chinatours.com Open in urlscan Pro
2606:4700:3108::ac42:2907 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://chinatours.com/wp-content/cache/pkv/netrad/
Effective URL:
https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Submission: On March 21 via api (March 21st 2024, 9:18:21 am UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3108::ac42:2907, located in United States and belongs to CLOUDFLARENET, US. The main domain is chinatours.com.
TLS certificate: Issued by GTS CA 1P5 on January 31st 2024. Valid for: 3 months.

This is the only time chinatours.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 12	2606:4700:310... 2606:4700:3108::ac42:2907		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:4f49		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:86c0:209... 2a00:86c0:2090::1		40027 (NETFLIX-ASN) (NETFLIX-ASN)
13	3

12 2606:4700:3108::ac42:2907 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

chinatours.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4f49 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	chinatours.com 1 redirects chinatours.com	203 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 2815	72 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1408	7 KB
13	3

	Domain	Requested by
12	chinatours.com	1 redirects chinatours.com static.cloudflareinsights.com
1	assets.nflxext.com	chinatours.com
1	static.cloudflareinsights.com	chinatours.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
chinatours.com GTS CA 1P5	`2024-01-31` - `2024-04-30`	3 months	crt.sh
cloudflareinsights.com GTS CA 1P5	`2024-03-10` - `2024-06-08`	3 months	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2024-03-01` - `2024-04-05`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Frame ID: 4C75E5F212FCC423C1A1F82063401427
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Page URL History Show full URLs

https://chinatours.com/wp-content/cache/pkv/netrad/ HTTP 301
https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

282 kB
Transfer

571 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://chinatours.com/wp-content/cache/pkv/netrad/ HTTP 301
https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
chinatours.com/wp-content/cache/pkv/netrad/net/
Redirect Chain

https://chinatours.com/wp-content/cache/pkv/netrad/
https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php

7 KB
3 KB

116ms
115ms

Document
text/html

2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.34
Resource Hash: 6affbbf86e1528a6d998c41a589f965dd1cf05438eb30c39483ff689a6adfd47

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 867cda7c5a5902e8-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 21 Mar 2024 09:18:14 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B6EdnpRv6YoNCWhoQtz%2B2hg81JI6tdQ2Ds6aGhbYk8P2UInD%2F%2Fv2LmFTSM0Tr%2Fc06JKxe1m4Utnq%2BRKLZTHMdwKVOnYtptVs%2Fz4gRhdxp04T5t0%2F40G4VVWGOUjR%2BXJjqyclszO7vSXUBCeJ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.2.34

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 867cda7a49ac02e8-MIA
content-type: text/html; charset=UTF-8
date: Thu, 21 Mar 2024 09:18:14 GMT
location: net/login.php
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=abvwL0Mc%2Bwlts7hN5QF%2FPKFVgzGxEcinh4LPyCMqs2yOf%2FjTlwSMcX6NFuc0r5ECvNoiGVVNXoLjv4WJ7XyBk6fXs1Crrc3RE1K1DMOlvK%2F%2FLyVPgCAsGBO3Vi8ivAPTCaYugU5J8VQnSd0n"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.2.34

GET
H3 200 none.css
chinatours.com/wp-content/cache/pkv/netrad/net/files/css/ 119 KB
19 KB 100ms
99ms Stylesheet
text/css 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/css/none.css
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72f76a9789cf8a2d1bed358707c4dad4730539428c909182d42e27e00910a6d4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=148910
etag: W/"65eddc87-245ae"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BNw80xG6zHNG0E%2F3hI0lVMoHEtu2zEvpFlVxKGu8nD0aAwkUt9Kr4LSjlCMddNhJfyMaTHjB7SpmsPDgpnEttU7cCXClXso8X8Odmgsrsu5AodPghtNcUf3nkhuQgdGJ%2B%2BH5NFuOxgiroPo9"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 867cda7d1a1a7483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 none2.css
chinatours.com/wp-content/cache/pkv/netrad/net/files/css/ 134 KB
22 KB 133ms
132ms Stylesheet
text/css 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/css/none2.css
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e7d039f02237c7037d68803d4f2db2644f7c771674e198f8ac5b9d10104f4ca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=166902
etag: W/"65eddc87-28bf6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SFtfPL3Qndb5geP4UIVP%2B3zMM1GYEWElH8PTySY7L1U%2BzJHqsstfkc1DLNDdvAGNW98Zm68Obu2T%2FA7UyJ%2BZceAag5ZY9LW52F1FlwAcC%2BgcVnWHDlv3PkQg7T6hD2LHyxqboJIGFORMwx1V"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 867cda7d1a1e7483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 modernizr.min.js Show response
chinatours.com/wp-content/cache/pkv/netrad/net/files/js/ 4 KB
2 KB 97ms
96ms Script
application/javascript 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/js/modernizr.min.js
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65eddc87-edf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VL2Cp%2FC8OYqIQwhB0xNajnrHBCJmm0JJb3lRE6XEzQOcqGPNlbBEjzLn35Q9HMDnralrsauCDa1FZRVjvw8SZfinUUDuhk1c0g7XKEUhtUAjbduT9LHao1WA4rG%2F3dMfAA6U7uU8QihXH127"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 867cda7d1a207483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.js Show response
chinatours.com/wp-content/cache/pkv/netrad/net/files/js/ 85 KB
31 KB 161ms
160ms Script
application/javascript 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/js/jquery.js
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: W/"65eddc87-15339"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AJut%2F0ndv9i%2BgfSEZhhowhR0m9wTzmZ6FYUA868gEPeNjja5dlz9EBJOaVnsDTrhKHG8KAeVwIWR1nM8UKDXTN3Tn8A%2FaMlbp7BwJ91f%2B9zNrigcoFEB%2FOOFuGHKaUT4thMihVUc7mTI%2FcYs"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 867cda7d1a217483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.ccvalid.js Show response
chinatours.com/wp-content/cache/pkv/netrad/net/files/js/ 5 KB
2 KB 96ms
95ms Script
application/javascript 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/js/jquery.ccvalid.js
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e50df4a213b92115f8647f85a06754c41efde6c9cdafd976525517d3434512a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=7442
etag: W/"65eddc87-1d12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=USWAE3Ux09BsrJj618rxG1Xh%2FUvtiMBvtTMwtDCgVfw5xep1VpyzTqorA%2BfoHXyZyFgCrQhFt0y0s1aeloPD6oiNcko%2BgGktFUAQvwOS3Uyy3PCcWxnVuZeLoLz5hSwdnuICgSZHp449aG4c"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 867cda7d1a237483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.mask.js Show response
chinatours.com/wp-content/cache/pkv/netrad/net/files/js/ 8 KB
4 KB 165ms
164ms Script
application/javascript 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/js/jquery.mask.js
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60e746819a8d244fc8708cb0ea4aa3c6d015826624ddd7792d25f60fbe17e2fa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=8109
etag: W/"65eddc87-1fad"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iftwkVtDck0u%2FSgafd%2FVMTdvz9eojtnc6LIxrVz3Ti03mPi7qlkDSauhS2FI%2BCOA%2BZq%2Fngho4A367sTAxsVe9WVeY%2Bn26ruuWgEFvBhqHZhDuRniINwNsUeFgnmKbq1jM%2BuZaO2wDQry1gcO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 867cda7d1a247483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bg.jpg
chinatours.com/wp-content/cache/pkv/netrad/net/files/img/ 117 KB
118 KB 192ms
191ms Image
image/jpeg 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/img/bg.jpg
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
cf-cache-status: HIT
cf-bgj: imgq:85,h2pri
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: status=not_needed
etag: W/"65eddc87-1d529"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PwrmZDJyb%2BIoAtUYcZR4p4aeGRXakT3ETaRR11IGlZOWeKCJTo7puLQhxqyTcnURw7ElIhrt%2F4c9f4jv5P9xGKHT6jiZA35jlbXo71bPxJ4WJvbCYTRyir9xgr5Y%2FLzGYuP5j4VLh4n62Evl"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=31536000
cf-ray: 867cda7d1a267483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 logo.svg
chinatours.com/wp-content/cache/pkv/netrad/net/files/img/ 864 B
1020 B 92ms
92ms Image
image/svg+xml 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/img/logo.svg
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65eddc87-360"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2FmYedJqhMgByAIH6376dL2wJZDHUEI0sqSATaeOKnPsR6G7lD5fziMtnxs6w7%2Frpj%2FtzMsY%2BAwlYSViWJx03yOXXl91tnDnHDdZQ87rIEtxFp%2FZMGZp5YTMs%2Fzga6qmom2Cb2ZtSZB5KOzZ"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=31536000
cf-ray: 867cda7d1a297483-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 fb.png
chinatours.com/wp-content/cache/pkv/netrad/net/files/img/ 280 B
805 B 131ms
131ms Image
image/webp 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/img/fb.png
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb4695828b7b4c180b658bc4241763686e1f46828a628d2d0d65da38539ea8a1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
cf-cache-status: HIT
cf-bgj: imgq:85,h2pri
last-modified: Sun, 10 Mar 2024 16:15:03 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origFmt=png, origSize=1455
etag: W/"65eddc87-5af"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ztu6rTr5CnG6OybXNcdqEZjpQu47R5Nja800m2OfPQkEZhK9WreFTUbUl7wYZNhm7MA14EvirsTxFzYl6GN6zxPUjdR4%2F4fLTxYL3KkJnUkgCWxVRNOFa3nzd%2FDUjFZS5Q8yoNtsEevRH0Je"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=31536000
content-disposition: inline; filename="fb.webp"
cf-ray: 867cda7daa8f7483-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 135ms
65ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://chinatours.com/
Origin: https://chinatours.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 867cda7eb9ee31f8-MIA

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 120ms
32ms Font
font/woff 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: chinatours.com
URL: https://chinatours.com/wp-content/cache/pkv/netrad/net/files/css/none.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer: https://chinatours.com/
Origin: https://chinatours.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Thu, 21 Mar 2024 09:18:14 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Thu, 28 Mar 2024 09:18:15 GMT

POST
H3 204 rum Show response
chinatours.com/cdn-cgi/ 0
140 B 37ms
36ms XHR
text/plain 2606:4700:3108::ac42:2907
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://chinatours.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:2907 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://chinatours.com/wp-content/cache/pkv/netrad/net/login.php
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
content-type: application/json

Response headers

date: Thu, 21 Mar 2024 09:18:14 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://chinatours.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 867cda7f9b807483-MIA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| html5 object| Modernizr function| $ function| jQuery object| $jscomp function| isEmail object| __cfBeacon

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			chinatours.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: mti9467h2h47lgd08jr0p7hsi6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
chinatours.com
static.cloudflareinsights.com
2606:4700:3108::ac42:2907
2606:4700::6810:4f49
2a00:86c0:2090::1
2e50df4a213b92115f8647f85a06754c41efde6c9cdafd976525517d3434512a
60e746819a8d244fc8708cb0ea4aa3c6d015826624ddd7792d25f60fbe17e2fa
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
6affbbf86e1528a6d998c41a589f965dd1cf05438eb30c39483ff689a6adfd47
72f76a9789cf8a2d1bed358707c4dad4730539428c909182d42e27e00910a6d4
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9e7d039f02237c7037d68803d4f2db2644f7c771674e198f8ac5b9d10104f4ca
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb4695828b7b4c180b658bc4241763686e1f46828a628d2d0d65da38539ea8a1