Report - kedsshoesmy.com/

Report Overview

Submitted URL
kedsshoesmy.com/
IP
103.197.219.145
ASN
#26658 HENGTONG-IDC-LLC
Submitted
2024-04-18 06:40:19
Access
public
Website Title
广安卣临电子商务有限公司
Final URL
www.kedsshoesmy.com/index.php
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
kedsshoesmy.com	unknown	2023-03-05	2021-12-24	2024-04-18	386 B	200 B	103.197.219.145
www.kedsshoesmy.com	unknown	unknown	No data	No data	1.4 kB	4.1 kB	103.197.219.145
push.zhanzhang.baidu.com	57139	1999-10-11	2015-07-22	2024-04-18	328 B	750 B	14.215.182.161
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-04-17	2.3 kB	24 kB	183.240.98.228
api.tongjiniao.com	unknown	2022-12-22	2023-02-01	2024-04-17	1.6 kB	9.5 kB	43.248.117.124
api.share.baidu.com	44629	1999-10-11	2013-04-25	2024-04-18	382 B	114 B	180.101.212.103

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	tongjiniao.com	Sinkholed
2024-04-18	medium	tongjiniao.com	Sinkholed
2024-04-18	medium	tongjiniao.com	Sinkholed
2024-04-18	medium	tongjiniao.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (16)

	URL	Size	First Seen	Last Seen
	unknown	26 B	2023-04-11	2024-05-01
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:13:06 Last Seen2024-05-01 03:11:04 Times Seen116020 Hash 1c862db5f2555377c2dc1e62ed7b3981 c29e6dc25c08a70995127ec13ded6f80d9a36174 27d373a6961f797edf69a80f7f24877ef85c2fc4f9f770b2540b1bf5e66823ac Loading...

	www.kedsshoesmy.com/tj.js	1.7 kB	2024-04-18	2024-04-18
Pretty URL www.kedsshoesmy.com/tj.js IP 103.197.219.145 ASN #26658 HENGTONG-IDC-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen2 Hash a9ad8d1703e840e25bf85405b2869f68 866f4ffba0956b2935bf20b5fd37d371d56d9aec 9ff9f37862ce5608edd0f7b7cfd66098eb26bb229999929bf13e9e1bde7e6fd7 Loading...

	unknown	37 B	2023-04-11	2024-05-01
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49:14 Last Seen2024-05-01 05:36:30 Times Seen22078 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	api.tongjiniao.com/c?_=630381606453088256	11 kB	2024-04-18	2024-04-18
Pretty URL api.tongjiniao.com/c?_=630381606453088256 IP 43.248.117.124 ASN #23650 AS Number for CHINANET jiangsu province backbone Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen2 Hash 223ee11949ea8f75ff8db04996b15760 9d6b7b3fe4b1a36e54631f7e6f16a9318a78a9e5 88c3ec7a5d1f31e589e3a542d9f05c9c6852d5516ca9c1b1f1836e7b98fa1e31 Loading...

	www.kedsshoesmy.com/index.php	0 B	2023-03-07	2024-05-01
Pretty URL www.kedsshoesmy.com/index.php IP 103.197.219.145 ASN #26658 HENGTONG-IDC-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-01 06:37:07 Times Seen37237695 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	333 B	2024-03-29	2024-04-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 06:37:47 Last Seen2024-04-29 13:51:05 Times Seen24 Hash 7494754b31e88980fca87798503abf9a 245b16f6f2c83bf66dce1599bad53f10725874a3 d025205f783ea5f72115f61cfa682d9abb01e2afcf2965b0daa4aee3c0ac962c Loading...

	hm.baidu.com/hm.js?3fbee70682dcfbb14dc1ea03b4e266d2	30 kB	2024-04-18	2024-04-18
Pretty URL hm.baidu.com/hm.js?3fbee70682dcfbb14dc1ea03b4e266d2 IP 183.240.98.228 ASN #56040 China Mobile communications corporation Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen2 Hash e47eb6b1d79fa23c4e936de16de97f5f db5ebad07ca8f1931f31f24cf1d0ece0f6fdd7a9 81e2cdeb22bdfae799c59dd2e2173157b5b3855cdbcc7600fafc42cca6e57ab0 Loading...

	unknown	366 B	2024-04-18	2024-04-18
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen1 Hash 9994ba0e130d32c9699062a30972c2aa 539a548312265e85bda5825d07a7166194d22c83 90f7a78154882ffca21a8d82ebafcb9232636bbad3b98f19440986e71060ecdf Loading...

	www.kedsshoesmy.com/common.js	5.3 kB	2024-04-18	2024-04-18
Pretty URL www.kedsshoesmy.com/common.js IP 103.197.219.145 ASN #26658 HENGTONG-IDC-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen2 Hash 554d151c400fdd5c864cdf7f9215b3b0 1b15ab4bf0c9df6a48c1d451fea220acf60fd196 13bf5aa29df27890bae14ade42f75262828ff52bd4c151db2b9564e32c78f08d Loading...

	unknown	365 B	2024-04-18	2024-04-18
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen1 Hash 5762f4f60e09a8c82027f1453eb03a02 81684f63aa4ecd14496bb3b666f3079e2c7922cb 98dc589a6e5210d8061bbdb44a21440780ae064081b63faa09cb0fe23d59d115 Loading...

	api.tongjiniao.com/c?_=630382824570867712	11 kB	2024-04-18	2024-04-18
Pretty URL api.tongjiniao.com/c?_=630382824570867712 IP 43.248.117.124 ASN #23650 AS Number for CHINANET jiangsu province backbone Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen2 Hash 6e3a287c36cc3a019fcb556e11dec06b 2b11da67319c2988b373263807ba81264d39ad9d 5830456baed9d5cc95bcd5578bb3c1ea4eb8544f28c381128a183d3d415b647e Loading...

	unknown	333 B	2024-04-18	2024-04-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen1 Hash 5072fa06b3372c788e7b29e53952aee5 0b4b6dd840c532385607f374775bb77038171673 44fad7167dc48d72ad61def3d4352269b2f6fa7b8c191e2695c7be5b99be4af2 Loading...

	push.zhanzhang.baidu.com/push.js	281 B	2023-03-07	2024-04-30
Pretty URL push.zhanzhang.baidu.com/push.js IP 14.215.182.161 ASN #4134 Chinanet Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:09 Last Seen2024-04-30 19:40:20 Times Seen19113 Hash 1bb5a3267c9865ad4abe8d937734b62b b5478dd2edb3e64242eced1db2dbd945ef81f592 674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2 Loading...

	hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e	30 kB	2024-04-18	2024-04-18
Pretty URL hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e IP 183.240.98.228 ASN #56040 China Mobile communications corporation Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen2 Hash 2f805aaf24fbe6e9f35d56f0d363d344 2065efaca8a91d11961f4f2c7cb07af209762158 33c017af617547436e872640e22637dfd2e048e7c689bc044b362e4f906e1048 Loading...

		Size	First Seen	Last Seen
	#1 Write - 8c442a03b2abb20ec370e9ffc44a0b9e	331 B	2024-03-29	2024-04-29
Pretty Observations First Seen2024-03-29 06:37:47 Last Seen2024-04-29 13:51:06 Times Seen24 Hash 8c442a03b2abb20ec370e9ffc44a0b9e 97db7d0e99221a27051b38830eb9a7956109afea 0b6a1c081072a7b9ae86ed75598f82ad1b74f6b6471b981ac170beea6038fb0c Loading...

	#2 Write - 9f33d579cf56d9ae54a099e137a681a7	331 B	2024-04-18	2024-04-18
Pretty Observations First Seen2024-04-18 08:40:26 Last Seen2024-04-18 08:40:26 Times Seen1 Hash 9f33d579cf56d9ae54a099e137a681a7 1c1ba9a606cd91be4a428aa978ba1166ea03db1f b43b1b7f7edbb74c1eabef93d6bbe0f860556cfef5feb08b068c545d4d3df701 Loading...

HTTP Transactions (15)

URL IP Response Size

kedsshoesmy.com/

103.197.219.145

0 B

URL User Request GET
kedsshoesmy.com/
IP
103.197.219.145:0
ASN
#26658 HENGTONG-IDC-LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: kedsshoesmy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 18 Apr 2024 06:39:54 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Location: http://www.kedsshoesmy.com/index.php

www.kedsshoesmy.com/index.php

103.197.219.145

785 B

URL User Request GET
www.kedsshoesmy.com/index.php
IP
103.197.219.145:0
ASN
#26658 HENGTONG-IDC-LLC

File type
JavaScript source, ISO-8859 text, with CRLF line terminators
Size
785 B (785 bytes)
Hash
9eb645235b1ba72b11ac71ec4287420c
948f72b30b348712e14e66b408da6307a0a76a3f
f33a0fa13e67251bf48f9e38939b726ad2214b2f5f90271ff16a80dad042a011

HTTP Headers

GET /index.php HTTP/1.1
Host: www.kedsshoesmy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:55 GMT
Content-Type: text/html
Content-Length: 785
Connection: keep-alive

www.kedsshoesmy.com/tj.js

103.197.219.145

200 OK

600 B

URL GET HTTP/1.1
www.kedsshoesmy.com/tj.js
IP
103.197.219.145:80
ASN
#26658 HENGTONG-IDC-LLC

Requested by
http://www.kedsshoesmy.com/index.php

File type
JavaScript source, ASCII text, with very long lines (363), with CRLF line terminators
Size
600 B (600 bytes)
Hash
a9ad8d1703e840e25bf85405b2869f68
866f4ffba0956b2935bf20b5fd37d371d56d9aec
9ff9f37862ce5608edd0f7b7cfd66098eb26bb229999929bf13e9e1bde7e6fd7

HTTP Headers

GET /tj.js HTTP/1.1
Host: www.kedsshoesmy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/index.php
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:55 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

www.kedsshoesmy.com/common.js

103.197.219.145

200 OK

1.3 kB

URL GET HTTP/1.1
www.kedsshoesmy.com/common.js
IP
103.197.219.145:80
ASN
#26658 HENGTONG-IDC-LLC

Requested by
http://www.kedsshoesmy.com/index.php

File type
JavaScript source, ASCII text, with very long lines (5277), with CRLF line terminators
Size
1.3 kB (1270 bytes)
Hash
554d151c400fdd5c864cdf7f9215b3b0
1b15ab4bf0c9df6a48c1d451fea220acf60fd196
13bf5aa29df27890bae14ade42f75262828ff52bd4c151db2b9564e32c78f08d

HTTP Headers

GET /common.js HTTP/1.1
Host: www.kedsshoesmy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/index.php
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:55 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

push.zhanzhang.baidu.com/push.js

14.215.182.161

200 OK

227 B

URL GET HTTP/1.1
push.zhanzhang.baidu.com/push.js
IP
14.215.182.161:80
ASN
#4134 Chinanet

Requested by
http://www.kedsshoesmy.com/index.php

File type
ASCII text, with no line terminators
Size
227 B (227 bytes)
Hash
1bb5a3267c9865ad4abe8d937734b62b
b5478dd2edb3e64242eced1db2dbd945ef81f592
674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2

HTTP Headers

GET /push.js HTTP/1.1
Host: push.zhanzhang.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Encoding: gzip
Content-Length: 227
Content-Type: text/javascript
Date: Thu, 18 Apr 2024 06:39:56 GMT
Etag: "4078521116"
Expires: Fri, 18 Apr 2025 06:39:56 GMT
Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: apache
Set-Cookie: BAIDUID=3BFB6A03D7E61964AF48672D25A233DD:FG=1; max-age=31536000; expires=Fri, 18-Apr-25 06:39:56 GMT; domain=.baidu.com; path=/; version=1
Vary: Accept-Encoding

hm.baidu.com/hm.js?3fbee70682dcfbb14dc1ea03b4e266d2

183.240.98.228

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?3fbee70682dcfbb14dc1ea03b4e266d2
IP
183.240.98.228:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.kedsshoesmy.com/index.php
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (620)
Size
11 kB (11258 bytes)
Hash
e47eb6b1d79fa23c4e936de16de97f5f
db5ebad07ca8f1931f31f24cf1d0ece0f6fdd7a9
81e2cdeb22bdfae799c59dd2e2173157b5b3855cdbcc7600fafc42cca6e57ab0

HTTP Headers

GET /hm.js?3fbee70682dcfbb14dc1ea03b4e266d2 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11258
Content-Type: application/javascript
Date: Thu, 18 Apr 2024 06:39:57 GMT
Etag: ecab6c5d986dbc6d20992a41bdf56a66
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=0EC032CD9F1991C5; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

www.kedsshoesmy.com/favicon.ico

103.197.219.145

200 OK

785 B

URL GET HTTP/1.1
www.kedsshoesmy.com/favicon.ico
IP
103.197.219.145:80
ASN
#26658 HENGTONG-IDC-LLC

Requested by
http://www.kedsshoesmy.com/index.php

File type
JavaScript source, ISO-8859 text, with CRLF line terminators
Size
785 B (785 bytes)
Hash
9eb645235b1ba72b11ac71ec4287420c
948f72b30b348712e14e66b408da6307a0a76a3f
f33a0fa13e67251bf48f9e38939b726ad2214b2f5f90271ff16a80dad042a011

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.kedsshoesmy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/index.php
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:56 GMT
Content-Type: text/html
Content-Length: 785
Connection: keep-alive

hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e

183.240.98.228

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e
IP
183.240.98.228:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.kedsshoesmy.com/index.php
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (620)
Size
11 kB (11258 bytes)
Hash
2f805aaf24fbe6e9f35d56f0d363d344
2065efaca8a91d11961f4f2c7cb07af209762158
33c017af617547436e872640e22637dfd2e048e7c689bc044b362e4f906e1048

HTTP Headers

GET /hm.js?0b22e3ab72a30f15311e5dc5950f263e HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11258
Content-Type: application/javascript
Date: Thu, 18 Apr 2024 06:39:57 GMT
Etag: 08a51132f537e4b751f9e216c5629b3f
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=E9BE47C21BE43E80; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=604526412&si=3fbee70682dcfbb14dc1ea03b4e266d2&v=1.3.0&lv=1&sn=9823&r=0&ww=1280&u=http%3A%2F%2Fwww.kedsshoesmy.com%2Findex.php&tt=%E5%B9%BF%E5%AE%89%E5%8D%A3%E4%B8%B4%E7%94%B5%E5%AD%90%E5%95%86%E5%8A%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

183.240.98.228

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=604526412&si=3fbee70682dcfbb14dc1ea03b4e266d2&v=1.3.0&lv=1&sn=9823&r=0&ww=1280&u=http%3A%2F%2Fwww.kedsshoesmy.com%2Findex.php&tt=%E5%B9%BF%E5%AE%89%E5%8D%A3%E4%B8%B4%E7%94%B5%E5%AD%90%E5%95%86%E5%8A%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
183.240.98.228:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.kedsshoesmy.com/index.php
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=604526412&si=3fbee70682dcfbb14dc1ea03b4e266d2&v=1.3.0&lv=1&sn=9823&r=0&ww=1280&u=http%3A%2F%2Fwww.kedsshoesmy.com%2Findex.php&tt=%E5%B9%BF%E5%AE%89%E5%8D%A3%E4%B8%B4%E7%94%B5%E5%AD%90%E5%95%86%E5%8A%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Thu, 18 Apr 2024 06:39:57 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=42E1421DBF051DE3; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1004451942&si=0b22e3ab72a30f15311e5dc5950f263e&v=1.3.0&lv=1&sn=9823&r=0&ww=1280&u=http%3A%2F%2Fwww.kedsshoesmy.com%2Findex.php&tt=%E5%B9%BF%E5%AE%89%E5%8D%A3%E4%B8%B4%E7%94%B5%E5%AD%90%E5%95%86%E5%8A%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

183.240.98.228

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1004451942&si=0b22e3ab72a30f15311e5dc5950f263e&v=1.3.0&lv=1&sn=9823&r=0&ww=1280&u=http%3A%2F%2Fwww.kedsshoesmy.com%2Findex.php&tt=%E5%B9%BF%E5%AE%89%E5%8D%A3%E4%B8%B4%E7%94%B5%E5%AD%90%E5%95%86%E5%8A%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
183.240.98.228:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.kedsshoesmy.com/index.php
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1004451942&si=0b22e3ab72a30f15311e5dc5950f263e&v=1.3.0&lv=1&sn=9823&r=0&ww=1280&u=http%3A%2F%2Fwww.kedsshoesmy.com%2Findex.php&tt=%E5%B9%BF%E5%AE%89%E5%8D%A3%E4%B8%B4%E7%94%B5%E5%AD%90%E5%95%86%E5%8A%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Thu, 18 Apr 2024 06:39:57 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=61CC1CF49FEBC103; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

api.tongjiniao.com/c?_=630382824570867712

43.248.117.124

3.9 kB

URL GET
api.tongjiniao.com/c?_=630382824570867712
IP
43.248.117.124:0
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.kedsshoesmy.com/index.php

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
3.9 kB (3885 bytes)
Hash
6e3a287c36cc3a019fcb556e11dec06b
2b11da67319c2988b373263807ba81264d39ad9d
5830456baed9d5cc95bcd5578bb3c1ea4eb8544f28c381128a183d3d415b647e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /c?_=630382824570867712 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:57 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 3885
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.tongjiniao.com/c?_=630381606453088256

43.248.117.124

3.9 kB

URL GET
api.tongjiniao.com/c?_=630381606453088256
IP
43.248.117.124:0
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.kedsshoesmy.com/index.php

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
3.9 kB (3882 bytes)
Hash
223ee11949ea8f75ff8db04996b15760
9d6b7b3fe4b1a36e54631f7e6f16a9318a78a9e5
88c3ec7a5d1f31e589e3a542d9f05c9c6852d5516ca9c1b1f1836e7b98fa1e31

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /c?_=630381606453088256 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:58 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 3882
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.tongjiniao.com/r?t=1713422397&p=639473645562535936

43.248.117.124

200 OK

58 B

URL POST HTTP/1.1
api.tongjiniao.com/r?t=1713422397&p=639473645562535936
IP
43.248.117.124:80
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.kedsshoesmy.com/index.php

File type
JSON text data
Size
58 B (58 bytes)
Hash
f6f0534758356f644786f03d9912b271
de49a584515e2637c727595652f99c78386ff7d4
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /r?t=1713422397&p=639473645562535936 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 599
Origin: http://www.kedsshoesmy.com
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:58 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.tongjiniao.com/r?t=1713422398&p=639473646619533312

43.248.117.124

200 OK

58 B

URL POST HTTP/1.1
api.tongjiniao.com/r?t=1713422398&p=639473646619533312
IP
43.248.117.124:80
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.kedsshoesmy.com/index.php

File type
JSON text data
Size
58 B (58 bytes)
Hash
f6f0534758356f644786f03d9912b271
de49a584515e2637c727595652f99c78386ff7d4
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /r?t=1713422398&p=639473646619533312 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 599
Origin: http://www.kedsshoesmy.com
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 06:39:58 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.share.baidu.com/s.gif?l=http://www.kedsshoesmy.com/index.php

180.101.212.103

200 OK

0 B

URL GET HTTP/1.1
api.share.baidu.com/s.gif?l=http://www.kedsshoesmy.com/index.php
IP
180.101.212.103:80
ASN
#134770 CHINANET Jiangsu province Suzhou taihu IDC network

Requested by
http://www.kedsshoesmy.com/index.php

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /s.gif?l=http://www.kedsshoesmy.com/index.php HTTP/1.1
Host: api.share.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.kedsshoesmy.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Thu, 18 Apr 2024 06:40:01 GMT

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (16)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations