marco-cloudflare-pages-0-edtunnel.pages.dev Open in urlscan Pro
172.66.47.2 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://marco-cloudflare-pages-0-edtunnel.pages.dev/
Effective URL:
https://marco-cloudflare-pages-0-edtunnel.pages.dev/index
Submission: On July 19 via automatic, source certstream-suspicious (July 19th 2024, 2:44:31 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 172.66.47.2, located in United States and belongs to CLOUDFLARENET, US. The main domain is marco-cloudflare-pages-0-edtunnel.pages.dev.
TLS certificate: Issued by WE1 on July 19th 2024. Valid for: 3 months.

This is the only time marco-cloudflare-pages-0-edtunnel.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:310... 2606:4700:310c::ac42:2cfe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.66.47.2 172.66.47.2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	14.215.182.140 14.215.182.140	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
1	117.45.3.100 117.45.3.100	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
11	5

1 2606:4700:310c::ac42:2cfe (United States)

ASN13335 (CLOUDFLARENET, US)

marco-cloudflare-pages-0-edtunnel.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.66.47.2 (United States)

ASN13335 (CLOUDFLARENET, US)

marco-cloudflare-pages-0-edtunnel.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 14.215.182.140 (Guangzhou, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 117.45.3.100 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

v1.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 8226	12 KB
2	pages.dev marco-cloudflare-pages-0-edtunnel.pages.dev	5 KB
1	cnzz.com v1.cnzz.com — Cisco Umbrella Rank: 65629	364 B
0	jianshu.io Failed cdn2.jianshu.io Failed
11	4

	Domain	Requested by
2	hm.baidu.com	marco-cloudflare-pages-0-edtunnel.pages.dev
2	marco-cloudflare-pages-0-edtunnel.pages.dev	marco-cloudflare-pages-0-edtunnel.pages.dev
1	v1.cnzz.com	marco-cloudflare-pages-0-edtunnel.pages.dev
0	cdn2.jianshu.io Failed	marco-cloudflare-pages-0-edtunnel.pages.dev
11	4

This site contains links to these domains. Also see Links.

Domain
weibo.com

Subject Issuer	Validity	Valid
marco-cloudflare-pages-0-edtunnel.pages.dev WE1	`2024-07-19` - `2024-10-17`	3 months	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2024-07-08` - `2025-08-09`	a year	crt.sh
*.cnzz.com GlobalSign Organization Validation CA - SHA256 - G3	`2024-02-17` - `2025-03-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://marco-cloudflare-pages-0-edtunnel.pages.dev/index
Frame ID: B9BE0F917B813698C8ED9901306898BA
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

您要找的页面不存在 - 简书

Page URL History Show full URLs

https://marco-cloudflare-pages-0-edtunnel.pages.dev/ Page URL
https://marco-cloudflare-pages-0-edtunnel.pages.dev/index Page URL

Detected technologies

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

CNZZ (Analytics) Expand

Overall confidence: 100%
Detected patterns

//[^./]+\.cnzz\.com/(?:z_stat.php|core)\?

Page Statistics

11
Requests

45 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

17 kB
Transfer

37 kB
Size

5
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://weibo.com/jianshuio
Title: 关注简书官方微博 ›

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://marco-cloudflare-pages-0-edtunnel.pages.dev/ Page URL
https://marco-cloudflare-pages-0-edtunnel.pages.dev/index Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
marco-cloudflare-pages-0-edtunnel.pages.dev/ 381 B
729 B 1171ms
1106ms Document
text/html 2606:4700:310c::ac42:2cfe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://marco-cloudflare-pages-0-edtunnel.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:310c::ac42:2cfe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: aa5636d7df9efaeccd1bc021347818c19c25068f264cdff290f7967a865294af

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 8a5b7d490ddc5d85-FRA
content-encoding: br
content-type: text/html
date: Fri, 19 Jul 2024 14:44:26 GMT
last-modified: Fri, 28 Jul 2023 13:36:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cx6QMmdppKAvrKId1b797wxo35yLoXvcUQnB2tQFr3GPv%2FO2LDtUT53%2BzahmgIAgQGA1%2F3MmndV%2F1OKdOWPgnsnU%2BlE1OJmv5EVEsElyOrwI%2FCpAKDNXbBzNSdJOvD7Br864DkMBSaqoUsGPvpAQeAinQhJdtUe1F0FAm2uJf66zCPLmvABKGED4"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: ASP.NET

GET
H3 404 Primary Request index Show response
marco-cloudflare-pages-0-edtunnel.pages.dev/ 7 KB
4 KB 726ms
726ms Document
text/html 172.66.47.2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://marco-cloudflare-pages-0-edtunnel.pages.dev/index

Requested by

Host: marco-cloudflare-pages-0-edtunnel.pages.dev
URL: https://marco-cloudflare-pages-0-edtunnel.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1a8de952e62d6875d87f06c00cc051c7552fd3ed55740de6284ddbbfe22fe75

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' .jianshu.com .jianshu.io .bootcdn.net .cloudflare.com .nkscdn.com .huanqiu.com post.star-media.cn api.geevisit.com monitor.geetest.com api.geetest.com static.geetest.com dn-staticdown.qbox.me zz.bdstatic.com .google-analytics.com .baidu.com .cnzz.com .iscrv.com .nkscdn.com .xingchenjia.com nkscdn.com push.zhanzhang.baidu.com res.wx.qq.com qzonestyle.gtimg.cn as.alipayobjects.com nbrecsys.4paradigm.com shared.ydstatic.com gorgon.youdao.com .googlesyndication.com adservice.google.com www.googletagservices.com cpro.baidustatic.com .sogou.com .sogoucdn.com .alicdn.com .baidustatic.com .aliyun.com sofire.bdstatic.com js-agent.newrelic.com ;style-src 'self' 'unsafe-inline' .jianshu.com .jianshu.io api.geetest.com monitor.geetest.com api.geetest.com static.geetest.com shared.ydstatic.com .sogou.com .sogoucdn.com .alicdn.com .baidustatic.com *.aliyun.com ;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://marco-cloudflare-pages-0-edtunnel.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8a5b7d501b1230e2-FRA
content-encoding: br
content-security-policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' *.jianshu.com *.jianshu.io *.bootcdn.net *.cloudflare.com *.nkscdn.com *.huanqiu.com post.star-media.cn api.geevisit.com monitor.geetest.com api.geetest.com static.geetest.com dn-staticdown.qbox.me zz.bdstatic.com *.google-analytics.com *.baidu.com *.cnzz.com *.iscrv.com *.nkscdn.com *.xingchenjia.com nkscdn.com push.zhanzhang.baidu.com res.wx.qq.com qzonestyle.gtimg.cn as.alipayobjects.com nbrecsys.4paradigm.com shared.ydstatic.com gorgon.youdao.com *.googlesyndication.com adservice.google.com www.googletagservices.com cpro.baidustatic.com *.sogou.com *.sogoucdn.com *.alicdn.com *.baidustatic.com *.aliyun.com sofire.bdstatic.com js-agent.newrelic.com ;style-src 'self' 'unsafe-inline' *.jianshu.com *.jianshu.io api.geetest.com monitor.geetest.com api.geetest.com static.geetest.com shared.ydstatic.com *.sogou.com *.sogoucdn.com *.alicdn.com *.baidustatic.com *.aliyun.com ;
content-type: text/html; charset=utf-8
date: Fri, 19 Jul 2024 14:44:26 GMT
eagleid: a3b55c9917214002667256219e
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=upS4IeLjC4E02%2ByKfWhuhzIkMj8ITkJTSLoTc2hjwKHBL%2B%2Fksf7yDkSpS1R63eHcLHJa%2ByaRhWJfDUd%2BTaeTcW4gsGhmhaiXXncrkRJ%2FHdz3YBqddTYTF32RjqDki5juy5zLqbr3kbKgU2CSFElXioH2pnLiFrV4L6W61aLe"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: cache9.l2nu20-1[65,0], ens-cache5.de5[231,0]
x-alicdn-da-ups-status: endOs,0,404
x-content-type-options: nosniff
x-frame-options: DENY
x-request-id: 36072f28-6e4b-46d8-929d-f3ddbc9dc202
x-runtime: 0.010170
x-xss-protection: 1; mode=block

GET error_p_logo-4a543c8ed828256afa97a62fbea4c186.png
cdn2.jianshu.io/assets/web/ 0
0

GET img_404-80cb554db22104d39ab89692e9ebfdb8.png
cdn2.jianshu.io/assets/web/ 0
0

GET error_p_app-52706219fcf58ae658cd9f68c7610bad.png
cdn2.jianshu.io/assets/web/ 0
0

GET error_p_weibo-a35a5ab1702131fd77afc11ad608c40b.png
cdn2.jianshu.io/assets/web/ 0
0

GET qrcode_wechat-55114be8bccc3bccb1ae76a6d3dd10e9.png
cdn2.jianshu.io/assets/web/ 0
0

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 1010ms
357ms Script
application/javascript 14.215.182.140
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?0c0e9d9b1e7d617b3e6842e85b9fb068

Requested by

Host: marco-cloudflare-pages-0-edtunnel.pages.dev
URL: https://marco-cloudflare-pages-0-edtunnel.pages.dev/index

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

14.215.182.140 Guangzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),

Reverse DNS

Software

apache /

Resource Hash

66c70e5d782c3d99afd02a9c7ce2729521e92dec9c45116ba743df09a4589d4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

Referer: https://marco-cloudflare-pages-0-edtunnel.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Fri, 19 Jul 2024 14:44:27 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=172800
Server: apache
Etag: af825cf9b3fd26f09fe40f440a0e5d02
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: application/javascript
Cache-Control: max-age=0, must-revalidate
Content-Length: 11390

GET
H2 200 z_stat.php Show response
v1.cnzz.com/ 0
364 B 2495ms
282ms Script
text/plain 117.45.3.100
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.cnzz.com/z_stat.php?id=1279807957&web_id=1279807957
Requested by: Host: marco-cloudflare-pages-0-edtunnel.pages.dev
URL: https://marco-cloudflare-pages-0-edtunnel.pages.dev/index
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 117.45.3.100 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://marco-cloudflare-pages-0-edtunnel.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 19 Jul 2024 14:43:39 GMT
content-encoding: gzip
via: cache16.l2cn1802[0,0,200-0,H], cache2.l2cn1802[1,0], cache8.cn5085[0,0,200-0,H], cache12.cn5085[9,0]
server: Tengine
age: 49
x-swift-cachetime: 85
vary: accept-encoding
ali-swift-global-savetime: 1721400220
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
cache-control: public, max-age=90
x-swift-savetime: Fri, 19 Jul 2024 14:43:45 GMT
timing-allow-origin: *
content-length: 20
eagleid: 752d031217214002693122409e

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 354ms
354ms Image
image/gif 14.215.182.140
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?hca=A17AF27CEC0EC438&cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=de-de&lo=0&rnd=834948466&si=0c0e9d9b1e7d617b3e6842e85b9fb068&su=https%3A%2F%2Fmarco-cloudflare-pages-0-edtunnel.pages.dev%2F&v=1.3.2&lv=1&sn=57958&r=0&ww=1600&u=https%3A%2F%2Fmarco-cloudflare-pages-0-edtunnel.pages.dev%2Findex&tt=%E6%82%A8%E8%A6%81%E6%89%BE%E7%9A%84%E9%A1%B5%E9%9D%A2%E4%B8%8D%E5%AD%98%E5%9C%A8%20-%20%E7%AE%80%E4%B9%A6

Requested by

Host: marco-cloudflare-pages-0-edtunnel.pages.dev
URL: https://marco-cloudflare-pages-0-edtunnel.pages.dev/index

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

14.215.182.140 Guangzhou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

Referer: https://marco-cloudflare-pages-0-edtunnel.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 19 Jul 2024 14:44:28 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
Server: apache
Content-Type: image/gif
Cache-Control: private, max-age=0, no-cache
Content-Length: 43

GET favicon-e743bfb1821442341c3ab15bdbe804f7ad97676bd07a770ccc9483473aa76f06.ico
cdn2.jianshu.io/assets/favicons/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn2.jianshu.io
URL: https://cdn2.jianshu.io/assets/web/error_p_logo-4a543c8ed828256afa97a62fbea4c186.png

Domain: cdn2.jianshu.io
URL: https://cdn2.jianshu.io/assets/web/img_404-80cb554db22104d39ab89692e9ebfdb8.png

Domain: cdn2.jianshu.io
URL: https://cdn2.jianshu.io/assets/web/error_p_app-52706219fcf58ae658cd9f68c7610bad.png

Domain: cdn2.jianshu.io
URL: https://cdn2.jianshu.io/assets/web/error_p_weibo-a35a5ab1702131fd77afc11ad608c40b.png

Domain: cdn2.jianshu.io
URL: https://cdn2.jianshu.io/assets/web/qrcode_wechat-55114be8bccc3bccb1ae76a6d3dd10e9.png

Domain: cdn2.jianshu.io
URL: https://cdn2.jianshu.io/assets/favicons/favicon-e743bfb1821442341c3ab15bdbe804f7ad97676bd07a770ccc9483473aa76f06.ico

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _hmt boolean| _bdhm_loaded_0c0e9d9b1e7d617b3e6842e85b9fb068

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
marco-cloudflare-pages-0-edtunnel.pages.dev/	1969-12-31 23:59:59	Name: eng_k55_id Value: 015106
.hm.baidu.com/	1970-01-21 07:46:00	Name: HMACCOUNT_BFESS Value: A17AF27CEC0EC438
.marco-cloudflare-pages-0-edtunnel.pages.dev/	1970-01-21 06:55:36	Name: Hm_lvt_0c0e9d9b1e7d617b3e6842e85b9fb068 Value: 1721400268
.marco-cloudflare-pages-0-edtunnel.pages.dev/	1969-12-31 23:59:59	Name: Hm_lpvt_0c0e9d9b1e7d617b3e6842e85b9fb068 Value: 1721400268
.marco-cloudflare-pages-0-edtunnel.pages.dev/	1969-12-31 23:59:59	Name: HMACCOUNT Value: A17AF27CEC0EC438

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://marco-cloudflare-pages-0-edtunnel.pages.dev/index Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn2.jianshu.io
hm.baidu.com
marco-cloudflare-pages-0-edtunnel.pages.dev
v1.cnzz.com
cdn2.jianshu.io
117.45.3.100
14.215.182.140
172.66.47.2
2606:4700:310c::ac42:2cfe
66c70e5d782c3d99afd02a9c7ce2729521e92dec9c45116ba743df09a4589d4d
aa5636d7df9efaeccd1bc021347818c19c25068f264cdff290f7967a865294af
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e1a8de952e62d6875d87f06c00cc051c7552fd3ed55740de6284ddbbfe22fe75
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

marco-cloudflare-pages-0-edtunnel.pages.dev Open in urlscan Pro 172.66.47.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

45 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

17 kBTransfer

37 kBSize

5 Cookies

1 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

marco-cloudflare-pages-0-edtunnel.pages.dev Open in urlscan Pro
172.66.47.2 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

45 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

17 kB
Transfer

37 kB
Size

5
Cookies

11 HTTP transactions
0 data transactions