The scan of www.d.cn on 23 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with www.d.cn?

3 analysed samples communicate with this URL, including Zusy, Mira, Phishing.

How was www.d.cn checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

www.d.cn - URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned www.d.cn and returned a unknown verdict (score -6). The page resolved to 138.113.225.73. 26 domains and 2 IPs were contacted, over 8 HTTP requests. 3 malware samples communicate with this URL (Zusy, Mira, Phishing). The request followed 2 redirects before landing. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -6) · Confidence 12%
Scanned URL: https://d.cn/
Domain: www.d.cn · IP: 138.113.225.73
Server: Apache/2.4.57 (Unix) OpenSSL/1.1.1f mod_jk/1.2.40
Page title: 当乐网(d.cn)_手游从当乐开始！
HTTP status: 200 · text/html; charset=UTF-8
TLS issuer: C=US, O=DigiCert, Inc., CN=GeoTrust G2 TLS CN RSA4096 SHA256 2022 CA1 · valid to Feb 13 23: · subject C=CN, ST=北京市, O=北京当乐信息技术有限公司, CN=*.d.cn
Evidenced operator: 北京当乐信息技术有限公司
HTTP requests captured: 8
Scan tier: fast · observed 2026-08-23 13:07:40 UTC

Redirect chain

https://d.cn/
http://www.d.cn/
https://www.d.cn/

Malware communicating with this URL (3)

These samples were observed contacting or being served from www.d.cn. Each links to its full analysis.

Zusy - referenced · 56052b4d8b8714595dfc6459d8917107 · first seen 2026-08-23
Mira - referenced · 6dc9f476578a29cd15135e8353cbe1a0 · first seen 2026-08-18
Phishing - referenced · 0316eed6203eebf613b56743cf22e785 · first seen 2026-08-14

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
Cross-host redirect chain

Detected technologies

Apache
jQuery

Contacted infrastructure

138.113.225.73 - AS54994 Meteverse Limited. (Singapore)
115.182.198.115 - AS4847 Beijing Teletron Telecom Engineering Co., Ltd. (China)

Observed indicators

www.d.cn
raw.d.cn
x.d.cn
ng.d.cn
news.d.cn
app.d.cn
oauth.d.cn
avatar.d.cn
img-android.d.cn
img.d.cn
res5.d.cn
3g.d.cn
v.d.cn
android.d.cn
v.douyin.com
weibo.com
www.toutiao.com
open.d.cn
kf.d.cn
tsm.miit.gov.cn

Questions about www.d.cn

Is www.d.cn safe?: The scan of www.d.cn on 23 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with www.d.cn?: 3 analysed samples communicate with this URL, including Zusy, Mira, Phishing.
How was www.d.cn checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of www.d.cn

Scanned on MalwareAnalyzer by Cyble · Open interactive scan