hg5013.cc Open in urlscan Pro
13.75.110.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://hg5013.cc/
Effective URL:
https://hg5013.cc:8989/
Submission: On May 23 via api (May 23rd 2024, 9:39:21 am UTC) from BE — Scanned from DE

Summary HTTP 32 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 32 HTTP transactions. The main IP is 13.75.110.224, located in Hong Kong, Hong Kong and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is hg5013.cc.
TLS certificate: Issued by R3 on May 19th 2024. Valid for: 3 months.

This is the only time hg5013.cc was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bet365 (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
10	13.75.110.224 13.75.110.224	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
12	103.155.16.137 103.155.16.137	() ()
32	3

10 13.75.110.224 (Hong Kong, Hong Kong)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

hg5013.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 103.155.16.137 (None, )

ASN- ()

6qekcy.eveday.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	eveday.me 6qekcy.eveday.me	97 KB
10	hg5013.cc hg5013.cc	120 KB
32	2

	Domain	Requested by
12	6qekcy.eveday.me	hg5013.cc
10	hg5013.cc	hg5013.cc
32	2

This site contains no links.

Subject Issuer	Validity	Valid
hg5013.cc R3	`2024-05-19` - `2024-08-17`	3 months	crt.sh
*.eveday.me Sectigo RSA Domain Validation Secure Server CA	`2024-01-18` - `2025-01-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hg5013.cc:8989/
Frame ID: 09A453A8030F88FE9AF160D68F7EBCA4
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://hg5013.cc/ HTTP 307
https://hg5013.cc/ Page URL
https://hg5013.cc:8989/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

69 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

217 kB
Transfer

986 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hg5013.cc/ HTTP 307
https://hg5013.cc/ Page URL
https://hg5013.cc:8989/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://hg5013.cc/ HTTP 307
https://hg5013.cc/

32 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
hg5013.cc/
Redirect Chain

http://hg5013.cc/
https://hg5013.cc/

81 B
410 B

828ms
263ms

Document
text/html

13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

63ed777c7f261b7c51742e110a85adcbf27c34a936f7502c0ef9fefe529c8513

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Thu, 23 May 2024 09:39:16 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

Redirect headers

Location: https://hg5013.cc/
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK Primary Request / Show response
hg5013.cc/ 381 KB
71 KB 1058ms
531ms Document
text/html 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

90cb297c3c732b5e12851f736f6323f97eea6e4a334709916a55996a7c8c7cef

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://hg5013.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Thu, 23 May 2024 09:39:17 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-html-cache: HIT-3600
out-line: gb-site-051
uuid: -

GET
H/1.1 404
Not Found favicon.ico
hg5013.cc/ 552 B
729 B 259ms
259ms Other
text/html 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:17 GMT
Connection: keep-alive
Content-Length: 552
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK gui-base.css
hg5013.cc/ftl/commonPage/themes/ 81 KB
17 KB 510ms
509ms Stylesheet
text/css 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/ftl/commonPage/themes/gui-base.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

03bae6f265bda27347f4697d37ddb03335678cf0a76d5a246ee1b02463294599

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:18 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Apr 2024 05:30:19 GMT
ETag: W/"661623eb-14596"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
X-Cache: HIT
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=86400
Connection: keep-alive
uuid: -
out-line: gb-site-051
Expires: Fri, 24 May 2024 09:39:18 GMT

GET
H/1.1 200
OK gui-skin-default.css
hg5013.cc/ftl/commonPage/themes/ 31 KB
7 KB 521ms
265ms Stylesheet
text/css 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/ftl/commonPage/themes/gui-skin-default.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

42a5a785e7ab2956f273d32e8c4a03e91a57a1c55cc9e952da66724bd9d48b5b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT
ETag: W/"64ad1569-7b6e"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
X-Cache: HIT
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=86400
Connection: keep-alive
uuid: -
out-line: gb-site-051
Expires: Fri, 24 May 2024 09:39:18 GMT

GET
H/1.1 200
OK common.css
6qekcy.eveday.me/ftl/huangguanvip1666/themes/style/ 31 KB
8 KB 2814ms
349ms Stylesheet
text/css 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/huangguanvip1666/themes/style/common.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-04 /

Resource Hash

08763503b0a927d870cc210821846cac500be417094d610155de60d33b443845

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 10 May 2024 19:32:17 GMT
Content-Encoding: gzip
Age: 1087622
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-04, HIT from KS-CLOUD-XJP-FOREIGN-21-09
X-Cache: MISS
Connection: keep-alive
uuid: -
Content-Length: 7189
Last-Modified: Tue, 01 Mar 2022 02:45:24 GMT
Server: Default-server-KS-CLOUD-XJP-12-04
ETag: W/"621d88c4-7b1f"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 13818e15dceff8b78dd8690d00f26306
Expires: Sun, 09 Jun 2024 19:32:17 GMT

GET
H/1.1 200
OK bootstrap-dialog.min.css
6qekcy.eveday.me/ftl/huangguanvip1666/themes/style/ 2 KB
1 KB 2816ms
352ms Stylesheet
text/css 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/huangguanvip1666/themes/style/bootstrap-dialog.min.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-03 /

Resource Hash

3fcfb5edb031a13551fb7630852d5a1b474339bfb2c8ac97e9596e9e798a7815

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 19 May 2024 14:27:25 GMT
Content-Encoding: gzip
Age: 328315
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-03, HIT from KS-CLOUD-XJP-FOREIGN-21-11
X-Cache: MISS
Connection: keep-alive
uuid: -
Content-Length: 582
Last-Modified: Tue, 01 Mar 2022 02:45:24 GMT
Server: Default-server-KS-CLOUD-XJP-12-03
ETag: W/"621d88c4-8a4"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 275410accb748b2ee577671e0fd2ad78
Expires: Tue, 18 Jun 2024 14:27:25 GMT

GET
H/1.1 200
OK i18n.js Show response
hg5013.cc/commonPage/lan/ 1 KB
1 KB 764ms
254ms Script
application/javascript 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/commonPage/lan/i18n.js?t=1716457157.53

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7083a01fc57dc37120e71632f5bbed2b99e2acc4c107a1c7e5308c06cae141fc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:18 GMT
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Connection: keep-alive
uuid: 01666-01-00000000-1716457158bb53
out-line: gb-site-051

GET
H/1.1 200
OK jquery-1.11.3.min.js Show response
6qekcy.eveday.me/ftl/commonPage/js/jquery/ 94 KB
33 KB 3194ms
379ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/jquery/jquery-1.11.3.min.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-FOREIGN-12-01 /

Resource Hash

329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 15:16:07 GMT
Content-Encoding: gzip
Age: 584593
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-01, HIT from KS-CLOUD-XJP-FOREIGN-21-02
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 33545
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01
ETag: W/"5d848f4f-176d4"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 3d97250d5c255aff6f761012b75cda8a
Expires: Sat, 15 Jun 2024 15:16:07 GMT

GET
H/1.1 200
OK float.js Show response
6qekcy.eveday.me/ftl/commonPage/js/ 7 KB
3 KB 3193ms
363ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/float.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-08 /

Resource Hash

1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 15:16:09 GMT
Content-Encoding: gzip
Age: 584591
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-08, HIT from KS-CLOUD-XJP-FOREIGN-21-09
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 1929
Last-Modified: Thu, 26 Aug 2021 07:50:18 GMT
Server: Default-server-KS-CLOUD-XJP-12-08
ETag: W/"612747ba-1b2f"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 582d724c13982b0649e30dcb2a613538
Expires: Sat, 15 Jun 2024 15:16:09 GMT

GET
H/1.1 200
OK idangerous.swiper.min.js Show response
6qekcy.eveday.me/ftl/commonPage/js/ 44 KB
12 KB 2849ms
379ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/idangerous.swiper.min.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-09 /

Resource Hash

1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 15:16:08 GMT
Content-Encoding: gzip
Age: 584592
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-09, HIT from KS-CLOUD-XJP-FOREIGN-21-11
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 11957
Last-Modified: Fri, 11 Aug 2023 04:30:09 GMT
Server: Default-server-KS-CLOUD-XJP-12-09
ETag: W/"64d5b951-b083"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 32038b68af2d96b0e0523f055b657198
Expires: Sat, 15 Jun 2024 15:16:08 GMT

GET
H/1.1 200
OK Comet.js Show response
6qekcy.eveday.me/ftl/commonPage/js/websocket/ 17 KB
5 KB 3209ms
366ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/websocket/Comet.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-FOREIGN-12-01 /

Resource Hash

6cf6e96f51f13834e233bee9a9040f6eff70601dc0b755e60885b20550b35a9f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 15:16:07 GMT
Content-Encoding: gzip
Age: 584593
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-01, HIT from KS-CLOUD-XJP-FOREIGN-21-08
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 4031
Last-Modified: Mon, 19 Jul 2021 23:50:13 GMT
Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01
ETag: W/"60f60fb5-43bc"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: a65718d9cdb4823c9185c8f4336a0b7a
Expires: Sat, 15 Jun 2024 15:16:07 GMT

GET
H/1.1 200
OK CometMarathon.js Show response
6qekcy.eveday.me/ftl/commonPage/js/websocket/ 12 KB
4 KB 3195ms
365ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/websocket/CometMarathon.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-FOREIGN-12-01 /

Resource Hash

e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 15:16:07 GMT
Content-Encoding: gzip
Age: 584592
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-01, HIT from KS-CLOUD-XJP-FOREIGN-21-21
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 3316
Last-Modified: Thu, 21 Apr 2022 04:30:12 GMT
Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01
ETag: W/"6260ddd4-2f13"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: cfa49a4dd7e3b32ba6e93f027f11f87f
Expires: Sat, 15 Jun 2024 15:16:07 GMT

GET PopUp.js
6qekcy.eveday.me/ftl/commonPage/js/websocket/ 0
0

GET
H/1.1 200 message_zh_CN.js Show response
hg5013.cc/ 32 KB
10 KB 796ms
270ms Script
application/javascript 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/message_zh_CN.js?v=1715766348884

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0aa3002021c50dd94fcd0eb615a6735db1b54723503264f1c24985e0bcdd868b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:18 GMT
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
X-Cache: HIT
Vary: Accept-Encoding
Cache-Control: max-age=86400
Connection: keep-alive
uuid: 01666-01-00000000-1716457158ff44
out-line: gb-site-051
Expires: Fri, 24 May 2024 09:39:18 GMT

GET
H/1.1 200
OK lazyload.js Show response
6qekcy.eveday.me/ftl/commonPage/js/ 12 KB
3 KB 3195ms
366ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/lazyload.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-04 /

Resource Hash

fb513dceb383ebeda507b1e1cc89ab4d73de071d8aa4fc78bc22f66e7fc5a7e4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 15:16:09 GMT
Content-Encoding: gzip
Age: 584591
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-04, HIT from KS-CLOUD-XJP-FOREIGN-21-09
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 2731
Last-Modified: Mon, 07 Aug 2023 03:05:10 GMT
Server: Default-server-KS-CLOUD-XJP-12-04
ETag: W/"64d05f66-2f79"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: ffdd2996d0059722af2021d470386eda
Expires: Sat, 15 Jun 2024 15:16:09 GMT

GET
H/1.1 200
OK gui-base.js Show response
6qekcy.eveday.me/ftl/commonPage/js/ 60 KB
16 KB 3268ms
417ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/js/gui-base.js

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-FOREIGN-12-06 /

Resource Hash

4370313fa317e44140f85bba141ec24c2c9ef674593779d3349d2a44001699d0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 28 Apr 2024 23:40:19 GMT
Content-Encoding: gzip
Age: 2109541
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-06, HIT from KS-CLOUD-XJP-FOREIGN-21-10
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 15779
Last-Modified: Thu, 17 Aug 2023 06:15:09 GMT
Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-06
ETag: W/"64ddbaed-ee5c"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 8e515e19ad6fd513b6e91e4181dec298
Expires: Tue, 28 May 2024 23:40:19 GMT

GET bootstrap-dialog.min.js
6qekcy.eveday.me/ftl/commonPage/js/ 0
0

GET layer.js
6qekcy.eveday.me/ftl/commonPage/js/ 0
0

GET jquery.super-marquee.js
6qekcy.eveday.me/ftl/commonPage/js/jquery/ 0
0

GET jquery.nicescroll.min.js
6qekcy.eveday.me/ftl/commonPage/js/jquery/ 0
0

GET jquery.validate.js
6qekcy.eveday.me/061410/rcenter/common/js/jquery/plugins/jquery.validate/ 0
0

GET jquery.validate.extend.msites.js
6qekcy.eveday.me/061410/rcenter/common/js/gamebox/common/ 0
0

GET moment.js
6qekcy.eveday.me/ftl/commonPage/js/ 0
0

GET
H/1.1 200
OK pc.css
6qekcy.eveday.me/ftl/commonPage/themes/hb/css/ 3 KB
2 KB 2816ms
353ms Stylesheet
text/css 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/ftl/commonPage/themes/hb/css/pc.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-03 /

Resource Hash

5eb4d895bcb33061cda238c8ff4985ede69a866819b980c732cf3802ec101e8d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 28 Apr 2024 23:40:19 GMT
Content-Encoding: gzip
Age: 2109540
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-03, HIT from KS-CLOUD-XJP-FOREIGN-21-21
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 911
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Server: Default-server-KS-CLOUD-XJP-12-03
ETag: W/"5d848f4f-b5d"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 489f27b351ba01d457a27cbf2b70c1e9
Expires: Tue, 28 May 2024 23:40:19 GMT

GET
H/1.1 200
OK gb.validation.min.js Show response
6qekcy.eveday.me/061410/rcenter/common/static/js/ 32 KB
6 KB 2587ms
363ms Script
application/javascript 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/061410/rcenter/common/static/js/gb.validation.min.js?v=1715766348884

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-12-04 /

Resource Hash

f5ca5f543161a6b37ca2bf26c4f3c630fe08323108c77dac1fba6ce755ce6f47

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 06:24:08 GMT
Content-Encoding: gzip
Age: 789312
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-12-04, HIT from KS-CLOUD-XJP-FOREIGN-21-11
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 5207
Last-Modified: Wed, 05 Oct 2022 09:40:30 GMT
Server: Default-server-KS-CLOUD-XJP-12-04
ETag: W/"633d510e-7fd7"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 1fbd1549f81a0b8cabeaa2873b6bb94d
Expires: Thu, 13 Jun 2024 06:24:08 GMT

GET
H/1.1 200
OK gb.validation.min.css
6qekcy.eveday.me/061410/rcenter/common/static/css/ 11 KB
4 KB 2570ms
358ms Stylesheet
text/css 103.155.16.137

General

Check archive.org

Show headers Download Go to

Full URL

https://6qekcy.eveday.me/061410/rcenter/common/static/css/gb.validation.min.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

103.155.16.137 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XJP-FOREIGN-12-01 /

Resource Hash

3043f42fdd97ec607648da79c3abfa6f364404c7594143227c2541d1f0ac6069

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 06:24:07 GMT
Content-Encoding: gzip
Age: 789313
x-link-via: xjp21:443;xjp12:80;
X-Cache-Status: HIT from KS-CLOUD-XJP-FOREIGN-12-01, HIT from KS-CLOUD-XJP-FOREIGN-21-04
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 3788
Last-Modified: Wed, 05 Oct 2022 09:40:30 GMT
Server: Default-server-KS-CLOUD-XJP-FOREIGN-12-01
ETag: W/"633d510e-2d52"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: fedd424e2e3220a443671173e0acde20
Expires: Thu, 13 Jun 2024 06:24:07 GMT

GET special_3.jpg
6qekcy.eveday.me/ftl/commonPage/zh_CN/mobileTopic/images/ 0
0

GET countUp.js
6qekcy.eveday.me/ftl/commonPage/js/countUp/ 0
0

GET
H/1.1 200
OK hongbao.css
hg5013.cc/ftl/commonPage/themes/ 53 KB
6 KB 264ms
257ms Stylesheet
text/css 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/ftl/commonPage/themes/hongbao.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/ftl/commonPage/themes/gui-base.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/ftl/commonPage/themes/gui-base.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Mar 2023 06:38:07 GMT
ETag: W/"64252e4f-d530"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
X-Cache: HIT
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=86400
Connection: keep-alive
uuid: -
out-line: gb-site-051
Expires: Fri, 24 May 2024 09:39:18 GMT

GET
H/1.1 200
OK gui-layer.css
hg5013.cc/ftl/commonPage/themes/ 50 KB
7 KB 272ms
261ms Stylesheet
text/css 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://hg5013.cc:8989/ftl/commonPage/themes/gui-layer.css

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/ftl/commonPage/themes/gui-base.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/ftl/commonPage/themes/gui-base.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Aug 2023 08:10:09 GMT
ETag: W/"64ddd5e1-c760"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
X-Cache: HIT
X-Frame-Options: SAMEORIGIN
Cache-Control: max-age=86400
Connection: keep-alive
uuid: -
out-line: gb-site-051
Expires: Fri, 24 May 2024 09:39:18 GMT

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 87c23bd5fa0b8f85ff28f773aefb2aa1503ba4b868fcf83f641de189177d9030

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H/1.1 200
OK partner-hongtu-gold.png
hg5013.cc/ftl/commonPage/images/partner/ 32 KB
0 530ms
526ms Image
image/png 13.75.110.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hg5013.cc:8989/ftl/commonPage/images/partner/partner-hongtu-gold.png

Requested by

Host: hg5013.cc
URL: https://hg5013.cc:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.75.110.224 Hong Kong, Hong Kong, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://hg5013.cc:8989/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 23 May 2024 09:39:20 GMT
Last-Modified: Mon, 08 Apr 2024 09:30:15 GMT
ETag: "6613b927-12a60"
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
out-line: gb-site-051
uuid: -
Content-Length: 76384
Expires: Fri, 24 May 2024 09:39:20 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/websocket/PopUp.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/bootstrap-dialog.min.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/layer.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/jquery/jquery.super-marquee.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/jquery/jquery.nicescroll.min.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/moment.js

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg

Domain: 6qekcy.eveday.me
URL: https://6qekcy.eveday.me/ftl/commonPage/js/countUp/countUp.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bet365 (Entertainment)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://hg5013.cc/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6qekcy.eveday.me
hg5013.cc
6qekcy.eveday.me
103.155.16.137
13.75.110.224
03bae6f265bda27347f4697d37ddb03335678cf0a76d5a246ee1b02463294599
08763503b0a927d870cc210821846cac500be417094d610155de60d33b443845
0aa3002021c50dd94fcd0eb615a6735db1b54723503264f1c24985e0bcdd868b
1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27
1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271
3043f42fdd97ec607648da79c3abfa6f364404c7594143227c2541d1f0ac6069
329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10
3fcfb5edb031a13551fb7630852d5a1b474339bfb2c8ac97e9596e9e798a7815
42a5a785e7ab2956f273d32e8c4a03e91a57a1c55cc9e952da66724bd9d48b5b
4370313fa317e44140f85bba141ec24c2c9ef674593779d3349d2a44001699d0
5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894
5eb4d895bcb33061cda238c8ff4985ede69a866819b980c732cf3802ec101e8d
63ed777c7f261b7c51742e110a85adcbf27c34a936f7502c0ef9fefe529c8513
6cf6e96f51f13834e233bee9a9040f6eff70601dc0b755e60885b20550b35a9f
7083a01fc57dc37120e71632f5bbed2b99e2acc4c107a1c7e5308c06cae141fc
87c23bd5fa0b8f85ff28f773aefb2aa1503ba4b868fcf83f641de189177d9030
90cb297c3c732b5e12851f736f6323f97eea6e4a334709916a55996a7c8c7cef
9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf
e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf
f5ca5f543161a6b37ca2bf26c4f3c630fe08323108c77dac1fba6ce755ce6f47
fb513dceb383ebeda507b1e1cc89ab4d73de071d8aa4fc78bc22f66e7fc5a7e4

hg5013.cc Open in urlscan Pro 13.75.110.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

32 Requests

69 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

217 kBTransfer

986 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

hg5013.cc Open in urlscan Pro
13.75.110.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

69 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

217 kB
Transfer

986 kB
Size

0
Cookies

32 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!