Submitted URL: http://url.i4.cn/JBrQBjaa?pcver=7.26.003
Effective URL: http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003
Submission Tags: falconsandbox
Submission: On December 20 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 1 HTTP transactions. The main IP is 163.171.132.115, located in Germany and belongs to QUANTILNETWORKS, US. The main domain is d.updater.i4.cn. The Cisco Umbrella rank of the primary domain is 451857.
This is the only time d.updater.i4.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 47.99.89.159 37963 (ALIBABA-C...)
1 163.171.132.115 54994 (QUANTILNE...)
1 2
Apex Domain
Subdomains
Transfer
2 i4.cn
url.i4.cn — Cisco Umbrella Rank: 315088
d.updater.i4.cn — Cisco Umbrella Rank: 451857
931 B
1 1
Domain Requested by
1 d.updater.i4.cn
1 url.i4.cn 1 redirects
1 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003
Frame ID: C3BB046D9BB91B12475D8F8A7C68E812
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://url.i4.cn/JBrQBjaa?pcver=7.26.003 HTTP 302
    http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003 Page URL

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

2
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://url.i4.cn/JBrQBjaa?pcver=7.26.003 HTTP 302
    http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request config_20170510.xml
d.updater.i4.cn/i4tools7/configs/auth_urls/
Redirect Chain
  • http://url.i4.cn/JBrQBjaa?pcver=7.26.003
  • http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003
120 B
674 B
Document
General
Full URL
http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003
Protocol
HTTP/1.1
Server
163.171.132.115 , Germany, ASN54994 (QUANTILNETWORKS, US),
Reverse DNS
Software
WS-web-server /
Resource Hash
5de66f97e0363ea2482ebe1d71ec61340b0aa81711869adbfc2653afd234adf8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/xml;charset=UTF-8
Date
Tue, 20 Dec 2022 01:36:00 GMT
ETag
W/"FguAlczaD0DvAmUsnjM3SiZV7udL"
Last-Modified
Mon, 20 Jun 2022 08:14:23 GMT
Server
WS-web-server
Transfer-Encoding
chunked
X-Reqid
203122119924332320221218195636DG25DVlisampled
X-Via
1.1 x111:4 (Cdn Cache Server V2.0)[146 200 2], 1.1 PS-FOC-01Wpj183:5 (Cdn Cache Server V2.0)[50 200 0], 1.1 PSdgflkfFRA2od64:0 (Cdn Cache Server V2.0)[571 200 2]
X-Ws-Request-Id
63a11180_PSdgflkfFRA2hf68_13692-24986

Redirect headers

Connection
keep-alive
Content-Language
zh-CN
Content-Length
0
Date
Tue, 20 Dec 2022 01:35:59 GMT
Location
http://d.updater.i4.cn/i4tools7/configs/auth_urls/config_20170510.xml?pcver=7.26.003
Server
nginx/1.15.7
truncated
/
112 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7a9ebfb7c3ecda0476f5c7350a344469673eb940d967b3bf40054fe667570f0a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://d.updater.i4.cn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d.updater.i4.cn
url.i4.cn
163.171.132.115
47.99.89.159
5de66f97e0363ea2482ebe1d71ec61340b0aa81711869adbfc2653afd234adf8
7a9ebfb7c3ecda0476f5c7350a344469673eb940d967b3bf40054fe667570f0a