Trust Services
Subjectfgxzt.cn
Fingerprint6F:8A:81:75:FD:E2:8B:21:7B:63:06:0D:72:65:03:D7:0C:3A:6F:57
ValidityMon, 23 Jun 2025 12:33:03 GMT - Sun, 21 Sep 2025 13:31:13 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8 HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://visa-lowee.fgxzt.cn
Referer: http://visa-lowee.fgxzt.cn/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 405 Method Not Allowed
date: Tue, 24 Jun 2025 07:25:03 GMT
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tFFu04cNct4lGF6nNGR8EdLSSB1RwLN0RfnBis8vI4ST055IT8hHPuAnFAGh%2FU5qgl8gH1MEiQpN47j8iV1883ht%2Bb7XXb2wCSmgNrjCuay0bjMhIblXSVoLESzMGc%2BEV6GkNAEG"}],"group":"cf-nel","max_age":604800}
allow: POST
cf-ray: 954a7d33cf7d1c06-OSL
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3889&min_rtt=745&rtt_var=2525&sent=12&recv=8&lost=0&retrans=0&sent_bytes=3766&recv_bytes=1285&delivery_rate=548045&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=15487&unsent_bytes=0&cid=767081c090ffb197&ts=42&inflight_dur=6&x=44"

POST visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8

172.67.217.4

302 Moved Temporarily

0 B

URL POST
visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8
IP
172.67.217.4:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8 HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 11541
Origin: http://visa-lowee.fgxzt.cn
DNT: 1
Connection: keep-alive
Referer: http://visa-lowee.fgxzt.cn/pay-with-featured/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: text/html
Content-Length: 143
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://visa-lowee.fgxzt.cn/cdn-cgi/challenge-platform/h/g/jsd/r/0.20010286140475372:1750746321:91bDHDez-oqq-RTJq5YLymf5ODfWdbdfMuVqv5Aae_8/954a7d2f4fc056a8
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xJe3F3cYHByx5nf6AIsX9hQemr9DOw9WGZd2taVT1HODv7MkYgbnEmc4yDH10SM6J3zslWO5OqgSnwjZ8jd0c3nD2engHKuelZk1KS5Fa5Wm7lzaqfYKI1IpjOiWol4vA0H2m%2BYE"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
Cf-Ray: 954a7d338e577131-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=3770&min_rtt=444&rtt_var=6464&sent=15&recv=22&lost=0&retrans=0&sent_bytes=9587&recv_bytes=14785&delivery_rate=8262482&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

GET visa-lowee.fgxzt.cn/pay-with-featured/

104.21.45.169

403 Forbidden

6.0 kB

URL User Request GET
visa-lowee.fgxzt.cn/pay-with-featured/
IP
104.21.45.169:80
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (1439)
Size
6.0 kB (5950 bytes)
Hash
1f55022fac5df8a65c47ea6e144a9f9b
937c0e5675e2e2cb117a632ea5867b41468f7b92
8847f9f86f0f689225fc18c032c575c6eab3d270b01df27c5d298bf6fc318a1f

HTTP Headers

GET /pay-with-featured/ HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4W1xqt7xZkRX9dct5nUAOB06j01MyEE8FPOhyguAX6tlSYnDOGhPw5MjxgDHkhdHY%2FL%2Bl%2FvpEMVTS554q7Wm4goYZX1jlxQ6osffzNxIKBfNXPjAP4HZspP9Pjat1s0LKdtVV5Ji"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
Cf-Ray: 954a7d2f4fc056a8-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
Server-Timing: cfOrigin;dur=0,cfEdge;dur=24, cfL4;desc="?proto=TCP&rtt=491&min_rtt=491&rtt_var=245&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=422&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

GET visa-lowee.fgxzt.cn/cdn-cgi/styles/cf.errors.css

104.21.45.169

200 OK

24 kB

URL GET
visa-lowee.fgxzt.cn/cdn-cgi/styles/cf.errors.css
IP
104.21.45.169:80
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/

File type
ASCII text, with very long lines (24050)
Size
24 kB (24051 bytes)
Hash
5e8c69a459a691b5d1b9be442332c87d
f24dd1ad7c9080575d92a9a9a2c42620725ef836
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

HTTP Headers

GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Host: visa-lowee.fgxzt.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://visa-lowee.fgxzt.cn/pay-with-featured/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 24 Jun 2025 07:25:03 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Fng9gj43ltdB0H%2BOr5e4ew4v119izL3ti02fejkH0dcju3JFYn8IbN2x86GfuBku1nw9IGJzwx2sZEE%2FSmhK6ZMQI7XXbhn4KqHGYCUZCvAq"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Content-Encoding: gzip
Server: cloudflare
CF-RAY: 954a7d30795956a8-OSL

GET static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

104.16.79.73

200 OK

20 kB

URL GET
static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
IP
104.16.79.73:443
ASN
#13335 CLOUDFLARENET

Requested by
http://visa-lowee.fgxzt.cn/pay-with-featured/
Certificate
IssuerGoogle Trust Services
Subjectcloudflareinsights.com
FingerprintEA:C7:0D:68:3A:45:CB:AD:C5:33:41:B6:DF:F1:60:64:E1:0F:52:6A
ValiditySun, 27 Apr 2025 18:18:02 GMT - Sat, 26 Jul 2025 19:17:55 GMT

File type
JavaScript source, ASCII text, with very long lines (19948), with no line terminators
Size
20 kB (19948 bytes)
Hash
ec18af6d41f6f278b6aed3bdabffa7bc
62c9e2cab76b888829f3c5335e91c320b22329ae
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

HTTP Headers

GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://visa-lowee.fgxzt.cn
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 24 Jun 2025 07:25:03 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.6.1"
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 954a7d30bac40b65-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL POST

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET