g551004.com Open in urlscan Pro
103.249.110.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://g551004.com/
Effective URL:
https://g551004.com:8989/
Submission: On May 17 via api (May 17th 2024, 10:59:24 pm UTC) from US — Scanned from DE

Summary HTTP 33 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 33 HTTP transactions. The main IP is 103.249.110.55, located in Hong Kong and belongs to SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK. The main domain is g551004.com.
TLS certificate: Issued by R3 on May 15th 2024. Valid for: 3 months.

This is the only time g551004.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bet365 (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
6	103.249.110.55 103.249.110.55	133199 (SONDERCLO...) (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited)
10	103.198.200.1 103.198.200.1	() ()
33	3

6 103.249.110.55 (Hong Kong)

ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK)

g551004.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 103.198.200.1 (None, )

ASN- ()

brhrjf.gaokejd.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	gaokejd.xyz brhrjf.gaokejd.xyz	96 KB
6	g551004.com g551004.com	109 KB
33	2

	Domain	Requested by
10	brhrjf.gaokejd.xyz	g551004.com brhrjf.gaokejd.xyz
6	g551004.com	g551004.com
33	2

This site contains no links.

Subject Issuer	Validity	Valid
g551004.com R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh
*.gaokejd.xyz Certum Domain Validation CA SHA2	`2023-11-30` - `2024-11-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://g551004.com:8989/
Frame ID: 7DEE2B4DAECFC65B482C62B010B939A6
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://g551004.com/ Page URL
https://g551004.com:8989/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

33
Requests

48 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

206 kB
Transfer

858 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://g551004.com/ Page URL
https://g551004.com:8989/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

33 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
g551004.com/ 83 B
412 B 1176ms
338ms Document
text/html 103.249.110.55
SONDERCLOUDLIMITE...

General

Check archive.org

Show headers Download Go to

Full URL

https://g551004.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.249.110.55 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),

Reverse DNS

Software

Resource Hash

2dd650e57ede0be6b969d8b04308c3a1cd189a6aa3ed3594ff4fc8ac342910f5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 17 May 2024 22:59:17 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK Primary Request / Show response
g551004.com/ 432 KB
76 KB 1675ms
715ms Document
text/html 103.249.110.55
SONDERCLOUDLIMITE...

General

Check archive.org

Show headers Download Go to

Full URL

https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.249.110.55 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),

Reverse DNS

Software

Resource Hash

a828d7702b8def1edcabe1cafc3451c8c5c597d80a4a1e3afca032d3537c5b86

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://g551004.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 17 May 2024 22:59:19 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-html-cache: HIT-3600
out-line: gb-site-110
uuid: -

GET
H/1.1 404
Not Found favicon.ico
g551004.com/ 552 B
729 B 334ms
334ms Other
text/html 103.249.110.55
SONDERCLOUDLIMITE...

General

Check archive.org

Show headers Download Go to

Full URL

https://g551004.com/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.249.110.55 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 22:59:18 GMT
Connection: keep-alive
Content-Length: 552
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK gui-base.css
brhrjf.gaokejd.xyz/ftl/commonPage/themes/ 81 KB
17 KB 3663ms
429ms Stylesheet
text/css 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-base.css

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-03 /

Resource Hash

03bae6f265bda27347f4697d37ddb03335678cf0a76d5a246ee1b02463294599

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 09:55:01 GMT
Content-Encoding: gzip
Age: 133461
x-link-via: xg21:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-03, HIT from KS-CLOUD-XG-FOREIGN-21-09
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 17118
Last-Modified: Wed, 10 Apr 2024 05:30:19 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-03
ETag: W/"661623eb-14596"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 32b3e13272676463f5254259e49cf75b
Expires: Sat, 15 Jun 2024 09:55:01 GMT

GET
H/1.1 200
OK gui-skin-default.css
brhrjf.gaokejd.xyz/ftl/commonPage/themes/ 31 KB
7 KB 3661ms
429ms Stylesheet
text/css 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-skin-default.css

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-36-02 /

Resource Hash

42a5a785e7ab2956f273d32e8c4a03e91a57a1c55cc9e952da66724bd9d48b5b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 06:26:27 GMT
Content-Encoding: gzip
Age: 577975
x-link-via: xg21:443;xg36:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-36-02, HIT from KS-CLOUD-XG-FOREIGN-21-07
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 6253
Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-36-02
ETag: W/"64ad1569-7b6e"
Vary: Accept-Encoding, Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 5809f203472c5228cf811fa1ce739c1c
Expires: Mon, 10 Jun 2024 06:26:27 GMT

GET
H/1.1 200
OK common.css
brhrjf.gaokejd.xyz/ftl/bet365-1761/themes/style/ 19 KB
5 KB 3663ms
430ms Stylesheet
text/css 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/bet365-1761/themes/style/common.css

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-05 /

Resource Hash

3f01d819d9341c2c85647a64a9fa180d9d378811eb3ca1fc5cf7a6ca3bdc98f3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 09:55:00 GMT
Content-Encoding: gzip
Age: 133462
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-21-15
X-Cache: MISS
Connection: keep-alive
uuid: -
Content-Length: 4200
Last-Modified: Wed, 18 Oct 2023 01:45:40 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"652f38c4-4d04"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 9e8512a5b9869fd7604fcc5c90159a6b
Expires: Sat, 15 Jun 2024 09:55:00 GMT

GET
H/1.1 200
OK bootstrap-dialog.min.css
brhrjf.gaokejd.xyz/ftl/bet365-1761/themes/style/ 3 KB
1 KB 3664ms
430ms Stylesheet
text/css 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/bet365-1761/themes/style/bootstrap-dialog.min.css

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-04 /

Resource Hash

7fd1c34d205f2165ee1b3cc3c2fe54af6f115c58bbd849907c3cf2be6814b159

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 09:55:00 GMT
Content-Encoding: gzip
Age: 133462
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-FOREIGN-21-01
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 625
Last-Modified: Thu, 05 Oct 2023 06:35:45 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: W/"651e5941-adc"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: fcc815a60dcf33b2c94685fc33a03c34
Expires: Sat, 15 Jun 2024 09:55:00 GMT

GET
H/1.1 200
OK i18n.js Show response
g551004.com/commonPage/lan/ 1 KB
1 KB 1720ms
1612ms Script
application/javascript 103.249.110.55
SONDERCLOUDLIMITE...

General

Check archive.org

Show headers Download Go to

Full URL

https://g551004.com:8989/commonPage/lan/i18n.js?t=1715986759.095

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.249.110.55 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),

Reverse DNS

Software

Resource Hash

fce915d3aa194479219a273e7b157ca2e1876c5117d8c3953a2dac222f761afe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 22:59:21 GMT
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Connection: keep-alive
uuid: 01761-01-00000000-171598676190fe
out-line: gb-site-110

GET
H/1.1 200
OK ads1.png
g551004.com/ftl/commonPage/zh_CN/pubads/images/ 12 KB
12 KB 992ms
336ms Image
image/png 103.249.110.55
SONDERCLOUDLIMITE...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g551004.com:8989/ftl/commonPage/zh_CN/pubads/images/ads1.png

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.249.110.55 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),

Reverse DNS

Software

Resource Hash

01cf3c6ca09d7b6003faf27cdf6ff31dc52ec67f73070a6c81bfcb50b7b9ea4c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 22:59:20 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
ETag: "5d848f4f-2e75"
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
out-line: gb-site-110
uuid: -
Content-Length: 11893
Expires: Sat, 18 May 2024 22:59:20 GMT

GET
H/1.1 200
OK ads2.png
g551004.com/ftl/commonPage/zh_CN/pubads/images/ 19 KB
19 KB 1034ms
348ms Image
image/png 103.249.110.55
SONDERCLOUDLIMITE...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g551004.com:8989/ftl/commonPage/zh_CN/pubads/images/ads2.png

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.249.110.55 , Hong Kong, ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK),

Reverse DNS

Software

Resource Hash

13e5348ceb8b66112851439602497e44bcb574bf16794598bce46340f784d533

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 22:59:20 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
ETag: "5d848f4f-4bbc"
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
out-line: gb-site-110
uuid: -
Content-Length: 19388
Expires: Sat, 18 May 2024 22:59:20 GMT

GET
H/1.1 200
OK jquery-1.11.3.min.js Show response
brhrjf.gaokejd.xyz/ftl/commonPage/js/jquery/ 94 KB
33 KB 2670ms
423ms Script
application/javascript 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/js/jquery/jquery-1.11.3.min.js

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-04 /

Resource Hash

329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 09:52:50 GMT
Content-Encoding: gzip
Age: 133592
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-FOREIGN-21-07
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 33545
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: W/"5d848f4f-176d4"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 921c9ce46f489e4efe06b44b2b958e7c
Expires: Sat, 15 Jun 2024 09:52:50 GMT

GET
H/1.1 200
OK float.js Show response
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 7 KB
3 KB 2629ms
416ms Script
application/javascript 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/js/float.js

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-36-09 /

Resource Hash

1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 06:47:39 GMT
Content-Encoding: gzip
Age: 576703
x-link-via: xg21:443;xg36:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-36-09, HIT from KS-CLOUD-XG-FOREIGN-21-10
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 1929
Last-Modified: Thu, 26 Aug 2021 07:50:18 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-36-09
ETag: W/"612747ba-1b2f"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 84447acce2ef00bac3bd3b7a1d99fdcd
Expires: Mon, 10 Jun 2024 06:47:39 GMT

GET
H/1.1 200
OK idangerous.swiper.min.js Show response
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 44 KB
12 KB 349ms
348ms Script
application/javascript 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/js/idangerous.swiper.min.js

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-02 /

Resource Hash

1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 09:52:51 GMT
Content-Encoding: gzip
Age: 133592
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-FOREIGN-21-06
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 11957
Last-Modified: Fri, 11 Aug 2023 04:30:09 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"64d5b951-b083"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 47cd892ad93beee354fb84dd3f8a044f
Expires: Sat, 15 Jun 2024 09:52:51 GMT

GET Comet.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/websocket/ 0
0

GET
H/1.1 200
OK CometMarathon.js Show response
brhrjf.gaokejd.xyz/ftl/commonPage/js/websocket/ 12 KB
4 KB 319ms
319ms Script
application/javascript 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/js/websocket/CometMarathon.js

Requested by

Host: g551004.com
URL: https://g551004.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-36-04 /

Resource Hash

e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://g551004.com:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 11 May 2024 06:31:56 GMT
Content-Encoding: gzip
Age: 577647
x-link-via: xg21:443;xg36:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-36-04, HIT from KS-CLOUD-XG-FOREIGN-21-03
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 3316
Last-Modified: Thu, 21 Apr 2022 04:30:12 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-36-04
ETag: W/"6260ddd4-2f13"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-206
X-Cdn-Request-ID: 9532d1a129baff80fea22a2ab90d144d
Expires: Mon, 10 Jun 2024 06:31:56 GMT

GET PopUp.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/websocket/ 0
0

GET message_zh_CN.js
g551004.com/ 0
0

GET lazyload.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 0
0

GET gui-base.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 0
0

GET bootstrap-dialog.min.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 0
0

GET layer.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 0
0

GET jquery.super-marquee.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/jquery/ 0
0

GET jquery.nicescroll.min.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/jquery/ 0
0

GET jquery.validate.js
brhrjf.gaokejd.xyz/061410/rcenter/common/js/jquery/plugins/jquery.validate/ 0
0

GET jquery.validate.extend.msites.js
brhrjf.gaokejd.xyz/061410/rcenter/common/js/gamebox/common/ 0
0

GET moment.js
brhrjf.gaokejd.xyz/ftl/commonPage/js/ 0
0

GET pc.css
brhrjf.gaokejd.xyz/ftl/commonPage/themes/hb/css/ 0
0

GET gb.validation.min.js
brhrjf.gaokejd.xyz/061410/rcenter/common/static/js/ 0
0

GET gb.validation.min.css
brhrjf.gaokejd.xyz/061410/rcenter/common/static/css/ 0
0

GET special_3.jpg
brhrjf.gaokejd.xyz/ftl/commonPage/zh_CN/mobileTopic/images/ 0
0

GET
H/1.1 200
OK hongbao.css
brhrjf.gaokejd.xyz/ftl/commonPage/themes/ 53 KB
6 KB 334ms
333ms Stylesheet
text/css 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/hongbao.css

Requested by

Host: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-base.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-04 /

Resource Hash

5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-base.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 17 May 2024 09:40:26 GMT
Content-Encoding: gzip
Age: 47937
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-FOREIGN-21-10
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 5666
Last-Modified: Thu, 30 Mar 2023 06:38:07 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: W/"64252e4f-d530"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: e76588cb6efbca0fcc7db77a25789701
Expires: Sun, 16 Jun 2024 09:40:26 GMT

GET
H/1.1 200
OK gui-layer.css
brhrjf.gaokejd.xyz/ftl/commonPage/themes/ 50 KB
7 KB 727ms
727ms Stylesheet
text/css 103.198.200.1

General

Check archive.org

Show headers Download Go to

Full URL

https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-layer.css

Requested by

Host: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-base.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.198.200.1 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XG-FOREIGN-12-01 /

Resource Hash

9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/gui-base.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 10:02:56 GMT
Content-Encoding: gzip
Age: 132987
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-21-07
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 6923
Last-Modified: Thu, 17 Aug 2023 08:10:09 GMT
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"64ddd5e1-c760"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: fc669ee029da3575b81921849d059d4c
Expires: Sat, 15 Jun 2024 10:02:56 GMT

GET partner-hongtu-white.png
g551004.com/ftl/commonPage/images/partner/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/websocket/Comet.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/websocket/PopUp.js

Domain: g551004.com
URL: https://g551004.com:8989/message_zh_CN.js?v=1715766348884

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/lazyload.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/gui-base.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/bootstrap-dialog.min.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/layer.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/jquery/jquery.super-marquee.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/jquery/jquery.nicescroll.min.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/js/moment.js

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/themes/hb/css/pc.css

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/061410/rcenter/common/static/js/gb.validation.min.js?v=1715766348884

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/061410/rcenter/common/static/css/gb.validation.min.css

Domain: brhrjf.gaokejd.xyz
URL: https://brhrjf.gaokejd.xyz/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg

Domain: g551004.com
URL: https://g551004.com:8989/ftl/commonPage/images/partner/partner-hongtu-white.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bet365 (Entertainment)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://g551004.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

brhrjf.gaokejd.xyz
g551004.com
brhrjf.gaokejd.xyz
g551004.com
103.198.200.1
103.249.110.55
01cf3c6ca09d7b6003faf27cdf6ff31dc52ec67f73070a6c81bfcb50b7b9ea4c
03bae6f265bda27347f4697d37ddb03335678cf0a76d5a246ee1b02463294599
13e5348ceb8b66112851439602497e44bcb574bf16794598bce46340f784d533
1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27
1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271
2dd650e57ede0be6b969d8b04308c3a1cd189a6aa3ed3594ff4fc8ac342910f5
329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10
3f01d819d9341c2c85647a64a9fa180d9d378811eb3ca1fc5cf7a6ca3bdc98f3
42a5a785e7ab2956f273d32e8c4a03e91a57a1c55cc9e952da66724bd9d48b5b
5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894
7fd1c34d205f2165ee1b3cc3c2fe54af6f115c58bbd849907c3cf2be6814b159
9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf
a828d7702b8def1edcabe1cafc3451c8c5c597d80a4a1e3afca032d3537c5b86
e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf
fce915d3aa194479219a273e7b157ca2e1876c5117d8c3953a2dac222f761afe

g551004.com Open in urlscan Pro 103.249.110.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

33 Requests

48 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

206 kBTransfer

858 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

g551004.com Open in urlscan Pro
103.249.110.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

48 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

206 kB
Transfer

858 kB
Size

0
Cookies

33 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!