Submitted URL: https://yzjhlt.cyou/
Effective URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Submission: On April 20 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 172.67.183.254, located in United States and belongs to CLOUDFLARENET, US. The main domain is yzjhlt.cyou.
TLS certificate: Issued by GTS CA 1P5 on April 20th 2024. Valid for: 3 months.
This is the only time yzjhlt.cyou was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 172.67.183.254 13335 (CLOUDFLAR...)
14 2
Apex Domain
Subdomains
Transfer
4 yzjhlt.cyou
yzjhlt.cyou
16 KB
0 yzjhlt.club Failed
yzjhlt.club Failed
14 2
Domain Requested by
4 yzjhlt.cyou 1 redirects yzjhlt.cyou
0 yzjhlt.club Failed yzjhlt.cyou
14 2

This site contains links to these domains. Also see Links.

Domain
qm.qq.com
wpa.qq.com
Subject Issuer Validity Valid
yzjhlt.cyou
GTS CA 1P5
2024-04-20 -
2024-07-19
3 months crt.sh

This page contains 1 frames:

Primary Page: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Frame ID: E2D5078CB04DE6F8F66D24092ADEA398
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

登录 - 影子江湖 - Powered by Discuz!

Page URL History Show full URLs

  1. https://yzjhlt.cyou/ HTTP 302
    https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

14
Requests

21 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

15 kB
Transfer

22 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://yzjhlt.cyou/ HTTP 302
    https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request member.php
yzjhlt.cyou/
Redirect Chain
  • https://yzjhlt.cyou/
  • https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
14 KB
6 KB
Document
General
Full URL
https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.183.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df50045a01ed33e65bb8953dc30960ba0f6610e3ff10e4f104b79f4f4b9acae5

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8778841ad89b9b95-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 20 Apr 2024 22:19:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uucP4a0ksZotmAGFzMSYcoakYulSBw9CcgFMxURJzYG%2F%2Fv2KX5FitrwcAq95SmBrGBW5cnTdbxk8XEYnaT57K%2B337RP96fxQnUtX4Chp1Vfa5hrqpILTjgiYOmuJlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
877884169de29b95-FRA
content-type
text/html; charset=utf-8
date
Sat, 20 Apr 2024 22:19:27 GMT
location
member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RViIfZ05j9DnrrIWfLipUY7Rl%2FrJe1tx3skk7rMMvwOKRyAJPGqORcAz8gqwyao4jBiQoojmDs5htMfh7FN9YkHCWh0eGuFvwTdGr9IFQGZPcFkUn0Yloz87SY9cEA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
style_5_common.css
yzjhlt.cyou/data/cache/
0
0

style_5_member_logging.css
yzjhlt.cyou/data/cache/
0
0

common.js
yzjhlt.cyou/static/js/
0
0

font-awesome.min.css
yzjhlt.cyou/template/the_c_style/images/css/
0
0

jquery-1.7.1.min.js
yzjhlt.cyou/template/the_c_style/images/js/
0
0

sunju_face.css
yzjhlt.cyou/source/plugin/sunju_facemall/public/css/
0
0

sunju_face.js
yzjhlt.cyou/source/plugin/sunju_facemall/public/
0
0

comiis_pcflxx.css
yzjhlt.cyou/template/comiis_app/comiis/comiis_flxx/
0
0

md5.js
yzjhlt.cyou/static/js/
0
0

bg20.jpg
yzjhlt.club/img/
0
0

normal.cur
yzjhlt.cyou/source/plugin/bon_cursor/static/14/
4 KB
5 KB
Image
General
Full URL
https://yzjhlt.cyou/source/plugin/bon_cursor/static/14/normal.cur
Requested by
Host: yzjhlt.cyou
URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.183.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
edf517d16a3f9de1aff7513d4d4610bdb40a380fc087b4da509d223694eeddf4

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 20 Apr 2024 22:19:28 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 21 Mar 2024 12:34:38 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65fc295e-10be"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ocdQBCw6m3cpTmoqEklpsTKHj1DBE%2FT2mJK5wkGRuAnkeYG%2BIWYs9scNITeUYA777jKT9mK6RfuSoBnGEuA26hpNJXH4vpIZlqrbDlm7nTu%2B8dKu%2F86oGLqmK4O2tw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
accept-ranges
bytes
cf-ray
8778841dbaed9b95-FRA
alt-svc
h3=":443"; ma=86400
content-length
4286
link.cur
yzjhlt.cyou/source/plugin/bon_cursor/static/14/
4 KB
5 KB
Image
General
Full URL
https://yzjhlt.cyou/source/plugin/bon_cursor/static/14/link.cur
Requested by
Host: yzjhlt.cyou
URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.183.254 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
520603ee0ac5f38557137370a0f7464b8e0f0a859a755bcb44eab15f12b1b6e3

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 20 Apr 2024 22:19:28 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 21 Mar 2024 12:34:38 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65fc295e-10be"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QnB%2FViOlBrXOWAPjhDhTwnaJ1mv4WO3TQ3C3QmrYkcL835upBl2ivgNoYoGJVut33aFuD70IWko%2B6dVhaqs0dyjJ5jGMoTHE5Jv6dSvtoAwVUZvN6ssOdKuUCI2tog%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
accept-ranges
bytes
cf-ray
8778841dbaee9b95-FRA
alt-svc
h3=":443"; ma=86400
content-length
4286
home.php
yzjhlt.cyou/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/data/cache/style_5_common.css?JML
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/data/cache/style_5_member_logging.css?JML
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/static/js/common.js?JML
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/template/the_c_style/images/css/font-awesome.min.css?JML
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/template/the_c_style/images/js/jquery-1.7.1.min.js?JML
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/source/plugin/sunju_facemall/public/css/sunju_face.css
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/source/plugin/sunju_facemall/public/sunju_face.js
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/template/comiis_app/comiis/comiis_flxx/comiis_pcflxx.css
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/static/js/md5.js?JML
Domain
yzjhlt.club
URL
https://yzjhlt.club/img/bg20.jpg
Domain
yzjhlt.cyou
URL
http://yzjhlt.cyou/home.php?mod=misc&ac=sendmail&rand=1713651568

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| STYLEID string| STATICURL string| IMGDIR string| VERHASH string| charset string| discuz_uid string| cookiepre string| cookiedomain string| cookiepath string| showusercard string| attackevasive string| disallowfloat string| creditnotice string| defaultstyle string| REPORTURL string| SITEURL string| JSPATH string| DYNAMICURL number| pwdclear function| initinput_login function| clearpwd function| loadingBox function| doIt function| wph

4 Cookies

Domain/Path Name / Value
yzjhlt.cyou/ Name: O9cz_2132_saltkey
Value: v5HPH0hL
yzjhlt.cyou/ Name: O9cz_2132_lastvisit
Value: 1713647967
yzjhlt.cyou/ Name: O9cz_2132_sid
Value: Xk3QLk
yzjhlt.cyou/ Name: O9cz_2132_lastact
Value: 1713651568%09member.php%09logging

16 Console Messages

Source Level URL
Text
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 13)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://yzjhlt.cyou/data/cache/style_5_common.css?JML'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 13)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://yzjhlt.cyou/data/cache/style_5_member_logging.css?JML'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure script 'http://yzjhlt.cyou/static/js/common.js?JML'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 18)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://yzjhlt.cyou/template/the_c_style/images/css/font-awesome.min.css?JML'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure script 'http://yzjhlt.cyou/template/the_c_style/images/js/jquery-1.7.1.min.js?JML'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 74)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://yzjhlt.cyou/source/plugin/sunju_facemall/public/css/sunju_face.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure script 'http://yzjhlt.cyou/source/plugin/sunju_facemall/public/sunju_face.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 74)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://yzjhlt.cyou/template/comiis_app/comiis/comiis_flxx/comiis_pcflxx.css'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 114)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://yzjhlt.cyou/member.php?mod=logging&action=login&loginsubmit=yes&loginhash=LWd17'. This endpoint should be made available over a secure connection.
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure script 'http://yzjhlt.cyou/static/js/md5.js?JML'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 167)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://yzjhlt.cyou/member.php?mod=lostpasswd&lostpwsubmit=yes&infloat=yes'. This endpoint should be made available over a secure connection.
security warning URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 211)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure element 'http://yzjhlt.club/img/bg20.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 211)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure element 'http://yzjhlt.cyou/source/plugin/bon_cursor/static/14/normal.cur'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php(Line 211)
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure element 'http://yzjhlt.cyou/source/plugin/bon_cursor/static/14/link.cur'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Message:
Mixed Content: The page at 'https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php' was loaded over HTTPS, but requested an insecure script 'http://yzjhlt.cyou/home.php?mod=misc&ac=sendmail&rand=1713651568'. This request has been blocked; the content must be served over HTTPS.
recommendation verbose URL: https://yzjhlt.cyou/member.php?mod=logging&action=login&referer=http%3A%2F%2Fyzjhlt.cyou%2Findex.php
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

yzjhlt.club
yzjhlt.cyou
yzjhlt.club
yzjhlt.cyou
172.67.183.254
520603ee0ac5f38557137370a0f7464b8e0f0a859a755bcb44eab15f12b1b6e3
df50045a01ed33e65bb8953dc30960ba0f6610e3ff10e4f104b79f4f4b9acae5
edf517d16a3f9de1aff7513d4d4610bdb40a380fc087b4da509d223694eeddf4