express.jlg288.com Open in urlscan Pro
134.122.205.212 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://express.jlg288.com/
Submission: On June 19 via api (June 19th 2024, 5:37:06 am UTC) from HK — Scanned from SG

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 18 HTTP transactions. The main IP is 134.122.205.212, located in Singapore and belongs to CTGSERVERLIMITED-AS-AP CTG Server Limited, HK. The main domain is express.jlg288.com.
TLS certificate: Issued by R3 on April 22nd 2024. Valid for: 3 months.

This is the only time express.jlg288.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
9	134.122.205.212 134.122.205.212	152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited)
7	149.88.81.9 149.88.81.9	142032 (HFTCL-AS-...) (HFTCL-AS-AP High Family Technology Co.)
18	3

9 134.122.205.212 (Singapore)

ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)

express.jlg288.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 149.88.81.9 (London, United Kingdom)

ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK)

res.zvo.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.translate.zvo.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	jlg288.com express.jlg288.com	947 KB
7	zvo.cn res.zvo.cn api.translate.zvo.cn — Cisco Umbrella Rank: 534069 america.api.translate.zvo.cn Failed	217 KB
18	2

	Domain	Requested by
9	express.jlg288.com	express.jlg288.com
6	api.translate.zvo.cn	res.zvo.cn
1	res.zvo.cn	express.jlg288.com
0	america.api.translate.zvo.cn Failed	res.zvo.cn
18	4

This site contains no links.

Subject Issuer	Validity	Valid
express.jlg288.com R3	`2024-04-22` - `2024-07-21`	3 months	crt.sh
res.zvo.cn TrustAsia RSA DV TLS CA G2	`2023-12-26` - `2024-12-25`	a year	crt.sh
api.translate.zvo.cn TrustAsia RSA DV TLS CA G2	`2023-08-01` - `2024-07-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://express.jlg288.com/
Frame ID: B18447F5A411E0C54A47DB313EC1642D
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

物流管理系统

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

89 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

1164 kB
Transfer

1364 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
express.jlg288.com/ 3 KB
1 KB 980ms
318ms Document
text/html 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://express.jlg288.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

1378f20078bb9f2b9d60c5d6f2cd4e50e241e60ecda5d755025693595df1fd34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 19 Jun 2024 05:36:56 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
express.jlg288.com/static/admin/css/ 118 KB
24 KB 356ms
355ms Stylesheet
text/css 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://express.jlg288.com/static/admin/css/bootstrap.min.css?v=3.3.6

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

68b69105673fbb64096c34b060f900d2731d4f19202ad8f2c11274f3d6f59126

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 25 Aug 2023 16:51:56 GMT
server: nginx
etag: W/"64e8dc2c-1d996"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Wed, 19 Jun 2024 17:36:56 GMT

GET
H2 200 css.css
express.jlg288.com/static/index/css/ 3 KB
1 KB 363ms
362ms Stylesheet
text/css 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://express.jlg288.com/static/index/css/css.css

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

fe5ccee402aa4f07fbd643779e74ef9efd012c75376bfdd83dd5902b802b7d81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 25 Aug 2023 16:52:26 GMT
server: nginx
etag: W/"64e8dc4a-b69"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Wed, 19 Jun 2024 17:36:56 GMT

GET
H2 200 jquery.min.js Show response
express.jlg288.com/static/admin/js/ 82 KB
33 KB 383ms
383ms Script
application/javascript 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://express.jlg288.com/static/admin/js/jquery.min.js?v=2.1.4

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

de4b3c3d1dc2506b6693f0f98884e1dc074cda9d66cab39b7b48a115fdfc4c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 25 Aug 2023 16:52:14 GMT
server: nginx
etag: W/"64e8dc3e-1497d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Wed, 19 Jun 2024 17:36:56 GMT

GET
H2 200 logo.png
express.jlg288.com/static/index/img/ 19 KB
19 KB 243ms
243ms Image
image/png 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://express.jlg288.com/static/index/img/logo.png

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

4a155cb0921cb87bb7c3a7d01bc0505f33d489d92e8421b512a7be559fd06d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:57 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 25 Sep 2023 15:29:42 GMT
server: nginx
etag: "6511a766-4b22"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 19234
expires: Fri, 19 Jul 2024 05:36:57 GMT

GET
H/1.1 200
OK translate.js Show response
res.zvo.cn/translate/ 209 KB
210 KB 1750ms
950ms Script
application/javascript 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://res.zvo.cn/translate/translate.js
Requested by: Host: express.jlg288.com
URL: https://express.jlg288.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: c6efbc6f69a679730a8de5dda8064d38bf9bf9a8070515f3495ec53f82bbc9d8

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 05:36:46 GMT
Last-Modified: Thu, 13 Jun 2024 12:11:01 GMT
Server: nginx/1.19.6
ETag: "666ae1d5-345ff"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 214527

GET
H2 200 layer.min.js Show response
express.jlg288.com/static/admin/js/plugins/layer/ 21 KB
8 KB 277ms
277ms Script
application/javascript 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://express.jlg288.com/static/admin/js/plugins/layer/layer.min.js

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

fd8f3a227ff1476d3d7fb5dd45d8dda480dd894737f5fb55c3ed181a8ede64d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:57 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 25 Aug 2023 16:52:18 GMT
server: nginx
etag: W/"64e8dc42-535f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Wed, 19 Jun 2024 17:36:57 GMT

GET
H2 200 banner.jpg
express.jlg288.com/static/index/img/ 851 KB
852 KB 287ms
286ms Image
image/jpeg 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://express.jlg288.com/static/index/img/banner.jpg

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/static/index/css/css.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

65c9a7079063c28a4e7eb45ba7967b8857aa08d1f26f8a3b735dc565f3f6fc5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/static/index/css/css.css
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:57 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 25 Aug 2023 16:52:26 GMT
server: nginx
etag: "64e8dc4a-d4bf2"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 871410
expires: Fri, 19 Jul 2024 05:36:57 GMT

OPTIONS
H/1.1 200 connectTest.json
api.translate.zvo.cn/ 0
0 301ms
101ms Preflight 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/connectTest.json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://express.jlg288.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Wed, 19 Jun 2024 05:36:47 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

OPTIONS connectTest.json
america.api.translate.zvo.cn/ 0
0

OPTIONS
H/1.1 200 init.json
api.translate.zvo.cn/ 0
0 301ms
104ms Preflight 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/init.json?v=3.5.2.20240613
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://express.jlg288.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Wed, 19 Jun 2024 05:36:47 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

OPTIONS
H/1.1 200 language.json
api.translate.zvo.cn/ 0
0 296ms
100ms Preflight 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/language.json?v=3.5.2.20240613
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: currentpage
Access-Control-Request-Method: POST
Origin: https://express.jlg288.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: currentpage
Access-Control-Allow-Origin: *
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Author: guanleiming
Connection: keep-alive
Date: Wed, 19 Jun 2024 05:36:47 GMT
Server: nginx/1.19.6
Site: wm.zvo.cn
Transfer-Encoding: chunked
Vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
site: http://translate.zvo.cn

POST
H/1.1 200 connectTest.json Show response
api.translate.zvo.cn/ 51 B
328 B 61ms
60ms XHR
application/json 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/connectTest.json
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: a670968373e972f89338087f326333d31360fb696807844101b789451d98300e

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
Referer: https://express.jlg288.com/
currentpage: https://express.jlg288.com/
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 05:36:47 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

POST connectTest.json
america.api.translate.zvo.cn/ 0
0

POST
H/1.1 200 init.json Show response
api.translate.zvo.cn/ 105 B
382 B 60ms
60ms XHR
application/json 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/init.json?v=3.5.2.20240613
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: 48b0e04854cfe500ce19fd9a6bb7398603f5ce2b71ab5222fb7fef29eed85eb3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://express.jlg288.com/
currentpage: https://express.jlg288.com/
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 05:36:47 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

POST
H/1.1 200 language.json Show response
api.translate.zvo.cn/ 6 KB
7 KB 61ms
60ms XHR
application/json 149.88.81.9
HFTCL-AS-AP High ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.translate.zvo.cn/language.json?v=3.5.2.20240613
Requested by: Host: res.zvo.cn
URL: https://res.zvo.cn/translate/translate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 149.88.81.9 London, United Kingdom, ASN142032 (HFTCL-AS-AP High Family Technology Co., Limited, HK),
Reverse DNS
Software: nginx/1.19.6 /
Resource Hash: ce10a2b6fb2a4161461d1d016105f0cd3117e29cb1c5a280a1bc10e568e5e156

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
Referer: https://express.jlg288.com/
currentpage: https://express.jlg288.com/
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 19 Jun 2024 05:36:47 GMT
Server: nginx/1.19.6
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: currentpage
site: http://translate.zvo.cn

GET
H2 200 layer.css
express.jlg288.com/static/admin/js/plugins/layer/skin/default/ 14 KB
3 KB 261ms
260ms Stylesheet
text/css 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://express.jlg288.com/static/admin/js/plugins/layer/skin/default/layer.css?v=3.0.11110

Requested by

Host: express.jlg288.com
URL: https://express.jlg288.com/static/admin/js/plugins/layer/layer.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

651f64dffeb4354d09c720e83d62e5d6d0376bc8b973588ad8036150864e2bc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:59 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 25 Aug 2023 16:52:18 GMT
server: nginx
etag: W/"64e8dc42-37d8"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Wed, 19 Jun 2024 17:36:59 GMT

GET
H2 404 favicon.ico
express.jlg288.com/ 38 KB
6 KB 312ms
312ms Other
text/html 134.122.205.212
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL: https://express.jlg288.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 134.122.205.212 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),
Reverse DNS
Software: nginx /
Resource Hash: 4b38daa4297a13450c9128ce6a1766bd0a818b42454bb434e046908e7740c7cb

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://express.jlg288.com/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 05:36:59 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: america.api.translate.zvo.cn
URL: https://america.api.translate.zvo.cn/connectTest.json

Domain: america.api.translate.zvo.cn
URL: https://america.api.translate.zvo.cn/connectTest.json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://express.jlg288.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

america.api.translate.zvo.cn
api.translate.zvo.cn
express.jlg288.com
res.zvo.cn
america.api.translate.zvo.cn
134.122.205.212
149.88.81.9
1378f20078bb9f2b9d60c5d6f2cd4e50e241e60ecda5d755025693595df1fd34
48b0e04854cfe500ce19fd9a6bb7398603f5ce2b71ab5222fb7fef29eed85eb3
4a155cb0921cb87bb7c3a7d01bc0505f33d489d92e8421b512a7be559fd06d58
4b38daa4297a13450c9128ce6a1766bd0a818b42454bb434e046908e7740c7cb
651f64dffeb4354d09c720e83d62e5d6d0376bc8b973588ad8036150864e2bc9
65c9a7079063c28a4e7eb45ba7967b8857aa08d1f26f8a3b735dc565f3f6fc5c
68b69105673fbb64096c34b060f900d2731d4f19202ad8f2c11274f3d6f59126
a670968373e972f89338087f326333d31360fb696807844101b789451d98300e
c6efbc6f69a679730a8de5dda8064d38bf9bf9a8070515f3495ec53f82bbc9d8
ce10a2b6fb2a4161461d1d016105f0cd3117e29cb1c5a280a1bc10e568e5e156
de4b3c3d1dc2506b6693f0f98884e1dc074cda9d66cab39b7b48a115fdfc4c0f
fd8f3a227ff1476d3d7fb5dd45d8dda480dd894737f5fb55c3ed181a8ede64d2
fe5ccee402aa4f07fbd643779e74ef9efd012c75376bfdd83dd5902b802b7d81

express.jlg288.com Open in urlscan Pro 134.122.205.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

89 %HTTPS

0 %IPv6

2 Domains

4 Subdomains

3 IPs

2 Countries

1164 kBTransfer

1364 kBSize

0 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

express.jlg288.com Open in urlscan Pro
134.122.205.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

89 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

1164 kB
Transfer

1364 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!