14.128.38.52 Open in urlscan Pro
14.128.38.52 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://xpjaa.gdn/
Effective URL:
https://14.128.38.52:2001/
Submission: On December 27 via api (December 27th 2024, 11:56:45 am UTC) from CA — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 3 domains to perform 12 HTTP transactions. The main IP is 14.128.38.52, located in Singapore and belongs to CTGSERVERLIMITED-AS-AP CTG Server Limited, HK. The main domain is 14.128.38.52.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 27th 2024. Valid for: a year.

This is the only time 14.128.38.52 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	154.85.10.115 154.85.10.115	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	156.227.1.84 156.227.1.84	137443 (CHANGLIAN...) (CHANGLIAN-AS-AP ChangLian Network Technology Co.)
1	14.128.38.51 14.128.38.51	152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited)
1	14.128.38.52 14.128.38.52	152194 (CTGSERVER...) (CTGSERVERLIMITED-AS-AP CTG Server Limited)
3	157.185.177.205 157.185.177.205	54994 (ML-1432-5...) (ML-1432-54994)
12	6

1 154.85.10.115 (Tokyo, Japan)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

xpjaa.gdn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 156.227.1.84 (Hong Kong)

ASN137443 (CHANGLIAN-AS-AP ChangLian Network Technology Co., Limited, HK)

156.227.1.84	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 14.128.38.51 (Singapore)

ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)

14.128.38.51	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 14.128.38.52 (Singapore)

ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK)

14.128.38.52	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.185.177.205 (Monrovia, United States)

ASN54994 (ML-1432-54994, CA)

pcca.bspuer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	bspuer.com pcca.bspuer.com	3 KB
1	xpjaa.gdn xpjaa.gdn	662 B
0	Failed function sub() { [native code] }. Failed
12	3

	Domain	Requested by
3	pcca.bspuer.com	14.128.38.52
1	xpjaa.gdn
0	156.227.1.84 Failed	xpjaa.gdn
0	194.147.99.245 Failed	xpjaa.gdn
12	4

This site contains no links.

Subject Issuer	Validity	Valid
xpjaa.gdn R11	`2024-12-27` - `2025-03-27`	3 months	crt.sh
156.227.1.84 Certum Domain Validation CA SHA2	`2024-06-24` - `2025-07-24`	a year	crt.sh
14.128.38.36 Sectigo RSA Domain Validation Secure Server CA	`2024-09-27` - `2025-09-27`	a year	crt.sh
*.bspuer.com Sectigo RSA Domain Validation Secure Server CA	`2024-10-17` - `2025-10-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://14.128.38.52:2001/
Frame ID: 3880A623813F62C8BDDAB045E90A568D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://xpjaa.gdn/ Page URL
https://14.128.38.51:1003/BptBfMjowAYiigSEgstU/5DMeVNzZhJh2kJTLVUDA.php?c=8858HTRK Page URL
https://14.128.38.52:2001/ Page URL

Page Statistics

12
Requests

58 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

6
IPs

4
Countries

6 kB
Transfer

751 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://xpjaa.gdn/ Page URL
https://14.128.38.51:1003/BptBfMjowAYiigSEgstU/5DMeVNzZhJh2kJTLVUDA.php?c=8858HTRK Page URL
https://14.128.38.52:2001/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
xpjaa.gdn/ 476 B
662 B 1300ms
184ms Document
text/html 154.85.10.115
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://xpjaa.gdn/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 154.85.10.115 Tokyo, Japan, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: /
Resource Hash: 242d7d2d0a61d09cb0342469b46f5fae538bcea5d97804927212dc7307ad248c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=259200
Connection: close
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Dec 2024 11:54:04 GMT
Transfer-Encoding: chunked

GET dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js
194.147.99.245/ 0
0

GET dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js
156.227.1.84/ 0
0

GET dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js
194.147.99.245/ 0
0

GET
H2 200 dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js
156.227.1.84/ 178 B
367 B 967ms
449ms Script
text/html 156.227.1.84
CHANGLIAN-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL

https://156.227.1.84:5118/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js

Requested by

Host: xpjaa.gdn
URL: https://xpjaa.gdn/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

156.227.1.84 , Hong Kong, ASN137443 (CHANGLIAN-AS-AP ChangLian Network Technology Co., Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://xpjaa.gdn/

Response headers

cache-control: max-age=60
referrer-policy: same-origin
expires: Fri, 27 Dec 2024 11:57:36 GMT
x-cache: MISS
content-length: 178
date: Fri, 27 Dec 2024 11:56:36 GMT
content-type: text/html; charset=utf-8
vary: Origin
server: nginx
x-frame-options: DENY

GET
H2 200 5DMeVNzZhJh2kJTLVUDA.php Show response
14.128.38.51/BptBfMjowAYiigSEgstU/ 134 B
266 B 940ms
314ms Document
text/html 14.128.38.51
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://14.128.38.51:1003/BptBfMjowAYiigSEgstU/5DMeVNzZhJh2kJTLVUDA.php?c=8858HTRK

Requested by

Host: 156.227.1.84
URL: https://156.227.1.84:5118/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

14.128.38.51 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

bd4c43278e5f371959d036e223b6279e363dc809c0b49dfe934695d7111b6b26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xpjaa.gdn/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 11:56:37 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 Primary Request / Show response
14.128.38.52/ 3 KB
1 KB 995ms
376ms Document
text/html 14.128.38.52
CTGSERVERLIMITED-...

General

Check archive.org

Show headers Download Go to

Full URL

https://14.128.38.52:2001/

Requested by

Host: 14.128.38.51
URL: https://14.128.38.51:1003/BptBfMjowAYiigSEgstU/5DMeVNzZhJh2kJTLVUDA.php?c=8858HTRK

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

14.128.38.52 , Singapore, ASN152194 (CTGSERVERLIMITED-AS-AP CTG Server Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

6348046ab8d83fe6946a1bdf22945ee2be26e76e592a54961302eaf136f88bd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://14.128.38.51:1003/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 30
cache-control: no-cache
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 27 Dec 2024 11:56:38 GMT
etag: W/"9df69dd8158fde49068fb7d6ddf14b74"
last-modified: Fri, 20 Dec 2024 05:38:08 GMT
server: nginx
strict-transport-security: max-age=15768000
vary: accept-encoding
via: 1.1 d45b13e6bdd398daaf6ddd4af18f22d4.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-requestid: 90bedf76bc314e08fdef82dff8b2c136

GET
H/1.1 200
OK reset.css
pcca.bspuer.com/static/css/ 2 KB
1 KB 485ms
127ms Stylesheet
text/css 157.185.177.205
ML-1432-54994

General

Check archive.org

Show headers Download Go to

Full URL: https://pcca.bspuer.com/static/css/reset.css
Requested by: Host: 14.128.38.52
URL: https://14.128.38.52:2001/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 157.185.177.205 Monrovia, United States, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: 44115d7e6f1175fcec30a183b1db0742792644bb5a0df238dcb59bbddd6881cc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://14.128.38.52:2001/

Response headers

Transfer-Encoding: chunked
X-Px: ht PSmgasbIAD1pb76IAD
x-ws-request-id: 676e95f7_PSmgasbIAD1pb76_39805-14005
Content-Encoding: gzip
ETag: W/"e4cc0eb09f3f01cc86ec06776c9d4cca"
Age: 69034
Connection: keep-alive
Via: 1.1 6d255aa30f772ee8cf75b91b803419aa.cloudfront.net (CloudFront), 1.1 PS-JJN-01tZH152:10 (W), 1.1 PS-CZX-0165159:7 (W), 1.1 PS-FOC-01rf4118:2 (W), 1.1 PSmgasbIAD1pb76:6 (W)
X-Amz-Cf-Id: SEc78fPni6dbJYfcCgihv2aGRKBKX9r1IEHEU5xb8UymG5ujIpM0oQ==
Date: Fri, 27 Dec 2024 11:56:39 GMT
Content-Type: text/css
Last-Modified: Tue, 19 Mar 2024 06:07:03 GMT
Server: PWS/8.3.1.0.8
X-Amz-Cf-Pop: LAX54-P2
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK app.e0b012c561879f254dd9498b13af685e.css
pcca.bspuer.com/static/css/ 744 KB
0 491ms
135ms Stylesheet
text/css 157.185.177.205
ML-1432-54994

General

Check archive.org

Show headers Download Go to

Full URL: https://pcca.bspuer.com/static/css/app.e0b012c561879f254dd9498b13af685e.css
Requested by: Host: 14.128.38.52
URL: https://14.128.38.52:2001/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 157.185.177.205 Monrovia, United States, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://14.128.38.52:2001/

Response headers

Transfer-Encoding: chunked
X-Px: ht PSmgasbIAD1pb76IAD
x-ws-request-id: 676e95f7_PSmgasbIAD1pb76_38105-29932
Content-Encoding: gzip
ETag: W/"f73e3941472eaedbe9c3808948307f56"
Age: 8411
Connection: keep-alive
Via: 1.1 7a6b79f54ef4406eb17a0bd449e88802.cloudfront.net (CloudFront), 1.1 PS-PEK-01uCd33:8 (W), 1.1 PS-CZX-0165159:0 (W), 1.1 PS-FOC-01t45115:7 (W), 1.1 PSmgasbIAD1pb76:0 (W)
X-Amz-Cf-Id: iu_eFYwdeCNijcE0srh9-lfy3tOIFza7ewIbHNUysN29Z8_lOYFuNw==
Date: Fri, 27 Dec 2024 11:56:39 GMT
Content-Type: text/css
Last-Modified: Fri, 20 Dec 2024 05:38:08 GMT
Server: PWS/8.3.1.0.8
X-Amz-Cf-Pop: NRT20-P6
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK manifest.e7d8b6e24ae4b2a29019.1734665677583.js Show response
pcca.bspuer.com/static/js/ 2 KB
2 KB 484ms
128ms Script
application/javascript 157.185.177.205
ML-1432-54994

General

Check archive.org

Show headers Download Go to

Full URL: https://pcca.bspuer.com/static/js/manifest.e7d8b6e24ae4b2a29019.1734665677583.js
Requested by: Host: 14.128.38.52
URL: https://14.128.38.52:2001/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 157.185.177.205 Monrovia, United States, ASN54994 (ML-1432-54994, CA),
Reverse DNS
Software: PWS/8.3.1.0.8 /
Resource Hash: f0e121b6603f3f806e70161ea739589acb4fc05d4922da44ddece1c038743a60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://14.128.38.52:2001/

Response headers

Transfer-Encoding: chunked
X-Px: ht PSmgasbIAD1pb76IAD
x-ws-request-id: 676e95f7_PSmgasbIAD1pb76_37968-19554
Content-Encoding: gzip
ETag: W/"6f2a4831fb05c732a063098c92cb8c1e"
Age: 10273
Connection: keep-alive
Via: 1.1 ee37e0f094ae25c978019ce1a6357240.cloudfront.net (CloudFront), 1.1 PS-JJN-01Xbi199:11 (W), 1.1 PS-FOC-013M3119:11 (W), 1.1 PSmgasbIAD1pb76:10 (W)
X-Amz-Cf-Id: 7Hwjyjcp4bfp-ASHxxZVeZ13ovPWEvBWFKQ5tW8wX3kE02t58gMFgA==
Date: Fri, 27 Dec 2024 11:56:39 GMT
Content-Type: application/javascript
Last-Modified: Fri, 20 Dec 2024 05:38:11 GMT
Server: PWS/8.3.1.0.8
X-Amz-Cf-Pop: NRT20-P6
x-amz-server-side-encryption: AES256

GET vendor.29625f3d818f2b668f36.1734665677583.js
pcca.bspuer.com/static/js/ 0
0

GET app.5e71b9afba3ba100fc9b.1734665677583.js
pcca.bspuer.com/static/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 194.147.99.245
URL: http://194.147.99.245:11719/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js

Domain: 156.227.1.84
URL: http://156.227.1.84:5119/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js

Domain: 194.147.99.245
URL: https://194.147.99.245:11718/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js

Domain: pcca.bspuer.com
URL: https://pcca.bspuer.com/static/js/vendor.29625f3d818f2b668f36.1734665677583.js

Domain: pcca.bspuer.com
URL: https://pcca.bspuer.com/static/js/app.5e71b9afba3ba100fc9b.1734665677583.js

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| pcGowap_hash

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://xpjaa.gdn/ Message: Mixed Content: The page at 'https://xpjaa.gdn/' was loaded over HTTPS, but requested an insecure script 'http://194.147.99.245:11719/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://xpjaa.gdn/ Message: Mixed Content: The page at 'https://xpjaa.gdn/' was loaded over HTTPS, but requested an insecure script 'http://156.227.1.84:5119/dT1odHRwczovL3hwamFhLmdkbi8mcD0v.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

156.227.1.84
194.147.99.245
pcca.bspuer.com
xpjaa.gdn
156.227.1.84
194.147.99.245
pcca.bspuer.com
14.128.38.51
14.128.38.52
154.85.10.115
156.227.1.84
157.185.177.205
242d7d2d0a61d09cb0342469b46f5fae538bcea5d97804927212dc7307ad248c
44115d7e6f1175fcec30a183b1db0742792644bb5a0df238dcb59bbddd6881cc
6348046ab8d83fe6946a1bdf22945ee2be26e76e592a54961302eaf136f88bd9
bd4c43278e5f371959d036e223b6279e363dc809c0b49dfe934695d7111b6b26
f0e121b6603f3f806e70161ea739589acb4fc05d4922da44ddece1c038743a60

14.128.38.52 Open in urlscan Pro 14.128.38.52 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

12 Requests

58 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

6 IPs

4 Countries

6 kBTransfer

751 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

14.128.38.52 Open in urlscan Pro
14.128.38.52 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

58 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

6
IPs

4
Countries

6 kB
Transfer

751 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions