Report - kimjikuk.luxeone.cn/app/77P/

Report Overview

Submitted URL
kimjikuk.luxeone.cn/app/77P/
IP
121.5.128.216
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited
Submitted
2023-05-07 02:52:48
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
5

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-05-06	1.7 kB	3.5 kB	142.250.74.131
ssl.gstatic.com	unknown	2008-02-11	2012-05-23	2023-05-06	924 B	6.0 kB	142.250.74.163
kimjikuk.luxeone.cn	unknown	2012-10-14	2019-12-19	2023-05-06	1.1 kB	124 kB	121.5.128.216
www.google.com	7	1997-09-15	2015-05-10	2023-05-06	470 B	5.8 kB	142.250.74.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-05-07	medium	kimjikuk.luxeone.cn/app/77P/
2023-05-07	medium	kimjikuk.luxeone.cn/app/77P/?i=1

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
kimjikuk.luxeone.cn/app/77P/?i=1
IP
121.5.128.216
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 20 19:00:43 2022, Last Saved Time/Date: Thu Jan 20 19:07:37 2022, Security: 0\012- OLE 2 Compound Document, v3.62, SecID 0x89, 2 FAT sectors, 0 Mini FAT sector : Microsoft Excel 97-2003 worksheet or template\012- data
Size
73 kB (72721 bytes)
Hash
21fc12ef8a4a4ba5b38a303fa7e70c08
5700a2231371b289eae19ce62e1a73457ee582c4
6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5

Detections

Analyzer	Verdict	Alert
VirusTotal	38/54	VirusTotal -

JavaScript (2)

	URL	Size	First Seen	Last Seen
	kimjikuk.luxeone.cn/app/77P/	2.5 kB	2023-03-07	2024-03-04
Pretty URL kimjikuk.luxeone.cn/app/77P/ IP 121.5.128.216 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:15:49 Last Seen2024-03-04 22:34:02 Times Seen3528 Hash b553d617e22bea5c038b659b459947e3 9da13ff5b73dbf982d23a21dab51fadde71ae637 cb6d2c67669ed2781da3cbb4d486802a3bdf066437a158adfa3c50d4c7ee5b3a Loading...

	kimjikuk.luxeone.cn/app/77P/	617 B	2023-03-07	2024-03-04
Pretty URL kimjikuk.luxeone.cn/app/77P/ IP 121.5.128.216 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:15:49 Last Seen2024-03-04 22:34:02 Times Seen2796 Hash 14f67e7aa20b9b21dbf19c5b890c2ce7 9d722eea0d2e08fd213be2eea5d514a01d1cb7be f4de02decfc801c65a780e1ff21bd2d0f031250ee7b4ece729cc4cd8be756083 Loading...

HTTP Transactions (10)

URL IP Response Size

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
d3454e1b68c1c2a44dd9624b283b3945
406b597540f09f2a82205e83a391f91e864c5532
19b2aacd9ee6f9cfff0e08b8350d97afc75e255916d9c26fa7bfee664bd09cac

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 07 May 2023 02:52:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
d3454e1b68c1c2a44dd9624b283b3945
406b597540f09f2a82205e83a391f91e864c5532
19b2aacd9ee6f9cfff0e08b8350d97afc75e255916d9c26fa7bfee664bd09cac

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 07 May 2023 02:52:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ssl.gstatic.com/images/branding/product/2x/hh_drive_24dp.png

142.250.74.163

200 OK

1.4 kB

URL GET HTTP/2
ssl.gstatic.com/images/branding/product/2x/hh_drive_24dp.png
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://kimjikuk.luxeone.cn/app/77P/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintD2:67:59:66:D0:D5:C9:19:F4:2D:E4:65:4B:EA:E1:50:8D:D2:3E:1D
ValidityMon, 17 Apr 2023 08:25:28 GMT - Mon, 10 Jul 2023 08:25:27 GMT

File type
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size
1.4 kB (1406 bytes)
Hash
e33f62c65be5d812af2bb339ad27c18b
a32858e4d72771e0fd85a2ac86dce05c09b51a89
52e3b7ed5e8100ad9c81c95f181d5feb617960dad651e0ec9ae313278dcafaf7

HTTP Headers

GET /images/branding/product/2x/hh_drive_24dp.png HTTP/1.1
Host: ssl.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kimjikuk.luxeone.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1406
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 06 May 2023 11:24:31 GMT
expires: Sun, 05 May 2024 11:24:31 GMT
cache-control: public, max-age=31536000
age: 55682
last-modified: Tue, 15 Sep 2020 13:15:00 GMT
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

kimjikuk.luxeone.cn/app/77P/

121.5.128.216

200 OK

50 kB

URL User Request GET HTTP/2
kimjikuk.luxeone.cn/app/77P/
IP
121.5.128.216:443
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

Certificate
IssuerLet's Encrypt
Subjectkimjikuk.luxeone.cn
Fingerprint2E:D3:91:72:F9:98:B8:EB:61:0C:7C:24:D9:F7:0A:1F:0D:C1:CB:EE
ValidityThu, 20 Apr 2023 05:15:09 GMT - Wed, 19 Jul 2023 05:15:08 GMT

File type
data
Size
50 kB (50115 bytes)
Hash
04a58f86a29c98817e123c944cb4fc7d
433751d60d38d97e46bf3984dc39049e3457574e
885357144e63274cee6fa1663b85ebfe929fca90813d382a91b5f92ae2c4821c

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /app/77P/ HTTP/1.1
Host: kimjikuk.luxeone.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sun, 07 May 2023 02:52:32 GMT
content-type: text/html;charset=UTF-8
vary: Accept-Encoding
set-cookie: 645712706b1f5=1683427952; expires=Sun, 07-May-2023 02:53:32 GMT; Max-Age=60; path=/
cache-control: no-cache, must-revalidate
pragma: no-cache
last-modified: Sun, 07 May 2023 02:52:32 GMT
expires: Sun, 07 May 2023 02:52:32 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
9e0048bfd4dbd888e603799c38403132
0d83fde57ec051b3268d6187be01605080ae9c8a
643718e3659186d0651b6e4bd3c0d138bdb786ab2b455724cb251cfa74d3c5f0

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 07 May 2023 02:52:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/images/branding/googlelogo/2x/googlelogo_color_120x44dp.png

142.250.74.132

200 OK

5.1 kB

URL GET HTTP/2
www.google.com/images/branding/googlelogo/2x/googlelogo_color_120x44dp.png
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://kimjikuk.luxeone.cn/app/77P/
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint22:2A:81:06:18:D1:68:C5:1A:F7:E4:D9:FB:DF:C4:9B:E3:FD:BF:6E
ValidityMon, 17 Apr 2023 08:26:19 GMT - Mon, 10 Jul 2023 08:26:18 GMT

File type
PNG image data, 240 x 88, 8-bit/color RGBA, non-interlaced\012- data
Size
5.1 kB (5087 bytes)
Hash
8d2b7f3d00f50b8aebb7d1c002c64ca1
b3d5a78c18020868d322a0ac54c9d8e45a59a3b3
29c50fa4422ac0a690af5b0987dee6a030a7eeaafa9dda8543cf022368f545aa

HTTP Headers

GET /images/branding/googlelogo/2x/googlelogo_color_120x44dp.png HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://kimjikuk.luxeone.cn/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 5087
date: Sun, 07 May 2023 02:52:33 GMT
expires: Sun, 07 May 2023 02:52:33 GMT
cache-control: private, max-age=31536000
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
d3454e1b68c1c2a44dd9624b283b3945
406b597540f09f2a82205e83a391f91e864c5532
19b2aacd9ee6f9cfff0e08b8350d97afc75e255916d9c26fa7bfee664bd09cac

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 07 May 2023 02:52:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
bf34384a7fd9e62b9045178ff81864df
732744c22cd182dac8ab80666ef2d8985a47d3a9
89f580bee129d929f610dcbb61af775e59ebd60acf584cf274346ecf638816f5

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 07 May 2023 02:52:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

kimjikuk.luxeone.cn/app/77P/?i=1

121.5.128.216

200 OK

73 kB

URL User Request GET HTTP/2
kimjikuk.luxeone.cn/app/77P/?i=1
IP
121.5.128.216:443
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

Certificate
IssuerLet's Encrypt
Subjectkimjikuk.luxeone.cn
Fingerprint2E:D3:91:72:F9:98:B8:EB:61:0C:7C:24:D9:F7:0A:1F:0D:C1:CB:EE
ValidityThu, 20 Apr 2023 05:15:09 GMT - Wed, 19 Jul 2023 05:15:08 GMT

File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 20 19:00:43 2022, Last Saved Time/Date: Thu Jan 20 19:07:37 2022, Security: 0\012- OLE 2 Compound Document, v3.62, SecID 0x89, 2 FAT sectors, 0 Mini FAT sector : Microsoft Excel 97-2003 worksheet or template\012- data
Size
73 kB (72721 bytes)
Hash
21fc12ef8a4a4ba5b38a303fa7e70c08
5700a2231371b289eae19ce62e1a73457ee582c4
6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5

Detections

Analyzer	Verdict	Alert
fortinet	Malware
VirusTotal	38/54	VirusTotal -

HTTP Headers

GET /app/77P/?i=1 HTTP/1.1
Host: kimjikuk.luxeone.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kimjikuk.luxeone.cn/app/77P/
Cookie: 645712706b1f5=1683427952
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 07 May 2023 02:52:36 GMT
content-type: application/vnd.ms-excel
content-length: 72721
set-cookie: 645712744a103=1683427956; expires=Sun, 07-May-2023 02:53:36 GMT; Max-Age=60; path=/
cache-control: no-cache, must-revalidate
pragma: no-cache
last-modified: Sun, 07 May 2023 02:52:36 GMT
expires: Sun, 07 May 2023 02:52:36 GMT
content-disposition: attachment; filename="628977816939330473.xls"
content-transfer-encoding: binary
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

ssl.gstatic.com/images/branding/product/2x/hh_drive_96dp.png

142.250.74.163

200 OK

3.2 kB

URL GET HTTP/2
ssl.gstatic.com/images/branding/product/2x/hh_drive_96dp.png
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://kimjikuk.luxeone.cn/app/77P/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintD2:67:59:66:D0:D5:C9:19:F4:2D:E4:65:4B:EA:E1:50:8D:D2:3E:1D
ValidityMon, 17 Apr 2023 08:25:28 GMT - Mon, 10 Jul 2023 08:25:27 GMT

File type
PNG image data, 192 x 192, 8-bit colormap, non-interlaced\012- data
Size
3.2 kB (3187 bytes)
Hash
19e8bf7bac9b6574d8888e3834a31ebe
0e51db1a9561498234e51d7f067a25869913a329
cf1af6a9f65f77148ff375b65410da631d96774ad33042b88f28e2d5f4b4cecc

HTTP Headers

GET /images/branding/product/2x/hh_drive_96dp.png HTTP/1.1
Host: ssl.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kimjikuk.luxeone.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 3187
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 06 May 2023 11:29:34 GMT
expires: Sun, 05 May 2024 11:29:34 GMT
cache-control: public, max-age=31536000
age: 55379
last-modified: Tue, 15 Sep 2020 13:15:00 GMT
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections