secure-safedownload.com Open in urlscan Pro
202.155.238.12 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://secure-safedownload.com/?rid=cL28RDB
Submission: On July 06 via manual (July 6th 2023, 8:24:56 am UTC) from HK — Scanned from DE

Summary HTTP 6 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 202.155.238.12, located in Central, Hong Kong and belongs to HKBNES-AS-AP HKBN Enterprise Solutions HK Limited, HK. The main domain is secure-safedownload.com.
TLS certificate: Issued by R3 on June 2nd 2023. Valid for: 3 months.

This is the only time secure-safedownload.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	202.155.238.12 202.155.238.12	9381 (HKBNES-AS...) (HKBNES-AS-AP HKBN Enterprise Solutions HK Limited)
1	104.126.37.163 104.126.37.163	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	3

2 202.155.238.12 (Central, Hong Kong)

ASN9381 (HKBNES-AS-AP HKBN Enterprise Solutions HK Limited, HK)
PTR: mail.greenradar.com

secure-safedownload.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.126.37.163 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-126-37-163.deploy.static.akamaitechnologies.com

smile.parknshop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	secure-safedownload.com secure-safedownload.com	134 KB
1	parknshop.com smile.parknshop.com	73 KB
6	2

	Domain	Requested by
2	secure-safedownload.com	smile.parknshop.com
1	smile.parknshop.com	secure-safedownload.com smile.parknshop.com
6	2

This site contains links to these domains. Also see Links.

Domain
smile.parknshop.com
parknshopapp.page.link

Subject Issuer	Validity	Valid
secure-safedownload.com R3	`2023-06-02` - `2023-08-31`	3 months	crt.sh
www2.aswatson.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-31` - `2024-01-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://secure-safedownload.com/?rid=cL28RDB
Frame ID: 4BC00203E777DC0D2CC04D0CB3C81617
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

健康食品問卷調查

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

207 kB
Transfer

515 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://smile.parknshop.com/

Search URL Search Domain Scan URL

URL: https://parknshopapp.page.link/G6Dt
Title: PARKnSHOP App

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
secure-safedownload.com/ 184 KB
134 KB 768ms
253ms Document
text/html 202.155.238.12
HKBNES-AS-AP HKBN...

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-safedownload.com/?rid=cL28RDB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 202.155.238.12 Central, Hong Kong, ASN9381 (HKBNES-AS-AP HKBN Enterprise Solutions HK Limited, HK),
Reverse DNS: mail.greenradar.com
Software: /
Resource Hash: 64b4246a18e30127fdd47630865667db1077a1d3e10d71cbb985ce48c78a5d67

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 06 Jul 2023 08:24:50 GMT
vary: Accept-Encoding
x-server: gophish

GET
DATA 200
OK truncated
/ 26 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b794385ca81edfd932e12907c9f5f8ffac83e08dff7851753a390b41eec388a1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d66fefb0a73fe16a55b32d9aca538143547e785e5909ab4536d1a64f333669df

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5f647db3844f54b7be64f9a874f31db1ae17434330d237d6070ee492d4079d51

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 94 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebc46f20f309655c80c7a95bfa21fb6e16baeba8687f9886bdb991d0f1b80ee5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1494141e12c62bf7058ba22dfe4a96513a20831ed79ba0425a8417307be3b4d8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 GkI Show response
smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/ 199 KB
73 KB 107ms
16ms Script
application/javascript 104.126.37.163
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI

Requested by

Host: secure-safedownload.com
URL: https://secure-safedownload.com/?rid=cL28RDB

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.37.163 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-126-37-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

ab5d287faca6771865d82b79225e01bbf02c1ba7a390f8c145ff6e3757ab3d08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure-safedownload.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 08:24:51 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
last-modified: Wed, 26 Apr 2023 15:12:19 GMT
mpulse_cdn_cache: HIT
etag: "5e1769686922f1444a55a008d682b6589f13feb0c9565b135830cab8ca7fafe4"
stored-attribute-sha-checksum: ab5d287faca6771865d82b79225e01bbf02c1ba7a390f8c145ff6e3757ab3d08
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate, no-cache
mpulse_origin_time: 0
content-length: 73506
x-xss-protection: 1; mode=block
expires: Wed, 02 Aug 2023 10:14:34 GMT, 0

GET
H2 404 get_params Show response
secure-safedownload.com/_bm/ 19 B
111 B 206ms
206ms XHR
text/plain 202.155.238.12
HKBNES-AS-AP HKBN...

General

Check archive.org

Show headers Download Go to

Full URL

https://secure-safedownload.com/_bm/get_params?type=get-akid

Requested by

Host: smile.parknshop.com
URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

202.155.238.12 Central, Hong Kong, ASN9381 (HKBNES-AS-AP HKBN Enterprise Solutions HK Limited, HK),

Reverse DNS

mail.greenradar.com

Software

Resource Hash

b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secure-safedownload.com/?rid=cL28RDB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 08:24:51 GMT
x-content-type-options: nosniff
content-length: 19
vary: Accept-Encoding
content-type: text/plain; charset=utf-8

POST GkI
smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: smile.parknshop.com
URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI

Domain: smile.parknshop.com
URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI

Domain: smile.parknshop.com
URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://secure-safedownload.com/?rid=cL28RDB Message: Access to XMLHttpRequest at 'https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI' from origin 'https://secure-safedownload.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://secure-safedownload.com/_bm/get_params?type=get-akid Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://secure-safedownload.com/?rid=cL28RDB Message: Access to XMLHttpRequest at 'https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI' from origin 'https://secure-safedownload.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://secure-safedownload.com/?rid=cL28RDB Message: Access to XMLHttpRequest at 'https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI' from origin 'https://secure-safedownload.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://smile.parknshop.com/kk_ltQzxg/k/t/5mntDPmfx22AGRPA/D33tSQ8N9Y/Elk8RmwD/cxEsVSct/GkI Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secure-safedownload.com
smile.parknshop.com
smile.parknshop.com
104.126.37.163
202.155.238.12
1494141e12c62bf7058ba22dfe4a96513a20831ed79ba0425a8417307be3b4d8
5f647db3844f54b7be64f9a874f31db1ae17434330d237d6070ee492d4079d51
64b4246a18e30127fdd47630865667db1077a1d3e10d71cbb985ce48c78a5d67
ab5d287faca6771865d82b79225e01bbf02c1ba7a390f8c145ff6e3757ab3d08
b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
b794385ca81edfd932e12907c9f5f8ffac83e08dff7851753a390b41eec388a1
d66fefb0a73fe16a55b32d9aca538143547e785e5909ab4536d1a64f333669df
ebc46f20f309655c80c7a95bfa21fb6e16baeba8687f9886bdb991d0f1b80ee5

secure-safedownload.com Open in urlscan Pro 202.155.238.12 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

207 kBTransfer

515 kBSize

0 Cookies

2 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

7 Console Messages

Indicators

secure-safedownload.com Open in urlscan Pro
202.155.238.12 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

207 kB
Transfer

515 kB
Size

0
Cookies

6 HTTP transactions
5 data transactions