www.ysthm.com Open in urlscan Pro
173.44.146.115 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ysthm.com/
Effective URL:
http://www.ysthm.com/
Submission: On October 16 via api (October 16th 2022, 8:07:31 pm UTC) from BD — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 173.44.146.115, located in United States and belongs to AS62904, US. The main domain is www.ysthm.com.

This is the only time www.ysthm.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	173.44.146.115 173.44.146.115	62904 (AS62904) (AS62904)
2	122.9.129.226 122.9.129.226	58519 (CHINATELE...) (CHINATELECOM-CTCLOUD Cloud Computing Corporation)
2	115.233.206.246 115.233.206.246	4809 (CHINATELE...) (CHINATELECOM-CORE-WAN-CN2 China Telecom Next Generation Carrier Network)
1	240e:83:205:e... 240e:83:205:e8:0:ff:b089:12f	23724 (CHINANET-...) (CHINANET-IDC-BJ-AP IDC)
7	5

2 173.44.146.115 (United States) 1 redirects

ASN62904 (AS62904, US)
PTR: mail.creaseys.com

ysthm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.ysthm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 122.9.129.226 (Guiyang, China)

ASN58519 (CHINATELECOM-CTCLOUD Cloud Computing Corporation, CN)
PTR: ecs-122-9-129-226.compute.hwclouds-dns.com

custompages.websaas.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 115.233.206.246 (Hangzhou, China)

ASN4809 (CHINATELECOM-CORE-WAN-CN2 China Telecom Next Generation Carrier Network, CN)

tapi.dbappsecurity.com.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240e:83:205:e8:0:ff:b089:12f (China)

ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN)

istats.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	dbappsecurity.com.cn tapi.dbappsecurity.com.cn	940 KB
2	websaas.cn custompages.websaas.cn	9 KB
2	ysthm.com 1 redirects ysthm.com www.ysthm.com	46 KB
1	baidu.com istats.baidu.com	1 KB
7	4

	Domain	Requested by
2	tapi.dbappsecurity.com.cn	www.ysthm.com tapi.dbappsecurity.com.cn
2	custompages.websaas.cn	www.ysthm.com
1	istats.baidu.com	tapi.dbappsecurity.com.cn
1	www.ysthm.com
1	ysthm.com	1 redirects
7	5

This site contains no links.

Subject Issuer	Validity	Valid
*.websaas.cn GlobalSign RSA OV SSL CA 2018	`2022-03-04` - `2023-04-05`	a year	crt.sh
*.dbappsecurity.com.cn GlobalSign RSA OV SSL CA 2018	`2022-04-11` - `2023-05-13`	a year	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2022-07-05` - `2023-08-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.ysthm.com/
Frame ID: CB98EC82BE54182A3E600DBB8726B2AE
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

bm11222宝马娱乐app-App Store

Page URL History Show full URLs

http://ysthm.com/ HTTP 301
http://www.ysthm.com/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

71 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

996 kB
Transfer

1057 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ysthm.com/ HTTP 301
http://www.ysthm.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.ysthm.com/
Redirect Chain

http://ysthm.com/
http://www.ysthm.com/

66 KB
46 KB

1958ms
181ms

Document
text/html

173.44.146.115
AS62904

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ysthm.com/
Protocol: HTTP/1.1
Server: 173.44.146.115 , United States, ASN62904 (AS62904, US),
Reverse DNS: mail.creaseys.com
Software: nginx / PHP/5.4.41
Resource Hash: b195c87e1f94d6b7619fb5f82080c0ad0cf76cd58100d4e5675a9ef74c307d9d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Sun, 16 Oct 2022 20:07:21 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41

Redirect headers

Connection: keep-alive
Content-Length: 178
Content-Type: text/html
Date: Sun, 16 Oct 2022 20:07:19 GMT
Location: http://www.ysthm.com/
Server: nginx

GET
DATA 200
OK truncated
/ 43 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4ad9d0d6f07de6f5379b083dfbaa3f24530873b9dcca17237bdd34fd39de317

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ysthm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK sha1.min.js Show response
custompages.websaas.cn/ 9 KB
9 KB 1035ms
237ms Script
application/javascript 122.9.129.226
CHINATELECOM-CTCL...

General

Check archive.org

Show headers Download Go to

Full URL: https://custompages.websaas.cn/sha1.min.js
Requested by: Host: www.ysthm.com
URL: http://www.ysthm.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 122.9.129.226 Guiyang, China, ASN58519 (CHINATELECOM-CTCLOUD Cloud Computing Corporation, CN),
Reverse DNS: ecs-122-9-129-226.compute.hwclouds-dns.com
Software: openresty/1.19.3.2 /
Resource Hash: 411dc0c73b3f0612e25d8c673f226d1e52f104eefa32d47b441e11eac576fdd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ysthm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Sun, 16 Oct 2022 20:07:22 GMT
Last-Modified: Thu, 16 Sep 2021 12:01:45 GMT
Server: openresty/1.19.3.2
ETag: "61433229-24de"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9438

GET
H/1.1 200
OK tj.min.js Show response
tapi.dbappsecurity.com.cn/tj/ 939 KB
939 KB 1923ms
549ms Script
text/javascript 115.233.206.246
CHINATELECOM-CORE...

General

Check archive.org

Show headers Download Go to

Full URL

https://tapi.dbappsecurity.com.cn/tj/tj.min.js

Requested by

Host: www.ysthm.com
URL: http://www.ysthm.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

115.233.206.246 Hangzhou, China, ASN4809 (CHINATELECOM-CORE-WAN-CN2 China Telecom Next Generation Carrier Network, CN),

Reverse DNS

Software

Resource Hash

d1140ea138e7591ea2916c7b299d7e2a67d24b24640177ee901de71ec86113ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ysthm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 16 Oct 2022 20:07:28 GMT
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
Transfer-Encoding: chunked
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-XSS-Protection: 1 ; mode=block
Expires: 0

GET
H/1.1 200
OK getinquiry Show response
istats.baidu.com/portal/operation/ 433 B
1 KB 3294ms
194ms Script
application/json 240e:83:205:e8:0:ff:b089:12f
CHINANET-IDC-BJ-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://istats.baidu.com/portal/operation/getinquiry?ajax=1&accessid=&device=h5&rule_type=111&callback=jQuery36003096761370961152_1665950845556&_=1665950845557
Requested by: Host: tapi.dbappsecurity.com.cn
URL: https://tapi.dbappsecurity.com.cn/tj/tj.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 240e:83:205:e8:0:ff:b089:12f , China, ASN23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation, CN),
Reverse DNS
Software: Apache /
Resource Hash: 37af10acc364fdd236fea1453e594d7a18421ab9474df15096905b5bcfee0651

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.ysthm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date: Sun, 16 Oct 2022 20:07:28 GMT
Content-Encoding: gzip
Tracecode: 04487658922436228362101704
Server: Apache
X-Trace: ae53591
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *.baidu.com
Serialize: 9.0599060058594E-6
Request-Id: 0448765892
Cost: 0.026214

OPTIONS
H/1.1 403
Forbidden 7bef9456-a3a9-4306-a9ca-5cadc03f6879.js
custompages.websaas.cn/ 0
0 906ms
453ms Preflight
text/html 122.9.129.226
CHINATELECOM-CTCL...

General

Check archive.org

Show headers Download Go to

Full URL: https://custompages.websaas.cn/7bef9456-a3a9-4306-a9ca-5cadc03f6879.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 122.9.129.226 Guiyang, China, ASN58519 (CHINATELECOM-CTCLOUD Cloud Computing Corporation, CN),
Reverse DNS: ecs-122-9-129-226.compute.hwclouds-dns.com
Software: openresty/1.19.3.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: xwd-token
Access-Control-Request-Method: GET
Origin: http://www.ysthm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 41390
Content-Type: text/html
Date: Sun, 16 Oct 2022 20:07:26 GMT
ETag: "610263cd-a1ae"
Server: openresty/1.19.3.2

GET 7bef9456-a3a9-4306-a9ca-5cadc03f6879.js
custompages.websaas.cn/ 0
0

POST
H/1.1 200
OK tj_logs Show response
tapi.dbappsecurity.com.cn/tj/ 41 B
449 B 414ms
414ms XHR
application/json 115.233.206.246
CHINATELECOM-CORE...

General

Check archive.org

Show headers Download Go to

Full URL

https://tapi.dbappsecurity.com.cn/tj/tj_logs

Requested by

Host: tapi.dbappsecurity.com.cn
URL: https://tapi.dbappsecurity.com.cn/tj/tj.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

115.233.206.246 Hangzhou, China, ASN4809 (CHINATELECOM-CORE-WAN-CN2 China Telecom Next Generation Carrier Network, CN),

Reverse DNS

Software

Resource Hash

c0010a5755e3545a876dbb08d84918c8bbaaf518e785698874572184a4b9c118

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://www.ysthm.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Sun, 16 Oct 2022 20:07:33 GMT
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: http://www.ysthm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
X-XSS-Protection: 1 ; mode=block
Expires: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: custompages.websaas.cn
URL: https://custompages.websaas.cn/7bef9456-a3a9-4306-a9ca-5cadc03f6879.js

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			tapi.dbappsecurity.com.cn/	1969-12-31 23:59:59	Name: stat_id Value: f655fdabaea26561f9cbbc964504ab501665950843247
			.baidu.com/	1970-01-20 15:31:26	Name: BAIDUID_BFESS Value: 763F0EA00C23AD441EA77A7A9F5F3A36:FG=1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: http://www.ysthm.com/ Message: Access to XMLHttpRequest at 'https://custompages.websaas.cn/7bef9456-a3a9-4306-a9ca-5cadc03f6879.js' from origin 'http://www.ysthm.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://custompages.websaas.cn/7bef9456-a3a9-4306-a9ca-5cadc03f6879.js Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

custompages.websaas.cn
istats.baidu.com
tapi.dbappsecurity.com.cn
www.ysthm.com
ysthm.com
custompages.websaas.cn
115.233.206.246
122.9.129.226
173.44.146.115
240e:83:205:e8:0:ff:b089:12f
37af10acc364fdd236fea1453e594d7a18421ab9474df15096905b5bcfee0651
411dc0c73b3f0612e25d8c673f226d1e52f104eefa32d47b441e11eac576fdd6
b195c87e1f94d6b7619fb5f82080c0ad0cf76cd58100d4e5675a9ef74c307d9d
c0010a5755e3545a876dbb08d84918c8bbaaf518e785698874572184a4b9c118
d1140ea138e7591ea2916c7b299d7e2a67d24b24640177ee901de71ec86113ad
d4ad9d0d6f07de6f5379b083dfbaa3f24530873b9dcca17237bdd34fd39de317

www.ysthm.com Open in urlscan Pro 173.44.146.115 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

71 %HTTPS

25 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

996 kBTransfer

1057 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

www.ysthm.com Open in urlscan Pro
173.44.146.115 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

71 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

996 kB
Transfer

1057 kB
Size

2
Cookies

7 HTTP transactions
1 data transactions