This address, img2.360buyimg.com, is a subdomain that doesn't work as a regular website. It returns an HTTP 405 error, which means the server rejects browser requests. That's a strong sign this isn't meant for people to visit directly. It's almost certainly a backend server or CDN endpoint used by JD.com (formerly 360buy) to serve images or other static files. Legitimate infrastructure subdomains like this don't need contact pages or privacy policies because they aren't collecting user data. But if you ended up here by accident, there's nothing to see. The site has no web archive history and no clear ownership for this exact subdomain, though the parent domain is linked to a major company. The best advice is straightforward: don't try to browse this URL. If you're looking for JD.com's main site, go directly to jd.com. For a safety check on img2.360buyimg.com, the real question isn't whether it's a scam — it's whether it's usable, and the answer is no.
No — img2.360buyimg.com doesn't look safe
In plain English
This subdomain returns an error and appears to be part of the backend infrastructure for JD.com, not a consumer-facing website. There's no way to browse or interact with it normally, and it lacks any contact or transparency information. Avoid visiting it directly.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site uses a valid SSL certificate from a reputable issuer and enforces HTTPS, but it still accepts outdated TLS versions that browsers have deprecated. That's a minor gap for a backend server, not a dealbreaker.
The subdomain itself has no separate WHOIS record, which is normal for subdomains of large companies. The parent domain (360buyimg.com) is tied to JD.com, a well-known Chinese e-commerce company, so the ownership is effectively known.
The site isn't on any blacklists, but there's no history in the Wayback Machine. For a subdomain of an established brand, the lack of any archived snapshots is unusual and suggests this specific address might be very new or rarely accessed directly.
There is no about page, no contact information, and no social media presence. For a site someone might land on, this is a critical gap. It offers no way to understand who runs it or how to reach them.
No privacy policy or terms of service are present. For a backend infrastructure subdomain that isn't collecting user data, this is less concerning than it would be for a storefront. Still, it's not a consumer-focused site.
The server returns an HTTP 405 error, meaning it refuses the request method. This site is not designed for direct browser access. Multiple IP addresses suggest a content delivery network, but the lack of email handling and DNSSEC is fine for a static resource server.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.