Report - 1800insuranceformyauto.com/spider.zip

Report Overview

Submitted URL
1800insuranceformyauto.com/spider.zip
IP
45.33.243.184
ASN
#26658 HENGTONG-IDC-LLC
Submitted
2024-04-16 20:16:36
Access
public
Website Title
湘西缆欢电子科技有限公司
Final URL
www.1800insuranceformyauto.com/spider.zip
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.1800insuranceformyauto.com	unknown	2024-04-05	2020-08-03	2024-04-16	1.5 kB	3.3 kB	45.33.243.184
push.zhanzhang.baidu.com	57139	1999-10-11	2015-07-22	2024-04-16	339 B	750 B	180.101.212.103
api.tongjiniao.com	unknown	2022-12-22	2023-02-01	2024-04-15	1.7 kB	9.5 kB	43.248.140.176
api.share.baidu.com	44629	1999-10-11	2013-04-25	2024-04-15	405 B	114 B	112.34.113.148
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-04-16	2.4 kB	24 kB	111.45.3.198
1800insuranceformyauto.com	unknown	unknown	No data	No data	407 B	212 B	45.33.243.184

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	tongjiniao.com	Sinkholed
2024-04-16	medium	tongjiniao.com	Sinkholed
2024-04-16	medium	tongjiniao.com	Sinkholed
2024-04-16	medium	tongjiniao.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (16)

	URL	Size	First Seen	Last Seen
	push.zhanzhang.baidu.com/push.js	281 B	2023-03-07	2024-04-29
Pretty URL push.zhanzhang.baidu.com/push.js IP 180.101.212.103 ASN #134770 CHINANET Jiangsu province Suzhou taihu IDC network Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:09 Last Seen2024-04-29 16:26:21 Times Seen19069 Hash 1bb5a3267c9865ad4abe8d937734b62b b5478dd2edb3e64242eced1db2dbd945ef81f592 674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2 Loading...

	api.tongjiniao.com/c?_=630381606453088256	11 kB	2024-04-16	2024-04-16
Pretty URL api.tongjiniao.com/c?_=630381606453088256 IP 43.248.140.176 ASN #23650 AS Number for CHINANET jiangsu province backbone Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-16 22:16:48 Last Seen2024-04-16 22:16:48 Times Seen2 Hash 0cd93774e0021fd87f80ab645bbe530f 80961b4cdb7e239f7f3dfe10382ecfc007f13673 e1f5e3db6ca49697c60f73b74708970a9998e3d87e457793ec4ce4bec40a1d62 Loading...

	hm.baidu.com/hm.js?d0bc6791416670d8f4ffa83c8563e7dc	30 kB	2024-04-16	2024-04-16
Pretty URL hm.baidu.com/hm.js?d0bc6791416670d8f4ffa83c8563e7dc IP 111.45.3.198 ASN #56040 China Mobile communications corporation Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-16 22:16:48 Last Seen2024-04-16 22:16:48 Times Seen2 Hash fcc3c5afcb8e98754c977c69ce734727 8c563c29b117ee74c1d07ab2cdfe4041711bb7e2 4ec13def0900dbea4e2d4932fbe4a3c5570c73d2f73359cb897faf9221addab9 Loading...

	hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e	30 kB	2024-04-16	2024-04-16
Pretty URL hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e IP 111.45.3.198 ASN #56040 China Mobile communications corporation Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-16 22:16:48 Last Seen2024-04-16 22:16:48 Times Seen2 Hash bb4ff5114b161dd8f2adfe3c94af5367 6b56e9636f867fa35afd0ce69b28044e3e1f7749 91e65a618fadc372689ab52c4cd7a611ebc1b93ea74a3a30af1e3823a435391b Loading...

	unknown	37 B	2023-04-11	2024-04-29
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49:14 Last Seen2024-04-29 19:52:17 Times Seen22027 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	unknown	333 B	2024-03-29	2024-04-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 06:37:47 Last Seen2024-04-29 13:51:05 Times Seen24 Hash 7494754b31e88980fca87798503abf9a 245b16f6f2c83bf66dce1599bad53f10725874a3 d025205f783ea5f72115f61cfa682d9abb01e2afcf2965b0daa4aee3c0ac962c Loading...

	unknown	333 B	2024-04-16	2024-04-16
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-16 09:16:23 Last Seen2024-04-16 22:16:48 Times Seen4 Hash ded1647b3541f91d9a4eddde835f8ee8 c79a493b8b8a7e701b8aa2d30c7e1e7005d8fb1a 89e4332829eb692e297221606fa969639cf7db8d26cb07a01b84a9d5c91ccc58 Loading...

	api.tongjiniao.com/c?_=636954379104690176	11 kB	2024-04-16	2024-04-16
Pretty URL api.tongjiniao.com/c?_=636954379104690176 IP 43.248.140.176 ASN #23650 AS Number for CHINANET jiangsu province backbone Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-16 22:16:48 Last Seen2024-04-16 22:16:48 Times Seen2 Hash 1d2a400f9cdecb57e3c7efbe88da1110 e676f16ea50bd365714a22dc104a73bceaa35497 3a758bd49e4efc5f9c5077310e343f140534346a607b7f4108004a8cc9292179 Loading...

	www.1800insuranceformyauto.com/tj.js	1.7 kB	2024-04-16	2024-04-16
Pretty URL www.1800insuranceformyauto.com/tj.js IP 45.33.243.184 ASN #26658 HENGTONG-IDC-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-16 09:16:23 Last Seen2024-04-16 22:16:48 Times Seen8 Hash ac8a600451d09a087130a7240f417572 7811c853054712605e2c35293c3429dd95eb2a6a 14fbdee70ebc44bd57bfd66a417ad59660bcc4790b068447239731a7dda4a10d Loading...

	www.1800insuranceformyauto.com/common.js	0 B	2023-03-07	2024-04-29
Pretty URL www.1800insuranceformyauto.com/common.js IP 45.33.243.184 ASN #26658 HENGTONG-IDC-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-29 22:23:23 Times Seen37190938 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	26 B	2023-04-11	2024-04-29
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:13:06 Last Seen2024-04-29 20:44:56 Times Seen115977 Hash 1c862db5f2555377c2dc1e62ed7b3981 c29e6dc25c08a70995127ec13ded6f80d9a36174 27d373a6961f797edf69a80f7f24877ef85c2fc4f9f770b2540b1bf5e66823ac Loading...

	unknown	379 B	2024-04-16	2024-04-16
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-16 22:16:48 Last Seen2024-04-16 22:16:48 Times Seen1 Hash be09be7413b0a1fe8caaa194960a666e b359c23fe3fd63b907220e23d306caa4ef6120ed db803640b36f2bb7a94453afe7d56b2d715f2e67f834b353d64273ba3771252c Loading...

	www.1800insuranceformyauto.com/spider.zip	0 B	2023-03-07	2024-04-29
Pretty URL www.1800insuranceformyauto.com/spider.zip IP 45.33.243.184 ASN #26658 HENGTONG-IDC-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-29 22:23:23 Times Seen37190938 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	378 B	2024-04-16	2024-04-16
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-16 22:16:48 Last Seen2024-04-16 22:16:48 Times Seen1 Hash 4a9e99ce3471670354cf1571e36aebbe d8643cbdc4760eb8466e71a3787cb392c4071d40 5d778980262d2ea11a53c6f261f99371c94622962aaaf37da7d2b6fe8f672b25 Loading...

		Size	First Seen	Last Seen
	#1 Write - 8c442a03b2abb20ec370e9ffc44a0b9e	331 B	2024-03-29	2024-04-29
Pretty Observations First Seen2024-03-29 06:37:47 Last Seen2024-04-29 13:51:06 Times Seen24 Hash 8c442a03b2abb20ec370e9ffc44a0b9e 97db7d0e99221a27051b38830eb9a7956109afea 0b6a1c081072a7b9ae86ed75598f82ad1b74f6b6471b981ac170beea6038fb0c Loading...

	#2 Write - e924c2e476833bc7d7d1a4df14a7e1f1	331 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 09:16:23 Last Seen2024-04-16 22:16:48 Times Seen4 Hash e924c2e476833bc7d7d1a4df14a7e1f1 a71841f4c10fe99460b00dc8fb0281d987ab9158 a625a11ba1c785d50294056f2186a38bedecdd59551d24f3f7f91b4d32bcc663 Loading...

HTTP Transactions (15)

URL IP Response Size

1800insuranceformyauto.com/spider.zip

45.33.243.184

301 Moved Permanently

0 B

URL User Request GET HTTP/1.1
1800insuranceformyauto.com/spider.zip
IP
45.33.243.184:80
ASN
#26658 HENGTONG-IDC-LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /spider.zip HTTP/1.1
Host: 1800insuranceformyauto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 16 Apr 2024 20:16:14 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Location: http://www.1800insuranceformyauto.com/spider.zip

www.1800insuranceformyauto.com/spider.zip

45.33.243.184

200 OK

785 B

URL User Request GET HTTP/1.1
www.1800insuranceformyauto.com/spider.zip
IP
45.33.243.184:80
ASN
#26658 HENGTONG-IDC-LLC

File type
JavaScript source, ISO-8859 text, with CRLF line terminators
Size
785 B (785 bytes)
Hash
d62ed84f94c8d937e9278848b9eff57e
9e024f7cf1520e55d600e903ba676b1059276e9c
96a40ccdf79f2b54de247389816b0c20fa2b3a32b56834b1d460d637a9355a28

HTTP Headers

GET /spider.zip HTTP/1.1
Host: www.1800insuranceformyauto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:15 GMT
Content-Type: text/html
Content-Length: 785
Connection: keep-alive

www.1800insuranceformyauto.com/tj.js

45.33.243.184

200 OK

600 B

URL GET HTTP/1.1
www.1800insuranceformyauto.com/tj.js
IP
45.33.243.184:80
ASN
#26658 HENGTONG-IDC-LLC

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
JavaScript source, ASCII text, with very long lines (363), with CRLF line terminators
Size
600 B (600 bytes)
Hash
ac8a600451d09a087130a7240f417572
7811c853054712605e2c35293c3429dd95eb2a6a
14fbdee70ebc44bd57bfd66a417ad59660bcc4790b068447239731a7dda4a10d

HTTP Headers

GET /tj.js HTTP/1.1
Host: www.1800insuranceformyauto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/spider.zip
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:15 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

www.1800insuranceformyauto.com/common.js

45.33.243.184

200 OK

0 B

URL GET HTTP/1.1
www.1800insuranceformyauto.com/common.js
IP
45.33.243.184:80
ASN
#26658 HENGTONG-IDC-LLC

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /common.js HTTP/1.1
Host: www.1800insuranceformyauto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/spider.zip
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:16 GMT
Content-Type: application/x-javascript
Content-Length: 0
Connection: keep-alive

push.zhanzhang.baidu.com/push.js

180.101.212.103

200 OK

227 B

URL GET HTTP/1.1
push.zhanzhang.baidu.com/push.js
IP
180.101.212.103:80
ASN
#134770 CHINANET Jiangsu province Suzhou taihu IDC network

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
ASCII text, with no line terminators
Size
227 B (227 bytes)
Hash
1bb5a3267c9865ad4abe8d937734b62b
b5478dd2edb3e64242eced1db2dbd945ef81f592
674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2

HTTP Headers

GET /push.js HTTP/1.1
Host: push.zhanzhang.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Encoding: gzip
Content-Length: 227
Content-Type: text/javascript
Date: Tue, 16 Apr 2024 20:16:13 GMT
Etag: "4078521116"
Expires: Wed, 16 Apr 2025 20:16:13 GMT
Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: apache
Set-Cookie: BAIDUID=B64EA69DFC57A904C35BA46CECD856D7:FG=1; max-age=31536000; expires=Wed, 16-Apr-25 20:16:13 GMT; domain=.baidu.com; path=/; version=1
Vary: Accept-Encoding

www.1800insuranceformyauto.com/favicon.ico

45.33.243.184

200 OK

1.2 kB

URL GET HTTP/1.1
www.1800insuranceformyauto.com/favicon.ico
IP
45.33.243.184:80
ASN
#26658 HENGTONG-IDC-LLC

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
7ef1f0a0093460fe46bb691578c07c95
2da3ffbbf4737ce4dae9488359de34034d1ebfbd
4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.1800insuranceformyauto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/spider.zip
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:16 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT
Connection: keep-alive
ETag: "4e0d81df-47e"
Expires: Sun, 21 Apr 2024 20:16:16 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes

api.tongjiniao.com/c?_=636954379104690176

43.248.140.176

3.9 kB

URL GET
api.tongjiniao.com/c?_=636954379104690176
IP
43.248.140.176:0
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
3.9 kB (3885 bytes)
Hash
1d2a400f9cdecb57e3c7efbe88da1110
e676f16ea50bd365714a22dc104a73bceaa35497
3a758bd49e4efc5f9c5077310e343f140534346a607b7f4108004a8cc9292179

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /c?_=636954379104690176 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:13 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 3885
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.tongjiniao.com/c?_=630381606453088256

43.248.140.176

3.9 kB

URL GET
api.tongjiniao.com/c?_=630381606453088256
IP
43.248.140.176:0
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
3.9 kB (3886 bytes)
Hash
0cd93774e0021fd87f80ab645bbe530f
80961b4cdb7e239f7f3dfe10382ecfc007f13673
e1f5e3db6ca49697c60f73b74708970a9998e3d87e457793ec4ce4bec40a1d62

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /c?_=630381606453088256 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:13 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 3886
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.share.baidu.com/s.gif?l=http://www.1800insuranceformyauto.com/spider.zip

112.34.113.148

200 OK

0 B

URL GET HTTP/1.1
api.share.baidu.com/s.gif?l=http://www.1800insuranceformyauto.com/spider.zip
IP
112.34.113.148:80
ASN
#9808 China Mobile Communications Group Co., Ltd.

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /s.gif?l=http://www.1800insuranceformyauto.com/spider.zip HTTP/1.1
Host: api.share.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Tue, 16 Apr 2024 20:16:14 GMT

hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e

111.45.3.198

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?0b22e3ab72a30f15311e5dc5950f263e
IP
111.45.3.198:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.1800insuranceformyauto.com/spider.zip
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (620)
Size
11 kB (11258 bytes)
Hash
bb4ff5114b161dd8f2adfe3c94af5367
6b56e9636f867fa35afd0ce69b28044e3e1f7749
91e65a618fadc372689ab52c4cd7a611ebc1b93ea74a3a30af1e3823a435391b

HTTP Headers

GET /hm.js?0b22e3ab72a30f15311e5dc5950f263e HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11258
Content-Type: application/javascript
Date: Tue, 16 Apr 2024 20:16:14 GMT
Etag: b24661129fc3b56b1646b19b7d237068
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=95C50CF1DD0EEDEA; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.js?d0bc6791416670d8f4ffa83c8563e7dc

111.45.3.198

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?d0bc6791416670d8f4ffa83c8563e7dc
IP
111.45.3.198:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.1800insuranceformyauto.com/spider.zip
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (621)
Size
11 kB (11259 bytes)
Hash
fcc3c5afcb8e98754c977c69ce734727
8c563c29b117ee74c1d07ab2cdfe4041711bb7e2
4ec13def0900dbea4e2d4932fbe4a3c5570c73d2f73359cb897faf9221addab9

HTTP Headers

GET /hm.js?d0bc6791416670d8f4ffa83c8563e7dc HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11259
Content-Type: application/javascript
Date: Tue, 16 Apr 2024 20:16:14 GMT
Etag: 90b36dd68d425fbfc6a90e299f9fc2b5
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=A76ADBAB7265FF98; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

api.tongjiniao.com/r?t=1713298573&p=638954290046660608

43.248.140.176

200 OK

58 B

URL POST HTTP/1.1
api.tongjiniao.com/r?t=1713298573&p=638954290046660608
IP
43.248.140.176:80
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
JSON text data
Size
58 B (58 bytes)
Hash
f6f0534758356f644786f03d9912b271
de49a584515e2637c727595652f99c78386ff7d4
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /r?t=1713298573&p=638954290046660608 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 611
Origin: http://www.1800insuranceformyauto.com
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:14 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

api.tongjiniao.com/r?t=1713298573&p=638954290042445824

43.248.140.176

200 OK

58 B

URL POST HTTP/1.1
api.tongjiniao.com/r?t=1713298573&p=638954290042445824
IP
43.248.140.176:80
ASN
#23650 AS Number for CHINANET jiangsu province backbone

Requested by
http://www.1800insuranceformyauto.com/spider.zip

File type
JSON text data
Size
58 B (58 bytes)
Hash
f6f0534758356f644786f03d9912b271
de49a584515e2637c727595652f99c78386ff7d4
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /r?t=1713298573&p=638954290042445824 HTTP/1.1
Host: api.tongjiniao.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 611
Origin: http://www.1800insuranceformyauto.com
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 16 Apr 2024 20:16:14 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
Cache-Control: no-cache,no-store, no-cache

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=2089661739&si=d0bc6791416670d8f4ffa83c8563e7dc&v=1.3.0&lv=1&sn=17070&r=0&ww=1280&u=http%3A%2F%2Fwww.1800insuranceformyauto.com%2Fspider.zip&tt=%E6%B9%98%E8%A5%BF%E7%BC%86%E6%AC%A2%E7%94%B5%E5%AD%90%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

111.45.3.198

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=2089661739&si=d0bc6791416670d8f4ffa83c8563e7dc&v=1.3.0&lv=1&sn=17070&r=0&ww=1280&u=http%3A%2F%2Fwww.1800insuranceformyauto.com%2Fspider.zip&tt=%E6%B9%98%E8%A5%BF%E7%BC%86%E6%AC%A2%E7%94%B5%E5%AD%90%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
111.45.3.198:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.1800insuranceformyauto.com/spider.zip
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=2089661739&si=d0bc6791416670d8f4ffa83c8563e7dc&v=1.3.0&lv=1&sn=17070&r=0&ww=1280&u=http%3A%2F%2Fwww.1800insuranceformyauto.com%2Fspider.zip&tt=%E6%B9%98%E8%A5%BF%E7%BC%86%E6%AC%A2%E7%94%B5%E5%AD%90%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 16 Apr 2024 20:16:15 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=F89D21901C266755; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=944702456&si=0b22e3ab72a30f15311e5dc5950f263e&v=1.3.0&lv=1&sn=17070&r=0&ww=1280&u=http%3A%2F%2Fwww.1800insuranceformyauto.com%2Fspider.zip&tt=%E6%B9%98%E8%A5%BF%E7%BC%86%E6%AC%A2%E7%94%B5%E5%AD%90%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

111.45.3.198

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=944702456&si=0b22e3ab72a30f15311e5dc5950f263e&v=1.3.0&lv=1&sn=17070&r=0&ww=1280&u=http%3A%2F%2Fwww.1800insuranceformyauto.com%2Fspider.zip&tt=%E6%B9%98%E8%A5%BF%E7%BC%86%E6%AC%A2%E7%94%B5%E5%AD%90%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
111.45.3.198:443
ASN
#56040 China Mobile communications corporation

Requested by
http://www.1800insuranceformyauto.com/spider.zip
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=944702456&si=0b22e3ab72a30f15311e5dc5950f263e&v=1.3.0&lv=1&sn=17070&r=0&ww=1280&u=http%3A%2F%2Fwww.1800insuranceformyauto.com%2Fspider.zip&tt=%E6%B9%98%E8%A5%BF%E7%BC%86%E6%AC%A2%E7%94%B5%E5%AD%90%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://www.1800insuranceformyauto.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 16 Apr 2024 20:16:15 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=70E5D50BD1CBDE42; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (16)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash