URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Submission: On October 20 via api from AU — Scanned from AU

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 19 HTTP transactions. The main IP is 101.199.255.209, located in China and belongs to CHINA169-BJ China Unicom Beijing Province Network, CN. The main domain is ti.360.net.
TLS certificate: Issued by WoTrus DV Server CA [Run by the Issuer] on August 8th 2022. Valid for: a year.
This is the only time ti.360.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 101.199.255.209 4808 (CHINA169-...)
1 42.236.105.242 4837 (CHINA169-...)
1 18.155.68.49 16509 (AMAZON-02)
1 13.33.88.12 16509 (AMAZON-02)
19 5
Apex Domain
Subdomains
Transfer
7 360.net
ti.360.net
1 MB
1 qhimg.com
s.ssl.qhimg.com — Cisco Umbrella Rank: 168475
281 KB
1 qhres2.com
s2.ssl.qhres2.com — Cisco Umbrella Rank: 405905
12 KB
1 360.cn
captcha.antispam.360.cn
s.360.cn Failed
10 KB
19 4
Domain Requested by
7 ti.360.net ti.360.net
1 s.ssl.qhimg.com ti.360.net
1 s2.ssl.qhres2.com ti.360.net
1 captcha.antispam.360.cn ti.360.net
0 s.360.cn Failed ti.360.net
19 5

This site contains links to these domains. Also see Links.

Domain
beian.miit.gov.cn
www.beian.gov.cn
Subject Issuer Validity Valid
*.ti.360.cn
WoTrus DV Server CA [Run by the Issuer]
2022-08-08 -
2023-08-08
a year crt.sh
antispam.360.cn
WoTrus DV Server CA [Run by the Issuer]
2022-06-06 -
2023-06-06
a year crt.sh
*.ssl.qhres2.com
WoTrus DV Server CA [Run by the Issuer]
2022-03-14 -
2023-03-14
a year crt.sh
*.ssl.qhimg.com
WoTrus DV Server CA [Run by the Issuer]
2022-04-18 -
2023-04-18
a year crt.sh

This page contains 1 frames:

Primary Page: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Frame ID: B087FF5F2C795A140212D3EA2D02160E
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

360威胁情报中心

Page Statistics

19
Requests

53 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

1700 kB
Transfer

4993 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ti.360.net/blog/articles/analysis-of-darkhotel/
1 KB
924 B
Document
General
Full URL
https://ti.360.net/blog/articles/analysis-of-darkhotel/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx/1.13.9 /
Resource Hash
de819ac0d10a60419da5fccd65b3f2c36544f0853979175a03b53c1c83820ddb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 20 Oct 2022 11:34:13 GMT
ETag
W/"6348e1b8-4ab"
Last-Modified
Fri, 14 Oct 2022 04:12:40 GMT
Server
nginx/1.13.9
Transfer-Encoding
chunked
Vary
Accept-Encoding
q360.js
captcha.antispam.360.cn/v1.2.2/
25 KB
10 KB
Script
General
Full URL
https://captcha.antispam.360.cn/v1.2.2/q360.js
Requested by
Host: ti.360.net
URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
42.236.105.242 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
hn.kd.ny.adsl
Software
nginx /
Resource Hash
784fa414179170ff1ae8d8ecde67e93615ab3fdc334269c9911485fe3e804c9c

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ti.360.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:16 GMT
Content-Encoding
gzip
Last-Modified
Mon, 14 Feb 2022 03:26:43 GMT
Server
nginx
ETag
"6209cbf3-2585"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Content-Length
9605
app.da6eeead.css
ti.360.net/css/
351 KB
57 KB
Stylesheet
General
Full URL
https://ti.360.net/css/app.da6eeead.css
Requested by
Host: ti.360.net
URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx/1.13.9 /
Resource Hash
9ddd0a69ac0bf844310c2fdbafa7fd9c8cf3cd669865199293a18ce17a8eb42e

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ti.360.net/blog/articles/analysis-of-darkhotel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Oct 2022 04:12:40 GMT
Server
nginx/1.13.9
ETag
W/"6348e1b8-57d28"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
app.39ecc381.js
ti.360.net/js/
620 KB
165 KB
Script
General
Full URL
https://ti.360.net/js/app.39ecc381.js
Requested by
Host: ti.360.net
URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx/1.13.9 /
Resource Hash
0f7750cc24c7e01ad3545bd3c6b18338af00e77fc735bfb1dcb4b31bc03349b4

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ti.360.net/blog/articles/analysis-of-darkhotel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Oct 2022 04:12:40 GMT
Server
nginx/1.13.9
ETag
W/"6348e1b8-9ae9b"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
chunk-vendors.e405ea8b.js
ti.360.net/js/
3 MB
1 MB
Script
General
Full URL
https://ti.360.net/js/chunk-vendors.e405ea8b.js
Requested by
Host: ti.360.net
URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx/1.13.9 /
Resource Hash
1b9beefc383eb0e8ee5825e84611188f81123b90db775f241fb0b8162384a450

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ti.360.net/blog/articles/analysis-of-darkhotel/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:15 GMT
Content-Encoding
gzip
Last-Modified
Fri, 14 Oct 2022 04:12:40 GMT
Server
nginx/1.13.9
ETag
W/"6348e1b8-37aea3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
722013efa282e2fb.js
s2.ssl.qhres2.com/static/
11 KB
12 KB
Script
General
Full URL
https://s2.ssl.qhres2.com/static/722013efa282e2fb.js
Requested by
Host: ti.360.net
URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.68.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-68-49.sin52.r.cloudfront.net
Software
/
Resource Hash
62254ece5039af4523a52c44c38cceb305ede0bdef1d28b6d4966409e0713099

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ti.360.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 19 Apr 2022 09:08:16 GMT
via
1.1 0f2b81f417aa397d9ed9b32b2017aaca.cloudfront.net (CloudFront)
kcs-via
HIT from w-fc01.lato;MISS from w-sc01.lato
x-qstatic-hit
1
x-amz-cf-pop
SIN52-P1
age
15906359
x-cache
Hit from cloudfront
content-length
11738
last-modified
Mon, 01 Jan 2018 00:00:00 GMT
etag
W/"b8536a1cdcd699ac"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, immutable
accept-ranges
bytes
x-amz-cf-id
ntcv5frKhypxiWdjhWurkFew6oyMsksTCL9JWFQgUEhjTOsPxXsTXg==
expires
Fri, 16 Apr 2032 09:08:16 GMT
quc6.js
s.ssl.qhimg.com/quc/
280 KB
281 KB
Script
General
Full URL
https://s.ssl.qhimg.com/quc/quc6.js?_=1666265670874
Requested by
Host: ti.360.net
URL: https://ti.360.net/js/chunk-vendors.e405ea8b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.88.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-88-12.sin2.r.cloudfront.net
Software
/
Resource Hash
8f3bdb89924903f1336ef75a2cd9664429f259e906822d0cd6828ea8d09fdd76

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ti.360.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 20 Oct 2022 11:34:31 GMT
via
1.1 f376d87611123aa47c006262522a6a94.cloudfront.net (CloudFront)
kcs-via
HIT from w-fc01.lato;MISS from w-sc02.bjmd
last-modified
Mon, 01 Jan 2018 00:00:00 GMT
x-qstatic-hit
1
x-amz-cf-pop
SIN2-P2
etag
W/"05093c6dcec8f5ef"
x-cache
Miss from cloudfront
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=86400,s-maxage=86400,max-age=315360000, immutable
accept-ranges
bytes
content-length
286897
x-amz-cf-id
6yM8SicAIZbSIHmbDZhFLgQ4SuBedADFr63YYPaJDJP1JP_ZJm-34A==
expires
Fri, 21 Oct 2022 11:34:31 GMT
iconfont.995a9225.woff2
ti.360.net/fonts/
13 KB
13 KB
Font
General
Full URL
https://ti.360.net/fonts/iconfont.995a9225.woff2
Requested by
Host: ti.360.net
URL: https://ti.360.net/css/app.da6eeead.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx/1.13.9 /
Resource Hash
1b9d450bf053a366ddc275840dde21b6c1a7bf6ec3010f7513da9e4f1da39fd1

Request headers

Referer
https://ti.360.net/css/app.da6eeead.css
Origin
https://ti.360.net
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:31 GMT
Last-Modified
Fri, 14 Oct 2022 04:12:40 GMT
Server
nginx/1.13.9
ETag
"6348e1b8-3370"
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
13168
SourceHanSansCN-Regular.11c302dd.otf
ti.360.net/fonts/
128 KB
0
Font
General
Full URL
https://ti.360.net/fonts/SourceHanSansCN-Regular.11c302dd.otf
Requested by
Host: ti.360.net
URL: https://ti.360.net/css/app.da6eeead.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
nginx/1.13.9 /
Resource Hash

Request headers

Referer
https://ti.360.net/css/app.da6eeead.css
Origin
https://ti.360.net
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:32 GMT
Last-Modified
Fri, 14 Oct 2022 04:12:40 GMT
Server
nginx/1.13.9
ETag
"6348e1b8-7fa328"
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8364840
qhpass.htm
s.360.cn/i360/
0
0

/
ti.360.net/ti/
389 B
606 B
XHR
General
Full URL
https://ti.360.net/ti/
Requested by
Host: ti.360.net
URL: https://ti.360.net/js/chunk-vendors.e405ea8b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
101.199.255.209 , China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software
gunicorn/19.9.0 /
Resource Hash
764954e10539d9421fcdc80ad3c42a0bc2e60aef86331451beac1187f5a74bab

Request headers

Accept
application/json, text/plain, */*
Referer
https://ti.360.net/blog/articles/analysis-of-darkhotel/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Date
Thu, 20 Oct 2022 11:34:32 GMT
Content-Encoding
gzip
Server
gunicorn/19.9.0
Connection
keep-alive
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/json
home_header_logo.68bd2c65.svg
ti.360.net/img/
0
0

home_title_new.80d29434.svg
ti.360.net/img/
0
0

home_bg_new.1ea176ab.png
ti.360.net/img/
0
0

gen_sign
ti.360.net/ti/sandbox/
0
0

element-icons.535877f5.woff
ti.360.net/fonts/
0
0

s.htm
s.360.cn/qdas/
0
0

hot-search
ti.360.net/ti/
0
0

top
ti.360.net/ti/search/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s.360.cn
URL
https://s.360.cn/i360/qhpass.htm?src=pcw_fortinet&version=7.0.1&guid=183105827.3150653323146511000.1666265672603.293&action=init&resolution=1600x1200&color=24&language=en-US&isCookieEnabled=true
Domain
ti.360.net
URL
https://ti.360.net/img/home_header_logo.68bd2c65.svg
Domain
ti.360.net
URL
https://ti.360.net/img/home_title_new.80d29434.svg
Domain
ti.360.net
URL
https://ti.360.net/img/home_bg_new.1ea176ab.png
Domain
ti.360.net
URL
https://ti.360.net/ti/sandbox/gen_sign
Domain
ti.360.net
URL
https://ti.360.net/fonts/element-icons.535877f5.woff
Domain
s.360.cn
URL
https://s.360.cn/qdas/s.htm?p=QH_7759_1112&u=https%3A%2F%2Fti.360.net%2Fblog%2Farticles%2Fanalysis-of-darkhotel%2F%23%2Fhomepage%2F&gid=183105827.201869495.1666265674320.1666265674320.1&sid=183105827.4192949311675256300.1666265674320.9727&title=360%E5%A8%81%E8%83%81%E6%83%85%E6%8A%A5%E4%B8%AD%E5%BF%83&t=1666265674321
Domain
ti.360.net
URL
https://ti.360.net/ti/hot-search
Domain
ti.360.net
URL
https://ti.360.net/ti/search/top

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| __core-js_shared__ function| init360Captcha object| webpackJsonp function| service function| saveAs object| FileSaver object| XLSX function| make_xlsx_lib function| _ function| hotkeys object| FontAwesomeConfig object| ___FONT_AWESOME___ function| jQuery function| $ object| __qihoo_monitor_imgs object| QIHOO_MONITOR object| monitor object| QHPass object| BJ_REPORT object| QUC object| __quc_moitor_imgs number| minJQ-dwemcs0

7 Cookies

Domain/Path Name / Value
ti.360.net/blog/articles/analysis-of-darkhotel Name: test_cookie_enable
Value: null
ti.360.net/ Name: Q_UDID
Value: eff6b75c-1bb3-4794-6c75-105502ebb3b2
ti.360.net/ Name: __DC_monitor_count
Value: 1
.360.net/ Name: __guid
Value: 183105827.3150653323146511000.1666265672603.293
ti.360.net/ Name: ti_portal
Value: eyJfcGVybWFuZW50Ijp0cnVlfQ.Y1EySA.qVwvh5gmWBT5QhUFDuH0cQWNnjo
ti.360.net/ Name: __DC_gid
Value: 183105827.201869495.1666265674320.1666265674320.1
ti.360.net/ Name: __DC_sid
Value: 183105827.4192949311675256300.1666265674320.9727

1 Console Messages

Source Level URL
Text
rendering warning URL: https://ti.360.net/blog/articles/analysis-of-darkhotel/
Message:
The value "1150px" for key "width" was truncated to its numeric prefix.