URL: https://post.xuristar.top/
Submission: On October 16 via automatic, source certstream-suspicious — Scanned from GB

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 35.209.102.20, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is post.xuristar.top.
TLS certificate: Issued by E5 on October 16th 2024. Valid for: 3 months.
This is the only time post.xuristar.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 35.209.102.20 15169 (GOOGLE)
3 163.171.157.20 54994 (ML-1432-5...)
1 2602:816:5001... 54113 (FASTLY)
3 162.247.243.29 54113 (FASTLY)
9 4
Apex Domain
Subdomains
Transfer
3 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 245
1 KB
3 benchmarkemail.com
ui.benchmarkemail.com — Cisco Umbrella Rank: 156144
12 KB
2 xuristar.top
post.xuristar.top
23 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 592
19 KB
9 4
Domain Requested by
3 bam.nr-data.net post.xuristar.top
3 ui.benchmarkemail.com post.xuristar.top
2 post.xuristar.top
1 js-agent.newrelic.com post.xuristar.top
9 4

This site contains no links.

Subject Issuer Validity Valid
post.xuristar.top
E5
2024-10-16 -
2025-01-14
3 months crt.sh
benchmarkemail.com
E5
2024-07-24 -
2024-10-22
3 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-03-21 -
2025-04-22
a year crt.sh
*.nr-data.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-12 -
2025-08-12
a year crt.sh

This page contains 1 frames:

Primary Page: https://post.xuristar.top/
Frame ID: 2A93B1DF8FDABFDD102BF44349BF9F20
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Verified

Page Statistics

9
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

55 kB
Transfer

121 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
post.xuristar.top/
32 KB
12 KB
Document
General
Full URL
https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.209.102.20 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
20.102.209.35.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 /
Resource Hash
7e03481c4a1bb33bf8ef7d3200fd1f37bc13324afd66fe6b3505ca0c0c91b302
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection
keep-alive, Keep-Alive
Content-Encoding
gzip
Content-Length
11430
Date
Wed, 16 Oct 2024 09:10:01 GMT
Expires
Wed, 16 Oct 2024 09:10:01 GMT
Keep-Alive
timeout=5, max=500
Referrer-Policy
strict-origin
Server
Microsoft-IIS/10.0
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
cache-control
private, max-age=0
content-type
text/html; charset=utf-8
via
1.1 google
x-aspnet-version
4.0.30319
benchmark-logo.svg
ui.benchmarkemail.com/images/landingpage/
4 KB
5 KB
Image
General
Full URL
https://ui.benchmarkemail.com/images/landingpage/benchmark-logo.svg
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.171.157.20 Frankfurt am Main, Germany, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software
PWS/8.3.1.0.8 /
Resource Hash
7da8967c40d92babe9e50a3bbccc3422faf6437331178e14aa64bef581d3adc1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://post.xuristar.top/

Response headers

X-Px
ms PSdgflkfFRA2po75FRA,ht PSfgblPAR2ff185CDG
ETag
"0b1118ed58ed51:0"
X-Content-Type-Options
nosniff
Date
Wed, 16 Oct 2024 09:10:02 GMT
Content-Type
image/svg+xml
Last-Modified
Wed, 30 Oct 2019 03:53:14 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Cache-Control
max-age=2592000
x-ws-request-id
670f82ea_PSdgflkfFRA2lp71_420-59404
Connection
keep-alive
Referrer-Policy
strict-origin-when-cross-origin
Via
1.1 VM-SEA-01ACQ129:2 (W), 1.1 PSmglsjLAX2nr164:5 (W), 1.1 PSfgblPAR2ff185:7 (W), 1.1 PSdgflkfFRA2po75:0 (W)
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
4449
X-XSS-Protection
0
Server
PWS/8.3.1.0.8
benchmark-laptop-check.svg
ui.benchmarkemail.com/images/landingpage/
4 KB
5 KB
Image
General
Full URL
https://ui.benchmarkemail.com/images/landingpage/benchmark-laptop-check.svg
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.171.157.20 Frankfurt am Main, Germany, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software
PWS/8.3.1.0.8 /
Resource Hash
23d96af9b5dfec44ab3a061d27253743d70f6934ba3136b11aa9a843cf61a3c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://post.xuristar.top/

Response headers

X-Px
ms PSdgflkfFRA2po75FRA,ht PSfgblPAR2ff185CDG
ETag
"80aaf418da8ed51:0"
X-Content-Type-Options
nosniff
Date
Wed, 16 Oct 2024 09:10:02 GMT
Content-Type
image/svg+xml
Last-Modified
Wed, 30 Oct 2019 04:25:45 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Cache-Control
max-age=2592000
x-ws-request-id
670f82ea_PSdgflkfFRA2lp71_41014-40205
Connection
keep-alive
Referrer-Policy
strict-origin-when-cross-origin
Via
1.1 PS-SJC-01Blr173:1 (W), 1.1 PS-YUL-01gBp94:12 (W), 1.1 hx171:8 (W), 1.1 PSfgblPAR2ff185:4 (W), 1.1 PSdgflkfFRA2po75:0 (W)
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
4432
X-XSS-Protection
0
Server
PWS/8.3.1.0.8
bg-line-up.svg
ui.benchmarkemail.com/images/landingpage/
830 B
2 KB
Image
General
Full URL
https://ui.benchmarkemail.com/images/landingpage/bg-line-up.svg
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.171.157.20 Frankfurt am Main, Germany, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software
PWS/8.3.1.0.8 /
Resource Hash
888ceb12667495b65a138b485f9e5dc214fb2e8d225872eb1b05118fd678c5b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://post.xuristar.top/

Response headers

X-Px
ms PSdgflkfFRA2po75FRA,ht PSfgblPAR2ff185CDG
ETag
"0fb1531d58ed51:0"
X-Content-Type-Options
nosniff
Date
Wed, 16 Oct 2024 09:10:02 GMT
Content-Type
image/svg+xml
Last-Modified
Wed, 30 Oct 2019 03:50:38 GMT
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Cache-Control
max-age=2592000
x-ws-request-id
670f82ea_PSdgflkfFRA2lp71_43354-19053
Connection
keep-alive
Referrer-Policy
strict-origin-when-cross-origin
Via
1.1 VM-SEA-01ACQ129:2 (W), 1.1 PSmglsjLAX2ui163:7 (W), 1.1 PSfgblPAR2ff185:8 (W), 1.1 PSdgflkfFRA2po75:0 (W)
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
830
X-XSS-Protection
0
Server
PWS/8.3.1.0.8
nr-spa-1216.min.js
js-agent.newrelic.com/
49 KB
19 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-spa-1216.min.js
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2602:816:5001::39 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://post.xuristar.top/

Response headers

strict-transport-security
max-age=300
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
content-encoding
br
etag
"63e2df852d15ab21d7ff8fc4363222e8"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
x-cache
HIT
content-length
19141
date
Wed, 16 Oct 2024 09:10:03 GMT
last-modified
Wed, 18 Oct 2023 21:31:16 GMT
content-type
application/javascript
x-served-by
cache-lcy-eglc8600092-LCY
x-cache-hits
425863
vary
Accept-Encoding
favicon.ico
post.xuristar.top/
31 KB
12 KB
Other
General
Full URL
https://post.xuristar.top/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
35.209.102.20 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
20.102.209.35.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 /
Resource Hash
7aa488d281bd8838b9cbb7d1eb003102978dce4346539b8c909abea399a1c479
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://post.xuristar.top/

Response headers

Content-Encoding
gzip
X-Content-Type-Options
nosniff
Expires
Wed, 16 Oct 2024 09:10:03 GMT
Keep-Alive
timeout=5, max=499
Date
Wed, 16 Oct 2024 09:10:03 GMT
content-type
text/html; charset=utf-8
Vary
Accept-Encoding,User-Agent
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
cache-control
private, max-age=0
x-aspnet-version
4.0.30319
Connection
keep-alive, Keep-Alive
Referrer-Policy
strict-origin
via
1.1 google
Content-Length
11293
X-XSS-Protection
1; mode=block
Server
Microsoft-IIS/10.0
f6d053e389
bam.nr-data.net/1/
79 B
568 B
Script
General
Full URL
https://bam.nr-data.net/1/f6d053e389?a=493222421&v=1216.487a282&to=NldTZxcHDUZYWkdcWw8dcGA1SQdQX1hGWUBPU0JDHQ%3D%3D&rst=2989&ck=1&ref=https://post.xuristar.top/&ap=74&be=1192&fe=2465&dc=1235&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1729069800511,%22n%22:0,%22f%22:2,%22dn%22:16,%22dne%22:273,%22c%22:273,%22s%22:281,%22ce%22:741,%22rq%22:742,%22rp%22:972,%22rpe%22:1082,%22dl%22:984,%22di%22:1234,%22ds%22:1235,%22de%22:1236,%22dc%22:2465,%22l%22:2465,%22le%22:2467%7D,%22navigation%22:%7B%7D%7D&fp=2750&fcp=2750&jsonp=NREUM.setToken
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b39746c07da532b57661a77d04dc53159691290bc22dbc1a413b1443909c07b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://post.xuristar.top/

Response headers

access-control-expose-headers
Date
timing-allow-origin
*
Connection
close
cross-origin-resource-policy
cross-origin
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
access-control-allow-credentials
true
access-control-allow-origin
*
Content-Length
79
date
Wed, 16 Oct 2024 09:10:04 GMT
content-type
text/javascript
x-served-by
cache-lon420145-LON
f6d053e389
bam.nr-data.net/resources/1/
36 B
357 B
XHR
General
Full URL
https://bam.nr-data.net/resources/1/f6d053e389?a=493222421&v=1216.487a282&to=NldTZxcHDUZYWkdcWw8dcGA1SQdQX1hGWUBPU0JDHQ%3D%3D&rst=3694&ck=1&ref=https://post.xuristar.top/&st=1729069800511
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9f1ec44fc7bac989b21bba9385a581017c131e7f3368afe812352011b3cc8fdf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://post.xuristar.top/

Response headers

Connection
keep-alive
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin
https://post.xuristar.top
Content-Length
36
date
Wed, 16 Oct 2024 09:10:04 GMT
content-type
text/plain
x-served-by
cache-lhr-egll1980088-LHR
f6d053e389
bam.nr-data.net/events/1/
24 B
344 B
XHR
General
Full URL
https://bam.nr-data.net/events/1/f6d053e389?a=493222421&v=1216.487a282&to=NldTZxcHDUZYWkdcWw8dcGA1SQdQX1hGWUBPU0JDHQ%3D%3D&rst=3702&ck=1&ref=https://post.xuristar.top/
Requested by
Host: post.xuristar.top
URL: https://post.xuristar.top/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://post.xuristar.top/

Response headers

Connection
keep-alive
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
access-control-allow-origin
https://post.xuristar.top
Content-Length
24
date
Wed, 16 Oct 2024 09:10:04 GMT
content-type
image/gif
x-served-by
cache-lcy-eglc8600056-LCY

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| newrelic function| __nr_require

2 Cookies

Domain/Path Name / Value
post.xuristar.top/ Name: hasVisited
Value: 1
.nr-data.net/ Name: JSESSIONID
Value: a67f557130731049

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block