Submitted URL: http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/index.php?l=_jehfuq_vjoxk0qwhtogydw_product-useri...
Effective URL: https://mail.qq.com/
Submission Tags: @ipnigh
Submission: On July 29 via api from GB

Summary

This website contacted 8 IPs in 2 countries across 3 domains to perform 23 HTTP transactions. The main IP is 103.7.30.100, located in Shanghai, China and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is mail.qq.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on March 29th 2019. Valid for: a year.
This is the only time mail.qq.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 184.168.166.154 26496 (AS-26496-...)
2 103.7.30.100 132203 (TENCENT-N...)
4 203.205.138.57 132203 (TENCENT-N...)
1 203.205.128.160 132203 (TENCENT-N...)
2 203.205.143.151 132203 (TENCENT-N...)
1 203.205.142.186 132203 (TENCENT-N...)
3 203.205.158.35 132203 (TENCENT-N...)
23 8
Domain Requested by
4 rescdn.qqmail.com mail.qq.com
3 res.wx.qq.com open.weixin.qq.com
2 open.weixin.qq.com mail.qq.com
open.weixin.qq.com
2 ip-184-168-166-154.ip.secureserver.net 1 redirects
1 rl.mail.qq.com mail.qq.com
1 xui.ptlogin2.qq.com mail.qq.com
1 mail.qq.com ip-184-168-166-154.ip.secureserver.net
1 ssl.ptlogin2.qq.com ip-184-168-166-154.ip.secureserver.net
mail.qq.com
0 tajs.qq.com Failed xui.ptlogin2.qq.com
0 ty.captcha.qq.com Failed xui.ptlogin2.qq.com
0 long.open.weixin.qq.com Failed res.wx.qq.com
0 res.mail.qq.com Failed ip-184-168-166-154.ip.secureserver.net
xui.ptlogin2.qq.com
23 12
Subject Issuer Validity Valid
*.mail.qq.com
DigiCert SHA2 Secure Server CA
2019-03-29 -
2020-05-15
a year crt.sh
*.weixin.qq.com
GlobalSign Organization Validation CA - SHA256 - G2
2019-05-13 -
2020-05-13
a year crt.sh
ssl.ui.ptlogin2.qq.com
GlobalSign Organization Validation CA - SHA256 - G2
2019-05-09 -
2019-12-08
7 months crt.sh
mp.weixin.qq.com
GeoTrust RSA CA 2018
2019-03-07 -
2020-03-17
a year crt.sh
xui.ptlogin2.qq.com
GlobalSign Organization Validation CA - SHA256 - G2
2018-12-07 -
2019-12-08
a year crt.sh
res.weixin.qq.com
GeoTrust RSA CA 2018
2018-09-18 -
2019-12-14
a year crt.sh

This page contains 3 frames:

Primary Page: https://mail.qq.com/
Frame ID: 3D87437D9D3C4A9C7A54579CA9E56251
Requests: 13 HTTP requests in this frame

Frame: https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
Frame ID: 4DC8B908D4B7335CFCD703EE9894E607
Requests: 6 HTTP requests in this frame

Frame: https://xui.ptlogin2.qq.com/cgi-bin/xlogin?target=self&appid=522005705&daid=4&s_url=https://mail.qq.com/cgi-bin/readtemplate?check=false%26t=loginpage_new_jump%26vt=passport%26vm=wpt%26ft=loginpage%26target=&style=25&low_login=1&proxy_url=https://mail.qq.com/proxy.html&need_qr=0&hide_border=1&border_radius=0&self_regurl=http://zc.qq.com/chs/index.html?type=1&app_id=11005?t=regist&pt_feedback_link=http://support.qq.com/discuss/350_1.shtml&css=https://res.mail.qq.com/zh_CN/htmledition/style/ptlogin_input_for_xmail440503.css
Frame ID: ECB3DFB8AD52610178B1E7B56170AED5
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/index.php?l=_jehfuq_vjoxk0qwh... HTTP 302
    http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoG... Page URL
  2. https://mail.qq.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

23
Requests

57 %
HTTPS

0 %
IPv6

3
Domains

12
Subdomains

8
IPs

2
Countries

145 kB
Transfer

271 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/index.php?l=_jehfuq_vjoxk0qwhtogydw_product-userid&userid100bahtstore.comwindowcleaningproducts.org89.33.64.116/~imaco?id=china@langshide.com HTTP 302
    http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid= Page URL
  2. https://mail.qq.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/index.php?l=_jehfuq_vjoxk0qwhtogydw_product-userid&userid100bahtstore.comwindowcleaningproducts.org89.33.64.116/~imaco?id=china@langshide.com HTTP 302
  • http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=

23 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set id.php
ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/
Redirect Chain
  • http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/index.php?l=_jehfuq_vjoxk0qwhtogydw_product-userid&userid100bahtstore.comwindowcleaningproducts.org8...
  • http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=
10 KB
4 KB
Document
General
Full URL
http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=
Protocol
HTTP/1.1
Server
184.168.166.154 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-184-168-166-154.ip.secureserver.net
Software
Apache /
Resource Hash
b2aa2e41bd6af1650150f0f51acc5452b3e62bb6f9f20c698ef8204457534a5c

Request headers

Host
ip-184-168-166-154.ip.secureserver.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Mon, 29 Jul 2019 21:52:22 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=gn07ilth0bkqlo9jfjs2ujtov4; path=/
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
3641
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

Date
Mon, 29 Jul 2019 21:52:22 GMT
Server
Apache
Location
id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=
Content-Length
0
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
ptlogin1c005c.css
res.mail.qq.com/en_US/htmledition/style/
0
0

testimg
ssl.ptlogin2.qq.com/
0
0

qmlogin1be06a.js
res.mail.qq.com/en_US/htmledition/js/
0
0

ico_help12fb20.gif
res.mail.qq.com/en_US/htmledition/images/
0
0

spacer.gif
res.mail.qq.com/en_US/htmledition/images/
0
0

Primary Request /
mail.qq.com/
12 KB
5 KB
Document
General
Full URL
https://mail.qq.com/
Requested by
Host: ip-184-168-166-154.ip.secureserver.net
URL: http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.7.30.100 Shanghai, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
683774b12da66c4e4c164e273ea7899447ac8f85710f2527a0fd877796e4c945
Security Headers
Name Value
Content-Security-Policy referrer origin; script-src 'self' https://hm.baidu.com http://hm.baidu.com *.google-analytics.com http://mat1.gtimg.com https://mat1.gtimg.com http://*.soso.com https://*.soso.com http://*.qq.com https://*.qq.com http://*.qqmail.com https://*.qqmail.com http://pub.idqqimg.com blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://mail.qq.com/cgi-bin/report_cgi?r_subtype=csp&nocheck=false

Request headers

:method
GET
:authority
mail.qq.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Referer
http://ip-184-168-166-154.ip.secureserver.net/wordpress/wp-content/netvigator/update/qqinput/id.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=

Response headers

status
200
server
nginx
date
Mon, 29 Jul 2019 21:52:23 GMT
content-type
text/html; charset=GB18030
content-length
4647
content-security-policy
referrer origin; script-src 'self' https://hm.baidu.com http://hm.baidu.com *.google-analytics.com http://mat1.gtimg.com https://mat1.gtimg.com http://*.soso.com https://*.soso.com http://*.qq.com https://*.qq.com http://*.qqmail.com https://*.qqmail.com http://pub.idqqimg.com blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://mail.qq.com/cgi-bin/report_cgi?r_subtype=csp&nocheck=false
referrer-policy
origin
content-encoding
gzip
loginpage436d42.css
rescdn.qqmail.com/zh_CN/htmledition/style/
10 KB
3 KB
Stylesheet
General
Full URL
https://rescdn.qqmail.com/zh_CN/htmledition/style/loginpage436d42.css
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.138.57 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
98e113911e4d296fef5a210ebf57d1009f18e7cfb8ccf199cf92919c5665648a

Request headers

Referer
https://mail.qq.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:24 GMT
content-encoding
gzip
x-cache-lookup
Hit From Disktank3 Gz
last-modified
Fri, 25 Jan 2019 16:22:14 GMT
server
NWSs
content-type
text/css
status
200
cache-control
max-age=315360000
server_ip
203.205.138.57
x-nws-log-uuid
8d7aea33-56aa-4a81-88a7-275ee1a1f0ec
timing-allow-origin
*
content-length
2864
expires
Thu, 26 Jul 2029 21:52:24 GMT
testimg
ssl.ptlogin2.qq.com/
1 KB
1 KB
Image
General
Full URL
https://ssl.ptlogin2.qq.com/testimg
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.128.160 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
Tencent Login Server/2.0.0 /
Resource Hash
f5b16cadaa320974c03e63f91a02ef9a0dd46235bca4dfb449f1c64ec87bb855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://mail.qq.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 29 Jul 2019 21:52:25 GMT
server
Tencent Login Server/2.0.0
strict-transport-security
max-age=31536000
content-type
image/png
status
200
cache-control
no-cache, no-store, must-revalidate
content-length
1335
expires
-1
ico_help1e9c5d.gif
rescdn.qqmail.com/zh_CN/htmledition/images/
596 B
852 B
Image
General
Full URL
https://rescdn.qqmail.com/zh_CN/htmledition/images/ico_help1e9c5d.gif
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.138.57 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
12715bf92b2b427ba13c3a1f2189c2670499918fa132c980171af8585bf98cdb

Request headers

Referer
https://mail.qq.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:24 GMT
x-cache-lookup
Hit From Disktank3
last-modified
Wed, 25 Jun 2014 11:09:51 GMT
server
NWSs
content-type
image/gif
status
200
cache-control
max-age=315360000
server_ip
203.205.138.57
x-nws-log-uuid
7906793d-33a3-4170-9ab7-75c9a706f83d
timing-allow-origin
*
content-length
596
expires
Thu, 26 Jul 2029 21:52:24 GMT
qrconnect
open.weixin.qq.com/connect/ Frame 4DC8
8 KB
3 KB
Document
General
Full URL
https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.143.151 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
/
Resource Hash
1436f04708dc7ded4280ac4f5848bcef743713d304827640ad141b5d14017d1a

Request headers

:method
GET
:authority
open.weixin.qq.com
:scheme
https
:path
/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://mail.qq.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Referer
https://mail.qq.com/

Response headers

status
200
x-wx-fj
001,018,0000001024
skfrmwrespcookie
6xi9AiAEEAEoEjABOAFAAVgi3g==
content-type
text/html; charset=utf-8
cache-control
no-cache, must-revalidate
content-encoding
gzip
xlogin
xui.ptlogin2.qq.com/cgi-bin/ Frame ECB3
32 KB
11 KB
Document
General
Full URL
https://xui.ptlogin2.qq.com/cgi-bin/xlogin?target=self&appid=522005705&daid=4&s_url=https://mail.qq.com/cgi-bin/readtemplate?check=false%26t=loginpage_new_jump%26vt=passport%26vm=wpt%26ft=loginpage%26target=&style=25&low_login=1&proxy_url=https://mail.qq.com/proxy.html&need_qr=0&hide_border=1&border_radius=0&self_regurl=http://zc.qq.com/chs/index.html?type=1&app_id=11005?t=regist&pt_feedback_link=http://support.qq.com/discuss/350_1.shtml&css=https://res.mail.qq.com/zh_CN/htmledition/style/ptlogin_input_for_xmail440503.css
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.142.186 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
QZHTTP-2.38.41 /
Resource Hash
54cdb0c935acfbb0fb62483bfce8b27f6796f7e7e6cf01662c8185b2994e2a67
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
xui.ptlogin2.qq.com
:scheme
https
:path
/cgi-bin/xlogin?target=self&appid=522005705&daid=4&s_url=https://mail.qq.com/cgi-bin/readtemplate?check=false%26t=loginpage_new_jump%26vt=passport%26vm=wpt%26ft=loginpage%26target=&style=25&low_login=1&proxy_url=https://mail.qq.com/proxy.html&need_qr=0&hide_border=1&border_radius=0&self_regurl=http://zc.qq.com/chs/index.html?type=1&app_id=11005?t=regist&pt_feedback_link=http://support.qq.com/discuss/350_1.shtml&css=https://res.mail.qq.com/zh_CN/htmledition/style/ptlogin_input_for_xmail440503.css
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://mail.qq.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Referer
https://mail.qq.com/

Response headers

status
200
date
Mon, 29 Jul 2019 21:52:28 GMT
content-type
text/html
content-length
10319
server
QZHTTP-2.38.41
p3p
CP="CAO PSA OUR"
set-cookie
pt_user_id=14051601166759809446; EXPIRES=Thu, 26-Jul-2029 21:52:28 GMT; PATH=/; DOMAIN=ui.ptlogin2.qq.com; pt_login_sig=pHeMOIRQTLXThrgeoEPJUqugIIqk2fcxOo4N5bUCCsbh2eIPWiq0ZtMzCemDxNz-; PATH=/; DOMAIN=ptlogin2.qq.com; pt_clientip=17aa5361171edb66; PATH=/; DOMAIN=ptlogin2.qq.com; pt_serverip=13460af2a787b4a1; PATH=/; DOMAIN=ptlogin2.qq.com; pt_local_token=-717583043; PATH=/; DOMAIN=ptlogin2.qq.com; uikey=c4aa4d6724bbf96cdcb8f9baa4da688e1732290a825866c6cb0b7277f01ab60b; PATH=/; DOMAIN=ptlogin2.qq.com; pt_guid_sig=cc726392c474dead1d5d1aa26c47c9ebbab4e4df33877fad3a406e9c867dfb65; EXPIRES=Wed, 28-Aug-2019 21:52:28 GMT; PATH=/; DOMAIN=ptlogin2.qq.com; ptui_identifier=000D086752455622BDA57836CF6A8C32050EDAE1EE6463D4ACA621E1; PATH=/; DOMAIN=ui.ptlogin2.qq.com;
last-modified
Thu, 08 Mar 2012 02:04:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
qqmail_logo_default_35h206ff1.png
rescdn.qqmail.com/zh_CN/htmledition/images/logo/qqmail/
4 KB
4 KB
Image
General
Full URL
https://rescdn.qqmail.com/zh_CN/htmledition/images/logo/qqmail/qqmail_logo_default_35h206ff1.png
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.138.57 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
04049c42c35afbf5d76cd1c1b354ce17f8aadd5d8b6f42e6ead176378967cb54

Request headers

Referer
https://rescdn.qqmail.com/zh_CN/htmledition/style/loginpage436d42.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:24 GMT
x-cache-lookup
Hit From Disktank3
last-modified
Tue, 16 Sep 2014 14:09:39 GMT
server
NWSs
content-type
image/png
status
200
cache-control
max-age=315360000
server_ip
203.205.138.57
x-nws-log-uuid
792f7800-f101-4506-9e27-73e910e027f2
content-length
3985
expires
Thu, 26 Jul 2029 21:52:24 GMT
tg-chang1ea8a2.png
rescdn.qqmail.com/zh_CN/htmledition/images/
25 KB
26 KB
Image
General
Full URL
https://rescdn.qqmail.com/zh_CN/htmledition/images/tg-chang1ea8a2.png
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.138.57 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
b26e6f3f3d31a315749ae6c0c495db450acc56f64180fa85c3f2ac82fef11920

Request headers

Referer
https://mail.qq.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:24 GMT
x-cache-lookup
Hit From Disktank3
last-modified
Fri, 27 Jun 2014 15:30:56 GMT
server
NWSs
content-type
image/png
status
200
cache-control
max-age=315360000
server_ip
203.205.138.57
x-nws-log-uuid
7c8a6ab1-97a1-4126-93cc-3d340745923e
timing-allow-origin
*
content-length
26011
expires
Thu, 26 Jul 2029 21:52:24 GMT
getinvestigate
rl.mail.qq.com/cgi-bin/
0
398 B
Image
General
Full URL
https://rl.mail.qq.com/cgi-bin/getinvestigate?stat=loginerr&code=920&err=&un=&r=0.007484222171040056
Requested by
Host: mail.qq.com
URL: https://mail.qq.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.7.30.100 Shanghai, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'self' https://hm.baidu.com http://hm.baidu.com *.google-analytics.com http://mat1.gtimg.com https://mat1.gtimg.com http://*.soso.com https://*.soso.com http://*.qq.com https://*.qq.com http://*.qqmail.com https://*.qqmail.com http://pub.idqqimg.com blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://mail.qq.com/cgi-bin/report_cgi?r_subtype=csp&nocheck=false

Request headers

Referer
https://mail.qq.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

content-security-policy
script-src 'self' https://hm.baidu.com http://hm.baidu.com *.google-analytics.com http://mat1.gtimg.com https://mat1.gtimg.com http://*.soso.com https://*.soso.com http://*.qq.com https://*.qq.com http://*.qqmail.com https://*.qqmail.com http://pub.idqqimg.com blob: 'unsafe-inline' 'unsafe-eval'; report-uri https://mail.qq.com/cgi-bin/report_cgi?r_subtype=csp&nocheck=false
referrer-policy
origin
server
nginx
date
Mon, 29 Jul 2019 21:52:25 GMT
content-type
text/html; charset=GB18030
status
200
cache-control
max-age=0
content-length
0
impowerApp45a337.css
res.wx.qq.com/connect/zh_CN/htmledition/style/ Frame 4DC8
27 KB
7 KB
Stylesheet
General
Full URL
https://res.wx.qq.com/connect/zh_CN/htmledition/style/impowerApp45a337.css
Requested by
Host: open.weixin.qq.com
URL: https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.158.35 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
ea275574bf22d01c6f3661fe323eb11afaef6ad5bf6bc0b43ec457db06efde32

Request headers

Referer
https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:26 GMT
content-encoding
gzip
x-cache-lookup
Hit From Disktank3 Gz
last-modified
Mon, 29 Jul 2019 12:40:00 GMT
server
NWSs
content-type
text/css
status
200
cache-control
max-age=31536000
x-nws-log-uuid
2b211bda-735d-484f-960a-538d87929eb1
content-length
7152
expires
Tue, 28 Jul 2020 21:52:26 GMT
jquery.min.js
res.wx.qq.com/connect/zh_CN/htmledition/js/ Frame 4DC8
94 KB
33 KB
Script
General
Full URL
https://res.wx.qq.com/connect/zh_CN/htmledition/js/jquery.min.js
Requested by
Host: open.weixin.qq.com
URL: https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.158.35 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
ce32707c0d679b8ed56b5dc8c498e1b1667e5b1905b8aeff42151e3f6667d73d

Request headers

Referer
https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:26 GMT
content-encoding
gzip
x-cache-lookup
Hit From Disktank3 Gz
last-modified
Mon, 29 Jul 2019 06:40:00 GMT
server
NWSs
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-nws-log-uuid
8c0fcfb4-d05f-4d42-8021-e6b480352b0c
content-length
33320
expires
Tue, 28 Jul 2020 21:52:26 GMT
001VJ-izeFs8DqeF
open.weixin.qq.com/connect/qrcode/ Frame 4DC8
46 KB
46 KB
Image
General
Full URL
https://open.weixin.qq.com/connect/qrcode/001VJ-izeFs8DqeF
Requested by
Host: open.weixin.qq.com
URL: https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.143.151 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
/
Resource Hash
f6a2c3492531d98fdd7fc270f2fead260cd5fd483c93ab6c3a8eb350099e727a

Request headers

Referer
https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

status
200
skfrmwrespcookie
6xgzIAQQASgQMAE4AkAGWCLe
x-wx-fj
001,018,0000001024
content-type
image/jpeg
iframe_wx5a0c03.css
res.wx.qq.com/a/webmail/xmail/res/css/ Frame 4DC8
967 B
793 B
Stylesheet
General
Full URL
https://res.wx.qq.com/a/webmail/xmail/res/css/iframe_wx5a0c03.css
Requested by
Host: open.weixin.qq.com
URL: https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.205.158.35 Shenzhen, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
NWSs /
Resource Hash
abe46b98cc1a8f32cf6362814f17ca60906c64672fb2241616bd1a3e63d27403

Request headers

Referer
https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

date
Mon, 29 Jul 2019 21:52:26 GMT
content-encoding
gzip
x-cache-lookup
Hit From Disktank3 Gz
last-modified
Fri, 25 Jan 2019 15:31:07 GMT
server
NWSs
access-control-allow-origin
*
content-type
text/css
status
200
cache-control
max-age=31536000
x-nws-log-uuid
0dfed1ba-0223-4952-b290-addd90a2736b
content-length
534
expires
Tue, 28 Jul 2020 21:52:26 GMT
qrconnect
long.open.weixin.qq.com/connect/l/ Frame 4DC8
0
0

ptlogin_input_for_xmail440503.css
res.mail.qq.com/zh_CN/htmledition/style/ Frame ECB3
0
0

code
ty.captcha.qq.com/ Frame ECB3
0
0

stats
tajs.qq.com/ Frame ECB3
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
res.mail.qq.com
URL
https://res.mail.qq.com/en_US/htmledition/style/ptlogin1c005c.css
Domain
ssl.ptlogin2.qq.com
URL
https://ssl.ptlogin2.qq.com/testimg
Domain
res.mail.qq.com
URL
https://res.mail.qq.com/en_US/htmledition/js/qmlogin1be06a.js
Domain
res.mail.qq.com
URL
https://res.mail.qq.com/en_US/htmledition/images/ico_help12fb20.gif
Domain
res.mail.qq.com
URL
https://res.mail.qq.com/en_US/htmledition/images/spacer.gif
Domain
long.open.weixin.qq.com
URL
https://long.open.weixin.qq.com/connect/l/qrconnect?uuid=001VJ-izeFs8DqeF&_=1564437146771
Domain
res.mail.qq.com
URL
https://res.mail.qq.com/zh_CN/htmledition/style/ptlogin_input_for_xmail440503.css
Domain
ty.captcha.qq.com
URL
https://ty.captcha.qq.com/code?siteKey=9WY11WYltbEgYnEIaMhTrkSZqlAPCJzjEbBTyP1cLVkMJWWSB7rQrimq%2F0arQ5A0&Action=GetWebJs
Domain
tajs.qq.com
URL
https://tajs.qq.com/stats?sId=61651582

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| reportPtlogin function| str2JSON function| ptlogin2_onResize function| ready function| getLoginTypeFromCookie function| init

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://open.weixin.qq.com/connect/qrconnect?appid=wx5e893ac3cc590290&redirect_uri=https%3A%2F%2Fwx.mail.qq.com%2Flogin%2Flogin%3Fauth_type%3D1%26return_target%3D5%26delegate_url%3Dhttps%253A%252F%252Fmail.qq.com%252Fcgi-bin%252Freadtemplate%253Fcheck%253Dfalse%2526t%253Dloginpage_new_jump_for_xmail&self_redirect=true&response_type=code&scope=snsapi_login&state=state&href=https%3A%2F%2Fres.wx.qq.com%2Fa%2Fwebmail%2Fxmail%2Fres%2Fcss%2Fiframe_wx5a0c03.css(Line 75)
Message:
devtool use

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ip-184-168-166-154.ip.secureserver.net
long.open.weixin.qq.com
mail.qq.com
open.weixin.qq.com
res.mail.qq.com
res.wx.qq.com
rescdn.qqmail.com
rl.mail.qq.com
ssl.ptlogin2.qq.com
tajs.qq.com
ty.captcha.qq.com
xui.ptlogin2.qq.com
long.open.weixin.qq.com
res.mail.qq.com
ssl.ptlogin2.qq.com
tajs.qq.com
ty.captcha.qq.com
103.7.30.100
184.168.166.154
203.205.128.160
203.205.138.57
203.205.142.186
203.205.143.151
203.205.158.35
04049c42c35afbf5d76cd1c1b354ce17f8aadd5d8b6f42e6ead176378967cb54
12715bf92b2b427ba13c3a1f2189c2670499918fa132c980171af8585bf98cdb
1436f04708dc7ded4280ac4f5848bcef743713d304827640ad141b5d14017d1a
54cdb0c935acfbb0fb62483bfce8b27f6796f7e7e6cf01662c8185b2994e2a67
683774b12da66c4e4c164e273ea7899447ac8f85710f2527a0fd877796e4c945
98e113911e4d296fef5a210ebf57d1009f18e7cfb8ccf199cf92919c5665648a
abe46b98cc1a8f32cf6362814f17ca60906c64672fb2241616bd1a3e63d27403
b26e6f3f3d31a315749ae6c0c495db450acc56f64180fa85c3f2ac82fef11920
b2aa2e41bd6af1650150f0f51acc5452b3e62bb6f9f20c698ef8204457534a5c
ce32707c0d679b8ed56b5dc8c498e1b1667e5b1905b8aeff42151e3f6667d73d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea275574bf22d01c6f3661fe323eb11afaef6ad5bf6bc0b43ec457db06efde32
f5b16cadaa320974c03e63f91a02ef9a0dd46235bca4dfb449f1c64ec87bb855
f6a2c3492531d98fdd7fc270f2fead260cd5fd483c93ab6c3a8eb350099e727a