urlscan.io logo urlscan.io
SecurityTrails logo

bucket-ynote-online-cdn.note.youdao.com Open in urlscan Pro
240e:96c:6000:102:3::3fd  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://note.youdao.com/yws/api/personal/file/WEB0697bedcb863f50fb1cfc84adff2b04a?method=download&inline=true&shareKey=f...
Effective URL: https://bucket-ynote-online-cdn.note.youdao.com/tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4?filename=12011147.exe&Signature=Qgz1Hf3WIh...
Submission: On December 05 via manual from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 1 domains to perform 1 HTTP transactions. The main IP is 240e:96c:6000:102:3::3fd, located in China and belongs to CHINANET-SH-AP China Telecom Group, CN. The main domain is bucket-ynote-online-cdn.note.youdao.com.
TLS certificate: Issued by GeoTrust RSA CN CA G2 on June 5th 2023. Valid for: a year.
This is the only time bucket-ynote-online-cdn.note.youdao.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

12011147.exe 1 MB application/x-dosexec
MIME: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Size: 1 MB (1106432 bytes, 100% done)
Downloaded from: https://bucket-ynote-online-cdn.note.youdao.com/tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4?filename=12011147.exe&Signature=Qgz1Hf3WIhwaHh0OIDzH0w2S%2Bt33uuj51wB05B%2FZW%2B4%3D&Expires=1701744179&NOSAccessKeyId=e7d1acab859342789faa85a4b0cb4c83

Domain & IP information

IP Address AS Autonomous System
1 1 47.89.66.60 24429 (TAOBAO Zh...)
1 240e:96c:6000... 4812 (CHINANET-...)
1 1
Apex Domain
Subdomains		 Transfer
2 youdao.com
note.youdao.com — Cisco Umbrella Rank: 134183
bucket-ynote-online-cdn.note.youdao.com
1 KB
1 1
Domain Requested by
1 bucket-ynote-online-cdn.note.youdao.com
1 note.youdao.com 1 redirects
1 2

This site contains no links.

Subject Issuer Validity Valid
*.note.youdao.com
GeoTrust RSA CN CA G2		 2023-06-05 -
2024-07-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bucket-ynote-online-cdn.note.youdao.com/tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4?filename=12011147.exe&Signature=Qgz1Hf3WIhwaHh0OIDzH0w2S%2Bt33uuj51wB05B%2FZW%2B4%3D&Expires=1701744179&NOSAccessKeyId=e7d1acab859342789faa85a4b0cb4c83
Frame ID: 4E842EE5CC4CD534F134E8C9BE69D183
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

Page Statistics

1
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

1
IPs

2
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4
bucket-ynote-online-cdn.note.youdao.com/
Redirect Chain
  • http://note.youdao.com/yws/api/personal/file/WEB0697bedcb863f50fb1cfc84adff2b04a?method=download&inline=true&shareKey=f5ae9d34d5300288a7e5da87e23113dc
  • https://bucket-ynote-online-cdn.note.youdao.com/tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4?filename=12011147.exe&Signature=Qgz1Hf3WIhwaHh0OIDzH0w2S%2Bt33uuj51wB05B%2FZW%2B4%3D&Expires=17...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://bucket-ynote-online-cdn.note.youdao.com/tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4?filename=12011147.exe&Signature=Qgz1Hf3WIhwaHh0OIDzH0w2S%2Bt33uuj51wB05B%2FZW%2B4%3D&Expires=1701744179&NOSAccessKeyId=e7d1acab859342789faa85a4b0cb4c83
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
240e:96c:6000:102:3::3fd , China, ASN4812 (CHINANET-SH-AP China Telecom Group, CN),
Reverse DNS
Software
Tengine /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

access-control-allow-origin
https://note.youdao.com
age
60997
ali-swift-global-savetime
1701675983
cdn-ip
240e:96c:6000:102:3::3fd
cdn-source
ali
cdn-user-ip
2001:ac8:40:1e::2e
content-disposition
attachment; filename="12011147.exe"; filename*=UTF-8''12011147.exe
content-length
1106432
content-type
application/octet-stream
date
Mon, 04 Dec 2023 07:46:23 GMT
eagleid
de49211e17017369802392092e
etag
355d1f7214f559eb2e793ba9f0910b86
last-modified
Fri, 01 Dec 2023 11:56:53 Asia/Shanghai
server
Tengine
timing-allow-origin
*
via
cache49.l2cn3131[0,0,206-0,H], cache48.l2cn3131[0,0], vcache27.cn5626[0,0,200-0,H], vcache10.cn5626[3,0]
x-cache
HIT TCP_HIT dirn:13:273857041 mlen:0
x-nos-object-name
tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4
x-nos-request-id
b9ff4b16-8346-4629-ad40-40ee7d59dfe7
x-nos-requesttype
GetObject
x-nos-storage-class
STANDARD
x-swift-cachetime
2591864
x-swift-savetime
Mon, 04 Dec 2023 07:48:39 GMT

Redirect headers

Ali-Swift-Global-Savetime
1701736979
Cache-Control
no-cache, no-store, must-revalidate,no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 05 Dec 2023 00:42:59 GMT
EagleId
2f59420417017369787686794e
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Lingxi-Traceid
d2dcbf23008c4b12a53d7a55^1697547002968^810556484
Location
https://bucket-ynote-online-cdn.note.youdao.com/tjzndzui%40163.com%2F8CE985049E554DA988494670637195E4?filename=12011147.exe&Signature=Qgz1Hf3WIhwaHh0OIDzH0w2S%2Bt33uuj51wB05B%2FZW%2B4%3D&Expires=1701744179&NOSAccessKeyId=e7d1acab859342789faa85a4b0cb4c83
Pragma
no-cache no-cache
Server
Tengine
Timing-Allow-Origin
*
Via
cache15.l2hk2[624,625,302-0,M], cache28.l2hk2[626,0], cache5.jp2[686,686,302-0,M], cache4.jp2[689,0]
X-Cache
MISS TCP_MISS dirn:-2:-2
X-Envoy-Upstream-Service-Time
12
X-Swift-CacheTime
0
X-Swift-SaveTime
Tue, 05 Dec 2023 00:42:59 GMT
cdn-ip
47.89.66.60
cdn-source
ali
cdn-user-ip
146.70.201.212

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bucket-ynote-online-cdn.note.youdao.com
note.youdao.com
240e:96c:6000:102:3::3fd
47.89.66.60