Report - srfnu.cn/HJmOkggh/

Report Overview

Visited public
2025-04-21 12:08:31
Tags
URL
srfnu.cn/HJmOkggh/
Finishing URL
srfnu.cn/HJmOkggh/
IP / ASN
172.67.169.128
#13335 CLOUDFLARENET
Title
srfnu.cn/HJmOkggh/

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
srfnu.cn	unknown	2024-06-17	2025-04-21	2025-04-21	2.3 kB	288 kB	172.67.169.128

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-04-21	medium	srfnu.cn	Sinkholed
2025-04-21	medium	srfnu.cn	Sinkholed
2025-04-21	medium	srfnu.cn	Sinkholed
2025-04-21	medium	srfnu.cn	Sinkholed
2025-04-21	medium	srfnu.cn	Sinkholed

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	srfnu.cn/HJmOkggh/assets/index-C0FX3PT-.js	ScriptElement	259 kB	2025-04-19	2025-04-27
Pretty URL srfnu.cn/HJmOkggh/assets/index-C0FX3PT-.js IP 172.67.169.128 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-19 13:51 Last Seen2025-04-27 13:41 Times Seen4 Hash fadcaa6a551d1838aa4eae44ccecdfc3 3491048e504678db27baf776ba089ac06bbbd6cf 87331e422ad72d1d9ec021678601d5abc82d5f578f6e70b2c559a5c45950930e Loading...

HTTP Transactions (5)

URL IP Response Size

srfnu.cn/HJmOkggh/

172.67.169.128

200 OK

511 B

URL User Request GET
srfnu.cn/HJmOkggh/
IP
172.67.169.128:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectsrfnu.cn
FingerprintF5:4D:77:03:BC:DD:05:B7:26:8E:CD:9C:22:D8:C8:48:18:BD:77:2D
ValidityWed, 16 Apr 2025 12:52:32 GMT - Tue, 15 Jul 2025 13:50:49 GMT

File type
HTML document, ASCII text, with CRLF, CR, LF line terminators
Size
511 B (511 bytes)
Hash
ed85e33c855efdd519e5f76342e278eb
d216ccf17ab6b6fa534c059b814705277c7e3f49
7d80995023ff1ac73d2e268e7a1673aa80400d7793c7444d67512b611495c7af

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /HJmOkggh/ HTTP/1.1
Host: srfnu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 21 Apr 2025 12:08:10 GMT
content-type: text/html
server: cloudflare
last-modified: Tue, 15 Apr 2025 16:37:20 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
content-encoding: br
cf-ray: 933cc3e5dd3ffeb7-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

srfnu.cn/HJmOkggh/assets/index-DIMS-mde.css

172.67.169.128

200 OK

25 kB

URL GET
srfnu.cn/HJmOkggh/assets/index-DIMS-mde.css
IP
172.67.169.128:443
ASN
#13335 CLOUDFLARENET

Requested by
https://srfnu.cn/HJmOkggh/
Certificate
IssuerGoogle Trust Services
Subjectsrfnu.cn
FingerprintF5:4D:77:03:BC:DD:05:B7:26:8E:CD:9C:22:D8:C8:48:18:BD:77:2D
ValidityWed, 16 Apr 2025 12:52:32 GMT - Tue, 15 Jul 2025 13:50:49 GMT

File type
ASCII text, with very long lines (25031)
Size
25 kB (25032 bytes)
Hash
f5c1b4c1e30fbfa54e55a46ab2e5fc88
a3e48f29117fcb9fdb90d97fd5402013dcff35f6
363ad2e05d371876002c31756641b01903ba015f2da07176a1a2f7e33191f61c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /HJmOkggh/assets/index-DIMS-mde.css HTTP/1.1
Host: srfnu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://srfnu.cn/HJmOkggh/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 21 Apr 2025 12:08:11 GMT
content-type: text/css
server: cloudflare
last-modified: Tue, 15 Apr 2025 16:37:20 GMT
vary: Accept-Encoding
etag: W/"67fe8b40-61c8"
expires: Wed, 21 May 2025 12:08:11 GMT
cache-control: public, max-age=2592000
content-encoding: gzip
cf-cache-status: MISS
cf-ray: 933cc3eb0d46feb7-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

srfnu.cn/HJmOkggh/assets/index-C0FX3PT-.js

172.67.169.128

200 OK

259 kB

URL GET
srfnu.cn/HJmOkggh/assets/index-C0FX3PT-.js
IP
172.67.169.128:443
ASN
#13335 CLOUDFLARENET

Requested by
https://srfnu.cn/HJmOkggh/
Certificate
IssuerGoogle Trust Services
Subjectsrfnu.cn
FingerprintF5:4D:77:03:BC:DD:05:B7:26:8E:CD:9C:22:D8:C8:48:18:BD:77:2D
ValidityWed, 16 Apr 2025 12:52:32 GMT - Tue, 15 Jul 2025 13:50:49 GMT

File type
JavaScript source, ASCII text, with very long lines (35646)
Size
259 kB (259376 bytes)
Hash
fadcaa6a551d1838aa4eae44ccecdfc3
3491048e504678db27baf776ba089ac06bbbd6cf
87331e422ad72d1d9ec021678601d5abc82d5f578f6e70b2c559a5c45950930e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /HJmOkggh/assets/index-C0FX3PT-.js HTTP/1.1
Host: srfnu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://srfnu.cn/HJmOkggh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 21 Apr 2025 12:08:11 GMT
content-type: application/javascript
server: cloudflare
last-modified: Tue, 15 Apr 2025 16:37:20 GMT
vary: Accept-Encoding
etag: W/"67fe8b40-3f530"
expires: Wed, 21 May 2025 12:08:11 GMT
cache-control: public, max-age=2592000
content-encoding: gzip
cf-cache-status: MISS
cf-ray: 933cc3eb0d41feb7-AMS
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

srfnu.cn/open/visitors/info/createOrGetUserInfo

172.67.169.128

404 Not Found

9 B

URL POST
srfnu.cn/open/visitors/info/createOrGetUserInfo
IP
172.67.169.128:443
ASN
#13335 CLOUDFLARENET

Requested by
https://srfnu.cn/HJmOkggh/
Certificate
IssuerGoogle Trust Services
Subjectsrfnu.cn
FingerprintF5:4D:77:03:BC:DD:05:B7:26:8E:CD:9C:22:D8:C8:48:18:BD:77:2D
ValidityWed, 16 Apr 2025 12:52:32 GMT - Tue, 15 Jul 2025 13:50:49 GMT

File type
ASCII text, with no line terminators
Size
9 B (9 bytes)
Hash
9d1ead73e678fa2f51a70a933b0bf017
d205cbd6783332a212c5ae92d73c77178c2d2f28
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /open/visitors/info/createOrGetUserInfo HTTP/1.1
Host: srfnu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 479
Origin: https://srfnu.cn
DNT: 1
Connection: keep-alive
Referer: https://srfnu.cn/HJmOkggh/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Mon, 21 Apr 2025 12:08:12 GMT
content-type: text/plain; charset=utf-8
content-length: 9
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Y%2Bq38nxAHF4sr%2FSMwHGxg9KAw0CzgLhcD5N50xHMgGud%2FI4H2UahOck%2FqJWzJRyFArXXjXsdpjFUT7WCQClzVSkTHpjeVeHlJUynCd917mfdJPFshzHSdCPHw%3D%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin
access-control-allow-origin: https://srfnu.cn
set-cookie: locale=en-us; path=/; max-age=31557600; expires=Tue, 21 Apr 2026 18:08:12 GMT
cf-cache-status: DYNAMIC
cf-ray: 933cc3f29af1d8d0-AMS
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=26281&min_rtt=24982&rtt_var=9437&sent=31&recv=26&lost=0&retrans=0&sent_bytes=5718&recv_bytes=2858&delivery_rate=749&cwnd=12000&unsent_bytes=0&cid=1f6d9f862d5b1f95&ts=2045&x=16"

srfnu.cn/HJmOkggh/faviconV2.png

172.67.169.128

200 OK

332 B

URL GET
srfnu.cn/HJmOkggh/faviconV2.png
IP
172.67.169.128:443
ASN
#13335 CLOUDFLARENET

Requested by
https://srfnu.cn/HJmOkggh/
Certificate
IssuerGoogle Trust Services
Subjectsrfnu.cn
FingerprintF5:4D:77:03:BC:DD:05:B7:26:8E:CD:9C:22:D8:C8:48:18:BD:77:2D
ValidityWed, 16 Apr 2025 12:52:32 GMT - Tue, 15 Jul 2025 13:50:49 GMT

File type
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Size
332 B (332 bytes)
Hash
41069b4e27734ab2dbb2e1dbdae0bf39
e4d67413512b9cca8032740ee08e6aaa7e91f931
c354357ef441e14681dfbc4f22bfdaac3f323698565590f1563ddc7f61ea4913

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /HJmOkggh/faviconV2.png HTTP/1.1
Host: srfnu.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://srfnu.cn/HJmOkggh/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 21 Apr 2025 12:08:12 GMT
content-type: image/png
content-length: 332
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4nrqdkl4JR97DGr3zZvI8S2Sg8babMTr%2FoqA0Q08VYh2t7mp1x5GER%2Fe%2BOpgL4%2FF9Rt%2BCwWfyiMSGE7I5vNoTlwFmQmv48Zlq5WEtiBl3n9kcpZXNud7YK9LZg%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Sat, 15 Mar 2025 12:18:26 GMT
etag: "67d57012-14c"
expires: Fri, 16 May 2025 18:28:37 GMT
cache-control: public, max-age=2592000
cf-cache-status: HIT
age: 409175
accept-ranges: bytes
cf-ray: 933cc3f40b1ad8d0-AMS
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=25355&min_rtt=24982&rtt_var=10113&sent=30&recv=25&lost=0&retrans=0&sent_bytes=4672&recv_bytes=2814&delivery_rate=20812&cwnd=12000&unsent_bytes=0&cid=1f6d9f862d5b1f95&ts=1762&x=16"

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL POST

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers