urlscan.io logo urlscan.io
SecurityTrails logo

www.hpa.org.cn Open in urlscan Pro
211.149.241.147  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.ly/aNlcT
Effective URL: http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
Submission: On August 27 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 211.149.241.147, located in China and belongs to CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN. The main domain is www.hpa.org.cn.
This is the only time www.hpa.org.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 172.67.75.122 13335 (CLOUDFLAR...)
3 211.149.241.147 38283 (CHINANET-...)
4 2
Apex Domain
Subdomains		 Transfer
3 hpa.org.cn
www.hpa.org.cn
10 KB
1 t.ly
t.ly — Cisco Umbrella Rank: 150500
1 KB
0 jdevcloud.com Failed
syrvk.jdevcloud.com Failed
4 3
Domain Requested by
3 www.hpa.org.cn www.hpa.org.cn
1 t.ly 1 redirects
0 syrvk.jdevcloud.com Failed
4 3

This site contains links to these domains. Also see Links.

Domain
syrvk.jdevcloud.com
Subject Issuer Validity Valid

This page contains 1 frames:

Frame: https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
Frame ID: 2290FC98A1CE499EF0E1AC15D2B6BF47
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

automatically jump after 5 seconds...

Page URL History Show full URLs

  1. https://t.ly/aNlcT HTTP 302
    http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

10 kB
Transfer

24 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.ly/aNlcT HTTP 302
    http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request goto.php
www.hpa.org.cn/
Redirect Chain
  • https://t.ly/aNlcT
  • http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
1006 B
953 B 		Document
General
Check archive.org
Download Go to
Full URL
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
Protocol
HTTP/1.1
Server
211.149.241.147 , China, ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 / PHP/5.4.28 ASP.NET
Resource Hash
4c59044ffde7007b10ac33bcc48200913c8e899e20b0c088be6f3315ab683ef7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Content-Encoding
gzip
Content-Length
714
Content-Type
text/html;charset=utf-8
Date
Sun, 27 Aug 2023 23:39:03 GMT
Server
Microsoft-IIS/8.5
Vary
Accept-Encoding
X-Powered-By
PHP/5.4.28 ASP.NET

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
7fd826cc6b5e4ffc-MEL
content-type
text/html; charset=UTF-8
date
Sun, 27 Aug 2023 23:39:02 GMT
location
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gJGZ8Z%2B1xkVj%2BmUmAvHS7oS9ZsyRdLa568Ftm02EhWAqi1KxL948QjMh1SkGVQFhzUSyc5ctcfSF%2FLKXtc9llosvubT98Nt51C8eG%2B%2FKRRnAUJZDBKM%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-whom
tly-1
x-xss-protection
1; mode=block
style.css
www.hpa.org.cn/public/en/css/ 		21 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.hpa.org.cn/public/en/css/style.css
Requested by
Host: www.hpa.org.cn
URL: http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
Protocol
HTTP/1.1
Server
211.149.241.147 , China, ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
fade191d7dc6cf97bd6794ef3e579fd1fb1b3be598ccae7236c000ba77626d8c

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sun, 27 Aug 2023 23:39:04 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Jan 2021 03:11:12 GMT
Server
Microsoft-IIS/8.5
ETag
"968d28bf59e9d61:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
6806
loading.gif
www.hpa.org.cn/public/dialog/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.hpa.org.cn/public/dialog/loading.gif
Requested by
Host: www.hpa.org.cn
URL: http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
Protocol
HTTP/1.1
Server
211.149.241.147 , China, ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
5af5f042cb4b1cdbe1f108b8f339cb5830bb36685249b0c02a9b7e13bf460ac6

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://www.hpa.org.cn/goto.php?url=https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sun, 27 Aug 2023 23:39:04 GMT
Last-Modified
Sat, 18 Aug 2012 13:43:31 GMT
Server
Microsoft-IIS/8.5
ETag
"303ba74477dcd1:0"
X-Powered-By
ASP.NET
Content-Type
image/gif
Accept-Ranges
bytes
Content-Length
1922
U6fffCswSQQQr7.php
syrvk.jdevcloud.com/ffg3FGRZxdfZQ/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
syrvk.jdevcloud.com
URL
https://syrvk.jdevcloud.com/ffg3FGRZxdfZQ/U6fffCswSQQQr7.php?e=YTRD66767eseDF

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
t.ly/ Name: XSRF-TOKEN
Value: eyJpdiI6IlI2c0tJQlRBQUh0RHQ2T0FrV3F2bkE9PSIsInZhbHVlIjoidVUzR1ZwVmZacjd3S0o4UjRUODVReHpvelIvcjlYa0JNTXp0K3pQaTE4WmlpcVBPcDFQdElRU1dFWENkQ2tWOEtZcVpRVjZRbnV5MlNlMkt4NFRCMERFaWp5Ukc0ZEtmUFY5WmF2QVRxbVJ3U2J3Wks1TXVXaXJnUE5DN1dhSksiLCJtYWMiOiIzM2IzYWI2ZDVkOGI3ODAzNDhiMTlkZTZkNDdjYzY2MWRmMDEwMDVjZjVjODlmM2RjZmJjZjBiZTU3M2Q3MDYwIiwidGFnIjoiIn0%3D
t.ly/ Name: tly_session
Value: eyJpdiI6InRxajhlbVBoZG5nSlVqWnI5MUZHVnc9PSIsInZhbHVlIjoiWTJxUis0S0JnWk9XbGFlTGtVd0dGOEFVQm9EUmU4VzkrbjB2ZlFmWGdYZFZvV1hhOFhydDlMUnVqUWwvUm9Gb2ZzZXU2U2RZTWRJbk5ReHVCekNldkRKd2phOHZzbExrRkQ2czFVTXRHam0zUExnbThaQm55NHFEc0R6YnpWVCsiLCJtYWMiOiI2YTAzMzM3ZTViN2IzM2EwOTAwZTc3ZGQ2NDE3MDUyZTcyZWM1NTg5MWQ2NzA2OTNkYTFmYjY2N2UyZTZkM2MxIiwidGFnIjoiIn0%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

syrvk.jdevcloud.com
t.ly
www.hpa.org.cn
syrvk.jdevcloud.com
172.67.75.122
211.149.241.147
4c59044ffde7007b10ac33bcc48200913c8e899e20b0c088be6f3315ab683ef7
5af5f042cb4b1cdbe1f108b8f339cb5830bb36685249b0c02a9b7e13bf460ac6
fade191d7dc6cf97bd6794ef3e579fd1fb1b3be598ccae7236c000ba77626d8c