Report - jicheng-admin.usoft3.cn/

Report Overview

Submitted URL
jicheng-admin.usoft3.cn/
IP
154.223.102.105
ASN
#54467 XNNET
Submitted
2024-04-24 14:51:05
Access
public
Website Title
jicheng-admin.usoft3.cn/
Final URL
jicheng-admin.usoft3.cn/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
12

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
jicheng-admin.usoft3.cn	unknown	unknown	No data	No data	751 B	6.8 kB	154.223.102.105
168.206.55.196	unknown	unknown	No data	No data	2.1 kB	201 kB	168.206.55.196
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-04-23	2.1 kB	24 kB	14.215.183.79

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	168.206.55.196	Sinkholed
2024-04-24	medium	168.206.55.196	Sinkholed
2024-04-24	medium	168.206.55.196	Sinkholed
2024-04-24	medium	168.206.55.196	Sinkholed
2024-04-24	medium	168.206.55.196	Sinkholed
2024-04-24	medium	168.206.55.196	Sinkholed

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	168.206.55.196/link.js	1.8 kB	2024-04-24	2024-04-24
Pretty URL 168.206.55.196/link.js IP 168.206.55.196 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen2 Hash 1b345dcf472876e3339bcf26a40594fb b788b7c3d88871881615f7d8a0ca2f59fd52471f ad27101a1021abc2dc2b52d19542ede8803bb81a7c7e41b064ea3f29ae4a9a66 Loading...

	hm.baidu.com/hm.js?11398176db3dfaf53ba7d11069a9046f	30 kB	2024-04-24	2024-04-24
Pretty URL hm.baidu.com/hm.js?11398176db3dfaf53ba7d11069a9046f IP 14.215.183.79 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen2 Hash 1d0989729f60c740a523c480e0d8800d 9b3f328b5c8e72c66f752b7e908ab880cc366569 77c4a94d34e86d6d636355c57749db2a3d0f2460cd21f7ce3b892223f210316e Loading...

	unknown	37 B	2023-04-11	2024-05-06
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49:14 Last Seen2024-05-06 05:43:26 Times Seen22291 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	unknown	250 B	2024-04-24	2024-04-24
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen1 Hash 9d402eff98bc8bea3d4c3129f9a5fb41 652e62d67a133b0fec3790767f66adae0887e682 5af99291f23f3f366a24fc5efe7cb24cdfb56d0652588eba863d4d27f1b02f66 Loading...

	jicheng-admin.usoft3.cn/	0 B	2023-03-07	2024-05-06
Pretty URL jicheng-admin.usoft3.cn/ IP 154.223.102.105 ASN #54467 XNNET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-06 07:04:25 Times Seen37374130 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	249 B	2024-04-24	2024-04-24
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen1 Hash f4327e07097de2bdf30cf03e3f53698f 2aaa4fba6ee4abda34b9bf9c084794b376664f3d 2e3d9482629ac4ae27732f8a50967e96c31dbc3ac12776916c5e8519004f614d Loading...

	168.206.55.196/	0 B	2023-03-07	2024-05-06
Pretty URL 168.206.55.196/ IP 168.206.55.196 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-06 07:04:25 Times Seen37374130 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	hm.baidu.com/hm.js?cb02a6f47f95f3d3660f97375e04f283	30 kB	2024-04-24	2024-04-24
Pretty URL hm.baidu.com/hm.js?cb02a6f47f95f3d3660f97375e04f283 IP 14.215.183.79 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen2 Hash e85682d65997a6ac961384384cd5d997 df1619f44a3e7cb6fbe942e0427dda44f6e2915a 2ae2e55c756a44cf787e467dab099aa66f19e1d4b461ed13523ccf5ead12a9c6 Loading...

		Size	First Seen	Last Seen
	#1 Eval - 471b26857cf66a6fbae9c5e66381545c	198 B	2024-04-24	2024-04-24
Pretty Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen1 Hash 471b26857cf66a6fbae9c5e66381545c c64144b26d48737e8f9d8c9d8843b05565a29338 012a05fa047436a544272dee16dffb8ab2b45080ae0fa05d62c1842810e365a4 Loading...

		Size	First Seen	Last Seen
	#1 Write - 59f72033bec6818ffd69552b3474dee6	179 B	2024-04-24	2024-04-24
Pretty Observations First Seen2024-04-24 16:51:12 Last Seen2024-04-24 16:51:12 Times Seen1 Hash 59f72033bec6818ffd69552b3474dee6 d837e9ed2f4d7ae1556751163d756668e0f29172 7baabc637e4946c10ab5e9ea0fc865ca78045a3c7d59296f9dcca621407d481e Loading...

HTTP Transactions (12)

URL IP Response Size

jicheng-admin.usoft3.cn/

154.223.102.105

6.4 kB

URL User Request GET
jicheng-admin.usoft3.cn/
IP
154.223.102.105:0
ASN
#54467 XNNET

File type
JavaScript source, Unicode text, UTF-8 text
Size
6.4 kB (6407 bytes)
Hash
3b0b5ffbce669581d748b28b99843619
5864e01a5621c9ff18ea4544fcec1d26d516fa07
4642a02fd9d3f2a28caf09a3c6c91a5158d602ad72234172957d5addb22db86b

HTTP Headers

GET / HTTP/1.1
Host: jicheng-admin.usoft3.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 502 Bad Gateway
Server: nginx
Date: Wed, 24 Apr 2024 14:50:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive

jicheng-admin.usoft3.cn/favicon.ico

154.223.102.105

200 OK

0 B

URL GET HTTP/1.1
jicheng-admin.usoft3.cn/favicon.ico
IP
154.223.102.105:80
ASN
#54467 XNNET

Requested by
http://jicheng-admin.usoft3.cn/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: jicheng-admin.usoft3.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://jicheng-admin.usoft3.cn/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:40 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Sun, 01 Oct 2023 08:57:07 GMT
Connection: keep-alive
ETag: "65193463-0"
Accept-Ranges: bytes

168.206.55.196/

168.206.55.196

200 OK

997 B

URL GET HTTP/1.1
168.206.55.196/
IP
168.206.55.196:80
ASN
#137951 ASLINE LIMITED

Requested by
http://jicheng-admin.usoft3.cn/

File type
HTML document, Unicode text, UTF-8 text
Size
997 B (997 bytes)
Hash
0e86a213a08a358c26ac985fa929507c
b831b71b0edef98ee0e3a0e49dd6fecdfa02b5bf
19cc3102e907d5a6cb8ffc99d6bc997e7ed7c37f44258f127fc2edfe82c101b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 168.206.55.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://jicheng-admin.usoft3.cn/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:41 GMT
Content-Type: text/html
Last-Modified: Thu, 28 Mar 2024 08:56:10 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"660530aa-9db"
Content-Encoding: gzip

168.206.55.196/link.js

168.206.55.196

200 OK

555 B

URL GET HTTP/1.1
168.206.55.196/link.js
IP
168.206.55.196:80
ASN
#137951 ASLINE LIMITED

Requested by
http://168.206.55.196/

File type
Unicode text, UTF-8 text
Size
555 B (555 bytes)
Hash
1b345dcf472876e3339bcf26a40594fb
b788b7c3d88871881615f7d8a0ca2f59fd52471f
ad27101a1021abc2dc2b52d19542ede8803bb81a7c7e41b064ea3f29ae4a9a66

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /link.js HTTP/1.1
Host: 168.206.55.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://168.206.55.196/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:41 GMT
Content-Type: application/javascript
Last-Modified: Wed, 24 Apr 2024 11:57:14 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6628f39a-6dc"
Expires: Thu, 25 Apr 2024 02:50:41 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

hm.baidu.com/hm.js?11398176db3dfaf53ba7d11069a9046f

14.215.183.79

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?11398176db3dfaf53ba7d11069a9046f
IP
14.215.183.79:443
ASN
#4134 Chinanet

Requested by
http://jicheng-admin.usoft3.cn/
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (620)
Size
11 kB (11258 bytes)
Hash
1d0989729f60c740a523c480e0d8800d
9b3f328b5c8e72c66f752b7e908ab880cc366569
77c4a94d34e86d6d636355c57749db2a3d0f2460cd21f7ce3b892223f210316e

HTTP Headers

GET /hm.js?11398176db3dfaf53ba7d11069a9046f HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://jicheng-admin.usoft3.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11258
Content-Type: application/javascript
Date: Wed, 24 Apr 2024 14:50:41 GMT
Etag: 94a8ff1648bcf56ab2a3a87da1101b40
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=AF8CE6849B205A92; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

168.206.55.196/static/picture/bg1.jpg

168.206.55.196

200 OK

86 kB

URL GET HTTP/1.1
168.206.55.196/static/picture/bg1.jpg
IP
168.206.55.196:80
ASN
#137951 ASLINE LIMITED

Requested by
http://168.206.55.196/

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3840x2160, components 3
Size
86 kB (86545 bytes)
Hash
ea68b88baf20c974aca2dfc04c3d2260
5b32700ad6ccec9ab72ff036fc0eb7a590b94e49
346245dbeb20cb69fe0b18a656607d02ee9f4a309512ffaf4e0d62bbaec27496

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/bg1.jpg HTTP/1.1
Host: 168.206.55.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://168.206.55.196/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:41 GMT
Content-Type: image/jpeg
Content-Length: 86545
Last-Modified: Tue, 12 Mar 2024 07:44:05 GMT
Connection: keep-alive
ETag: "65f007c5-15211"
Expires: Fri, 24 May 2024 14:50:41 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes

168.206.55.196/static/picture/ayx.png

168.206.55.196

200 OK

24 kB

URL GET HTTP/1.1
168.206.55.196/static/picture/ayx.png
IP
168.206.55.196:80
ASN
#137951 ASLINE LIMITED

Requested by
http://168.206.55.196/

File type
PNG image data, 918 x 220, 8-bit colormap, non-interlaced
Size
24 kB (24464 bytes)
Hash
553c082a1103cfc44f9813dcb343600f
930cca7568d14b8523fe966f891c6dd761dc63ed
6a25744e4e31c7dff4d2f2b8584a5ee1e74be7ba317782dd38bd5e262b12b9dc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/ayx.png HTTP/1.1
Host: 168.206.55.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://168.206.55.196/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:41 GMT
Content-Type: image/png
Content-Length: 24464
Last-Modified: Tue, 12 Mar 2024 07:44:05 GMT
Connection: keep-alive
ETag: "65f007c5-5f90"
Expires: Fri, 24 May 2024 14:50:41 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes

168.206.55.196/static/picture/kaiyun.png

168.206.55.196

200 OK

24 kB

URL GET HTTP/1.1
168.206.55.196/static/picture/kaiyun.png
IP
168.206.55.196:80
ASN
#137951 ASLINE LIMITED

Requested by
http://168.206.55.196/

File type
PNG image data, 918 x 220, 8-bit colormap, non-interlaced
Size
24 kB (23779 bytes)
Hash
5ac1aae1401f4abd5ab81f8741e44ee9
67e8bdf179f4b0fda1c1e3f5ddccaed51dd961ca
bbf1492b152a535d42b16c0c3b2dde9de8aa5b0afea11d2beefcd7c9aef066e0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/kaiyun.png HTTP/1.1
Host: 168.206.55.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://168.206.55.196/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:41 GMT
Content-Type: image/png
Content-Length: 23779
Last-Modified: Tue, 12 Mar 2024 07:44:05 GMT
Connection: keep-alive
ETag: "65f007c5-5ce3"
Expires: Fri, 24 May 2024 14:50:41 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes

168.206.55.196/static/picture/jy1.png

168.206.55.196

200 OK

62 kB

URL GET HTTP/1.1
168.206.55.196/static/picture/jy1.png
IP
168.206.55.196:80
ASN
#137951 ASLINE LIMITED

Requested by
http://168.206.55.196/

File type
PNG image data, 918 x 220, 8-bit/color RGBA, non-interlaced
Size
62 kB (62541 bytes)
Hash
dbebb8da9fe8fa1f603761cd7924c89b
53e77c74152e66387b4ae7164c110b043e32d117
70805887f90c05c5c21c9955386f0d3f186fb4fc4a723ce1fee22a138c76607b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/jy1.png HTTP/1.1
Host: 168.206.55.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://168.206.55.196/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 14:50:41 GMT
Content-Type: image/png
Content-Length: 62541
Last-Modified: Thu, 28 Mar 2024 08:28:02 GMT
Connection: keep-alive
ETag: "66052a12-f44d"
Expires: Fri, 24 May 2024 14:50:41 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1061503364&si=11398176db3dfaf53ba7d11069a9046f&v=1.3.0&lv=1&sn=33387&r=0&ww=1280&u=http%3A%2F%2Fjicheng-admin.usoft3.cn%2F

14.215.183.79

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1061503364&si=11398176db3dfaf53ba7d11069a9046f&v=1.3.0&lv=1&sn=33387&r=0&ww=1280&u=http%3A%2F%2Fjicheng-admin.usoft3.cn%2F
IP
14.215.183.79:443
ASN
#4134 Chinanet

Requested by
http://jicheng-admin.usoft3.cn/
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1061503364&si=11398176db3dfaf53ba7d11069a9046f&v=1.3.0&lv=1&sn=33387&r=0&ww=1280&u=http%3A%2F%2Fjicheng-admin.usoft3.cn%2F HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://jicheng-admin.usoft3.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Wed, 24 Apr 2024 14:50:42 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=9B1359F8DDBD0C8D; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

hm.baidu.com/hm.js?cb02a6f47f95f3d3660f97375e04f283

14.215.183.79

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?cb02a6f47f95f3d3660f97375e04f283
IP
14.215.183.79:443
ASN
#4134 Chinanet

Requested by
http://jicheng-admin.usoft3.cn/
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (627)
Size
11 kB (11265 bytes)
Hash
e85682d65997a6ac961384384cd5d997
df1619f44a3e7cb6fbe942e0427dda44f6e2915a
2ae2e55c756a44cf787e467dab099aa66f19e1d4b461ed13523ccf5ead12a9c6

HTTP Headers

GET /hm.js?cb02a6f47f95f3d3660f97375e04f283 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://jicheng-admin.usoft3.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11265
Content-Type: application/javascript
Date: Wed, 24 Apr 2024 14:50:45 GMT
Etag: 741428c6d47573a490466fa99fad5fe5
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=3E99DF1A082C13C2; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=885993838&si=cb02a6f47f95f3d3660f97375e04f283&v=1.3.0&lv=1&sn=33391&r=0&ww=1280&u=http%3A%2F%2Fjicheng-admin.usoft3.cn%2F

14.215.183.79

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=885993838&si=cb02a6f47f95f3d3660f97375e04f283&v=1.3.0&lv=1&sn=33391&r=0&ww=1280&u=http%3A%2F%2Fjicheng-admin.usoft3.cn%2F
IP
14.215.183.79:443
ASN
#4134 Chinanet

Requested by
http://jicheng-admin.usoft3.cn/
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=885993838&si=cb02a6f47f95f3d3660f97375e04f283&v=1.3.0&lv=1&sn=33391&r=0&ww=1280&u=http%3A%2F%2Fjicheng-admin.usoft3.cn%2F HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://jicheng-admin.usoft3.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Wed, 24 Apr 2024 14:50:46 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=45B034B90FF617EB; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (12)

URL User Request GET

IP