Report - 444liu.com/

Report Overview

Submitted URL
444liu.com/
IP
34.160.241.69
ASN
#396982 GOOGLE-CLOUD-PLATFORM
Submitted
2024-04-24 13:57:32
Access
public
Website Title
444liu.com
Final URL
444liu.com/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
444liu.com	unknown	unknown	No data	No data	776 B	3.1 kB	34.160.241.69
g.alicdn.com	6787	2008-06-25	2014-10-06	2024-04-23	1.3 kB	22 kB	163.181.56.190
image.uc.cn	54371	2003-03-17	2014-06-05	2024-04-18	886 B	12 kB	47.246.3.232
px.effirst.com	31137	2019-07-05	2019-09-03	2024-04-23	1.1 kB	824 B	111.63.205.165
track.uc.cn	69223	2003-03-17	2014-06-05	2024-04-18	1.8 kB	506 B	123.182.51.94
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-04-23	1.0 kB	12 kB	111.45.11.83
pre-mpnewyear.uc.cn	590198	2003-03-17	2022-06-02	2024-04-18	509 B	559 B	59.82.23.111

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	444liu.com	Sinkholed
2024-04-24	medium	444liu.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (12)

	URL	Size	First Seen	Last Seen
	unknown	37 B	2023-04-11	2024-05-06
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49:14 Last Seen2024-05-06 00:05:29 Times Seen22288 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	41 kB	2023-10-31	2024-05-04
Pretty URL g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js IP 163.181.56.190 ASN #24429 Zhejiang Taobao Network Co.,Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-31 06:22:05 Last Seen2024-05-04 07:44:23 Times Seen721 Hash 995c173aa043d3cc1d774ca298a71b74 65b6edb7a721a8312de14f1dd78df2c6d13658b4 ed55450c5fd25afc4812912061a313704f155a507e302921a9513df81c9e493f Loading...

	g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	5.3 kB	2023-04-11	2024-05-04
Pretty URL g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js IP 163.181.56.190 ASN #24429 Zhejiang Taobao Network Co.,Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-11 23:26:24 Last Seen2024-05-04 07:44:23 Times Seen1360 Hash 2edd3ece2d4fdebb930c640f8011a567 bd2ff2c0a0e98a7ddb2449e2afe00a68d16ffc12 0be039408b767c620542ae7d66781537712fe8096253922e09fb3082a62730f8 Loading...

	444liu.com/	283 B	2023-10-19	2024-04-30
Pretty URL 444liu.com/ IP 34.160.241.69 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-10-19 11:16:54 Last Seen2024-04-30 09:41:14 Times Seen97 Hash c456167dd36827e6d876ce8ff23df71d 90ec1ff659a81e539fd77581d5dcdeae0f1fed25 ece0348a0484ffdfed28c09aa0757980282445df49be86ebad60dafd81ca5b53 Loading...

	unknown	251 B	2024-04-24	2024-04-24
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-04-24 15:57:40 Last Seen2024-04-24 15:57:40 Times Seen1 Hash 9ef067edf56f500c31b0681d29dc338d d9d7cf589b75e285dca2a91441544076dc86a3f6 31f3dd9f809647a4a125dd3f01d8a955e1668982613872b546159f9ef3740531 Loading...

	444liu.com/	446 B	2023-10-19	2024-04-30
Pretty URL 444liu.com/ IP 34.160.241.69 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-10-19 11:16:54 Last Seen2024-04-30 09:41:14 Times Seen97 Hash 95306ce0698a8eb6253d64b1cdc8811e c8e29793e0db14575c7006d47a57521ce4257841 ba5b96d65a57cde094e21dd689245cd9e0a8219cdded3a77f27ff58b61af6c07 Loading...

	image.uc.cn/s/uae/g/3o/berg/static/archer_index.3625ec6bca8fbb37d7f5.js	33 kB	2023-10-19	2024-04-30
Pretty URL image.uc.cn/s/uae/g/3o/berg/static/archer_index.3625ec6bca8fbb37d7f5.js IP 47.246.3.232 ASN #24429 Zhejiang Taobao Network Co.,Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-19 11:16:54 Last Seen2024-04-30 09:41:14 Times Seen194 Hash 7ccce6c7fb6517a5de0a6d9f345d6333 89915b5a58e5ce235fa7ffa8a799e7d2e9dad7c0 1f38823b40033c73d58784b2f32ed2d86faf5693141c34d0a331c64402aedbe0 Loading...

	hm.baidu.com/hm.js?b150d8955dada51289c717fc938583d3	30 kB	2024-04-24	2024-04-24
Pretty URL hm.baidu.com/hm.js?b150d8955dada51289c717fc938583d3 IP 111.45.11.83 ASN #56040 China Mobile communications corporation Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 15:57:40 Last Seen2024-04-24 15:57:40 Times Seen2 Hash 396cc5358db67c8e80fe669de4d1b979 6fb208f8a730c8c54bb7f1d853be49f932c01c92 ef5e0a77cfa23083e788069f8d0f8bbdb1f73cede6bf62a911ded148d0c386cc Loading...

	g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	5.8 kB	2023-04-11	2024-05-04
Pretty URL g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js IP 163.181.56.190 ASN #24429 Zhejiang Taobao Network Co.,Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-11 23:26:24 Last Seen2024-05-04 07:44:23 Times Seen1359 Hash 9f681b53980381f708c2787b4961b8e7 8fa2a66468a3db33ae1b10cdabd9de88c20211b9 ff81aa49e48452dc0d382124bf6277a29977a95743711b268eb7a76849cd225a Loading...

	444liu.com/	2.4 kB	2023-10-19	2024-04-30
Pretty URL 444liu.com/ IP 34.160.241.69 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-10-19 11:16:54 Last Seen2024-04-30 09:41:14 Times Seen97 Hash 5a3ebef027764537e0f1a6c63ece1d44 d6045b240416e895692581e73725932ad1bd9c7f 77548e48952011f3955edecbbabfacd06ed3fa36f5cc2300a6e9f3fb536e7853 Loading...

	444liu.com/	677 B	2023-04-05	2024-05-04
Pretty URL 444liu.com/ IP 34.160.241.69 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-05 07:24:51 Last Seen2024-05-04 07:44:23 Times Seen685 Hash ae122dace4d89339aac7bf0935fa98ac bf26669156d4f51d455cc7480351e40e0e7bdc4e 0d1de7a4d187b4decc1bd1c92787b34c200b00fd20964d5206a7d69f2377e4e1 Loading...

	444liu.com/	131 B	2023-04-05	2024-05-04
Pretty URL 444liu.com/ IP 34.160.241.69 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-05 07:24:51 Last Seen2024-05-04 07:44:23 Times Seen685 Hash 082e61361a0fa61cdf282c8599c93c4e 370261194ab560873a389f7759e45e9ed076ef7d 1f917b159803690dbd11d6b1920842e2eacb2f87f1c28ca0ed7fe7cf714d9e12 Loading...

HTTP Transactions (14)

URL IP Response Size

444liu.com/

34.160.241.69

2.5 kB

URL User Request GET
444liu.com/
IP
34.160.241.69:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
HTML document, Unicode text, UTF-8 text, with very long lines (5151), with no line terminators
Size
2.5 kB (2536 bytes)
Hash
3b856a993e6eb0c9ba7fa424b0fb8313
ffe4530470bf2269f9bf1f9a08e0d47f84e0d47a
177a8274958eb733752084c9b314d8c98eded6e223bab4d6d5055c93e86c3ff9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 444liu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: nginx/1.20.2
date: Wed, 24 Apr 2024 13:57:06 GMT
content-type: text/html
last-modified: Mon, 16 Oct 2023 11:33:42 GMT
vary: Accept-Encoding
etag: W/"652d1f96-14b3"
cache-control: no-cache
content-encoding: gzip
via: 1.1 google
Transfer-Encoding: chunked

g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js

163.181.56.190

200 OK

15 kB

URL GET HTTP/2
g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
IP
163.181.56.190:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.tbcdn.cn
Fingerprint29:04:BE:E6:49:30:F7:DC:C0:BE:56:8F:B4:AC:24:9B:50:1A:F7:E2
ValidityTue, 26 Dec 2023 03:36:04 GMT - Tue, 30 Jul 2024 02:26:11 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (39989), with no line terminators
Size
15 kB (14747 bytes)
Hash
995c173aa043d3cc1d774ca298a71b74
65b6edb7a721a8312de14f1dd78df2c6d13658b4
ed55450c5fd25afc4812912061a313704f155a507e302921a9513df81c9e493f

HTTP Headers

GET /woodpeckerx/jssdk/wpkReporter.js HTTP/1.1
Host: g.alicdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://444liu.com
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: application/javascript
content-length: 14747
date: Wed, 24 Apr 2024 13:49:58 GMT
vary: Accept-Encoding
x-oss-request-id: 66290E0601FB553330DE8BF3
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 17575337766638963859
x-oss-storage-class: Standard
cache-control: max-age=86400,s-maxage=600
content-md5: mVwXOqBD08wdd0yimKcbdA==
x-oss-server-time: 2
content-encoding: gzip
access-control-allow-origin: *
x-bucket-code: 3
ali-swift-global-savetime: 1713966598
via: cache25.l2de2[12,11,200-0,M], cache19.l2de2[13,0], cache19.l2de2[13,0], ens-cache2.de4[0,0,200-0,H], ens-cache4.de4[10,0]
age: 429
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
x-swift-savetime: Wed, 24 Apr 2024 13:49:58 GMT
x-swift-cachetime: 600
timing-allow-origin: *
eagleid: 2ff62b1c17139670271728172e
X-Firefox-Spdy: h2

g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js

163.181.56.190

200 OK

2.4 kB

URL GET HTTP/2
g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
IP
163.181.56.190:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.tbcdn.cn
Fingerprint29:04:BE:E6:49:30:F7:DC:C0:BE:56:8F:B4:AC:24:9B:50:1A:F7:E2
ValidityTue, 26 Dec 2023 03:36:04 GMT - Tue, 30 Jul 2024 02:26:11 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (5084), with no line terminators
Size
2.4 kB (2356 bytes)
Hash
2edd3ece2d4fdebb930c640f8011a567
bd2ff2c0a0e98a7ddb2449e2afe00a68d16ffc12
0be039408b767c620542ae7d66781537712fe8096253922e09fb3082a62730f8

HTTP Headers

GET /woodpeckerx/jssdk/plugins/globalerror.js HTTP/1.1
Host: g.alicdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://444liu.com
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: application/javascript
content-length: 2356
date: Wed, 24 Apr 2024 13:53:18 GMT
vary: Accept-Encoding
x-oss-request-id: 66290ECE4650AD37353ED7E4
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 16649164976846769012
x-oss-storage-class: Standard
cache-control: max-age=86400,s-maxage=600
content-md5: Lt0+zi1P3ruTDGQPgBGlZw==
x-oss-server-time: 1
content-encoding: gzip
access-control-allow-origin: *
x-bucket-code: 3
ali-swift-global-savetime: 1713966798
via: cache8.l2de2[0,0,200-0,H], cache2.l2de2[1,0], cache2.l2de2[1,0], ens-cache1.de4[0,0,200-0,H], ens-cache4.de4[20,0]
age: 229
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
x-swift-savetime: Wed, 24 Apr 2024 13:53:19 GMT
x-swift-cachetime: 599
timing-allow-origin: *
eagleid: 2ff62b1c17139670271748181e
X-Firefox-Spdy: h2

g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js

163.181.56.190

200 OK

2.6 kB

URL GET HTTP/2
g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
IP
163.181.56.190:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.tbcdn.cn
Fingerprint29:04:BE:E6:49:30:F7:DC:C0:BE:56:8F:B4:AC:24:9B:50:1A:F7:E2
ValidityTue, 26 Dec 2023 03:36:04 GMT - Tue, 30 Jul 2024 02:26:11 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (5721), with no line terminators
Size
2.6 kB (2591 bytes)
Hash
9f681b53980381f708c2787b4961b8e7
8fa2a66468a3db33ae1b10cdabd9de88c20211b9
ff81aa49e48452dc0d382124bf6277a29977a95743711b268eb7a76849cd225a

HTTP Headers

GET /woodpeckerx/jssdk/plugins/performance.js HTTP/1.1
Host: g.alicdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://444liu.com
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: application/javascript
content-length: 2591
date: Wed, 24 Apr 2024 13:56:14 GMT
vary: Accept-Encoding
x-oss-request-id: 66290F7E712A5833357105B6
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 10730233764925966105
x-oss-storage-class: Standard
cache-control: max-age=86400,s-maxage=600
content-md5: n2gbU5gDgfcIwnh7SWG45w==
x-oss-server-time: 1
content-encoding: gzip
access-control-allow-origin: *
x-bucket-code: 3
ali-swift-global-savetime: 1713966974
via: cache25.l2de2[7,7,200-0,M], cache8.l2de2[8,0], cache8.l2de2[8,0], ens-cache1.de4[0,0,200-0,H], ens-cache4.de4[25,0]
age: 53
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
x-swift-savetime: Wed, 24 Apr 2024 13:56:14 GMT
x-swift-cachetime: 600
timing-allow-origin: *
eagleid: 2ff62b1c17139670271978274e
X-Firefox-Spdy: h2

image.uc.cn/s/uae/g/3o/berg/static/index.a84da0673eccc37fa0f2.css

47.246.3.232

200 OK

937 B

URL GET HTTP/2
image.uc.cn/s/uae/g/3o/berg/static/index.a84da0673eccc37fa0f2.css
IP
47.246.3.232:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.uc.cn
FingerprintEF:76:66:0B:BC:06:CB:DC:CA:4F:DB:1A:04:75:36:84:9F:9A:72:F3
ValidityFri, 05 Jan 2024 01:56:02 GMT - Wed, 05 Feb 2025 01:56:01 GMT

File type
ASCII text, with very long lines (2179), with no line terminators
Size
937 B (937 bytes)
Hash
09bdfbcc9456faf8a85a94d44ef7734d
e3d00a7df14bc13abb5bd31caa58f1e4be17ede0
05ef687cb9294988df06df1c39cc1e84a26f29f26735c6948978347ed7927fc8

HTTP Headers

GET /s/uae/g/3o/berg/static/index.a84da0673eccc37fa0f2.css HTTP/1.1
Host: image.uc.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: text/css
content-length: 937
date: Sun, 03 Mar 2024 20:14:17 GMT
expires: Tue, 20 Feb 2024 18:23:06 GMT
cache-control: max-age=8640000
vary: Accept-Encoding
etag: b589311b-883
access-control-allow-origin: *
content-encoding: gzip
ali-swift-global-savetime: 1709496858
via: cache11.l2fr1[0,0,200-0,H], cache7.l2fr1[0,0], cache7.ru4[0,0,200-0,H], cache1.ru4[0,0]
age: 66
x-cache: HIT TCP_MEM_HIT dirn:10:383546876
x-swift-savetime: Wed, 24 Apr 2024 06:30:38 GMT
x-swift-cachetime: 4196620
timing-allow-origin: *
eagleid: 2ff6039517139670278194960e
X-Firefox-Spdy: h2

image.uc.cn/s/uae/g/3o/berg/static/archer_index.3625ec6bca8fbb37d7f5.js

47.246.3.232

200 OK

10 kB

URL GET HTTP/2
image.uc.cn/s/uae/g/3o/berg/static/archer_index.3625ec6bca8fbb37d7f5.js
IP
47.246.3.232:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.uc.cn
FingerprintEF:76:66:0B:BC:06:CB:DC:CA:4F:DB:1A:04:75:36:84:9F:9A:72:F3
ValidityFri, 05 Jan 2024 01:56:02 GMT - Wed, 05 Feb 2025 01:56:01 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (24206)
Size
10 kB (10319 bytes)
Hash
7ccce6c7fb6517a5de0a6d9f345d6333
89915b5a58e5ce235fa7ffa8a799e7d2e9dad7c0
1f38823b40033c73d58784b2f32ed2d86faf5693141c34d0a331c64402aedbe0

HTTP Headers

GET /s/uae/g/3o/berg/static/archer_index.3625ec6bca8fbb37d7f5.js HTTP/1.1
Host: image.uc.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: text/javascript
content-length: 10319
date: Sun, 04 Feb 2024 23:41:51 GMT
vary: Accept-Encoding
expires: Tue, 20 Feb 2024 18:34:06 GMT
cache-control: max-age=8640000
etag: 45739637-7f40
access-control-allow-origin: *
content-encoding: gzip
ali-swift-global-savetime: 1707090111
via: cache2.l2fr1[0,0,200-0,H], cache1.l2fr1[1,0], cache8.ru4[0,0,200-0,H], cache1.ru4[0,0]
age: 66
x-cache: HIT TCP_MEM_HIT dirn:9:158005482
x-swift-savetime: Wed, 24 Apr 2024 06:30:38 GMT
x-swift-cachetime: 1789873
timing-allow-origin: *
eagleid: 2ff6039517139670278204963e
X-Firefox-Spdy: h2

px.effirst.com/api/v1/jconfig?wpk-header=app%3Dberg-download%26tm%3D1713967027%26ud%3D0fec9cf3-dbb9-426f-20c6-027a2749bf38%26sver%3D1.2.7%26sign%3Dc41e43c828c16c16a6eb1c9c1e68e8ce

111.63.205.165

200 OK

130 B

URL GET HTTP/1.1
px.effirst.com/api/v1/jconfig?wpk-header=app%3Dberg-download%26tm%3D1713967027%26ud%3D0fec9cf3-dbb9-426f-20c6-027a2749bf38%26sver%3D1.2.7%26sign%3Dc41e43c828c16c16a6eb1c9c1e68e8ce
IP
111.63.205.165:80
ASN
#24547 Hebei Mobile Communication Company Limited

Requested by
http://444liu.com/

File type
JSON text data
Size
130 B (130 bytes)
Hash
07b80d674fbaa6a67ff2972b325d9021
1e248f727c1ffb5785a6916f11b4d31d61bc1998
0c97dcd7755f8d38fa0a5ab6bb0621cb26fd0cb0f1266e66e0700b5fac05ed85

HTTP Headers

GET /api/v1/jconfig?wpk-header=app%3Dberg-download%26tm%3D1713967027%26ud%3D0fec9cf3-dbb9-426f-20c6-027a2749bf38%26sver%3D1.2.7%26sign%3Dc41e43c828c16c16a6eb1c9c1e68e8ce HTTP/1.1
Host: px.effirst.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://444liu.com
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine/2.1.3_400
Date: Wed, 24 Apr 2024 13:57:08 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE
Content-Encoding: gzip

track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_first&page_h5=page_loading_first&lt=pageview&c_lt=pageview&event_id=2001&keyword=&referrer=&host=444liu.com&url=http%3A%2F%2F444liu.com%2F&cookie=__wpkreporterwid_%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad&time=1713967027492&entry=&_ua=Mozilla%2F5.0+(X11%3B+Linux+x86_64%3B+rv%3A96.0)+Gecko%2F20100101+Firefox%2F96.0&isUC=false&isQuark=false&is_duannei=false&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv

123.182.51.94

200

33 B

URL GET HTTP/1.1
track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_first&page_h5=page_loading_first&lt=pageview&c_lt=pageview&event_id=2001&keyword=&referrer=&host=444liu.com&url=http%3A%2F%2F444liu.com%2F&cookie=__wpkreporterwid_%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad&time=1713967027492&entry=&_ua=Mozilla%2F5.0+(X11%3B+Linux+x86_64%3B+rv%3A96.0)+Gecko%2F20100101+Firefox%2F96.0&isUC=false&isQuark=false&is_duannei=false&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv
IP
123.182.51.94:443
ASN
#141771 China Telecom

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.uc.cn
FingerprintEF:76:66:0B:BC:06:CB:DC:CA:4F:DB:1A:04:75:36:84:9F:9A:72:F3
ValidityFri, 05 Jan 2024 01:56:02 GMT - Wed, 05 Feb 2025 01:56:01 GMT

File type
JSON text data
Size
33 B (33 bytes)
Hash
55199048ae64f13bfc67cd2fec307e1a
0febd20edc3ebbaa60bf312be0e1d977ddd3a319
7c677a0c1ba67a4335c821aa3af6031428be641e33887fc719ce8f52f926898d

HTTP Headers

GET /collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_first&page_h5=page_loading_first&lt=pageview&c_lt=pageview&event_id=2001&keyword=&referrer=&host=444liu.com&url=http%3A%2F%2F444liu.com%2F&cookie=__wpkreporterwid_%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad&time=1713967027492&entry=&_ua=Mozilla%2F5.0+(X11%3B+Linux+x86_64%3B+rv%3A96.0)+Gecko%2F20100101+Firefox%2F96.0&isUC=false&isQuark=false&is_duannei=false&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv HTTP/1.1
Host: track.uc.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Date: Wed, 24 Apr 2024 13:57:08 GMT
Content-Type: image/avif;charset=UTF-8
Content-Length: 33
Connection: keep-alive
Server: Tengine/2.1.3_400
Cache-Control: no-cache
Access-Control-Allow-Origin: *

track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_cn&page_h5=page_loading_cn&keyword=&referrer=&host=444liu.com&url=http%3A%2F%2F444liu.com%2F&cookie=__wpkreporterwid_%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad&time=1713967027944&entry=&_ua=Mozilla%2F5.0+(X11%3B+Linux+x86_64%3B+rv%3A96.0)+Gecko%2F20100101+Firefox%2F96.0&isUC=false&isQuark=false&is_duannei=false&lt=pageview&c_lt=pageview&event_id=2001&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv

123.182.51.94

200

33 B

URL GET HTTP/1.1
track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_cn&page_h5=page_loading_cn&keyword=&referrer=&host=444liu.com&url=http%3A%2F%2F444liu.com%2F&cookie=__wpkreporterwid_%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad&time=1713967027944&entry=&_ua=Mozilla%2F5.0+(X11%3B+Linux+x86_64%3B+rv%3A96.0)+Gecko%2F20100101+Firefox%2F96.0&isUC=false&isQuark=false&is_duannei=false&lt=pageview&c_lt=pageview&event_id=2001&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv
IP
123.182.51.94:443
ASN
#141771 China Telecom

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.uc.cn
FingerprintEF:76:66:0B:BC:06:CB:DC:CA:4F:DB:1A:04:75:36:84:9F:9A:72:F3
ValidityFri, 05 Jan 2024 01:56:02 GMT - Wed, 05 Feb 2025 01:56:01 GMT

File type
JSON text data
Size
33 B (33 bytes)
Hash
55199048ae64f13bfc67cd2fec307e1a
0febd20edc3ebbaa60bf312be0e1d977ddd3a319
7c677a0c1ba67a4335c821aa3af6031428be641e33887fc719ce8f52f926898d

HTTP Headers

GET /collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_cn&page_h5=page_loading_cn&keyword=&referrer=&host=444liu.com&url=http%3A%2F%2F444liu.com%2F&cookie=__wpkreporterwid_%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad&time=1713967027944&entry=&_ua=Mozilla%2F5.0+(X11%3B+Linux+x86_64%3B+rv%3A96.0)+Gecko%2F20100101+Firefox%2F96.0&isUC=false&isQuark=false&is_duannei=false&lt=pageview&c_lt=pageview&event_id=2001&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv HTTP/1.1
Host: track.uc.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Date: Wed, 24 Apr 2024 13:57:09 GMT
Content-Type: image/avif;charset=UTF-8
Content-Length: 33
Connection: keep-alive
Server: Tengine/2.1.3_400
Cache-Control: no-cache
Access-Control-Allow-Origin: *

hm.baidu.com/hm.js?b150d8955dada51289c717fc938583d3

111.45.11.83

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?b150d8955dada51289c717fc938583d3
IP
111.45.11.83:443
ASN
#56040 China Mobile communications corporation

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
JavaScript source, ASCII text, with very long lines (720)
Size
11 kB (11358 bytes)
Hash
396cc5358db67c8e80fe669de4d1b979
6fb208f8a730c8c54bb7f1d853be49f932c01c92
ef5e0a77cfa23083e788069f8d0f8bbdb1f73cede6bf62a911ded148d0c386cc

HTTP Headers

GET /hm.js?b150d8955dada51289c717fc938583d3 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11358
Content-Type: application/javascript
Date: Wed, 24 Apr 2024 13:57:09 GMT
Etag: f1c4799572a12acd43406f66d7fd7847
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=5455D692F14F3B7F; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

444liu.com/favicon.ico

34.160.241.69

404 Not Found

153 B

URL GET HTTP/1.1
444liu.com/favicon.ico
IP
34.160.241.69:80
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
http://444liu.com/

File type
HTML document, ASCII text, with CRLF line terminators
Size
153 B (153 bytes)
Hash
a53e183b2c571a68b246ad570b76da19
7eac95d26ba1e92a3b4d6fd47ee057f00274ac13
29574dc19a017adc4a026deb6d9a90708110eafe9a6acdc6496317382f9a4dc7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 444liu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Cookie: __wpkreporterwid_=ad79fa3e-393b-434f-26d5-a03cca24b6ad
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
server: nginx/1.20.2
date: Wed, 24 Apr 2024 13:57:09 GMT
content-type: text/html
Content-Length: 153
via: 1.1 google

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1368465993&si=b150d8955dada51289c717fc938583d3&v=1.3.0&lv=1&sn=30175&r=0&ww=1280&u=http%3A%2F%2F444liu.com%2F&tt=444liu.com

111.45.11.83

200 OK

43 B

URL GET HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1368465993&si=b150d8955dada51289c717fc938583d3&v=1.3.0&lv=1&sn=30175&r=0&ww=1280&u=http%3A%2F%2F444liu.com%2F&tt=444liu.com
IP
111.45.11.83:443
ASN
#56040 China Mobile communications corporation

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF
ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1368465993&si=b150d8955dada51289c717fc938583d3&v=1.3.0&lv=1&sn=30175&r=0&ww=1280&u=http%3A%2F%2F444liu.com%2F&tt=444liu.com HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Wed, 24 Apr 2024 13:57:09 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=9DFEF4F076D5D117; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

px.effirst.com/api/v1/jssdk/upload?wpk-header=app%3Dberg-download%26cp%3Dnone%26de%3D4%26seq%3D1713967029927%26tm%3D1713967029%26ud%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad%26ver%3D2.44.0%26type%3Dflow%26sver%3D1.2.7%26sign%3D9bf8a190ef82c5049df7b199c599c45b

111.63.205.165

200 OK

20 B

URL POST HTTP/1.1
px.effirst.com/api/v1/jssdk/upload?wpk-header=app%3Dberg-download%26cp%3Dnone%26de%3D4%26seq%3D1713967029927%26tm%3D1713967029%26ud%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad%26ver%3D2.44.0%26type%3Dflow%26sver%3D1.2.7%26sign%3D9bf8a190ef82c5049df7b199c599c45b
IP
111.63.205.165:80
ASN
#24547 Hebei Mobile Communication Company Limited

Requested by
http://444liu.com/

File type
gzip compressed data, from Unix
Size
20 B (20 bytes)
Hash
7029066c27ac6f5ef18d660d5741979a
46c6643f07aa7f6bfe7118de926b86defc5087c4
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

HTTP Headers

POST /api/v1/jssdk/upload?wpk-header=app%3Dberg-download%26cp%3Dnone%26de%3D4%26seq%3D1713967029927%26tm%3D1713967029%26ud%3Dad79fa3e-393b-434f-26d5-a03cca24b6ad%26ver%3D2.44.0%26type%3Dflow%26sver%3D1.2.7%26sign%3D9bf8a190ef82c5049df7b199c599c45b HTTP/1.1
Host: px.effirst.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 881
Origin: http://444liu.com
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/

HTTP/1.1 200 OK
Server: Tengine/2.1.3_400
Date: Wed, 24 Apr 2024 13:57:10 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE
Content-Encoding: gzip

pre-mpnewyear.uc.cn/iceberg/page/log?domain=444liu.com&uc_param_str=dsdnfrpfbivesscpgimibtbmnijblauputogpintnwktprchmt

59.82.23.111

404 Not Found

0 B

URL GET HTTP/2
pre-mpnewyear.uc.cn/iceberg/page/log?domain=444liu.com&uc_param_str=dsdnfrpfbivesscpgimibtbmnijblauputogpintnwktprchmt
IP
59.82.23.111:443
ASN
#37963 Hangzhou Alibaba Advertising Co.,Ltd.

Requested by
http://444liu.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.tanx.com
FingerprintF0:2F:16:5B:D1:19:2A:8F:20:E7:A2:C8:F4:4B:97:86:15:8E:E4:34
ValidityFri, 02 Jun 2023 06:02:03 GMT - Wed, 03 Jul 2024 05:56:05 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /iceberg/page/log?domain=444liu.com&uc_param_str=dsdnfrpfbivesscpgimibtbmnijblauputogpintnwktprchmt HTTP/1.1
Host: pre-mpnewyear.uc.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://444liu.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Wed, 24 Apr 2024 13:57:09 GMT
content-type: application/json
server: Tengine
set-cookie: XSRF-TOKEN=ac9e92a0-2b31-4430-99ca-71d06cd48536; Path=/; HttpOnly
vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: DENY
content-encoding: gzip
eagleeye-traceid: 2167629417139670294848824e1017
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by