9gzq3jra00.top
Open in
urlscan Pro
20.255.192.214
Public Scan
Submitted URL: https://rbxm9fk3j2aa.top/
Effective URL: https://9gzq3jra00.top:1843/?iv=60011&tt=1728693230
Submission Tags: phishingrod
Submission: On October 12 via api from DE — Scanned from US
Effective URL: https://9gzq3jra00.top:1843/?iv=60011&tt=1728693230
Submission Tags: phishingrod
Submission: On October 12 via api from DE — Scanned from US
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 19 HTTP transactions.
The main IP is 20.255.192.214, located in
Hong Kong, Hong Kong and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is 9gzq3jra00.top.
TLS certificate: Issued by Certum Domain Validation CA SHA2 on August 3rd 2024. Valid for: a year.
This is the only time 9gzq3jra00.top was scanned on urlscan.io!
TLS certificate: Issued by Certum Domain Validation CA SHA2 on August 3rd 2024. Valid for: a year.
This is the only time 9gzq3jra00.top was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 20.255.211.207 20.255.211.207 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 18 | 20.255.192.214 20.255.192.214 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 112.132.119.60 112.132.119.60 | 4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone) | |
| 19 | 3 |
1
112.132.119.60
(China)
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
PTR: 60.119.132.112.adsl-pool.ah.cnuninet.net
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
PTR: 60.119.132.112.adsl-pool.ah.cnuninet.net
| js-tx-kenbos.liy123.cn |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
9gzq3jra00.top
9gzq3jra00.top |
550 KB |
| 1 |
liy123.cn
js-tx-kenbos.liy123.cn |
372 B |
| 1 |
rbxm9fk3j2aa.top
1 redirects
rbxm9fk3j2aa.top |
566 B |
| 19 | 3 |
| Domain | Requested by | |
|---|---|---|
| 18 | 9gzq3jra00.top |
9gzq3jra00.top
|
| 1 | js-tx-kenbos.liy123.cn |
9gzq3jra00.top
|
| 1 | rbxm9fk3j2aa.top | 1 redirects |
| 19 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 41kp6tmtss.top Certum Domain Validation CA SHA2 |
2024-08-03 - 2025-09-02 |
a year | crt.sh |
| *.liy123.cn Certum Domain Validation CA SHA2 |
2024-05-09 - 2025-06-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://9gzq3jra00.top:1843/?iv=60011&tt=1728693230
Frame ID: E058AF0685C482FA59A0FAD75EB276D8
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://rbxm9fk3j2aa.top/
HTTP 301
https://9gzq3jra00.top:1843/?iv=60011&tt=1728693230 Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rbxm9fk3j2aa.top/
HTTP 301
https://9gzq3jra00.top:1843/?iv=60011&tt=1728693230 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
9gzq3jra00.top/ Redirect Chain
|
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index-css.css
9gzq3jra00.top/static/css/ |
1 KB 722 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
iconfontB.css
9gzq3jra00.top/static/css/ |
4 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
guide.css
9gzq3jra00.top/static/css/ |
1 KB 762 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mobile-changebg-newstyle-back.css
9gzq3jra00.top/static/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tk.js
js-tx-kenbos.liy123.cn/xin910417/js/ |
0 372 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
9gzq3jra00.top/static/js/ |
84 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.qrcode.js
9gzq3jra00.top/static/js/ |
16 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
utf.js
9gzq3jra00.top/static/js/ |
2 KB 881 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
HHTraceHelperSiMi_s.js
9gzq3jra00.top/static/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
HHandlerJS.js
9gzq3jra00.top/static/js/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logoA.png
9gzq3jra00.top/static/imgs/ |
61 KB 61 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
back.png
9gzq3jra00.top/static/imgs/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
text.png
9gzq3jra00.top/static/imgs/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
copyT.png
9gzq3jra00.top/static/imgs/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 2 KB |
Font
application/x-font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1-1.jpg
9gzq3jra00.top/static/imgs/ |
178 KB 178 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1-2.jpg
9gzq3jra00.top/static/imgs/ |
20 KB 20 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1-3.jpg
9gzq3jra00.top/static/imgs/ |
179 KB 179 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
9gzq3jra00.top/ |
144 B 223 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| QR8bitByte function| QRCode function| QRPolynomial function| QRRSBlock function| QRBitBuffer object| QRMode object| QRErrorCorrectLevel object| QRMaskPattern object| QRUtil object| QRMath function| utf16to8 function| utf8to16 object| _0x1259 function| _0xb0a2 function| isIos function| android function| isSafari function| Toast function| GetQueryString string| kktoken string| tokenChannel string| QRCodehost function| getTokenAndChannel function| getbackurl function| getbackurlEx function| getlocalParams function| getbrower function| getiosurl function| getTotalStr function| loadtotalEx function| executeLoadEx function| getivs function| getAndroidUrl function| checkIsHarmonyOS function| _download function| _copy function| goBack object| l_ios object| l_android function| _copyEx function| _downIos function| _downAndroid function| isMobile number| bgHeight number| targetHeight number| timeId1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| rbxm9fk3j2aa.top/ | Name: auth_token Value: "2|1:0|10:1728693230|10:auth_token|24:RzJwS1B5Qzkxcnd4dEFaUg==|68a2dabc6f395c0a3da1993b08e11ed3d8b0f61d08a3f74385c99cd365780ae5" |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
9gzq3jra00.top
js-tx-kenbos.liy123.cn
rbxm9fk3j2aa.top
112.132.119.60
20.255.192.214
20.255.211.207
02bac1dcf5e82984057d5d19278bd0317ab79381422ea3e1ca9ecd1142bdd018
041cfc37d3f40534bc78ccb7b0454936acab74901f56c22b7ab46d9f0262ee88
0c968d288e56e4fcb5dd4bea212e73bee6a76fa3d1dced0fd2374037585558cf
0cae459d7081cae3c2ccbce255fec3c0a80741a0b27b09f8ad6afe4cec3b0dfa
12525656d604a5cca334b6625c7cd48dc40575189853d015e8dcde568a28939b
1eea3dd84210679ec8c8e5581f1812c71f4575b8229b843ea9a8bd655f26932b
3329069d256b3a487b6cf2b8ff5dca8c4d2b63ec1192c7d5db2d94a01af0446d
622fdbba8205c61d6bfcf6043e2f5e8de6691d306c98fef5cdfad9f1eb54004d
9462a1502cb0815be7167d89981231eaba5d552e5993aafe5026584fb12d362a
a42f02ece25001a27a3cb5b399ceb2cc75f4a6e5fa97d54c6d3f7bf7ae3162dd
a5637030e0e2826ac27d89fe08466e448e837900f0544b8c641ab62b1df4d874
a6dbad6583b1b87998b0e40714a0c5e1d4c85b35e84b9c9a803608afd470c8d0
c5b73fa11131c4d1cdb983ce89e9ac8ecc7c85f7c89ad888020775ee545250ed
cf338871af7c82f448633b902f9ea6109200671b35792ada3e341e37368c9bf8
cf9f93487e7588aa28b524f55b246b57658b8fab5be8b2872207f4298e98f6de
de7b1328b8d26b0cfe8e95f85e36be8076b7712ddfb7569a59e709fb1121cfb8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e430440eab04259871bf6c4e4af7be79a7723fa321eae394659bc9c4e78014e6
f2248d0ea3546fdb59cdba5b4bb68f978a71dc00cab4c0e29b42d721f770ccb6
ff1de5b088b182c008b85416ad19741af821c79103149c2640e96e3c1634778a