Report - 121.36.202.172:8000/?kanqiu.xyz

Report Overview

Submitted URL
121.36.202.172:8000/?kanqiu.xyz
IP
121.36.202.172
ASN
#55990 Huawei Cloud Service data center
Submitted
2024-04-24 07:16:19
Access
public
Website Title
输入密码访问
Final URL
121.36.202.172:5002/?kanqiu.xyz
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
sdk.51.la	88367	2005-01-17	2021-03-08	2024-04-22	323 B	14 kB	47.246.44.203
res.cloudflareip.com	unknown	unknown	No data	No data	1.3 kB	13 kB	117.68.52.41
121.36.202.172:8000	unknown	unknown	No data	No data	401 B	270 B	121.36.202.172
121.36.202.172:5002	unknown	unknown	No data	No data	758 B	2.9 kB	121.36.202.172

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	121.36.202.172	Sinkholed
2024-04-24	medium	121.36.202.172	Sinkholed
2024-04-24	medium	121.36.202.172	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (8)

URL IP Response Size

121.36.202.172:8000/?kanqiu.xyz

121.36.202.172

302 Found

23 B

URL User Request GET HTTP/1.1
121.36.202.172:8000/?kanqiu.xyz
IP
121.36.202.172:8000
ASN
#55990 Huawei Cloud Service data center

File type
HTML document, ASCII text
Size
23 B (23 bytes)
Hash
f8374e6a1cf9f6b502493ea24330a1ee
3218b4b02dc2a7e5aafe9708ad286611d93c895d
b109239e78dca03f5721ba81cb876628e371b024164709d05099d45cd8facde6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?kanqiu.xyz HTTP/1.1
Host: 121.36.202.172:8000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx/1.15.11
Date: Wed, 24 Apr 2024 07:15:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.4
Location: http://121.36.202.172:5002/?kanqiu.xyz

121.36.202.172:5002/?kanqiu.xyz

121.36.202.172

200 OK

2.7 kB

URL User Request GET HTTP/1.1
121.36.202.172:5002/?kanqiu.xyz
IP
121.36.202.172:5002
ASN
#55990 Huawei Cloud Service data center

File type
HTML document, Unicode text, UTF-8 text, with very long lines (310), with CRLF line terminators
Size
2.7 kB (2733 bytes)
Hash
194cb341d3a11ba901fdcbaf7941854a
139a3c79d33541acece7bbf1a868b1205aee7321
b7d77665cad1ae6c2421578e34475e5142b2c471183e3f7d4eab61b6cb161d56

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?kanqiu.xyz HTTP/1.1
Host: 121.36.202.172:5002
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.15.11
Date: Wed, 24 Apr 2024 07:15:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.4

sdk.51.la/js-sdk-pro.min.js

47.246.44.203

200 OK

13 kB

URL GET HTTP/1.1
sdk.51.la/js-sdk-pro.min.js
IP
47.246.44.203:80
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
http://121.36.202.172:5002/?kanqiu.xyz

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (34110)
Size
13 kB (12846 bytes)
Hash
24bb520e9517f2ed3ed987b46aeaf723
846723563d7dd2bff3954f93633b11af0103adc8
d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27

HTTP Headers

GET /js-sdk-pro.min.js HTTP/1.1
Host: sdk.51.la
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://121.36.202.172:5002/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 12846
Connection: keep-alive
Date: Wed, 17 Apr 2024 02:56:06 GMT
x-oss-request-id: 661F3A46A554993430118686
x-oss-cdn-auth: success
Accept-Ranges: bytes
x-oss-object-type: Normal
x-oss-storage-class: Standard
Content-MD5: JLtSDpUX8u0+2Ye0aur3Iw==
x-oss-server-time: 3
Ali-Swift-Global-Savetime: 1713322566
Via: cache15.l2de2[0,0,304-0,H], cache6.l2de2[0,0], ens-cache18.se2[0,0,200-0,H], ens-cache18.se2[1,0]
Vary: Accept-Encoding
Last-Modified: Thu, 08 Jun 2023 02:24:34 GMT
x-oss-hash-crc64ecma: 5143829838470429443
Content-Encoding: gzip
Age: 620390
X-Cache: HIT TCP_MEM_HIT dirn:10:322730086
X-Swift-SaveTime: Wed, 17 Apr 2024 02:56:06 GMT
X-Swift-CacheTime: 1296000
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
EagleId: 2ff62ca617139429564251615e

res.cloudflareip.com/layer.css

117.68.52.41

200 OK

2.8 kB

URL GET HTTP/1.1
res.cloudflareip.com/layer.css
IP
117.68.52.41:80
ASN
#134425 China Telecom

Requested by
http://121.36.202.172:5002/?kanqiu.xyz

File type
ASCII text, with very long lines (14271), with no line terminators
Size
2.8 kB (2804 bytes)
Hash
c234eb06d5f32055092294e78957f17d
f15ee0bcb9694f32f5e1d524f2653aa0dd043402
5cdf3edb27b0c9f8e48918c486e9ae65a9e5beab806b64c4a7bc5bac53c0f540

HTTP Headers

GET /layer.css HTTP/1.1
Host: res.cloudflareip.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://121.36.202.172:5002/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Wed, 24 Apr 2024 07:15:58 GMT
Content-Type: text/css
Content-Length: 2804
Connection: keep-alive
Last-Modified: Sun, 24 Mar 2024 08:32:34 GMT
ETag: "FvFe4Ly5aU8y9eHVJPJlOqDdBDQC.gz"
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Age: 63759
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Log, X-Reqid
Access-Control-Max-Age: 2592000
Content-Disposition: inline; filename="layer.css"; filename*=utf-8''layer.css
Content-Md5: wjTrBtXzIFUJIpTniVfxfQ==
Content-Transfer-Encoding: binary
Vary: Accept-Encoding
X-Log: X-Log
X-M-Log: QNM:xs1176;QNM3
X-M-Reqid: aCwAAGH4QuM6sr8X
X-Qiniu-Zone: 0
X-Qnm-Cache: Hit
X-Reqid: CeUAAADoSzwUsr8X
X-Svr: IO
Ohc-Global-Saved-Time: Tue, 23 Apr 2024 12:09:46 GMT
Ohc-Cache-HIT: hfct68 [2]
Ohc-File-Size: 2804
X-Cache-Status: HIT

res.cloudflareip.com/layer.js

117.68.52.41

200 OK

7.9 kB

URL GET HTTP/1.1
res.cloudflareip.com/layer.js
IP
117.68.52.41:80
ASN
#134425 China Telecom

Requested by
http://121.36.202.172:5002/?kanqiu.xyz

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (22680), with CRLF line terminators
Size
7.9 kB (7897 bytes)
Hash
b4a07ebd1e78576d03052a287de2a939
83e7183990e32ec734e330d5ddba9bcb3278d31c
439a7f54e8c4ab2d9d9e5d85d4d3b16b73f7d50f456cb791ae8440b1946cc84f

HTTP Headers

GET /layer.js HTTP/1.1
Host: res.cloudflareip.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://121.36.202.172:5002/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Wed, 24 Apr 2024 07:15:58 GMT
Content-Type: text/javascript
Content-Length: 7897
Connection: keep-alive
Last-Modified: Sun, 24 Mar 2024 08:32:34 GMT
ETag: "FoPnGDmQ4y7HNOMw1d26m8syeNMc.gz"
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Age: 68834
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Log, X-Reqid
Access-Control-Max-Age: 2592000
Content-Disposition: inline; filename="layer.js"; filename*=utf-8''layer.js
Content-Md5: tKB+vR54V20DBSoofeKpOQ==
Content-Transfer-Encoding: binary
Vary: Accept-Encoding
X-Log: X-Log
X-M-Log: QNM:xs1181;QNM3
X-M-Reqid: dygAAAh3i906sr8X
X-Qiniu-Zone: 0
X-Qnm-Cache: Hit
X-Reqid: FukAAACHM2_Tsb8X
X-Svr: IO
Ohc-Global-Saved-Time: Tue, 23 Apr 2024 12:05:09 GMT
Ohc-Cache-HIT: hfct60 [2]
Ohc-File-Size: 7897
X-Cache-Status: HIT

121.36.202.172:5002/2e.png

0.0.0.0

0 B

URL GET
121.36.202.172:5002/2e.png
IP
0.0.0.0:0
ASN
#0

Requested by
http://121.36.202.172:5002/?kanqiu.xyz

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2e.png HTTP/1.1
Host: 121.36.202.172:5002
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://121.36.202.172:5002/?kanqiu.xyz
Pragma: no-cache
Cache-Control: no-cache

res.cloudflareip.com/jquery.min.js

0.0.0.0

0 B

URL GET
res.cloudflareip.com/jquery.min.js
IP
0.0.0.0:0
ASN
#0

Requested by
http://121.36.202.172:5002/?kanqiu.xyz

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /jquery.min.js HTTP/1.1
Host: res.cloudflareip.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://121.36.202.172:5002/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Wed, 24 Apr 2024 07:15:58 GMT
Content-Type: text/javascript
Content-Length: 30841
Connection: keep-alive
Last-Modified: Sun, 24 Mar 2024 08:32:34 GMT
ETag: "FowjWVdYashov_egtIJ88WPPgtne.gz"
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Age: 68817
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Log, X-Reqid
Access-Control-Max-Age: 2592000
Content-Disposition: inline; filename="jquery.min.js"; filename*=utf-8''jquery.min.js
Content-Md5: Vn7sdxfLUUQ0xlfZDoiv0g==
Content-Transfer-Encoding: binary
Vary: Accept-Encoding
X-Log: X-Log
X-M-Log: QNM:jjh3231;QNM3
X-M-Reqid: lb8AAOfX8eQ6sr8X
X-Qiniu-Zone: 0
X-Qnm-Cache: Hit
X-Reqid: BYYAAAAIuK_tsb8X
X-Svr: IO
Ohc-Global-Saved-Time: Tue, 23 Apr 2024 12:06:57 GMT
Ohc-Cache-HIT: hfct68 [2]
Ohc-File-Size: 30841
X-Cache-Status: HIT

res.cloudflareip.com/style_mini.css

0.0.0.0

0 B

URL GET
res.cloudflareip.com/style_mini.css
IP
0.0.0.0:0
ASN
#0

Requested by
http://121.36.202.172:5002/?kanqiu.xyz

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /style_mini.css HTTP/1.1
Host: res.cloudflareip.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://121.36.202.172:5002/
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (8)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by