gsf.29ar5ej.run.place Open in urlscan Pro
2606:4700:310c::ac42:2f0a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gsf.29ar5ej.run.place/
Submission: On July 06 via api (July 6th 2024, 2:22:43 am UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2606:4700:310c::ac42:2f0a, located in United States and belongs to CLOUDFLARENET, US. The main domain is gsf.29ar5ej.run.place.
TLS certificate: Issued by GTS CA 1P5 on May 27th 2024. Valid for: 3 months.

This is the only time gsf.29ar5ej.run.place was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:310... 2606:4700:310c::ac42:2f0a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	240e:f7:a060:... 240e:f7:a060:204::6	136188 (CHINATELE...) (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO)
1	2405:1480:200... 2405:1480:2000:3::33	23724 (CHINANET-...) (CHINANET-IDC-BJ-AP IDC)
17	4

2 2606:4700:310c::ac42:2f0a (United States)

ASN13335 (CLOUDFLARENET, US)

gsf.29ar5ej.run.place	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240e:f7:a060:204::6 (China)

ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN)

analytics.meituan.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2405:1480:2000:3::33 (China)

ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN)

appsec-mobile.meituan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	run.place gsf.29ar5ej.run.place	37 KB
1	meituan.com appsec-mobile.meituan.com — Cisco Umbrella Rank: 37243	114 KB
1	meituan.net analytics.meituan.net — Cisco Umbrella Rank: 228868 img.meituan.net Failed p1.meituan.net Failed p0.meituan.net Failed s0.meituan.net Failed	31 KB
0	dpfile.com Failed www.dpfile.com Failed
17	4

	Domain	Requested by
2	gsf.29ar5ej.run.place	gsf.29ar5ej.run.place
1	appsec-mobile.meituan.com	gsf.29ar5ej.run.place
1	analytics.meituan.net	gsf.29ar5ej.run.place
0	s0.meituan.net Failed	gsf.29ar5ej.run.place
0	p0.meituan.net Failed	gsf.29ar5ej.run.place
0	p1.meituan.net Failed	gsf.29ar5ej.run.place
0	img.meituan.net Failed	gsf.29ar5ej.run.place
0	www.dpfile.com Failed	gsf.29ar5ej.run.place
17	8

This site contains no links.

Subject Issuer	Validity	Valid
gsf.29ar5ej.run.place GTS CA 1P5	`2024-05-27` - `2024-08-25`	3 months	crt.sh
*.meituan.net GlobalSign RSA OV SSL CA 2018	`2024-05-31` - `2025-07-01`	a year	crt.sh
*.meituan.com GlobalSign RSA OV SSL CA 2018	`2023-08-04` - `2024-09-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://gsf.29ar5ej.run.place/
Frame ID: 71998DDCD4E1771255A36AF4A470525B
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://gsf.29ar5ej.run.place/ Page URL
https://gsf.29ar5ej.run.place/ Page URL

Page Statistics

17
Requests

24 %
HTTPS

100 %
IPv6

4
Domains

8
Subdomains

4
IPs

2
Countries

182 kB
Transfer

491 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gsf.29ar5ej.run.place/ Page URL
https://gsf.29ar5ej.run.place/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 /
gsf.29ar5ej.run.place/ 71 KB
22 KB 2161ms
1246ms Document
text/html 2606:4700:310c::ac42:2f0a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gsf.29ar5ej.run.place/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f0a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 89ec1fecdd2ebb86-FRA
content-encoding: br
content-type: text/html
date: Sat, 06 Jul 2024 02:22:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7PPk8%2FALfgXy4TxHEMTh3FloRNMT9n1opuRojW3JSvS%2B%2FmZGhjMgorTlyHfrBE%2F%2BDAAKH0IYC4tXtEjcDO7%2F%2FRcBnAi34%2Bl93u3dOHSvjhlCj8uslJFQfII02xjKK%2F2b2SspkN6tS%2Fy8VDqY9euIYcmpL0A%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cdn-cache; desc=MISS, edge; dur=1132, origin; dur=31 inner; dur=21,tt_agw; dur=12
strict-transport-security: max-age=31536000; includeSubDomains; preload
tt_stable: 1
vary: Accept-Encoding
x-agw-info: mRwYMkduwpKS-u6UCQ0axN_WAha0Tjti1rrFP4h_RzlAiuHM6AxwJM5emAEjYOZBJWFqFDJdklvNaxOm1RW_X0LE-5WAKF571nEqIWH6DrUKNUy7S8iVhhofB8Q_BGOJo2S-YFsRNDhBf9a1fnsSMSDal0tU3g2JfufqoQ8sRDw=
x-akamai-request-id: 5288643.6f537aa.77ecf6c8
x-cache: TCP_MISS from a2-19-125-207.deploy.akamaitechnologies.com (AkamaiGHost/11.5.3-56950534) (-)
x-cache-remote: TCP_MISS from a221-194-158-133.deploy.akamaitechnologies.com (AkamaiGHost/11.5.3-56950534) (-)
x-ms-token: jcKGVzDcs6ErU3sCX2nQ6t5EJyvoDuRRP50E2UnEsLAKkJHzt9CBqFnJvfnC3zk_zBhcccOXlzVi4IJuEFIk58-Bavu3Ap1ewt1HFgJ1
x-origin-response-time: 31,111.62.196.239
x-parent-response-time: 43,221.194.158.133 1163,2.19.125.207
x-tt-logid: 20240706102202A2CD2359B301A3637C07
x-tt-trace-host: 01ae3485c412db67097a2fefa88ba0f972274531880984e4b96df99ede2a3dbb8acec76a26f9b70fb1f40a93b2682e68096d335836a79428f31df42fd35bb2afd0e0cd224d27aacd78e7c448181437652c6c3412503171c514ec544c80d6bc419922772caf93a13b42022bfa28307fbda144479d1963c85f0d0fa250869c9e69c11e0a9c5dcc9633c05a9b6fa359983b37
x-tt-trace-id: 00-240706102202A2CD2359B301A3637C07-0E1038A9230A762C-00
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn

GET
H3 200 Primary Request / Show response
gsf.29ar5ej.run.place/ 79 KB
14 KB 839ms
839ms Document
text/html 2606:4700:310c::ac42:2f0a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gsf.29ar5ej.run.place/
Requested by: Host: gsf.29ar5ej.run.place
URL: https://gsf.29ar5ej.run.place/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27825dffbeeece0649e43824477d7866082a9d0d44ba753bc898992dfebada70

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://gsf.29ar5ej.run.place/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 89ec1ff4f9cdbb86-FRA
content-encoding: br
content-language: de-DE
content-type: text/html;charset=UTF-8
date: Sat, 06 Jul 2024 02:22:03 GMT
m-traceid: 28250741603678152 4480787273696854420
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0V6ZfamDjd01kIDpHxHXZzWA5tZ0JjKXKzygWbbGNgGTYHNj%2FrdvuR%2FQRIkj8NFf34amDhdtiNevCghiLhMAoO48d9P2wKQnXz3tLWW9Kzz%2B0Ikb8dkTiUIapFVAmxsYDvLK%2Fqx7xvoD7TDpQcsX5RC2OHI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, User-Agent, Accept-Encoding

GET index.min.1b782a80b8abe41a0307fdd6b470542a.css
www.dpfile.com/app/pc-common/ 0
0

GET
H/1.1 200
OK analytics.js Show response
analytics.meituan.net/ 72 KB
31 KB 1804ms
233ms Script
application/javascript 240e:f7:a060:204::6
CHINATELECOM-ZHEJ...

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.meituan.net/analytics.js
Requested by: Host: gsf.29ar5ej.run.place
URL: https://gsf.29ar5ej.run.place/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 240e:f7:a060:204::6 , China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software: openresty /
Resource Hash: c18edb26a6feb2e7ffd314efa90cf9d350c0530f51361ed17042d64fbfb8fa11

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://gsf.29ar5ej.run.place/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 15 Aug 2023 12:35:21 GMT
Content-Encoding: gzip
Age: 28129604
x-link-via: nbct08:443;huzmp04:443;
X-Cache-Status: HIT from KS-CLOUD-HUZ-MP-04-07, HIT from KS-CLOUD-NB-CT-08-21
Connection: keep-alive
Content-Length: 30763
Last-Modified: Tue, 15 Aug 2023 12:34:51 GMT
Server: openresty
ETag: W/"64db70eb-1214a"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600,s-maxage=3600
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Cdn-Request-ID: 7ce54dc02678d382e96515df1c2f0161
Expires: Fri, 09 Aug 2024 12:35:21 GMT

GET owl_1.5.16.js
www.dpfile.com/app/owl/static/ 0
0

GET
H/1.1 200
OK H5guard.js Show response
appsec-mobile.meituan.com/h5guard/ 269 KB
114 KB 984ms
437ms Script
application/javascript 2405:1480:2000:3::33
CHINANET-IDC-BJ-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://appsec-mobile.meituan.com/h5guard/H5guard.js
Requested by: Host: gsf.29ar5ej.run.place
URL: https://gsf.29ar5ej.run.place/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2405:1480:2000:3::33 , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN),
Reverse DNS
Software: openresty /
Resource Hash: 9a6c39ba97d76e323c02d6e10ea6709204e499c83c9d43aea4a57b459223396b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://gsf.29ar5ej.run.place/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 06 Jul 2024 02:22:04 GMT
Content-Encoding: gzip
X-Amz-Request-Id: 12109066213441223378
Transfer-Encoding: chunked
x-amz-storage-class: STANDARD
X-Route-Trace-Id: 14315892703015549649
Connection: keep-alive
X-Mss-Trace-Id: 12109066213441223378
X-Amz-Id-2: 4b04641a583ed31e564a964af2c82b99
Last-Modified: Tue, 02 Jan 2024 07:36:02 GMT
Server: openresty
ETag: W/"9fce66636f77b31cdeed7b7fc869f355"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache

GET index.min.ff5cdcf56025695da23ca22814de4f72.css
www.dpfile.com/app/dpindex-new-static/static/ 0
0

GET 2cc031985609ce10b1c85b792a262436285320.png
img.meituan.net/dpmobile/ 0
0

GET ff63f017a1363c29eef79f32cd39a46e5120.png
p1.meituan.net/mobilem/ 0
0

GET 8a011aaa356dc5cba2537cdd4400f1c09816.jpg
p1.meituan.net/gpa/ 0
0

GET c80f5d3f14c43db2d733a155110d27ad5539.png
p0.meituan.net/scarlett/ 0
0

GET index.min.f2491848f6ed02c16c39faad2febfa93.js
www.dpfile.com/app/pc-common/ 0
0

GET manifest.min.66dfe801672a62ad45780b313a399852.js
www.dpfile.com/app/dpindex-new-static/static/ 0
0

GET common.min.ac152c7f0d4ba6919a59ab23e86614b4.js
www.dpfile.com/app/dpindex-new-static/static/ 0
0

GET index.min.c8f5f66706a1c8740d0a50a38030d63c.js
www.dpfile.com/app/dpindex-new-static/static/ 0
0

GET owl.min.fc33f21654d625bfae13c8f7e6d91c2a.js
www.dpfile.com/app/owl/static/ 0
0

GET rohr.min.js
s0.meituan.net/mx/rohr/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/pc-common/index.min.1b782a80b8abe41a0307fdd6b470542a.css

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/owl/static/owl_1.5.16.js

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/dpindex-new-static/static/index.min.ff5cdcf56025695da23ca22814de4f72.css

Domain: img.meituan.net
URL: https://img.meituan.net/dpmobile/2cc031985609ce10b1c85b792a262436285320.png

Domain: p1.meituan.net
URL: https://p1.meituan.net/mobilem/ff63f017a1363c29eef79f32cd39a46e5120.png

Domain: p1.meituan.net
URL: https://p1.meituan.net/gpa/8a011aaa356dc5cba2537cdd4400f1c09816.jpg

Domain: p0.meituan.net
URL: https://p0.meituan.net/scarlett/c80f5d3f14c43db2d733a155110d27ad5539.png

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/pc-common/index.min.f2491848f6ed02c16c39faad2febfa93.js

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/dpindex-new-static/static/manifest.min.66dfe801672a62ad45780b313a399852.js

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/dpindex-new-static/static/common.min.ac152c7f0d4ba6919a59ab23e86614b4.js

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/dpindex-new-static/static/index.min.c8f5f66706a1c8740d0a50a38030d63c.js

Domain: www.dpfile.com
URL: https://www.dpfile.com/app/owl/static/owl.min.fc33f21654d625bfae13c8f7e6d91c2a.js

Domain: s0.meituan.net
URL: https://s0.meituan.net/mx/rohr/rohr.min.js

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage number| _start

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gsf.29ar5ej.run.place/	1970-01-20 21:50:34	Name: __ac_nonce Value: 06688aa4a00741fc59223
gsf.29ar5ej.run.place/	1970-01-21 06:36:08	Name: __ac_signature Value: _02B4Z6wo00f01a9edKwAAIDCrz8g7W8NEJGvfnAAAA1g24
gsf.29ar5ej.run.place/	1970-01-21 06:36:08	Name: __ac_referer Value: __ac_blank

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.meituan.net
appsec-mobile.meituan.com
gsf.29ar5ej.run.place
img.meituan.net
p0.meituan.net
p1.meituan.net
s0.meituan.net
www.dpfile.com
img.meituan.net
p0.meituan.net
p1.meituan.net
s0.meituan.net
www.dpfile.com
2405:1480:2000:3::33
240e:f7:a060:204::6
2606:4700:310c::ac42:2f0a
27825dffbeeece0649e43824477d7866082a9d0d44ba753bc898992dfebada70
9a6c39ba97d76e323c02d6e10ea6709204e499c83c9d43aea4a57b459223396b
c18edb26a6feb2e7ffd314efa90cf9d350c0530f51361ed17042d64fbfb8fa11

gsf.29ar5ej.run.place Open in urlscan Pro 2606:4700:310c::ac42:2f0a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

17 Requests

24 %HTTPS

100 %IPv6

4 Domains

8 Subdomains

4 IPs

2 Countries

182 kBTransfer

491 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

3 Cookies

Security Headers

Indicators

gsf.29ar5ej.run.place Open in urlscan Pro
2606:4700:310c::ac42:2f0a Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

24 %
HTTPS

100 %
IPv6

4
Domains

8
Subdomains

4
IPs

2
Countries

182 kB
Transfer

491 kB
Size

3
Cookies

17 HTTP transactions
0 data transactions