ocsp.trust-provider.cn/
283 B IP
ASN #24547 Hebei Mobile Communication Company Limited
Hash 787c569e44a3128a902b87f311fb0ee0
80ab30a02c8ab7f4b78adb439db86ca1d9b81829
d51e13a62fe95292e2ae73b354b2abb84f4a35e7c31ae2781baaa4556b5b53fa
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 283
Connection: keep-alive
Date: Tue, 26 Sep 2023 17:30:52 GMT
Accept-Ranges: bytes
CF-Cache-Status: EXPIRED
CF-RAY: 80b0bf260d1bc628-SEA
ETag: "80ab30a02c8ab7f4b78adb439db86ca1d9b81829"
Expires: Sat, 30 Sep 2023 03:31:48 GMT
Last-Modified: Sat, 23 Sep 2023 03:31:49 GMT
WS-Cache-Status: 2
X-CCACDN-Proxy-ID: scdpinlb4
X-Frame-Options: SAMEORIGIN
X-Via: 1.1 d129:16 (Cdn Cache Server V2.0), 1.1 PS-TSN-01fNz95:14 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 6513154c_PS-TSN-01c7T96_50882-4182
via: n173-145-133.bdcdn-hbcdcm02.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 16957494524abcd3631dac93e489efdc4c2a44dd96
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=56, edge;dur=0
ocsp.trust-provider.cn/
283 B IP
ASN #24547 Hebei Mobile Communication Company Limited
Hash 787c569e44a3128a902b87f311fb0ee0
80ab30a02c8ab7f4b78adb439db86ca1d9b81829
d51e13a62fe95292e2ae73b354b2abb84f4a35e7c31ae2781baaa4556b5b53fa
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 283
Connection: keep-alive
Date: Tue, 26 Sep 2023 17:30:52 GMT
Accept-Ranges: bytes
Age: 1
CF-Cache-Status: EXPIRED
CF-RAY: 80b0bf260d1bc628-SEA
ETag: "80ab30a02c8ab7f4b78adb439db86ca1d9b81829"
Expires: Sat, 30 Sep 2023 03:31:49 GMT
Last-Modified: Sat, 23 Sep 2023 03:31:49 GMT
WS-Cache-Status: 0
X-CCACDN-Proxy-ID: scdpinlb4
X-Frame-Options: SAMEORIGIN
X-Via: 1.1 d129:16 (Cdn Cache Server V2.0), 1.1 PS-000-01Ikh140:1 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 6513154c_PS-000-01tEx141_35766-51840
via: n173-145-133.bdcdn-hbcdcm02.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 1695749452dd17dd05780d6817d10f67e65ffc2939
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=25, edge;dur=0
www.jcedu.org/ebook/cs17.exe
404 Not Found 4.6 kB URL User Request GET HTTP/2 www.jcedu.org/ebook/cs17.exe
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (441), with CRLF, LF line terminators
Hash d8fa353a34e70049ac5f5de3619ac552
cf9aaa5631b0832b4ef629761f6231ebdc723047
ff52f923f50e7f64c9936639a10d60a17ab559114a1abeb2110f1186b600830f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ebook/cs17.exe HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 26 Sep 2023 17:30:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://www.jcedu.org/wp-json/>; rel="https://api.w.org/"
Content-Encoding: gzip
www.jcedu.org/wp-content/plugins/smartideo/static/smartideo.css?ver=2.7.3
439 B URL www.jcedu.org/wp-content/plugins/smartideo/static/smartideo.css?ver=2.7.3
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
Hash 306281391cfbaccd09a670dfa8b9d6f3
8cda67014e1807e84cf6d821837e56dd7b6696e6
d464d99f7ef87ee85a2ebf6acff6034ca10d126e3f1e3ed1f88b45aae48a53d0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/plugins/smartideo/static/smartideo.css?ver=2.7.3 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:55 GMT
Content-Type: text/css
Last-Modified: Sat, 01 Apr 2023 02:23:46 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"642795b2-47c"
Expires: Wed, 27 Sep 2023 05:30:55 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70
200 OK 374 B URL GET HTTP/1.1 www.jcedu.org/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
Hash 73d29ecb3ae4eb2b78712fab3a46d32d
05ea352ab14ccf04386a4c7d112ad4fec944d551
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: text/css
Content-Length: 374
Last-Modified: Sat, 01 Apr 2023 02:23:34 GMT
Connection: keep-alive
ETag: "642795a6-176"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Accept-Ranges: bytes
www.jcedu.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
4.2 kB URL www.jcedu.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (9959)
Hash 7121994eec5320fbe6586463bf9651c2
90532aff6d4121954254cdf04994d834f7ec169b
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Fri, 20 May 2016 06:11:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"573eaa90-2748"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/plugins/responsive-lightbox/assets/infinitescroll/infinite-scroll.pkgd.min.js?ver=14.7
200 OK 7.9 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/plugins/responsive-lightbox/assets/infinitescroll/infinite-scroll.pkgd.min.js?ver=14.7
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type ASCII text, with very long lines (25366), with CRLF line terminators
Hash d167977aa5ca8a8c2ec022222111a424
8162191aa162304890405f31d0efd88f7c1b5ebb
6f97fb27fc5a2b0b2ef192937aeea30f869e026c98518e154a796755e3d0d864
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/plugins/responsive-lightbox/assets/infinitescroll/infinite-scroll.pkgd.min.js?ver=14.7 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Thu, 03 Sep 2020 14:11:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f50f98c-640f"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/genericons/genericons.css?ver=3.4.1
200 OK 17 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/themes/xiyuan/genericons/genericons.css?ver=3.4.1
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type ASCII text, with very long lines (18732)
Hash 13a6500ddf36c6dd581877aefc78d34d
3ab844aaad6045edbe2da9e78c3c9f41599b67d6
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/genericons/genericons.css?ver=3.4.1 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: text/css
Last-Modified: Sun, 03 Jun 2018 13:28:56 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5b13ed18-6e6a"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/plugins/responsive-lightbox/js/front.js?ver=2.2.3
6.5 kB URL www.jcedu.org/wp-content/plugins/responsive-lightbox/js/front.js?ver=2.2.3
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (641), with CRLF line terminators
Hash 776d9f7a01301400e7b11ac4659fe3b0
495bbfa5efbfdbd240de364a4a52be2412cbcb01
48555977de52a497e0dd8fe5aaf9ebf2df20bf16340340f4012baaa8153e490b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/plugins/responsive-lightbox/js/front.js?ver=2.2.3 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Thu, 03 Sep 2020 14:11:24 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f50f98c-6912"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/css/reset.css
200 OK 1.1 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/themes/xiyuan/css/reset.css
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type Unicode text, UTF-8 (with BOM) text, with very long lines (351), with CRLF line terminators
Hash 0ff9768f49e449c84bca770cf3a6f6e2
e260ed1f5a305036eb274ed1bd51cfc444019d81
3f9797673ac497e0cb7f49f33cc007ab54a298b394036ad3103a0f8591c3c993
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/css/reset.css HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: text/css
Last-Modified: Mon, 04 Jun 2018 01:28:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5b1495c8-869"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/plugins/responsive-lightbox/assets/magnific/magnific-popup.min.css?ver=2.2.3
200 OK 1.8 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/plugins/responsive-lightbox/assets/magnific/magnific-popup.min.css?ver=2.2.3
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type ASCII text, with very long lines (5329), with no line terminators
Hash 1cedadb7963bde49fc7ed95d4c093c32
bf6ff1c9560ac3f6a9db421271ed6b0aac3e46cc
e24c43b96a33acd16d20293bbd033822525f8de747770c01026ed03b44e64b12
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/plugins/responsive-lightbox/assets/magnific/magnific-popup.min.css?ver=2.2.3 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: text/css
Last-Modified: Thu, 03 Sep 2020 14:11:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f50f98b-14d1"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/js/pageSwitch.min.js
1.6 kB URL www.jcedu.org/wp-content/themes/xiyuan/js/pageSwitch.min.js
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (4015), with no line terminators
Hash ab8be822a96f374eb560d4194972f237
e8f52dc3cbe02ffb4d10340fcf7e3bd979167460
adecc774b68f8424abc71c553ef64d0db0482971adb80f08bf602f2f93c31c5b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/js/pageSwitch.min.js HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Mon, 14 May 2018 02:11:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5af8f04e-faf"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/js/style.js
554 B URL www.jcedu.org/wp-content/themes/xiyuan/js/style.js
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash d3e89d55fff5c2ba9dfeab87c52f02a9
3e03f7e6cfcd2ba42c4804d3cf9f3e6ff0fb5558
900bc875737003f1bf34a8971ad6b0d39d4deecad3dfb7bcae37798f31761291
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/js/style.js HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Mon, 14 May 2018 08:00:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5af94228-585"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/js/jquery-1.11.3.min.js
38 kB URL www.jcedu.org/wp-content/themes/xiyuan/js/jquery-1.11.3.min.js
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (32038)
Hash 895323ed2f7258af4fae2c738c8aea49
276c87ff3e1e3155679c318938e74e5c1b76d809
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/js/jquery-1.11.3.min.js HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Mon, 14 May 2018 02:11:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5af8f04e-176d5"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/js/layer/layer.js
8.1 kB URL www.jcedu.org/wp-content/themes/xiyuan/js/layer/layer.js
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (21258)
Hash 780fa9fee096b7bf72104d7779c5c359
343b5c8e92950b102336bde889f7ce20999a3246
b0324bfc823184920bf852354aef5a8e9fdc95148061b70a72d08793c96ef7af
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/js/layer/layer.js HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Mon, 18 Dec 2017 07:59:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5a37756a-535e"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/js/layui/layui.js
2.6 kB URL www.jcedu.org/wp-content/themes/xiyuan/js/layui/layui.js
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (5391)
Hash b860b310e9b592cd1dbc4fb5d37b09b7
586f2054c4171af47bd9d6b5208a321946f68c30
9191bf92502e957e2ee22119fa3168ee6738568957ed4e6c5da934bd073d22c8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/js/layui/layui.js HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Mon, 18 Dec 2017 07:59:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5a37756a-1559"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
jcedu.org/ebook/cs17.exe
38 kB IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
File type , OEM-ID "\037\213", Bytes/sector 768, sectors/cluster 204, reserved sectors 27069, FATs 119, root entries 50979, sectors 59285 (volumes <=32 MB), Media descriptor 0xfd, sectors/FAT 16318, sectors/track 2309, heads 171, FAT (12 bit by descriptor)\012- data
Hash bee1abfa18f39aa4a4cab2da264bed6e
69b01f69941be1d42695bfe59e96dd1abe54f31d
975e3ee85466344202a8462d289a883cc6c7deddcd6b8e87668101dd3a8e7855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ebook/cs17.exe HTTP/1.1
Host: jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
server: nginx
date: Tue, 26 Sep 2023 17:30:53 GMT
content-type: text/html; charset=UTF-8
location: https://www.jcedu.org/ebook/cs17.exe
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
X-Firefox-Spdy: h2
www.jcedu.org/wp-content/plugins/responsive-lightbox/assets/magnific/jquery.magnific-popup.min.js?ver=2.2.3
200 OK 8.1 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/plugins/responsive-lightbox/assets/magnific/jquery.magnific-popup.min.js?ver=2.2.3
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type ASCII text, with very long lines (20087)
Hash ba6cf724c8bb1cf5b084e79ff230626e
f455c5f153f872e52265f87a644ff89fe14a6fb6
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/plugins/responsive-lightbox/assets/magnific/jquery.magnific-popup.min.js?ver=2.2.3 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Thu, 03 Sep 2020 14:11:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5f50f98b-4ef8"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/style.css?ver=14.7
7.1 kB URL www.jcedu.org/wp-content/themes/xiyuan/style.css?ver=14.7
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 (with BOM) text, with very long lines (455), with CRLF line terminators
Hash 500ff60de1f3c292095ce6684274fa03
387ceeb4f57203e00c141c91cc4421dae3297e98
5176648bfd8b9a53206427a8c74a3f17c99c87ec4b4ddb89db8400fc39be4a08
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/style.css?ver=14.7 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: text/css
Last-Modified: Fri, 25 Jan 2019 04:46:16 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5c4a9498-70ad"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/uploads/2018/06/Xiao_logo.png
7.9 kB URL www.jcedu.org/wp-content/uploads/2018/06/Xiao_logo.png
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type PNG image data, 125 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash f47abe0a63ad1034d8a785083c7f1b25
7fc3ff5049d7c0bcc7265206759270c4eaad33fa
40091390370bf8a2ee46187d71f5088096505142f74a530afe42d1daa38f65ff
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/uploads/2018/06/Xiao_logo.png HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:58 GMT
Content-Type: image/png
Content-Length: 7889
Last-Modified: Mon, 11 Jun 2018 23:29:36 GMT
Connection: keep-alive
ETag: "5b1f05e0-1ed1"
Expires: Thu, 26 Oct 2023 17:30:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.jcedu.org/wp-content/uploads/2018/06/ewm.jpg
6.0 kB URL www.jcedu.org/wp-content/uploads/2018/06/ewm.jpg
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 66x66, components 3\012- data
Hash 4482dca64cc296411d0ccf2ea2d0579c
2beaf18122be1c8dfda2b14d5c03973436db8813
c28fec989e292702ed349171dfe0bc099e55ef9b3cf0be95a741700bd6380b5a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/uploads/2018/06/ewm.jpg HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:58 GMT
Content-Type: image/jpeg
Content-Length: 5952
Last-Modified: Mon, 04 Jun 2018 00:41:58 GMT
Connection: keep-alive
ETag: "5b148ad6-1740"
Expires: Thu, 26 Oct 2023 17:30:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.jcedu.org/wp-content/uploads/2018/06/Yan_Jiu_Suo_Xiao_logo.png
200 OK 7.0 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/uploads/2018/06/Yan_Jiu_Suo_Xiao_logo.png
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type PNG image data, 140 x 70, 8-bit/color RGBA, non-interlaced\012- data
Hash 57ca495e9a36ec9ee9cc65cc381e1eff
bf33b2904daed77be93a502eed39dbeb1af6b1fd
cc0bc096e1b6b5d231001b3c3cba45177c676585c7f76dfafb68756dac50d54a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/uploads/2018/06/Yan_Jiu_Suo_Xiao_logo.png HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:58 GMT
Content-Type: image/png
Content-Length: 6952
Last-Modified: Mon, 11 Jun 2018 23:34:22 GMT
Connection: keep-alive
ETag: "5b1f06fe-1b28"
Expires: Thu, 26 Oct 2023 17:30:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.jcedu.org/wp-content/themes/xiyuan/js/layer/skin/default/layer.css?v=3.0.11110
3.3 kB URL www.jcedu.org/wp-content/themes/xiyuan/js/layer/skin/default/layer.css?v=3.0.11110
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (14296), with no line terminators
Hash 01ad21d46e656bb2c8e162c5305e754f
6bc931ea5cce8cf7ff2bc205f115af1da5a2df7a
b4ed5d24c92f99371c49023c1f7da9597cac7f23d3c9efe7c07025bc4a5d7386
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/js/layer/skin/default/layer.css?v=3.0.11110 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:58 GMT
Content-Type: text/css
Last-Modified: Mon, 18 Dec 2017 07:59:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5a37756a-37d8"
Expires: Wed, 27 Sep 2023 05:30:58 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
www.jcedu.org/wp-content/themes/xiyuan/images/search.png
200 OK 1.1 kB URL GET HTTP/1.1 www.jcedu.org/wp-content/themes/xiyuan/images/search.png
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash a4115ca78beed909b2ff664bfa95fddc
46519f7deee73557b0f0e6b1555eb87a42e4e895
a6e4902f130039d1de5767dc3dc2f2bb4671ba4341079cbe2d63e2bd4ff3a6f5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/images/search.png HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/wp-content/themes/xiyuan/style.css?ver=14.7
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:59 GMT
Content-Type: image/png
Content-Length: 1111
Last-Modified: Tue, 05 Jun 2018 06:27:36 GMT
Connection: keep-alive
ETag: "5b162d58-457"
Expires: Thu, 26 Oct 2023 17:30:59 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.jcedu.org/wp-content/themes/xiyuan/images/navsub-t.jpg
23 kB URL www.jcedu.org/wp-content/themes/xiyuan/images/navsub-t.jpg
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 235x163, components 3\012- data
Hash 69f3eb123ffb70e6810e29333b81c19e
f9e218071ae7aa1cd6155cc6bec36dfbc845f732
805da4304bf212e85f21a00ea912ac260fe5daa59cebcc29395ed563b17cf045
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/images/navsub-t.jpg HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/wp-content/themes/xiyuan/style.css?ver=14.7
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:59 GMT
Content-Type: image/jpeg
Content-Length: 23334
Last-Modified: Mon, 14 May 2018 02:11:26 GMT
Connection: keep-alive
ETag: "5af8f04e-5b26"
Expires: Thu, 26 Oct 2023 17:30:59 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.jcedu.org/wp-content/uploads/2018/06/zhulogo-min.png
161 kB URL www.jcedu.org/wp-content/uploads/2018/06/zhulogo-min.png
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type PNG image data, 2285 x 548, 8-bit colormap, non-interlaced\012- data
Size 161 kB (161389 bytes)
Hash e75bd2b40dff61eb4ee6c5b8e6797037
b4fd47cd5db271f7f25e88e25fa2ccaa0d9e252a
dc05e0ef28a162be2def6dc04035464c39006c370771f449baf58d9fcffb1df1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/uploads/2018/06/zhulogo-min.png HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:58 GMT
Content-Type: image/png
Content-Length: 161389
Last-Modified: Fri, 15 Jun 2018 08:16:40 GMT
Connection: keep-alive
ETag: "5b2375e8-2766d"
Expires: Thu, 26 Oct 2023 17:30:58 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
www.jcedu.org/wp-content/themes/xiyuan/images/foot.jpg
100 kB URL www.jcedu.org/wp-content/themes/xiyuan/images/foot.jpg
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x80, components 3\012- data
Size 100 kB (100495 bytes)
Hash 8199e714e8057a32eee79bb9ce85d1c4
590bf64eca9c9a0167740eb8ad616c8927ea2094
07b9971649455cc1065805ae0a111b94066ba3d286845820ff819e5b71c0d944
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/images/foot.jpg HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/wp-content/themes/xiyuan/style.css?ver=14.7
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:59 GMT
Content-Type: image/jpeg
Content-Length: 100495
Last-Modified: Mon, 14 May 2018 02:11:26 GMT
Connection: keep-alive
ETag: "5af8f04e-1888f"
Expires: Thu, 26 Oct 2023 17:30:59 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
hm.baidu.com/hm.js?15c385327f80b8ccc130141066acbcec
11 kB URL hm.baidu.com/hm.js?15c385327f80b8ccc130141066acbcec
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (619)
Hash 35a041dbec25402f9920bad9f7ee1554
47c2f76583ba317d6f789beb78b57557bf902ba7
7ec3aa757bd128c58a9e39790f00b25407c3e6a3b9876e82c041bfc5b26b025c
GET /hm.js?15c385327f80b8ccc130141066acbcec HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11257
Content-Type: application/javascript
Date: Tue, 26 Sep 2023 17:30:59 GMT
Etag: 159fe3d689d71688e88b31a383b68cc1
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=D9771AF9E4245D58; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1944917999&si=15c385327f80b8ccc130141066acbcec&v=1.3.0&lv=1&sn=31335&r=0&ww=1280&u=http%3A%2F%2Fwww.jcedu.org%2Febook%2Fcs17.exe&tt=%E6%9C%AA%E6%89%BE%E5%88%B0%E9%A1%B5%E9%9D%A2%20%E2%80%93%20%E8%A5%BF%E5%9B%AD%E6%88%92%E5%B9%A2%E5%BE%8B%E5%AF%BA
200 OK 43 B URL GET HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1944917999&si=15c385327f80b8ccc130141066acbcec&v=1.3.0&lv=1&sn=31335&r=0&ww=1280&u=http%3A%2F%2Fwww.jcedu.org%2Febook%2Fcs17.exe&tt=%E6%9C%AA%E6%89%BE%E5%88%B0%E9%A1%B5%E9%9D%A2%20%E2%80%93%20%E8%A5%BF%E5%9B%AD%E6%88%92%E5%B9%A2%E5%BE%8B%E5%AF%BA
IP
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
Certificate IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1944917999&si=15c385327f80b8ccc130141066acbcec&v=1.3.0&lv=1&sn=31335&r=0&ww=1280&u=http%3A%2F%2Fwww.jcedu.org%2Febook%2Fcs17.exe&tt=%E6%9C%AA%E6%89%BE%E5%88%B0%E9%A1%B5%E9%9D%A2%20%E2%80%93%20%E8%A5%BF%E5%9B%AD%E6%88%92%E5%B9%A2%E5%BE%8B%E5%AF%BA HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 26 Sep 2023 17:31:00 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=7D2002D396E813F1; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
www.jcedu.org/favicon.ico
200 OK 17 kB URL GET HTTP/1.1 www.jcedu.org/favicon.ico
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel\012- data
Hash 950e5175d15bd90b70f57ee0911ca228
53070fae2633dc263a8989903d73c3c1be23129d
0ac0daabcbbbf46ee26024d58b44a6a672869c9cae579e09b59dd11e05c23037
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Cookie: Hm_lvt_15c385327f80b8ccc130141066acbcec=1695749460; Hm_lpvt_15c385327f80b8ccc130141066acbcec=1695749460
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:31:00 GMT
Content-Type: image/x-icon
Content-Length: 16958
Last-Modified: Fri, 15 Jun 2018 09:27:32 GMT
Connection: keep-alive
ETag: "5b238684-423e"
Accept-Ranges: bytes
www.jcedu.org/wp-content/themes/xiyuan/fonts/huawenlishu.woff
2.9 MB URL www.jcedu.org/wp-content/themes/xiyuan/fonts/huawenlishu.woff
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Certificate IssuerTrustAsia Technologies, Inc.
Subjectjcedu.org
FingerprintDB:3E:26:09:22:AC:B7:3C:96:86:B0:CD:7C:FA:84:87:34:C5:6D:70
ValidityTue, 15 Aug 2023 00:00:00 GMT - Wed, 14 Aug 2024 23:59:59 GMT
File type Web Open Font Format, TrueType, length 2854640, version 1.2\012- data
Size 2.9 MB (2854640 bytes)
Hash 82710589dc54f7bbf8b7489ad27f1366
64d90bd0efd92ba390e3714cd3ad31a1b75993ce
adf8874ea754fa3bc119dd767ed5d129914275afb884569fd09fc6b455630466
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-content/themes/xiyuan/fonts/huawenlishu.woff HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/wp-content/themes/xiyuan/css/reset.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:59 GMT
Content-Type: font/woff
Content-Length: 2854640
Last-Modified: Mon, 14 May 2018 02:11:24 GMT
Connection: keep-alive
ETag: "5af8f04c-2b8ef0"
Accept-Ranges: bytes
www.jcedu.org/wp-includes/js/jquery/jquery.js?ver=1.12.4
200 OK 97 kB URL GET HTTP/1.1 www.jcedu.org/wp-includes/js/jquery/jquery.js?ver=1.12.4
IP
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
Requested by http://www.jcedu.org/ebook/cs17.exe
File type ASCII text, with very long lines (31997)
Hash dc5ba5044fccc0297be7b262ce669a7c
f137ff98ae379e35b0702967d3b6866a0a40e3be
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /wp-includes/js/jquery/jquery.js?ver=1.12.4 HTTP/1.1
Host: www.jcedu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.jcedu.org/ebook/cs17.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Sep 2023 17:30:56 GMT
Content-Type: application/javascript
Last-Modified: Thu, 05 Sep 2019 01:26:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"5d70644a-17a6a"
Expires: Wed, 27 Sep 2023 05:30:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
47.100.62.130
103.235.46.191