onedrive.heyzg.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 119.28.66.243, located in Hong Kong and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is onedrive.heyzg.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 21st 2019. Valid for: 3 months.

This is the only time onedrive.heyzg.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	119.28.66.243 119.28.66.243	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
2	213.244.178.178 213.244.178.178	3356 (LEVEL3) (LEVEL3 - Level 3 Parent)
5	3

1 119.28.66.243 (Hong Kong)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

onedrive.heyzg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.244.178.178 (United Kingdom)

ASN3356 (LEVEL3 - Level 3 Parent, LLC, US)

cdn.staticfile.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	staticfile.org cdn.staticfile.org	39 KB
1	heyzg.com onedrive.heyzg.com	3 KB
0	90so.net Failed cdn.90so.net Failed
5	3

	Domain	Requested by
2	cdn.staticfile.org	onedrive.heyzg.com
1	onedrive.heyzg.com
0	cdn.90so.net Failed	onedrive.heyzg.com
5	3

This site contains no links.

Subject Issuer	Validity	Valid
onedrive.heyzg.com Let's Encrypt Authority X3	`2019-06-21` - `2019-09-19`	3 months	crt.sh
*.staticfile.org GeoTrust RSA CA 2018	`2018-02-12` - `2020-09-19`	3 years	crt.sh

This page contains 1 frames:

Primary Page: https://onedrive.heyzg.com/
Frame ID: 36669A5D1EBC6E8E21D80CBB67C09FAD
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

42 kB
Transfer

129 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response onedrive.heyzg.com/	8 KB 3 KB	985ms 276ms	Document text/html	119.28.66.243 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL https://onedrive.heyzg.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 119.28.66.243 , Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `81eb4e25590af19e263ddbbf945dfaae26ba74e538949ebd049e3f2c65c40202` Request headers :method GET :authority onedrive.heyzg.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 server nginx date Fri, 21 Jun 2019 14:01:18 GMT content-type text/html; charset=utf-8 vary Accept-Encoding cache-control max-age=43200 pragma no-cache expires Sat, 22 Jun 2019 02:01:18 GMT set-cookie image_mode=0; Path=/ sortby=lastModtime; Path=/ order=desc; Path=/ content-encoding gzip
GET		layui.css cdn.90so.net/layui/2.4.5/css/	0 0

GET H/1.1	200 OK	font-awesome.css cdn.staticfile.org/font-awesome/4.7.0/css/	37 KB 8 KB	1783ms 15ms	Stylesheet text/css	213.244.178.178 Level 3 Parent
General Check archive.org Show headers Download Go to Full URL https://cdn.staticfile.org/font-awesome/4.7.0/css/font-awesome.css Requested by Host: onedrive.heyzg.com URL: https://onedrive.heyzg.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 213.244.178.178 , United Kingdom, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US), Reverse DNS Software Tengine / Resource Hash `36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c` Request headers Referer https://onedrive.heyzg.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Encoding gzip Age 62301 X-Swift-CacheTime 86400 Content-Disposition inline; filename="font-awesome.css"; filename=utf-8' 'font-awesome.css X-Swift-SaveTime* Fri, 21 Jun 2019 06:40:36 GMT X-M-Reqid rU8AAOXTF3LfAqoV X-M-Log QNM:jjh1510;QNM3/304 Etag "FgFAlSxk4_K3TvZOBQ8v6G6rZiTI.gz" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Access-Control-Expose-Headers X-Log, X-Reqid Cache-Control s-maxage=86400, max-age=86400 X-Qiniu-Zone 0 X-Qnm-Cache Hit EagleId d5f4b28415611256806391115e Expires Fri, 21 Jun 2019 20:42:59 GMT X-Log redis.g;IO/304 Date Thu, 20 Jun 2019 20:42:59 GMT Via cache40.l2de1[0,304-0,H], cache54.l2de1[1,0], cache6.nl1[0,200-0,H], cache4.nl1[2,0] X-Svr IO X-Swift-Error forward connect timeout X-Reqid jW4AAE3RGUY_yo8V Connection keep-alive Content-Transfer-Encoding binary Content-Length 7344 X-Cache HIT TCP_HIT dirn:3:495100001 Last-Modified Tue, 25 Oct 2016 10:00:21 GMT Server Tengine Access-Control-Max-Age 2592000 Ali-Swift-Global-Savetime 1545883534 Accept-Ranges bytes Timing-Allow-Origin *
GET H/1.1	200 OK	jquery.min.js Show response cdn.staticfile.org/jquery/3.3.1/	85 KB 31 KB	1811ms 26ms	Script application/javascript	213.244.178.178 Level 3 Parent
General Check archive.org Show headers Download Go to Full URL https://cdn.staticfile.org/jquery/3.3.1/jquery.min.js Requested by Host: onedrive.heyzg.com URL: https://onedrive.heyzg.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 213.244.178.178 , United Kingdom, ASN3356 (LEVEL3 - Level 3 Parent, LLC, US), Reverse DNS Software Tengine / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers Referer https://onedrive.heyzg.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Encoding gzip Age 27644 X-Swift-CacheTime 86400 Content-Disposition inline; filename="jquery.min.js"; filename=utf-8' 'jquery.min.js X-Swift-SaveTime* Fri, 21 Jun 2019 13:43:18 GMT X-M-Reqid IhMAAPhW3q5kIqoV X-M-Log QNM:jjh1521;QNM3:32/304 Etag "Fg3DLbSqnF8D87OMR9iD29T-0Tqu.gz" Vary Accept-Encoding Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Access-Control-Expose-Headers X-Log, X-Reqid Cache-Control s-maxage=86400, max-age=86400 X-Qiniu-Zone 0 X-Qnm-Cache Hit EagleId d5f4b28415611256806551143e Expires Sat, 22 Jun 2019 06:20:36 GMT X-Log X-Log Date Fri, 21 Jun 2019 06:20:36 GMT Via cache8.l2de1[0,304-0,H], cache25.l2de1[1,0], cache2.nl1[0,200-0,H], cache4.nl1[1,0] X-Svr IO X-Reqid LvAAAADAIQ81GJ0V Connection keep-alive Content-Transfer-Encoding binary Content-Length 30451 X-Cache HIT TCP_MEM_HIT dirn:8:593199273 Last-Modified Wed, 24 Jan 2018 15:12:08 GMT Server Tengine Access-Control-Max-Age 2592000 Ali-Swift-Global-Savetime 1548188575 Accept-Ranges bytes Timing-Allow-Origin *
GET		layui.js cdn.90so.net/layui/2.4.5/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.90so.net
URL: https://cdn.90so.net/layui/2.4.5/css/layui.css

Domain: cdn.90so.net
URL: https://cdn.90so.net/layui/2.4.5/layui.js

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.90so.net
cdn.staticfile.org
onedrive.heyzg.com
cdn.90so.net
119.28.66.243
213.244.178.178
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
81eb4e25590af19e263ddbbf945dfaae26ba74e538949ebd049e3f2c65c40202

onedrive.heyzg.com Open in urlscan Pro 119.28.66.243 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

42 kBTransfer

129 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Indicators

onedrive.heyzg.com Open in urlscan Pro
119.28.66.243 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

42 kB
Transfer

129 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions