technology software

cryptocurrency blockchain

government public service

documentation technical

Chinese

Within an unknown top-level domain, '124.223.76.60:8080' is registered with no subdomain. The registrable portion '124.223.76.60' spans 13 characters containing 0 vowels alongside 0 consonants; it also includes 10 digits. Segmentation suggests 4 words: 124, 223, 76, 60. The median word length lands at 2.5 characters. No strong language cues emerged from the frequency lists.

033c419056d2daab0ce1798fbbc3fc99e3620d67cc7818d163a43e3d94f42cde

6f3786cbb4440a5e2437403d70990ddffb1d13bcb831dcd74c3ef69ebb58b638

f736b5742c50fb2efd86fce128baae94f1202cc3f7952107da8a989505ece315

877d1ebc1291f96d471dafd8d7bf73b6c2f5d5f45b64fed5d42a9505aecaca7a

894e929606c14b8bba4dcfd63a26a5b1a30594e170a158fb8c917dde67cee741

60c29fc1f5e703b2ca8deb2a021c22ab9680b24965c45a25f5c5bf19a7dbd014

98d00c8195fc6d1487b51a98c6f8bb5f3a01f35e85d60fa10688d2da3cceb7ca

154b784f3de94b51cc11c68e9f6b7889db07c30bb0285b02802b770b1662df00

96d8499499f4f7a320ec7371865d11ce408985258e41341aad21da54bac76190

04fa57b84611f652f07fb0a35989c93afe245f4de760bb8d709167e03a4dbf18

901417645c687df4a859e46dc4a898bdfff40e3975517b10950ac4a0a9bf74f1

2566d5e81aaa5c6afec28fea05721d9147b671f23dc96a3142790707e4ad983b

2c40803d43dd441ec47f3bcdf18a14c1131f6f6b3ed6096ddb93aaae2a9852ad

4775bbe1c34d927e0728a04738c7453fc51d80964a325b1d16ca8be068ed864b

2250c67ff0222848480388a1af4aeb3c04aa1575230c533f14accc4a1c945550

39fd5159bfe554a265565f4dca503f798c2317c0cd5957d4b348ececfdf6dca2

b8056e49f5443b88ee02197110274ef42b7afff7620ff214401091101d77b9b0

22f85aebaaf40b6456718c9025362e0926deee4d9ab61855673a16ecbd3de8fd

88cad04cecf92453d4d3e0f30009674f992a8610db0f3ca7a89b4307fdbe705f

a4489c845e554f3d13796b99fa823ba3d900ea78b24cba675e6b4d5cffb349e5

36b7cce5ea33c920d7df5dfeca6f7bbd360fec7843e1f8359427c4e9e2d0e87c

74df697df8c76f94b53e78300bdb4436016b7f137f10f5477f0a2aaf3fc18d6d

8e9dc79a9a3cdc701f37b2019e89749d2c7304dc975c49e40b6b8e64d21f8898

5da23e1850a1d3741bc44ee5cf7dc83be82eadc764ad7e6db994efecc4c1b15a

22f775b60730a95a8a39b632981dd302f2f383496b68977e3770259798752f44

b55d6af4c1569eeaa00169bbbe678aa3a09e86491fcb11b1f89d0c85a3b831a6

374d246092385c5d5cc02e2caf1de6be269ab66e135c13d8b18ca7f29d694b19

6ed723386507bd45c3155ca3c92052c2cc7f35b084de617adfe9b356930c8266

4a7e7ac46543c041d262a6feda3077b8a29dc51851dbc6674f1e6ee7c3cd19e3

5a398770ad1e3f64acaf5608486c7184298be3a70abe98ebb2e2208483519518

6ea57b12dee3ae484afc9c2d23a877e37daf38179309e939b8d1182aa32b20a5

11c2fd418b358a41c5447ee32fcf8b182dc4ece129033a118c7fce9ee30788eb

bfc64e147baddeaf6ef6449263857faf99e686db695c34dcf02cf2d6c951e6d7

4a21b29eea543ab14b2e3629e9160f55d952b2895a749a35330558824689230b

327cab87c54f2e90740e3bd54231f213f4a3303c7c8f9375399976c578194e85

43829d90de6c8d5d40624cd111d0b65d66a411990909f96b10cd0c8594911505

c88376baa3b0752fabb17220a6c3904377f521f79790f696a7a4e34debbb8018

8d46039a5a5c7c614e18e7df6b87c7097e2bc410970becffdd8265aff5958ecd

277f53350848b420059396528bea903bf32a17cb80c5e39d7ed55616de9a60da

08e48e9fc0a4d4515843b915e81c9a6fd6b235b26a34f0b75efcc0463926851c

add9d2e269b110c0d295df4cf1325a7434019d37038d4325ba899b8bd6d9b374

d668ae4a0a5522e441dade1383a1f0cdc6717c5abefa893925520e442af14544

52926f67ac65a5117704a33ddc5857f7c620b19cb0aad0f1dc615fd5872ea4ee

52373739d06a6c48fcb19c4a6433a4646c174f8d88c0a66dc32093d071bb6202

bf212f11929a97b862ae2af2b8cf7769d4295ff48c650c977d2758a06a5f9daf

e99c967ceefadf17ee00a5829976df23afcf1177b54b9acc7692904ee28c68db

06b0589566e576e48d0da0c357c804bef26fd09f7e7e8e9fee3ee2d582a51b48

7a7e93669dc81fbb4be17adb856b9a3473d8a91d606f8fa5b9127178137056a2

DOMPurify allows tampering by prototype pollution

DOMPurify allows Cross-site Scripting (XSS)

When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array whose properties are looked up by name, making it susceptible to prototype pollution. If Array.prototype has been polluted with an event handler attribute name (e.g. onclick), DOMPurify will allow that event handler to survive sanitization, resulting in DOM-based XSS.

DOMPurify's ADD_ATTR predicate function mechanism (via EXTRA_ELEMENT_HANDLING.attributeCheck) short-circuits URI validation when the predicate returns true. This allows unsafe protocols such as javascript: to survive sanitization in href and similar attributes, enabling DOM-based XSS when such links are activated.

DOMPurify is vulnerable to mutation-XSS (mXSS) when sanitized HTML is embedded into special raw-text wrapper elements such as xmp, script, iframe, noembed, noframes, or noscript before being assigned via innerHTML. Attacker-controlled sequences like </xmp> inside attribute values close the raw-text context during the second parse, causing the sanitized output to mutate into executable markup.

DOMPurify has a logic inconsistency where FORBID_TAGS is not checked when a function-based ADD_TAGS (tagCheck) returns true. Due to short-circuit evaluation, the FORBID_TAGS check is never evaluated, allowing explicitly forbidden elements to pass through sanitization when EXTRA_ELEMENT_HANDLING.tagCheck is configured.

DOMPurify has an asymmetric security inconsistency where FORBID_TAGS does not win over a function-based ADD_TAGS predicate, while FORBID_ATTR correctly wins over ADD_ATTR. When ADD_TAGS is provided as a function that returns true, explicitly forbidden tags such as iframe and form pass through sanitization with their attributes intact.

DOMPurify's SAFE_FOR_TEMPLATES feature fails to strip Mustache/template expressions when RETURN_DOM or RETURN_DOM_FRAGMENT is used. The final string-scrubbing pass that removes expressions like {{...}} is skipped in DOM-return mode, and split text nodes (e.g. from removed intermediate tags) can rejoin to form a complete expression that template-evaluating frameworks like Vue 2 will execute.

DOMPurify versions 3.0.1 through 3.3.3 are vulnerable to an XSS bypass via prototype pollution. When no CUSTOM_ELEMENT_HANDLING is specified, the fallback plain object inherits from Object.prototype; if an attacker has polluted Object.prototype.tagNameCheck and Object.prototype.attributeNameCheck with permissive regexes, DOMPurify allows arbitrary custom elements with event handler attributes through sanitization.

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

4ed913f5ffd0817b8c0df7e6e4c535efb1e6c1eb7b8069f53af12b9e90109eef

33fcafc31a013417c087daa44b6a56303b7c62ef9b420f609845e3a323d67521

42cccc555b63847fca74c26f66a2754cd463ba24015a028b3d792c3851e40b1d

width=device-width, initial-scale=1.0, viewport-fit=cover, interactive-widget=resizes-content

viewport

theme-color

format-detection

mobile-web-app-capable

apple-mobile-web-app-capable

apple-mobile-web-app-status-bar-style

apple-mobile-web-app-title

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

James Tian

Jimmy Xiao

TencentCloud


        (function () {
            var initialPage = String(window.location.hash || '').replace(/^#/, '').split('?')[0];
            if (initialPage && initialPage !== 'dashboard') {
                document.documentElement.classList.add('initial-route-pending');
            }
        })();
    

Marked

CyberStrikeAI

regular

⚠️ High Risk - http://124.223.76.60:8080/

Requests	IP Address	Location	AS Autonomous System
58	124.223.76.60	Shanghai, Shanghai, China	AS45090Shenzhen Tencent Computer Systems Company Limited
58	1	-	-

Security Scan Report: 124.223.76.60

Summary

AI Security Verdict

High Risk

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History