70365app.net
Open in
urlscan Pro
45.125.65.208
Malicious Activity!
Public Scan
Effective URL: https://70365app.net/
Submission: On May 20 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by Certum Domain Validation CA SHA2 on November 12th 2023. Valid for: a year.
This is the only time 70365app.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bet365 (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 149.115.228.168 149.115.228.168 | 32558 (ADG-76-32558) (ADG-76-32558) | |
1 1 | 118.107.15.125 118.107.15.125 | 152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited) | |
10 | 45.125.65.208 45.125.65.208 | 133398 (TELE-AS T...) (TELE-AS Tele Asia Limited) | |
1 | 240e:f7:7c00:... 240e:f7:7c00:10a:3::3f2 | 136190 (CHINATELE...) (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA) | |
2 | 183.240.98.228 183.240.98.228 | 56040 (CMNET-GUA...) (CMNET-GUANGDONG-AP China Mobile communications corporation) | |
14 | 4 |
ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)
class.9wsudfp5at.com |
ASN133398 (TELE-AS Tele Asia Limited, HK)
PTR: srv-45-125-65-208.mlnl.host
70365app.net |
ASN136190 (CHINATELECOM-ZHEJIANG-JINHUA-IDC JINHUA, ZHEJIANG Province, P.R.China., CN)
v1.cnzz.com |
ASN56040 (CMNET-GUANGDONG-AP China Mobile communications corporation, CN)
hm.baidu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
70365app.net
70365app.net |
490 KB |
2 |
baidu.com
hm.baidu.com — Cisco Umbrella Rank: 10507 |
12 KB |
1 |
cnzz.com
v1.cnzz.com — Cisco Umbrella Rank: 112814 |
369 B |
1 |
9wsudfp5at.com
1 redirects
class.9wsudfp5at.com |
232 B |
1 |
70365sss.com
70365sss.com |
620 B |
14 | 5 |
Domain | Requested by | |
---|---|---|
10 | 70365app.net |
70365sss.com
70365app.net |
2 | hm.baidu.com |
70365app.net
|
1 | v1.cnzz.com |
70365app.net
|
1 | class.9wsudfp5at.com | 1 redirects |
1 | 70365sss.com | |
14 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ub66.io |
ha0fp4elyy.1fhei9ev.com |
www.app25365.com |
h25365.com |
70365ooo.com |
fff70365.com |
70365ppp.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
2021-08-13 - 2022-08-13 |
a year | crt.sh | |
70365app.net Certum Domain Validation CA SHA2 |
2023-11-12 - 2024-12-11 |
a year | crt.sh |
*.cnzz.com GlobalSign Organization Validation CA - SHA256 - G3 |
2024-02-17 - 2025-03-20 |
a year | crt.sh |
baidu.com GlobalSign RSA OV SSL CA 2018 |
2023-07-06 - 2024-08-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://70365app.net/
Frame ID: F77697C793860462DC2519CAC3030494
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
bet365最快线路检测中心Page URL History Show full URLs
-
http://70365sss.com/
HTTP 307
https://70365sss.com/ Page URL
-
https://class.9wsudfp5at.com:4562/?u=https://70365sss.com/&p=/
HTTP 302
https://70365app.net/ Page URL
Detected technologies
Baidu Analytics (百度统计) (Analytics) ExpandDetected patterns
- hm\.baidu\.com/hm\.js
CNZZ (Analytics) Expand
Detected patterns
- //[^./]+\.cnzz\.com/(?:z_stat.php|core)\?
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 我们的最新网址h25365.Com请一秒记住
Search URL Search Domain Scan URL
Title: 点击进入
Search URL Search Domain Scan URL
Title: 点击进入
Search URL Search Domain Scan URL
Title: 点击进入
Search URL Search Domain Scan URL
Title: 【app】
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://70365sss.com/
HTTP 307
https://70365sss.com/ Page URL
-
https://class.9wsudfp5at.com:4562/?u=https://70365sss.com/&p=/
HTTP 302
https://70365app.net/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://70365sss.com/ HTTP 307
- https://70365sss.com/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
70365sss.com/ Redirect Chain
|
434 B 620 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
70365app.net/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flash.css
70365app.net/css/ |
54 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
70365app.net/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.7.1.min.js
70365app.net/js/ |
92 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
z_stat.php
v1.cnzz.com/ |
0 369 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ewm.png
70365app.net/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.js
hm.baidu.com/ |
29 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bodyimg.png
70365app.net/img/ |
356 KB 357 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rss.png
70365app.net/img/ |
66 KB 67 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yelang.png
70365app.net/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dxx.png
70365app.net/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hm.gif
hm.baidu.com/ |
43 B 299 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
70365app.net/ |
1 KB 807 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bet365 (Entertainment)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| _hmt function| sc function| browserRedirect number| len number| rnd object| txt object| url object| url2 object| url3 object| url9 object| url29 object| url39 string| str string| str2 string| str3 string| str9 string| str29 string| str39 boolean| _bdhm_loaded_7a1582cc8f44113ce21248a0f1b73203 object| mini_tangram_log_qahihd3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.hm.baidu.com/ | Name: HMACCOUNT_BFESS Value: B4A5785B39F55FAF |
|
.70365app.net/ | Name: Hm_lvt_7a1582cc8f44113ce21248a0f1b73203 Value: 1716183504 |
|
.70365app.net/ | Name: Hm_lpvt_7a1582cc8f44113ce21248a0f1b73203 Value: 1716183504 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
70365app.net
70365sss.com
class.9wsudfp5at.com
hm.baidu.com
v1.cnzz.com
118.107.15.125
149.115.228.168
183.240.98.228
240e:f7:7c00:10a:3::3f2
45.125.65.208
10f24767fa61c73f55210e59428b3a684496fa9dcc6de46e3fe9256868b53ea9
1183af09aab2915ad1da55b60ad1c34c6948c13de0bca10da93caed6c7a91658
1c8a36f71ed37b5b3e17cafed8a337b744d2ab91d4d6ad64dc14137deb25b1f9
1cafa656d554956b948c7e59dd0411ac6eb9fa16ee71fc875b76fb71f36eabec
1e6327fed2333a1d60c96106853285e9004b8275946f99f023a8c5fcc8099d90
48ef7fb539ccc7d8186e8017283e3493b1d32497b445b8c7946363be989ff747
58d64bad8f43a6c332a2e1639a566bd482c812b3f892d4aba9ae15be8d06eb8f
6e09fb6e94c8054947adb4613326d69fc498a6c8ca9c81df02876a95a8df00f2
85c437c79c0bf2b68433ae7e70447a4f51d7176769c5bd489b5c46bf424a3991
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
9430965726caeed564e5323141da4c47ab0031976ad450c326ac56489c9205d2
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855