intrusec.com Open in urlscan Pro
103.193.134.127 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://intrusec.com/55808.html
Effective URL:
http://intrusec.com/default.php
Submission: On April 20 via manual (April 20th 2020, 5:11:39 pm UTC) from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 103.193.134.127, located in Hong Kong and belongs to LIHGL-AS-AP 24.hk global BGP, HK. The main domain is intrusec.com.

This is the only time intrusec.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 4	103.193.134.127 103.193.134.127	24000 (LIHGL-AS-...) (LIHGL-AS-AP 24.hk global BGP)
1 3	103.193.134.2 103.193.134.2	24000 (LIHGL-AS-...) (LIHGL-AS-AP 24.hk global BGP)
1 2	162.251.94.112 162.251.94.112	26484 (IKGUL-26484) (IKGUL-26484)
2	103.235.46.191 103.235.46.191	55967 (BAIDU Bei...) (BAIDU Beijing Baidu Netcom Science and Technology Co.)
8	4

4 103.193.134.127 (Hong Kong) 1 redirects

ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK)

intrusec.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.193.134.2 (Hong Kong) 1 redirects

ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK)

ryankleeman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.251.94.112 (Hot Springs, United States) 1 redirects

ASN26484 (IKGUL-26484, US)

pz116.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.235.46.191 (Hong Kong)

ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	intrusec.com 1 redirects intrusec.com	2 KB
3	ryankleeman.com 1 redirects ryankleeman.com	2 KB
2	baidu.com hm.baidu.com	14 KB
2	pz116.com 1 redirects pz116.com	213 B
8	4

	Domain	Requested by
4	intrusec.com	1 redirects intrusec.com
3	ryankleeman.com	1 redirects intrusec.com
2	hm.baidu.com	intrusec.com
2	pz116.com	1 redirects intrusec.com
8	4

This site contains no links.

Subject Issuer	Validity	Valid
*.pz116.com Sectigo RSA Domain Validation Secure Server CA	`2019-08-27` - `2020-08-26`	a year	crt.sh
baidu.com GlobalSign Organization Validation CA - SHA256 - G2	`2020-01-13` - `2020-06-25`	5 months	crt.sh

This page contains 2 frames:

Primary Page: http://intrusec.com/default.php
Frame ID: 9DBC79B3133E6BC9322FE7291CDAD73B
Requests: 7 HTTP requests in this frame

Frame: https://pz116.com/
Frame ID: B79412AE00AB49BBF0766B7A4D8529A0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://intrusec.com/55808.html HTTP 302
http://intrusec.com/default.php Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

38 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

18 kB
Transfer

42 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://intrusec.com/55808.html HTTP 302
http://intrusec.com/default.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://ryankleeman.com/js/js/jquery.min.js HTTP 302
http://ryankleeman.com/default.php

Request Chain 4

http://pz116.com/ HTTP 301
https://pz116.com/

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request default.php Show response
intrusec.com/
Redirect Chain

http://intrusec.com/55808.html
http://intrusec.com/default.php

852 B
757 B

578ms
560ms

Document
text/html

103.193.134.127
LIHGL-AS-AP 24.hk...

General

Check archive.org

Show headers Download Go to

Full URL: http://intrusec.com/default.php
Protocol: HTTP/1.1
Server: 103.193.134.127 , Hong Kong, ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK),
Reverse DNS
Software: Apache /
Resource Hash: 4094302aecdfe334def7cebaaaeb8365752826d0b22b874a22377b40695aa2b7

Request headers

Host: intrusec.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 20 Apr 2020 17:03:19 GMT
Server: Apache
Upgrade: h2
Connection: Upgrade, close
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 551
Content-Type: text/html

Redirect headers

Date: Mon, 20 Apr 2020 17:03:18 GMT
Server: Apache
Upgrade: h2
Connection: Upgrade, close
location: /default.php
Content-Length: 0
Content-Type: text/html

GET
H/1.1 200
OK base.js Show response
intrusec.com/ 519 B
668 B 583ms
553ms Script
application/javascript 103.193.134.127
LIHGL-AS-AP 24.hk...

General

Check archive.org

Show headers Download Go to

Full URL: http://intrusec.com/base.js
Requested by: Host: intrusec.com
URL: http://intrusec.com/default.php
Protocol: HTTP/1.1
Server: 103.193.134.127 , Hong Kong, ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK),
Reverse DNS
Software: Apache /
Resource Hash: 2165f74625d3ca2db3d7939394c0932ca7b3b496c274396dbc1a060545693b59

Request headers

Referer: http://intrusec.com/default.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 20 Apr 2020 17:03:20 GMT
Content-Encoding: gzip
Last-Modified: Mon, 16 Sep 2019 03:28:12 GMT
Server: Apache
ETag: "207-592a33192d27a-gzip"
Vary: Accept-Encoding
Upgrade: h2
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 349

GET
H/1.1 200
OK js.js Show response
intrusec.com/ 258 B
535 B 582ms
553ms Script
application/javascript 103.193.134.127
LIHGL-AS-AP 24.hk...

General

Check archive.org

Show headers Download Go to

Full URL: http://intrusec.com/js.js
Requested by: Host: intrusec.com
URL: http://intrusec.com/default.php
Protocol: HTTP/1.1
Server: 103.193.134.127 , Hong Kong, ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK),
Reverse DNS
Software: Apache /
Resource Hash: 968ce5ea84ccbd9e181e087cd50e6280d08b67a0a3ef70c3af6e451dd6c53202

Request headers

Referer: http://intrusec.com/default.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 20 Apr 2020 17:03:20 GMT
Content-Encoding: gzip
Last-Modified: Wed, 21 Aug 2019 02:50:22 GMT
Server: Apache
ETag: "102-59097a25cb780-gzip"
Vary: Accept-Encoding
Upgrade: h2
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 216

GET
H/1.1

200
OK

default.php Show response
ryankleeman.com/
Redirect Chain

http://ryankleeman.com/js/js/jquery.min.js
http://ryankleeman.com/default.php

0
0

587ms
567ms

Script
text/html

103.193.134.2
LIHGL-AS-AP 24.hk...

General

Check archive.org

Show headers Download Go to

Full URL: http://ryankleeman.com/default.php
Requested by: Host: intrusec.com
URL: http://intrusec.com/default.php
Protocol: HTTP/1.1
Server: 103.193.134.2 , Hong Kong, ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://intrusec.com/default.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

location: /default.php
Upgrade: h2
Date: Mon, 20 Apr 2020 17:03:30 GMT
Server: Apache
Connection: Upgrade, close
Content-Length: 0
Content-Type: text/html

GET
H/1.1 200
OK tz.js Show response
ryankleeman.com/js/ 2 KB
2 KB 10156ms
555ms Script
application/javascript 103.193.134.2
LIHGL-AS-AP 24.hk...

General

Check archive.org

Show headers Download Go to

Full URL: http://ryankleeman.com/js/tz.js
Requested by: Host: intrusec.com
URL: http://intrusec.com/default.php
Protocol: HTTP/1.1
Server: 103.193.134.2 , Hong Kong, ASN24000 (LIHGL-AS-AP 24.hk global BGP, HK),
Reverse DNS
Software: Apache /
Resource Hash: b3e8eedae7503c86b0ca7792c17746a1efa7dd5c0226954a2564b8ea7c18b0f9

Request headers

Referer: http://intrusec.com/default.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Mon, 20 Apr 2020 17:03:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 Sep 2019 02:43:03 GMT
Server: Apache
ETag: "7ec-5923dfae16f5f-gzip"
Vary: Accept-Encoding
Upgrade: h2
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 1345

GET
H/1.1

200
OK

Cookie set /
pz116.com/ Frame B794
Redirect Chain

http://pz116.com/
https://pz116.com/

0
0

1129ms
599ms

Document
text/html

162.251.94.112
IKGUL-26484

General

Check archive.org

Show headers Download Go to

Full URL

https://pz116.com/

Requested by

Host: intrusec.com
URL: http://intrusec.com/default.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.251.94.112 Hot Springs, United States, ASN26484 (IKGUL-26484, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=259200;

Request headers

Host: pz116.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://intrusec.com/default.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://intrusec.com/default.php

Response headers

Verification: clouds
Strict-Transport-Security: max-age=259200;
Server: nginx
Date: Mon, 20 Apr 2020 17:11:27 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: DELETE, HEAD, GET, OPTIONS, POST, PUT
Access-Control-Allow-Headers: Content-Type, Content-Range, Content-Disposition, Content-Description
Access-Control-Max-Age: 1728000
Set-Cookie: PHPSESSID=ititftdhv1a2cr6d5lalj7u4j5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
X-Cache: MISS from dhostname
Transfer-Encoding: chunked
Connection: keep-alive

Redirect headers

Server: clouds
Date: Mon, 20 Apr 2020 17:11:26 GMT
Location: https://pz116.com/
Content-Length: 0
Connection: keep-alive
Verification: clouds
Cache-Control: max-age=259200

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 38 KB
14 KB 1066ms
428ms Script
application/javascript 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?5520292f77207b50d46e56b65ddec479

Requested by

Host: intrusec.com
URL: http://intrusec.com/js.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

45e4c5280b10f6bc84f672c8ad1acf68c1fa92b945635afbe017311376625153

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

Referer: http://intrusec.com/default.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 20 Apr 2020 17:11:19 GMT
Content-Encoding: gzip
Server: apache
Etag: e59dc5dbe7e31a3a609c45afb5690b13
Strict-Transport-Security: max-age=172800
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: max-age=0, must-revalidate
Content-Type: application/javascript
Content-Length: 13834

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 429ms
429ms Image
image/gif 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=664313651&si=5520292f77207b50d46e56b65ddec479&v=1.2.73&lv=1&sn=13911&r=0&ww=1600&ct=!!&tt=%E8%82%A1%E7%A5%A8%E9%85%8D%E8%B5%84%E9%97%A8%E6%88%B7%7C%E8%82%A1%E7%A5%A8%E9%85%8D%E8%B5%84%E8%AE%BA%E5%9D%9B

Requested by

Host: intrusec.com
URL: http://intrusec.com/default.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

Referer: http://intrusec.com/default.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 20 Apr 2020 17:11:20 GMT
X-Content-Type-Options: nosniff
Server: apache
Strict-Transport-Security: max-age=172800
Content-Type: image/gif
Cache-Control: private, max-age=0, no-cache
Content-Length: 43

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hm.baidu.com
intrusec.com
pz116.com
ryankleeman.com
103.193.134.127
103.193.134.2
103.235.46.191
162.251.94.112
2165f74625d3ca2db3d7939394c0932ca7b3b496c274396dbc1a060545693b59
4094302aecdfe334def7cebaaaeb8365752826d0b22b874a22377b40695aa2b7
45e4c5280b10f6bc84f672c8ad1acf68c1fa92b945635afbe017311376625153
968ce5ea84ccbd9e181e087cd50e6280d08b67a0a3ef70c3af6e451dd6c53202
b3e8eedae7503c86b0ca7792c17746a1efa7dd5c0226954a2564b8ea7c18b0f9
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

intrusec.com Open in urlscan Pro 103.193.134.127 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

38 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

18 kBTransfer

42 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

0 Cookies

Indicators

intrusec.com Open in urlscan Pro
103.193.134.127 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

38 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

18 kB
Transfer

42 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions