promotion.aliyun.com Open in urlscan Pro
140.205.172.20 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://xn--app-py9ds60d.com/
Effective URL:
https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=tmu5nyjk
Submission: On June 29 via automatic, source certstream-suspicious (June 29th 2019, 3:04:09 am UTC)

Summary HTTP 36 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 6 domains to perform 36 HTTP transactions. The main IP is 140.205.172.20, located in China and belongs to CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN. The main domain is promotion.aliyun.com.
TLS certificate: Issued by GlobalSign Organization Validation CA... on May 23rd 2019. Valid for: 9 months.

This is the only time promotion.aliyun.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	103.121.93.13 103.121.93.13	137443 (ANCHGLOBA...) (ANCHGLOBAL-AS-AP Anchnet Asia Limited)
3	150.138.249.206 150.138.249.206	58540 (CHINATELE...) (CHINATELECOM-HUNAN-ZHUZHOU-MAN Zhuzhou)
1	222.85.26.208 222.85.26.208	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
1	180.149.142.215 180.149.142.215	23724 (CHINANET-...) (CHINANET-IDC-BJ-AP IDC)
1	222.85.26.209 222.85.26.209	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
1	203.119.206.97 203.119.206.97	37963 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.)
1	104.192.108.18 104.192.108.18	55992 (QIHOO Bei...) (QIHOO Beijing Qihu Technology Company Limited)
1	140.205.172.20 140.205.172.20	37963 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.)
36	9

2 103.121.93.13 (China)

ASN137443 (ANCHGLOBAL-AS-AP Anchnet Asia Limited, HK)

xn--app-py9ds60d.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 150.138.249.206 (China)

ASN58540 (CHINATELECOM-HUNAN-ZHUZHOU-MAN Zhuzhou, CN)

wxllq.gz01.bdysite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 222.85.26.208 (Xuchang, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
PTR: 208.26.85.222.broad.xc.ha.dynamic.163data.com.cn

s23.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 180.149.142.215 (China)

ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN)

basejs.bj01.bdysite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 222.85.26.209 (Xuchang, China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
PTR: 209.26.85.222.broad.xc.ha.dynamic.163data.com.cn

c.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 203.119.206.97 (China)

ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN)

z5.cnzz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.192.108.18 (United States)

ASN55992 (QIHOO Beijing Qihu Technology Company Limited, CN)

dl.360safe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 140.205.172.20 (China)

ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN)

promotion.aliyun.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	bdysite.com wxllq.gz01.bdysite.com basejs.bj01.bdysite.com	36 KB
3	cnzz.com s23.cnzz.com c.cnzz.com z5.cnzz.com	6 KB
2	xn--app-py9ds60d.com xn--app-py9ds60d.com	1 KB
1	aliyun.com promotion.aliyun.com www.aliyun.com Failed
1	360safe.com dl.360safe.com
0	alicdn.com Failed g.alicdn.com Failed at.alicdn.com Failed img.alicdn.com Failed
36	6

	Domain	Requested by
3	wxllq.gz01.bdysite.com	xn--app-py9ds60d.com wxllq.gz01.bdysite.com
2	xn--app-py9ds60d.com	xn--app-py9ds60d.com
1	promotion.aliyun.com	wxllq.gz01.bdysite.com
1	dl.360safe.com	wxllq.gz01.bdysite.com
1	z5.cnzz.com	wxllq.gz01.bdysite.com
1	c.cnzz.com	s23.cnzz.com
1	basejs.bj01.bdysite.com	wxllq.gz01.bdysite.com
1	s23.cnzz.com	wxllq.gz01.bdysite.com
0	img.alicdn.com Failed	promotion.aliyun.com
0	at.alicdn.com Failed	promotion.aliyun.com
0	www.aliyun.com Failed	promotion.aliyun.com
0	g.alicdn.com Failed	promotion.aliyun.com
36	12

This site contains no links.

Subject Issuer	Validity	Valid
WMSvc-WIN-J17MFPFHHUF WMSvc-WIN-J17MFPFHHUF	`2018-12-11` - `2028-12-08`	10 years	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.aliyun.com GlobalSign Organization Validation CA - SHA256 - G2	`2019-05-23` - `2020-02-16`	9 months	crt.sh

This page contains 3 frames:

Primary Page: https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=tmu5nyjk
Frame ID: B3CE275BD2600239AE0155A8122DB52B
Requests: 33 HTTP requests in this frame

Frame: http://wxllq.gz01.bdysite.com/download.html
Frame ID: 6E67D9156571274A7087BDBDB54CEB8F
Requests: 1 HTTP requests in this frame

Frame: http://dl.360safe.com/netunion/20140425/360safe+251289+n7ddbb65c96.exe
Frame ID: 8CB6D94B818F32A00B9AE7612C3749B0
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://xn--app-py9ds60d.com/ Page URL
http://wxllq.gz01.bdysite.com/gotopc.html Page URL
https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=tmu5nyjk Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

36
Requests

3 %
HTTPS

0 %
IPv6

6
Domains

12
Subdomains

9
IPs

2
Countries

43 kB
Transfer

86 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://xn--app-py9ds60d.com/ Page URL
http://wxllq.gz01.bdysite.com/gotopc.html Page URL
https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=tmu5nyjk Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

36 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
xn--app-py9ds60d.com/ 148 B
527 B 2463ms
260ms Document
text/html 103.121.93.13
ANCHGLOBAL-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xn--app-py9ds60d.com/
Protocol: HTTP/1.1
Security: TLS 1.0, ECDHE_RSA, AES_256_CBC
Server: 103.121.93.13 , China, ASN137443 (ANCHGLOBAL-AS-AP Anchnet Asia Limited, HK),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 59ef28ef47ad9ab65aee057e8d33aee3398b129922f9863120abf355f7b4e81e

Request headers

Host: xn--app-py9ds60d.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Fri, 21 Jun 2019 14:07:24 GMT
Accept-Ranges: bytes
ETag: "12b297a63a28d51:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 29 Jun 2019 03:03:36 GMT
Content-Length: 233

GET
H/1.1 200
OK goto.js
xn--app-py9ds60d.com/ 1 KB
1004 B 260ms
260ms Script
application/x-javascript 103.121.93.13
ANCHGLOBAL-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xn--app-py9ds60d.com/goto.js
Requested by: Host: xn--app-py9ds60d.com
URL: https://xn--app-py9ds60d.com/
Protocol: HTTP/1.1
Security: TLS 1.0, ECDHE_RSA, AES_256_CBC
Server: 103.121.93.13 , China, ASN137443 (ANCHGLOBAL-AS-AP Anchnet Asia Limited, HK),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash

Request headers

Referer: https://xn--app-py9ds60d.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 29 Jun 2019 03:03:36 GMT
Content-Encoding: gzip
ETag: "40852cc3a28d51:0"
Last-Modified: Fri, 21 Jun 2019 14:08:27 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 696

GET
H/1.1 200
OK Cookie set gotopc.html Show response
wxllq.gz01.bdysite.com/ 3 KB
2 KB 785ms
303ms Document
text/html 150.138.249.206
CHINATELECOM-HUNA...

General

Check archive.org

Show headers Download Go to

Full URL: http://wxllq.gz01.bdysite.com/gotopc.html
Requested by: Host: xn--app-py9ds60d.com
URL: https://xn--app-py9ds60d.com/goto.js
Protocol: HTTP/1.1
Server: 150.138.249.206 , China, ASN58540 (CHINATELECOM-HUNAN-ZHUZHOU-MAN Zhuzhou, CN),
Reverse DNS
Software: openresty /
Resource Hash: e5c2cf3b04f364c1e1f47730a8c033726e35925969bfcb7d8f6328e4733ced02

Request headers

Host: wxllq.gz01.bdysite.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: openresty
Date: Sat, 29 Jun 2019 03:03:40 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 19 May 2019 03:15:15 GMT
Vary: Accept-Encoding
ETag: W/"5ce0ca43-b3d"
Content-Encoding: gzip
Set-Cookie: BAEID=161CB3CA5445C00E665E9F81188FC2AB; expires=Sun, 28-Jun-20 03:03:40 GMT; max-age=31536000; path=/; version=1

GET
H/1.1 200
OK z_stat.php Show response
s23.cnzz.com/ 11 KB
5 KB 838ms
278ms Script
application/javascript 222.85.26.208
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: http://s23.cnzz.com/z_stat.php?id=1276082832
Requested by: Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/gotopc.html
Protocol: HTTP/1.1
Security: , ,
Server: 222.85.26.208 Xuchang, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS: 208.26.85.222.broad.xc.ha.dynamic.163data.com.cn
Software: Tengine / PHP/5.5.25
Resource Hash: 316cefa6043381e8e9ff1427e179ee9cba449feb434f973fac3940ba22f296e5

Request headers

Referer: http://wxllq.gz01.bdysite.com/gotopc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sat, 29 Jun 2019 02:41:49 GMT
Content-Encoding: gzip
Age: 1312
X-Powered-By: PHP/5.5.25
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-CacheTime: 5365
Connection: keep-alive
Content-Length: 4053
Last-Modified: Sat, 29 Jun 2019 02:41:49 GMT
Server: Tengine
Vary: Accept-Encoding
Ali-Swift-Global-Savetime: 1561520202
Content-Type: application/javascript
Via: cache30.l2cm9[0,200-0,H], cache23.l2cm9[0,0], kunlun9.cn257[0,200-0,H], kunlun4.cn257[0,0]
Cache-Control: max-age=5400,s-maxage=5400
Timing-Allow-Origin: *
EagleId: de551ac415617774216365474e
X-Swift-SaveTime: Sat, 29 Jun 2019 02:42:24 GMT

GET
H/1.1 200
OK 123aliyun.jpg
basejs.bj01.bdysite.com/pic/ 29 KB
30 KB 981ms
183ms Image
image/jpeg 180.149.142.215
CHINANET-IDC-BJ-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://basejs.bj01.bdysite.com/pic/123aliyun.jpg
Requested by: Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/gotopc.html
Protocol: HTTP/1.1
Security: , ,
Server: 180.149.142.215 , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN),
Reverse DNS
Software: openresty /
Resource Hash: bdf1e9a2ae32c96523a9103bf9ad64b986bb7b4eb4bc8f3ebc0657276147a688

Request headers

Referer: http://wxllq.gz01.bdysite.com/gotopc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 29 Jun 2019 03:03:42 GMT
Last-Modified: Fri, 26 Apr 2019 10:02:52 GMT
Server: openresty
ETag: "5cc2d74c-750a"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29962

GET
H/1.1 200
OK core.php Show response
c.cnzz.com/ 969 B
1 KB 473ms
236ms Script
application/javascript 222.85.26.209
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: http://c.cnzz.com/core.php?web_id=1276082832&t=z
Requested by: Host: s23.cnzz.com
URL: http://s23.cnzz.com/z_stat.php?id=1276082832
Protocol: HTTP/1.1
Security: , ,
Server: 222.85.26.209 Xuchang, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS: 209.26.85.222.broad.xc.ha.dynamic.163data.com.cn
Software: Tengine / PHP/5.5.25
Resource Hash: c3e5c85d059df961a01d4700dc8ec680ddd25b6cf1ce9bb3e7b3a3ac2b193979

Request headers

Referer: http://wxllq.gz01.bdysite.com/gotopc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sat, 29 Jun 2019 02:59:14 GMT
Content-Encoding: gzip
Age: 268
X-Powered-By: PHP/5.5.25
X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2
X-Swift-CacheTime: 632
X-Swift-SaveTime: Sat, 29 Jun 2019 03:03:42 GMT
Content-Length: 620
Last-Modified: Sat, 29 Jun 2019 02:59:14 GMT
Server: Tengine
Vary: Accept-Encoding
Ali-Swift-Global-Savetime: 1561777154
Content-Type: application/javascript
Via: cache1.l2cm9[0,200-0,H], cache42.l2cm9[1,0], kunlun6.cn257[37,200-0,M], kunlun8.cn257[37,0]
Connection: keep-alive
Timing-Allow-Origin: *
EagleId: de551ac815617774220958980e
Expires: Sat, 29 Jun 2019 03:14:14 GMT

GET
H/1.1 200
OK stat.htm
z5.cnzz.com/ 2 B
245 B 709ms
185ms Image
text/html 203.119.206.97
CNNIC-ALIBABA-CN-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://z5.cnzz.com/stat.htm?id=1276082832&r=&lg=en-us&ntime=none&cnzz_eid=1898201112-1561776109-&showp=1600x1200&p=http%3A%2F%2Fwxllq.gz01.bdysite.com%2Fgotopc.html&t=%E6%AD%A3%E5%9C%A8%E4%B8%BA%E6%82%A8%E8%B7%B3%E8%BD%AC%E2%80%A6%E2%80%A6&umuuid=16ba1303db9738-0299fb97089fea-37647e03-1d4c00-16ba1303dbad8d&h=1&rnd=786952346
Requested by: Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/gotopc.html
Protocol: HTTP/1.1
Security: , ,
Server: 203.119.206.97 , China, ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://wxllq.gz01.bdysite.com/gotopc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 29 Jun 2019 03:03:42 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Tengine
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8

GET
H/1.1 404
Not Found download.html Show response
wxllq.gz01.bdysite.com/ Frame 6E67 9 KB
4 KB 507ms
507ms Document
text/html 150.138.249.206
CHINATELECOM-HUNA...

General

Check archive.org

Show headers Download Go to

Full URL: http://wxllq.gz01.bdysite.com/download.html
Requested by: Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/gotopc.html
Protocol: HTTP/1.1
Server: 150.138.249.206 , China, ASN58540 (CHINATELECOM-HUNAN-ZHUZHOU-MAN Zhuzhou, CN),
Reverse DNS
Software: openresty /
Resource Hash: c05a6ddff988322c06acdedb1e94216cb6a30481c18f0d8b1776a91c81f822d3

Request headers

Host: wxllq.gz01.bdysite.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://wxllq.gz01.bdysite.com/gotopc.html
Accept-Encoding: gzip, deflate
Cookie: BAEID=161CB3CA5445C00E665E9F81188FC2AB; UM_distinctid=16ba1303db9738-0299fb97089fea-37647e03-1d4c00-16ba1303dbad8d; CNZZDATA1276082832=1898201112-1561776109-%7C1561776109
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://wxllq.gz01.bdysite.com/gotopc.html

Response headers

Server: openresty
Date: Sat, 29 Jun 2019 03:03:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"58d4dc9d-24d7"
Content-Encoding: gzip

GET
H/1.1 200
OK app.html Show response
wxllq.gz01.bdysite.com/ Frame 8CB6 600 B
835 B 512ms
302ms Document
text/html 150.138.249.206
CHINATELECOM-HUNA...

General

Check archive.org

Show headers Download Go to

Full URL: http://wxllq.gz01.bdysite.com/app.html
Requested by: Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/gotopc.html
Protocol: HTTP/1.1
Server: 150.138.249.206 , China, ASN58540 (CHINATELECOM-HUNAN-ZHUZHOU-MAN Zhuzhou, CN),
Reverse DNS
Software: openresty /
Resource Hash: ae0fc78a74fcd2f05cb7677a209c66185fe970101e6e42cab626efb24b6d1260

Request headers

Host: wxllq.gz01.bdysite.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://wxllq.gz01.bdysite.com/gotopc.html
Accept-Encoding: gzip, deflate
Cookie: BAEID=161CB3CA5445C00E665E9F81188FC2AB; UM_distinctid=16ba1303db9738-0299fb97089fea-37647e03-1d4c00-16ba1303dbad8d; CNZZDATA1276082832=1898201112-1561776109-%7C1561776109
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://wxllq.gz01.bdysite.com/gotopc.html

Response headers

Server: openresty
Date: Sat, 29 Jun 2019 03:03:42 GMT
Content-Type: text/html
Content-Length: 600
Connection: keep-alive
Last-Modified: Sun, 19 May 2019 03:15:16 GMT
ETag: "5ce0ca44-258"
Accept-Ranges: bytes

GET
H/1.1 200
OK 360safe+251289+n7ddbb65c96.exe
dl.360safe.com/netunion/20140425/ Frame 8CB6 0
0 722ms
155ms Document
application/octet-stream 104.192.108.18
QIHOO Beijing Qih...

General

Check archive.org

Show headers Download Go to

Full URL: http://dl.360safe.com/netunion/20140425/360safe+251289+n7ddbb65c96.exe
Requested by: Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/app.html
Protocol: HTTP/1.1
Server: 104.192.108.18 , United States, ASN55992 (QIHOO Beijing Qihu Technology Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: dl.360safe.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://wxllq.gz01.bdysite.com/app.html
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://wxllq.gz01.bdysite.com/app.html

Response headers

Server: nginx
Date: Sat, 29 Jun 2019 03:03:43 GMT
Content-Type: application/octet-stream
Content-Length: 81694480
Last-Modified: Thu, 30 May 2019 05:17:41 GMT
Connection: close
Expires: Sat, 29 Jun 2019 11:03:43 GMT
Cache-Control: max-age=28800
Accept-Ranges: bytes

GET
H2 200 Primary Request invite.html
promotion.aliyun.com/ntms/yunparter/ 30 KB
0 17083ms
887ms Document
text/html 140.205.172.20
CNNIC-ALIBABA-CN-...

General

Check archive.org

Show headers Download Go to

Full URL

https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=tmu5nyjk

Requested by

Host: wxllq.gz01.bdysite.com
URL: http://wxllq.gz01.bdysite.com/gotopc.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

140.205.172.20 , China, ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN),

Reverse DNS

Software

Tengine/Aserver /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: promotion.aliyun.com
:scheme: https
:path: /ntms/yunparter/invite.html?userCode=tmu5nyjk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: http://wxllq.gz01.bdysite.com/gotopc.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://wxllq.gz01.bdysite.com/gotopc.html

Response headers

status: 200
date: Sat, 29 Jun 2019 03:04:04 GMT
content-type: text/html;charset=UTF-8
vary: Accept-Encoding
set-cookie: JSESSIONID=O1666391-QTH63BEVXDUI0R9RCD4R1-CMSYXGXJ-6SFF1; Path=/; HttpOnly promotion_temporary_console0=1AbLByOMHeZe3G41KYd5WbAXoKFwbjyVYkBjMZv0jCC7t9ufZh6V7MhReU6UmEOa6Ecu5jRP6IBho3Zk530Sp5m1lyUFhKoufH1TVoK3TH85qp5nA24y1IhxdhqnXIb3tr6kVHBhKr3HVT5IR2H6DA%3D%3D; Path=/; HttpOnly
content-language: zh-CN
content-encoding: gzip
server: Tengine/Aserver
eagleeye-traceid: 0be5c75915617774444502885eb141
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET index.css
g.alicdn.com/aliyun/dbl-official-ui/1.0.33/css/ 0
0

GET /
g.alicdn.com/mtb/ 0
0

GET /
g.alicdn.com/ 0
0

GET ace-base-assets
www.aliyun.com/assets/ 0
0

GET /
g.alicdn.com/ 0
0

GET layout-hangye-pc.css
g.alicdn.com/tms/layouts/0.1.8/ 0
0

GET /
g.alicdn.com/ali-mod/ 0
0

GET font_276948_28ii451l5wi.css
at.alicdn.com/t/ 0
0

GET font_274588_mqzled928bl.css
at.alicdn.com/t/ 0
0

GET /
g.alicdn.com/ali-mod/ 0
0

GET index.js
g.alicdn.com/dawn/polyfill/1.0.6/js/ 0
0

GET /
g.alicdn.com/ 0
0

GET index.css
g.alicdn.com/dawn/topbar-dawn/2.0.5/css/ 0
0

GET index.js
g.alicdn.com/dawn/topbar-dawn/2.0.5/js/ 0
0

GET font_276948_7szs5lm5sqs.css
at.alicdn.com/t/ 0
0

GET TB17mppCFOWBuNjy0FiXXXFxVXa-36-28.png
img.alicdn.com/tfs/ 0
0

GET TB1lopON9zqK1RjSZFjXXblCFXa-160-40.png
img.alicdn.com/tfs/ 0
0

GET TB1IaF0N3HqK1RjSZFkXXX.WFXa-160-40.gif
img.alicdn.com/tfs/ 0
0

GET TB1yoKYXMmTBuNjy1XbXXaMrVXa-24-24.png
img.alicdn.com/tfs/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: g.alicdn.com
URL: https://g.alicdn.com/aliyun/dbl-official-ui/1.0.33/css/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/mtb/??lib-flexible/0.3.4/flexible.js

Domain: g.alicdn.com
URL: https://g.alicdn.com/??aliyun/static/0.0.13/jquery/1.11/jquery.min.js,aliyun/static/0.0.13/promise.js,mtb/lib-windvane/2.1.8/windvane.js,mtb/lib-env/1.9.9/env.js,aliyun/m-aliyun-dbl-bridge/0.2.2/dblbridge.min.js,dawn/polyfill/1.0.3/js/index.js

Domain: g.alicdn.com
URL: https://g.alicdn.com/??aliyun/dbl-official-ui/1.0.33/scripts/index.js

Domain: www.aliyun.com
URL: https://www.aliyun.com/assets/ace-base-assets

Domain: g.alicdn.com
URL: https://g.alicdn.com/??ali-mod/wb-zxw-yds-invite/0.0.4/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/tms/layouts/0.1.8/layout-hangye-pc.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/ali-mod/??aliyun-individuation-hook/0.0.7/index.css,aliyun-responsive-header/0.0.12/index.css,www-aliyun-common-allinone/0.0.1/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/ali-mod/??aliyun-individuation-topbar-search/0.0.6/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/ali-mod/??aliyun-individuation-topbar-search/0.0.6/index.js

Domain: g.alicdn.com
URL: https://g.alicdn.com/ali-mod/??aliyun-common-icon/0.0.7/index.css

Domain: at.alicdn.com
URL: https://at.alicdn.com/t/font_276948_28ii451l5wi.css

Domain: at.alicdn.com
URL: https://at.alicdn.com/t/font_274588_mqzled928bl.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/ali-mod/??aliyun-common-icon/0.0.7/index.js

Domain: g.alicdn.com
URL: https://g.alicdn.com/ali-mod/??www-aliyun-common-allinone/0.0.1/index.css,aliyun-common-topbar-2019/0.0.62/index.css,www-intl-redirect/0.0.2/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/dawn/polyfill/1.0.6/js/index.js

Domain: g.alicdn.com
URL: https://g.alicdn.com/??aliyun/util/1.0.95/css/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/??aliyun/util/1.0.95/index.js

Domain: g.alicdn.com
URL: https://g.alicdn.com/dawn/topbar-dawn/2.0.5/css/index.css

Domain: g.alicdn.com
URL: https://g.alicdn.com/dawn/topbar-dawn/2.0.5/js/index.js

Domain: at.alicdn.com
URL: https://at.alicdn.com/t/font_276948_7szs5lm5sqs.css

Domain: img.alicdn.com
URL: https://img.alicdn.com/tfs/TB17mppCFOWBuNjy0FiXXXFxVXa-36-28.png

Domain: img.alicdn.com
URL: https://img.alicdn.com/tfs/TB1lopON9zqK1RjSZFjXXblCFXa-160-40.png

Domain: img.alicdn.com
URL: https://img.alicdn.com/tfs/TB1IaF0N3HqK1RjSZFkXXX.WFXa-160-40.gif

Domain: img.alicdn.com
URL: https://img.alicdn.com/tfs/TB1yoKYXMmTBuNjy1XbXXaMrVXa-24-24.png

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
wxllq.gz01.bdysite.com/	1970-01-19 06:11:42	Name: CNZZDATA1276082832 Value: 1898201112-1561776109-%7C1561776109
.bdysite.com/	1970-01-19 06:11:42	Name: UM_distinctid Value: 16ba1303db9738-0299fb97089fea-37647e03-1d4c00-16ba1303dbad8d
wxllq.gz01.bdysite.com/	1970-01-19 10:35:13	Name: BAEID Value: 161CB3CA5445C00E665E9F81188FC2AB

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

at.alicdn.com
basejs.bj01.bdysite.com
c.cnzz.com
dl.360safe.com
g.alicdn.com
img.alicdn.com
promotion.aliyun.com
s23.cnzz.com
www.aliyun.com
wxllq.gz01.bdysite.com
xn--app-py9ds60d.com
z5.cnzz.com
at.alicdn.com
g.alicdn.com
img.alicdn.com
www.aliyun.com
103.121.93.13
104.192.108.18
140.205.172.20
150.138.249.206
180.149.142.215
203.119.206.97
222.85.26.208
222.85.26.209
316cefa6043381e8e9ff1427e179ee9cba449feb434f973fac3940ba22f296e5
59ef28ef47ad9ab65aee057e8d33aee3398b129922f9863120abf355f7b4e81e
ae0fc78a74fcd2f05cb7677a209c66185fe970101e6e42cab626efb24b6d1260
bdf1e9a2ae32c96523a9103bf9ad64b986bb7b4eb4bc8f3ebc0657276147a688
c05a6ddff988322c06acdedb1e94216cb6a30481c18f0d8b1776a91c81f822d3
c3e5c85d059df961a01d4700dc8ec680ddd25b6cf1ce9bb3e7b3a3ac2b193979
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2cf3b04f364c1e1f47730a8c033726e35925969bfcb7d8f6328e4733ced02

promotion.aliyun.com Open in urlscan Pro 140.205.172.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

36 Requests

3 %HTTPS

0 %IPv6

6 Domains

12 Subdomains

9 IPs

2 Countries

43 kBTransfer

86 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

3 Cookies

Indicators

promotion.aliyun.com Open in urlscan Pro
140.205.172.20 Public Scan

Screenshot
Live screenshot

Full Image

36
Requests

3 %
HTTPS

0 %
IPv6

6
Domains

12
Subdomains

9
IPs

2
Countries

43 kB
Transfer

86 kB
Size

3
Cookies

36 HTTP transactions
0 data transactions