Report - jirui-edu.cn/robots.txt

Report Overview

Visited public
2024-12-07 01:02:58
Tags
URL
jirui-edu.cn/robots.txt
Finishing URL
jirui-edu.cn/robots.txt
IP / ASN
155.159.217.158
#137951 ASLINE LIMITED
Title
jirui-edu.cn/robots.txt

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
jirui-edu.cn	unknown	2021-08-03	2024-12-07	2024-12-07	1.1 kB	1.6 kB	155.159.217.158
155.159.223.152	unknown	unknown	No data	No data	4.0 kB	851 kB	155.159.223.152
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-12-04	1.0 kB	12 kB	111.45.3.198
collect-v6.51.la	91421	2005-01-17	2021-03-08	2024-12-05	386 B	403 B	212.247.59.123

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-12-07 01:02:33	medium	155.159.217.158	Client IP	ET DROP Spamhaus DROP Listed Traffic Inbound group 25
2024-12-07 01:02:34	medium	155.159.223.152	Client IP	ET DROP Spamhaus DROP Listed Traffic Inbound group 25

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed
2024-12-07	medium	155.159.223.152	Sinkholed

ThreatFox

No alerts detected

JavaScript (9)

	URL	From	Size	First Seen	Last Seen
	155.159.223.152:668/	ScriptElement	58 B	2023-10-13	2025-03-02
Pretty URL 155.159.223.152:668/ IP 155.159.223.152 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML true Observations First Seen2023-10-13 11:11 Last Seen2025-03-02 05:24 Times Seen22 Hash cb8dbf05dc40254acd7243b1c55dbdaa 55fc72ea9bc669d3e9513ac8061afbeb2c469e03 c0973f6a677d4c16b8555459f8c6bbfefc60b6d006220764ff34fb12f9a28b8c Loading...

	unknown	Function	37 B	2023-04-11	2025-05-25
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:49 Last Seen2025-05-25 04:54 Times Seen35305 Hash 1c5c9160600df2d96d69a4ea16cec7ed 3cf678c9135cc952ba6970ef545035bb757a443f a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808 Loading...

	unknown	Function	269 B	2024-12-07	2024-12-07
Pretty Introduced by Function Embedded in HTML false Observations First Seen2024-12-07 01:03 Last Seen2024-12-07 01:03 Times Seen1 Hash 6add048885999c7fc0b16ef9e7685e09 3416d120d8a137566843f4b9556dc7147061df6b e7ae03c3d284a0392344dac9d954d47e3fa34370ee83f67b6548761ff4561ba1 Loading...

	hm.baidu.com/hm.js?cd7e6d43ca9e2a2217b4f386d15c24ea	ScriptElement	30 kB	2024-12-07	2024-12-07
Pretty URL hm.baidu.com/hm.js?cd7e6d43ca9e2a2217b4f386d15c24ea IP 111.45.3.198 ASN #56040 China Mobile communications corporation Introduced by scriptElement Embedded in HTML false Observations First Seen2024-12-07 01:03 Last Seen2024-12-07 01:03 Times Seen1 Hash ef27d81078784064b959f88188aa5e5d 217674a798d1c12f5246fca21996c6915744e9d0 03a2b1b22bff6f736785ebedceb0b5caa0682bfe381833411a14422bfb7c21de Loading...

	jirui-edu.cn/qifei.js	ScriptElement	1.2 kB	2024-12-07	2024-12-07
Pretty URL jirui-edu.cn/qifei.js IP 155.159.217.158 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2024-12-07 01:03 Last Seen2024-12-07 01:03 Times Seen1 Hash 9ea9cbb275e617b64ca235d969074aad 825e1a89f9e29dda6c68fe23e90023a21b21204f 5275d2377a5c9911e432458fcde7bb58ea239d7a31e9b1205bb5425fa06bf083 Loading...

	155.159.223.152:668/link1.js	ScriptElement	2.0 kB	2024-12-07	2024-12-07
Pretty URL 155.159.223.152:668/link1.js IP 155.159.223.152 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2024-12-07 01:03 Last Seen2024-12-07 01:03 Times Seen1 Hash bd1dae06f61aafb118bb24e6a371c824 8ea578a530e097bebe9af4e4f5659ef0b75cd61c e4a625e7f86fd2a5b34249c0b22b30dd43d35866072df346ec7d3a88234df558 Loading...

	155.159.223.152:668/static/js/js-sdk-pro.min.js	ScriptElement	34 kB	2023-04-05	2025-05-23
Pretty URL 155.159.223.152:668/static/js/js-sdk-pro.min.js IP 155.159.223.152 ASN #137951 ASLINE LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 07:31 Last Seen2025-05-23 23:04 Times Seen8548 Hash 8fc0b01d35300e8398d6e957987c01e7 f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4 Loading...

		Size	First Seen	Last Seen
	#1 Write - 74312d9fd3d0d77a65b4edf6f7a9d543	169 B	2023-03-07 12:43	2025-05-25 02:13
Pretty Observations First Seen2023-03-07 12:43 Last Seen2025-05-25 02:13 Times Seen1043 Hash 74312d9fd3d0d77a65b4edf6f7a9d543 f8f99b78a90612dba2ab0f2f96d35ef3c77cd3c6 e3932ed210d0dfb6820eacc496a3e5a609b8f011515b9324fe93b5d956a11f08 Loading...

	#2 Write - c84b0908f641bace9041b5594599d27b	282 B	2024-12-07 01:03	2024-12-07 01:03
Pretty Observations First Seen2024-12-07 01:03 Last Seen2024-12-07 01:03 Times Seen1 Hash c84b0908f641bace9041b5594599d27b 5b2dbbb818d5ffcd5db9ae6b30b07850cc266066 5220077079497efd4f3f02433508c0ade5f5d3cb4500a0a454688ff6772a05f4 Loading...

HTTP Transactions (17)

URL IP Response Size

jirui-edu.cn/robots.txt

155.159.217.158

200 OK

67 B

URL
jirui-edu.cn/robots.txt
IP
155.159.217.158:0
ASN
#137951 ASLINE LIMITED

File type
HTML document, ASCII text, with no line terminators
Size
67 B (67 bytes)
Hash
ad34d386f57329207e6b25c37e3b85b7
5781343abb70668bbd225bef51135ce6999a93da
9b648c0b6ac028f89ca576da86a53b42bad78fa5329d3b6fdb4d0578fa169952

HTTP Headers

GET /robots.txt HTTP/1.1
Host: jirui-edu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

jirui-edu.cn/qifei.js

155.159.217.158

200 OK

751 B

URL
jirui-edu.cn/qifei.js
IP
155.159.217.158:0
ASN
#137951 ASLINE LIMITED

File type
JavaScript source, Unicode text, UTF-8 text
Size
751 B (751 bytes)
Hash
9ea9cbb275e617b64ca235d969074aad
825e1a89f9e29dda6c68fe23e90023a21b21204f
5275d2377a5c9911e432458fcde7bb58ea239d7a31e9b1205bb5425fa06bf083

HTTP Headers

GET /qifei.js HTTP/1.1
Host: jirui-edu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://jirui-edu.cn/robots.txt
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:34 GMT
Content-Type: application/javascript
Last-Modified: Mon, 18 Nov 2024 03:47:09 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"673ab8bd-4db"
Expires: Sat, 07 Dec 2024 13:02:34 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

jirui-edu.cn/favicon.ico

155.159.217.158

200 OK

0 B

URL
jirui-edu.cn/favicon.ico
IP
155.159.217.158:0
ASN
#137951 ASLINE LIMITED

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: jirui-edu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://jirui-edu.cn/robots.txt
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:34 GMT
Content-Type: image/x-icon
Content-Length: 0
Last-Modified: Wed, 29 May 2024 07:20:46 GMT
Connection: keep-alive
ETag: "6656d74e-0"
Accept-Ranges: bytes

155.159.223.152:668/

155.159.223.152

200 OK

1.7 kB

URL
155.159.223.152:668/
IP
155.159.223.152:0
ASN
#137951 ASLINE LIMITED

File type
HTML document, Unicode text, UTF-8 text
Size
1.7 kB (1717 bytes)
Hash
243291f6b4e7749f35d59a9fa1d992f7
99f87a2c4f99695c0f2095f31c3b058507926641
ecddd4e789f27708b531ea8bc01e1c9c85dd6ed670423b6cc6a44270b1b3ee7c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://jirui-edu.cn/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:34 GMT
Content-Type: text/html
Last-Modified: Tue, 06 Aug 2024 06:27:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"66b1c257-19d0"
Content-Encoding: gzip

155.159.223.152:668/link1.js

155.159.223.152

200 OK

586 B

URL
155.159.223.152:668/link1.js
IP
155.159.223.152:0
ASN
#137951 ASLINE LIMITED

File type
ASCII text
Size
586 B (586 bytes)
Hash
bd1dae06f61aafb118bb24e6a371c824
8ea578a530e097bebe9af4e4f5659ef0b75cd61c
e4a625e7f86fd2a5b34249c0b22b30dd43d35866072df346ec7d3a88234df558

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /link1.js HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:34 GMT
Content-Type: application/javascript
Last-Modified: Fri, 06 Dec 2024 19:04:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"67534ac6-7a3"
Expires: Sat, 07 Dec 2024 13:02:34 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

155.159.223.152:668/static/js/js-sdk-pro.min.js

155.159.223.152

200 OK

14 kB

URL GET HTTP/1.1
155.159.223.152:668/static/js/js-sdk-pro.min.js
IP
155.159.223.152:668
ASN
#137951 ASLINE LIMITED

Requested by
http://155.159.223.152:668/

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (34110)
Size
14 kB (13928 bytes)
Hash
24bb520e9517f2ed3ed987b46aeaf723
846723563d7dd2bff3954f93633b11af0103adc8
d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/js-sdk-pro.min.js HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: application/javascript
Last-Modified: Tue, 03 Oct 2023 08:36:49 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"651bd2a1-861a"
Expires: Sat, 07 Dec 2024 13:02:35 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

155.159.223.152:668/static/picture/register.png

155.159.223.152

200 OK

3.8 kB

URL GET HTTP/1.1
155.159.223.152:668/static/picture/register.png
IP
155.159.223.152:668
ASN
#137951 ASLINE LIMITED

Requested by
http://155.159.223.152:668/

File type
PNG image data, 412 x 100, 8-bit/color RGBA, non-interlaced
Size
3.8 kB (3797 bytes)
Hash
b486bf2221cd00fe849219d975670487
61926edaecf1d6d8be20a097ee0742da798777a7
df8c4f63ad8f374e92fdc356027f638a99e621c857d69e51bb01e75a7da86f9f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/register.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 12 Mar 2024 08:32:39 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"65f01327-eb9"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

155.159.223.152:668/static/picture/download.png

155.159.223.152

200 OK

3.6 kB

URL
155.159.223.152:668/static/picture/download.png
IP
155.159.223.152:0
ASN
#137951 ASLINE LIMITED

File type
PNG image data, 416 x 100, 8-bit/color RGBA, non-interlaced
Size
3.6 kB (3591 bytes)
Hash
2ecdedf9ed6cfe667d8f0093f0f5d947
72d08c2362562f57dff5d26d129c6322382b1753
4cd827b8dd283a12d1cad398f8b21166f6bb0399cff4584583d8c7f108e498fd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/download.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 12 Mar 2024 08:32:39 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"65f01327-deb"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

155.159.223.152:668/static/picture/sectionky.png

155.159.223.152

200 OK

45 kB

URL
155.159.223.152:668/static/picture/sectionky.png
IP
155.159.223.152:0
ASN
#137951 ASLINE LIMITED

File type
PNG image data, 960 x 654, 8-bit colormap, non-interlaced
Size
45 kB (44735 bytes)
Hash
e8b4e9a0dcf02c0733803225a69bd6e6
6f40f8da7eed607780f375fe6aea94cac3a4fce9
eaf2477b666cfcd1c16cc3eb13c96fa95802806d875317a7e3b07f78211bfee5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/sectionky.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 12 Mar 2024 08:32:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"65f01328-b1e1"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

155.159.223.152:668/static/picture/activity.png

155.159.223.152

200 OK

26 kB

URL
155.159.223.152:668/static/picture/activity.png
IP
155.159.223.152:0
ASN
#137951 ASLINE LIMITED

File type
PNG image data, 960 x 1123, 4-bit colormap, non-interlaced
Size
26 kB (26402 bytes)
Hash
ade1152803c52799a6f5dda258467325
36f8410f7ea6e759b1e46239d4c81c2c5f4dc597
bf59f1bbc00714057970821bf96256ab182d0ea075bb6bd0b01963ea57cd62e1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/activity.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 03 Oct 2023 08:36:51 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"651bd2a3-6a40"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

hm.baidu.com/hm.js?cd7e6d43ca9e2a2217b4f386d15c24ea

111.45.3.198

200 OK

11 kB

URL GET HTTP/1.1
hm.baidu.com/hm.js?cd7e6d43ca9e2a2217b4f386d15c24ea
IP
111.45.3.198:443
ASN
#56040 China Mobile communications corporation

Requested by
http://jirui-edu.cn/robots.txt
Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
FingerprintEF:0F:BE:13:02:E2:C4:D4:89:BA:8F:BA:88:EF:6F:95:DC:CF:7B:E0
ValidityMon, 08 Jul 2024 01:41:02 GMT - Sat, 09 Aug 2025 01:41:01 GMT

File type
JavaScript source, ASCII text, with very long lines (617)
Size
11 kB (11287 bytes)
Hash
ef27d81078784064b959f88188aa5e5d
217674a798d1c12f5246fca21996c6915744e9d0
03a2b1b22bff6f736785ebedceb0b5caa0682bfe381833411a14422bfb7c21de

HTTP Headers

GET /hm.js?cd7e6d43ca9e2a2217b4f386d15c24ea HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://jirui-edu.cn/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11287
Content-Type: application/javascript
Date: Sat, 07 Dec 2024 01:02:35 GMT
Etag: e8deeada9cec63b0a4a98b737975d1a9
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=8162C507511FACF6; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

155.159.223.152:668/static/picture/bg1.jpg

155.159.223.152

200 OK

143 kB

URL
155.159.223.152:668/static/picture/bg1.jpg
IP
155.159.223.152:0
ASN
#137951 ASLINE LIMITED

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1440x2960, components 3
Size
143 kB (143242 bytes)
Hash
b248edfd4ea5774327a4b2e40bebfda3
57bb5c1328544234e43598c04ec249f2d26b0684
25a9e874d5192b9522af94aaa1b12d090dedea945ff3c4e37777abd1074e2396

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/bg1.jpg HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/jpeg
Last-Modified: Tue, 03 Oct 2023 08:36:54 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"651bd2a6-261b3"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

155.159.223.152:668/static/picture/jy-section.png

155.159.223.152

200 OK

166 kB

URL GET HTTP/1.1
155.159.223.152:668/static/picture/jy-section.png
IP
155.159.223.152:668
ASN
#137951 ASLINE LIMITED

Requested by
http://155.159.223.152:668/

File type
PNG image data, 960 x 654, 8-bit/color RGBA, non-interlaced
Size
166 kB (165993 bytes)
Hash
a7ad6d6bf6361246a9a376567d9a4f3d
a6a856d41be95642c6d982a8794479d21c13b706
c9178b2b5a26ee7ffcd29f0fd4a31a4a0591eec84addc2c92b27398693b94bc7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/jy-section.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 06 Aug 2024 06:13:46 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"66b1bf1a-2a424"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

155.159.223.152:668/static/picture/sectionayx.png

155.159.223.152

200 OK

44 kB

URL GET HTTP/1.1
155.159.223.152:668/static/picture/sectionayx.png
IP
155.159.223.152:668
ASN
#137951 ASLINE LIMITED

Requested by
http://155.159.223.152:668/

File type
PNG image data, 960 x 654, 8-bit colormap, non-interlaced
Size
44 kB (43695 bytes)
Hash
320b674353f4b7c7145d36e3b9cd391d
19637b4ff3ea44198be6d8f08d536d309ec24bcb
26a985d12e7a2a06c70128c999e9bea11257ab35ec99d20fbfde6cf9eec5bc8e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/sectionayx.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 12 Mar 2024 08:32:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"65f01328-acf1"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

155.159.223.152:668/static/picture/event1.png

155.159.223.152

200 OK

399 kB

URL GET HTTP/1.1
155.159.223.152:668/static/picture/event1.png
IP
155.159.223.152:668
ASN
#137951 ASLINE LIMITED

Requested by
http://155.159.223.152:668/

File type
PNG image data, 926 x 574, 8-bit/color RGBA, non-interlaced
Size
399 kB (399264 bytes)
Hash
db9fef1ed735159f3b8d8fd207488a34
1d83b4c48fd95d48fce27ffc60f00e1a1f7f82b2
fc268a70ec262e62b18ae7a3e36991860016b35198d53ed53c805ec7e0c504cd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/picture/event1.png HTTP/1.1
Host: 155.159.223.152:668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Type: image/png
Last-Modified: Tue, 06 Aug 2024 06:26:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"66b1c228-61bee"
Expires: Mon, 06 Jan 2025 01:02:35 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

collect-v6.51.la/v6/collect?dt=4

212.247.59.123

210

0 B

URL
collect-v6.51.la/v6/collect?dt=4
IP
212.247.59.123:0
ASN
#1257 Tele2 SWIPnet

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /v6/collect?dt=4 HTTP/1.1
Host: collect-v6.51.la
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 305
Origin: http://155.159.223.152:668
DNT: 1
Connection: keep-alive
Referer: http://155.159.223.152:668/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 210 
Date: Sat, 07 Dec 2024 01:02:35 GMT
Content-Length: 0
Connection: keep-alive
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Origin: http://155.159.223.152:668
Access-Control-Allow-Credentials: true
via: EU-SWE-stockholm-EDGE1-CACHE4[447],EU-SWE-stockholm-EDGE1-CACHE4[ovl,444]
X-CCDN-REQ-ID-46B1: f403f0c3cfefdae2d52fd88f930c2346

hm.baidu.com/hm.gif?hca=8162C507511FACF6&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1228770660&si=cd7e6d43ca9e2a2217b4f386d15c24ea&v=1.3.2&lv=1&sn=1536&r=0&ww=1280&u=http%3A%2F%2Fjirui-edu.cn%2Frobots.txt

111.45.3.198

200 OK

43 B

URL
hm.baidu.com/hm.gif?hca=8162C507511FACF6&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1228770660&si=cd7e6d43ca9e2a2217b4f386d15c24ea&v=1.3.2&lv=1&sn=1536&r=0&ww=1280&u=http%3A%2F%2Fjirui-edu.cn%2Frobots.txt
IP
111.45.3.198:0
ASN
#56040 China Mobile communications corporation

Certificate
IssuerGlobalSign nv-sa
Subjectbaidu.com
FingerprintEF:0F:BE:13:02:E2:C4:D4:89:BA:8F:BA:88:EF:6F:95:DC:CF:7B:E0
ValidityMon, 08 Jul 2024 01:41:02 GMT - Sat, 09 Aug 2025 01:41:01 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?hca=8162C507511FACF6&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1228770660&si=cd7e6d43ca9e2a2217b4f386d15c24ea&v=1.3.2&lv=1&sn=1536&r=0&ww=1280&u=http%3A%2F%2Fjirui-edu.cn%2Frobots.txt HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://jirui-edu.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Sat, 07 Dec 2024 01:02:35 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=DC1051ECF2E45627; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (17)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash