xxrkktg.cyou Open in urlscan Pro
103.143.159.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://xxrkktg.cyou/
Submission Tags: @phish_report
Submission: On August 27 via api (August 27th 2024, 3:54:32 pm UTC) from FI — Scanned from FI

Summary HTTP 18 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 103.143.159.9, located in Hong Kong and belongs to HIITL-AS-AP Hong Kong FireLine Network LTD, HK. The main domain is xxrkktg.cyou.
TLS certificate: Issued by R10 on August 6th 2024. Valid for: 3 months.

This is the only time xxrkktg.cyou was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address		AS Autonomous System
18	103.143.159.9 103.143.159.9		136950 (HIITL-AS-...) (HIITL-AS-AP Hong Kong FireLine Network LTD)
18	1

18 103.143.159.9 (Hong Kong)

ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK)

xxrkktg.cyou	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	xxrkktg.cyou xxrkktg.cyou	23 MB
18	1

	Domain	Requested by
18	xxrkktg.cyou	xxrkktg.cyou
18	1

This site contains links to these domains. Also see Links.

Domain
etchusces.selacain.shop
twitter.com

Subject Issuer	Validity	Valid
xxrkktg.cyou R10	`2024-08-06` - `2024-11-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xxrkktg.cyou/
Frame ID: 785A94EBBD645916316CEDCAA76C5F42
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram-Telegram

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23453 kB
Transfer

23481 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://etchusces.selacain.shop/TG/win_x64-tg09.exe
Title: home

Search URL Search Domain Scan URL

URL: https://twitter.com/telegram
Title: Twitter

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
xxrkktg.cyou/ 10 KB
2 KB 2140ms
277ms Document
text/html 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL

https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

ea3710df95218e0d9f76ddd57fe5ccaae3e8fe1280f892068f161f8e0055140f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Tue, 27 Aug 2024 15:54:14 GMT
etag: W/"669ce228-287c"
last-modified: Sun, 21 Jul 2024 10:25:44 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 style.css
xxrkktg.cyou/style/ 62 KB
13 KB 281ms
279ms Stylesheet
text/css 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL

https://xxrkktg.cyou/style/style.css

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

64e7a48d6b1ffad1238d25ecf2353fe3a008a7f3426a11138cf149bb07d4fbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Tue, 15 Aug 2023 17:37:44 GMT
server: nginx
etag: W/"64dbb7e8-f74a"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Wed, 28 Aug 2024 03:54:14 GMT

GET
H2 200 navright1.png
xxrkktg.cyou/style/ 3 KB
3 KB 561ms
559ms Image
image/png 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/navright1.png

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

33d6be96b9ceed78dc9b32bb3fcdf2814836635d2d376d746f42728c35538f9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-a75"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2677
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 navright.png
xxrkktg.cyou/style/ 1 KB
1 KB 562ms
562ms Image
image/png 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/navright.png

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-4f8"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1272
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 logo.png
xxrkktg.cyou/style/ 11 KB
11 KB 479ms
476ms Image
image/png 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/logo.png

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

88afe4caad9d3ef9d7b4a5301d1b2b4378b54d233038079f0145e2f387f4eed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-2cb9"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 11449
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 session3.jpg
xxrkktg.cyou/style/ 27 KB
27 KB 754ms
752ms Image
image/jpeg 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/session3.jpg

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

f123a86b52bc881b75b0afe9201a8cf1ed563c59e44b84c2c21f58e80ce3b44b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-6c4d"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 27725
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 window.jpg
xxrkktg.cyou/style/ 31 KB
31 KB 754ms
751ms Image
image/jpeg 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/window.jpg

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

c443c78239489b2ee75618b26460dae55a87a132b74807780ceab30130eb7a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:04 GMT
server: nginx
etag: "64dbb70c-7a9f"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 31391
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 section4i9.gif
xxrkktg.cyou/style/ 3 MB
3 MB 755ms
752ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i9.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

321fb7936dada76ce957347f61cd05be88581c5c3532d5cf87d346ba677474f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-2ffe3d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3145277
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 section4i8.gif
xxrkktg.cyou/style/ 3 MB
3 MB 756ms
754ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i8.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

3da30018745ee9d2032bb71f2907a2fa3647d1660d402200d35f161854b0ef48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-29342a"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2700330
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 section4i7.gif
xxrkktg.cyou/style/ 3 MB
3 MB 756ms
754ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i7.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

e21cceb8262a91f878fe4e5202139793e9cd3a02da2dd08d2dc4180cd29ac402

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-32c4dc"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3327196
expires: Thu, 26 Sep 2024 15:54:14 GMT

GET
H2 200 section4i6.gif
xxrkktg.cyou/style/ 2 MB
2 MB 756ms
754ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i6.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

116029bd091ec390064879df7dad05e601e284413f53b9d51978875b85dc7471

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-24ffe3"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2424803
expires: Thu, 26 Sep 2024 15:54:15 GMT

GET
H2 200 section4i5.gif
xxrkktg.cyou/style/ 2 MB
2 MB 756ms
755ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i5.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

f8152a8d500807f824571c3256320bbf578cdce88d45d0fd048a6422f71c272b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-1e8e27"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2002471
expires: Thu, 26 Sep 2024 15:54:15 GMT

GET
H2 200 section4i4.gif
xxrkktg.cyou/style/ 3 MB
3 MB 757ms
755ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i4.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

b285715d34361c4fed5058a10eb830bf2dd61126518477ded340dd7f95221417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-343916"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3422486
expires: Thu, 26 Sep 2024 15:54:15 GMT

GET
H2 200 section4i3.gif
xxrkktg.cyou/style/ 2 MB
2 MB 754ms
753ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i3.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

15d01829fac9057a922b9168d68d9ea940d7612b0128ae9b67fe69a1dd10e62d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-2267fe"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2254846
expires: Thu, 26 Sep 2024 15:54:15 GMT

GET
H2 200 section4i2.gif
xxrkktg.cyou/style/ 2 MB
2 MB 755ms
753ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i2.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

abdbfc359a2954fadb7d335a20c2ae29cc5b00dbd538e88b03d612f978654e45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-219b67"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2202471
expires: Thu, 26 Sep 2024 15:54:15 GMT

GET
H2 200 section4i1.gif
xxrkktg.cyou/style/ 2 MB
2 MB 755ms
754ms Image
image/gif 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xxrkktg.cyou/style/section4i1.gif

Requested by

Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),

Reverse DNS

Software

nginx /

Resource Hash

58a9156f7cb557eb157598032fd67ade899a5a8b635455fbeb46c7bfa0f122e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Aug 2023 17:34:06 GMT
server: nginx
etag: "64dbb70e-24dbae"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2415534
expires: Thu, 26 Sep 2024 15:54:15 GMT

GET
H2 404 skin.css
xxrkktg.cyou/style/ 0
0 859ms
859ms Stylesheet
text/html 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xxrkktg.cyou/style/skin.css
Requested by: Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/style/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://xxrkktg.cyou/style/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:15 GMT
server: nginx
content-length: 548
content-type: text/html

GET
H2 404 favicon.ico
xxrkktg.cyou/ 548 B
611 B 277ms
277ms Other
text/html 103.143.159.9
HIITL-AS-AP Hong ...

General

Check archive.org

Show headers Download Go to

Full URL: https://xxrkktg.cyou/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

Referer: https://xxrkktg.cyou/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 27 Aug 2024 15:54:27 GMT
server: nginx
content-length: 548
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| navright

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xxrkktg.cyou/style/skin.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://xxrkktg.cyou/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

xxrkktg.cyou
103.143.159.9
116029bd091ec390064879df7dad05e601e284413f53b9d51978875b85dc7471
15d01829fac9057a922b9168d68d9ea940d7612b0128ae9b67fe69a1dd10e62d
321fb7936dada76ce957347f61cd05be88581c5c3532d5cf87d346ba677474f6
33d6be96b9ceed78dc9b32bb3fcdf2814836635d2d376d746f42728c35538f9e
3da30018745ee9d2032bb71f2907a2fa3647d1660d402200d35f161854b0ef48
58a9156f7cb557eb157598032fd67ade899a5a8b635455fbeb46c7bfa0f122e4
64e7a48d6b1ffad1238d25ecf2353fe3a008a7f3426a11138cf149bb07d4fbd7
88afe4caad9d3ef9d7b4a5301d1b2b4378b54d233038079f0145e2f387f4eed9
abdbfc359a2954fadb7d335a20c2ae29cc5b00dbd538e88b03d612f978654e45
b285715d34361c4fed5058a10eb830bf2dd61126518477ded340dd7f95221417
c443c78239489b2ee75618b26460dae55a87a132b74807780ceab30130eb7a68
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e21cceb8262a91f878fe4e5202139793e9cd3a02da2dd08d2dc4180cd29ac402
e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2
ea3710df95218e0d9f76ddd57fe5ccaae3e8fe1280f892068f161f8e0055140f
f123a86b52bc881b75b0afe9201a8cf1ed563c59e44b84c2c21f58e80ce3b44b
f8152a8d500807f824571c3256320bbf578cdce88d45d0fd048a6422f71c272b

xxrkktg.cyou Open in urlscan Pro 103.143.159.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

23453 kBTransfer

23481 kBSize

0 Cookies

2 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

2 Console Messages

Security Headers

Indicators

xxrkktg.cyou Open in urlscan Pro
103.143.159.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23453 kB
Transfer

23481 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!