URL: https://xxrkktg.cyou/
Submission: On July 25 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 103.143.159.9, located in Hong Kong and belongs to HIITL-AS-AP Hong Kong FireLine Network LTD, HK. The main domain is xxrkktg.cyou.
TLS certificate: Issued by R10 on July 21st 2024. Valid for: 3 months.
This is the only time xxrkktg.cyou was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
17 103.143.159.9 136950 (HIITL-AS-...)
17 1
Apex Domain
Subdomains
Transfer
17 xxrkktg.cyou
xxrkktg.cyou
19 MB
17 1
Domain Requested by
17 xxrkktg.cyou xxrkktg.cyou
17 1

This site contains links to these domains. Also see Links.

Domain
etchusces.selacain.shop
twitter.com
Subject Issuer Validity Valid
xxrkktg.cyou
R10
2024-07-21 -
2024-10-19
3 months crt.sh

This page contains 1 frames:

Primary Page: https://xxrkktg.cyou/
Frame ID: 5B59E87227EE498570F69BD6B5724F20
Requests: 17 HTTP requests in this frame

Screenshot

Page Title

Telegram-Telegram

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

19094 kB
Transfer

22479 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
xxrkktg.cyou/
10 KB
2 KB
Document
General
Full URL
https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
ea3710df95218e0d9f76ddd57fe5ccaae3e8fe1280f892068f161f8e0055140f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Thu, 25 Jul 2024 05:20:42 GMT
etag
W/"669ce228-287c"
last-modified
Sun, 21 Jul 2024 10:25:44 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
style.css
xxrkktg.cyou/style/
62 KB
13 KB
Stylesheet
General
Full URL
https://xxrkktg.cyou/style/style.css
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
64e7a48d6b1ffad1238d25ecf2353fe3a008a7f3426a11138cf149bb07d4fbd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Tue, 15 Aug 2023 17:37:44 GMT
server
nginx
etag
W/"64dbb7e8-f74a"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Thu, 25 Jul 2024 17:20:43 GMT
navright1.png
xxrkktg.cyou/style/
3 KB
3 KB
Image
General
Full URL
https://xxrkktg.cyou/style/navright1.png
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
33d6be96b9ceed78dc9b32bb3fcdf2814836635d2d376d746f42728c35538f9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:04 GMT
server
nginx
etag
"64dbb70c-a75"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2677
expires
Sat, 24 Aug 2024 05:20:43 GMT
navright.png
xxrkktg.cyou/style/
1 KB
1 KB
Image
General
Full URL
https://xxrkktg.cyou/style/navright.png
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:04 GMT
server
nginx
etag
"64dbb70c-4f8"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1272
expires
Sat, 24 Aug 2024 05:20:43 GMT
logo.png
xxrkktg.cyou/style/
11 KB
11 KB
Image
General
Full URL
https://xxrkktg.cyou/style/logo.png
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
88afe4caad9d3ef9d7b4a5301d1b2b4378b54d233038079f0145e2f387f4eed9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:04 GMT
server
nginx
etag
"64dbb70c-2cb9"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
11449
expires
Sat, 24 Aug 2024 05:20:43 GMT
session3.jpg
xxrkktg.cyou/style/
27 KB
27 KB
Image
General
Full URL
https://xxrkktg.cyou/style/session3.jpg
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
f123a86b52bc881b75b0afe9201a8cf1ed563c59e44b84c2c21f58e80ce3b44b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:04 GMT
server
nginx
etag
"64dbb70c-6c4d"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
27725
expires
Sat, 24 Aug 2024 05:20:43 GMT
window.jpg
xxrkktg.cyou/style/
31 KB
31 KB
Image
General
Full URL
https://xxrkktg.cyou/style/window.jpg
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
c443c78239489b2ee75618b26460dae55a87a132b74807780ceab30130eb7a68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:04 GMT
server
nginx
etag
"64dbb70c-7a9f"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
31391
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i9.gif
xxrkktg.cyou/style/
3 MB
3 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i9.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
321fb7936dada76ce957347f61cd05be88581c5c3532d5cf87d346ba677474f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-2ffe3d"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3145277
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i8.gif
xxrkktg.cyou/style/
3 MB
3 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i8.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
3da30018745ee9d2032bb71f2907a2fa3647d1660d402200d35f161854b0ef48
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-29342a"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2700330
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i7.gif
xxrkktg.cyou/style/
3 MB
3 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i7.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
e21cceb8262a91f878fe4e5202139793e9cd3a02da2dd08d2dc4180cd29ac402
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-32c4dc"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3327196
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i6.gif
xxrkktg.cyou/style/
2 MB
2 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i6.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
116029bd091ec390064879df7dad05e601e284413f53b9d51978875b85dc7471
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-24ffe3"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2424803
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i5.gif
xxrkktg.cyou/style/
2 MB
2 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i5.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
f8152a8d500807f824571c3256320bbf578cdce88d45d0fd048a6422f71c272b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-1e8e27"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2002471
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i4.gif
xxrkktg.cyou/style/
3 MB
3 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i4.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
b285715d34361c4fed5058a10eb830bf2dd61126518477ded340dd7f95221417
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-343916"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3422486
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i3.gif
xxrkktg.cyou/style/
2 MB
0
Image
General
Full URL
https://xxrkktg.cyou/style/section4i3.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-2267fe"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2254846
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i2.gif
xxrkktg.cyou/style/
1 MB
0
Image
General
Full URL
https://xxrkktg.cyou/style/section4i2.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-219b67"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2202471
expires
Sat, 24 Aug 2024 05:20:43 GMT
section4i1.gif
xxrkktg.cyou/style/
2 MB
2 MB
Image
General
Full URL
https://xxrkktg.cyou/style/section4i1.gif
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash
58a9156f7cb557eb157598032fd67ade899a5a8b635455fbeb46c7bfa0f122e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://xxrkktg.cyou/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 15 Aug 2023 17:34:06 GMT
server
nginx
etag
"64dbb70e-24dbae"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2415534
expires
Sat, 24 Aug 2024 05:20:43 GMT
skin.css
xxrkktg.cyou/style/
0
0
Stylesheet
General
Full URL
https://xxrkktg.cyou/style/skin.css
Requested by
Host: xxrkktg.cyou
URL: https://xxrkktg.cyou/style/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.143.159.9 , Hong Kong, ASN136950 (HIITL-AS-AP Hong Kong FireLine Network LTD, HK),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://xxrkktg.cyou/style/style.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 25 Jul 2024 05:20:43 GMT
server
nginx
content-length
548
content-type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| navright

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://xxrkktg.cyou/style/skin.css
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000