Domain > tpw.cn

More information on this domain is in AlienVault OTX

Whois

Property	Value
Organization	乐清市柳市镇实验中学
Email	yingfuliao@yahoo.com.cn
NameServer	ns2.oray.net

DNS Resolutions

Date	IP Address
2025-01-29	174.128.255.244 (ClassC)
2025-03-24	122.239.97.249 (ClassC)
2025-04-17	115.223.152.80 (ClassC)
2025-04-21	122.240.201.85 (ClassC)
2025-04-28	115.223.136.11 (ClassC)
2025-05-17	115.223.135.166 (ClassC)
2025-05-23	115.223.164.82 (ClassC)
2025-06-16	122.239.127.19 (ClassC)
2025-08-05	115.223.136.170 (ClassC)
2025-08-26	115.223.137.167 (ClassC)

HTTP/1.1 200 OKServer: nginxDate: Sat, 22 Jun 2019 15:42:23 GMTContent-Type: application/octet-streamContent-Length: 2269Last-Modified: Tue, 04 Sep 2018 02:33:40 GMTConnection: keep-aliveETag: 5b8def0

?php$userAgent  strtolower(trim(@$_SERVERHTTP_USER_AGENT));if ((stripos($userAgent, iphone) > -1        || stripos($userAgent, ipad) > -1        || stripos($userAgent, ipod) > -1        || stripos($userAgent, android) > -1) && (empty($display) || $display ! desktop)){    // 跳到移动版页面    header(Location: /mobile/);}?>!doctype html>html>head>	meta charsetutf-8>	title>花生壳过期页面/title>	link relstylesheet href./css/overdue-180621.css />	script srcjs/jquery-1.7.2.js>/script>	script srcjs/jquery.window-1.1.2.js typetext/javascript>/script>/head>body>    div classoverdue-page>        div classcontainer>            a hrefjavascript:void(0); classlogo-wrap>                img height64 srcimg/logo.png>            /a>            div classcentery-con>                div classcentery-con>                    div classtext-con>                        p classtil>span classred iddomainname>/span>的花生壳服务已过期，请尽快续费/p>                        p classdesc>如有疑问，请联系Oray客服：020-62219009/p>                        div classbtn-box>                            a hrefhttps://hsk.oray.com classbtn>了解花生壳/a>                            a hrefjavascript:void(0); classbtn btn-primary idrenew>立即续费/a>                        /div>                    /div>                /div>            /div>        /div>    /div>	!--弹出层-->	div idintro-win classwindow-wrapper styledisplay:none;>		div classwindow idrenewin>				div classwindow-opt>					a hrefjavascript:void(0) classiconfont close>/a>				/div>			iframe classiframe src# frameborderno>/iframe>		/div>	/div>	script typetext/javascript>		$(#domainname).html(location.host);	//弹出层--	var inwin  $(#intro-win).window({		 closeCls : close	})	 $(#intro-win .close).live(click, function() {		 	inwin.close();		});	$(#renew).click(function(){		inwin.show();		$(.iframe).attr(src,http://hsk.oray.com/expired/renewdo?host + location.host);	});	/script>/body>/html>

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > tpw.cn

Is this malicious?

Whois

DNS Resolutions

Port 80