xrxqa8.top - urlscan.io

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 154.64.248.132, located in Hong Kong, Hong Kong and belongs to NETLAB-SDN, US. The main domain is xrxqa8.top.
TLS certificate: Issued by R10 on November 2nd 2024. Valid for: 3 months.

This is the only time xrxqa8.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	154.64.248.132 154.64.248.132	979 (NETLAB-SDN) (NETLAB-SDN)
1	43.152.140.107 43.152.140.107	139341 (ACE-AS-AP...) (ACE-AS-AP ACE)
1	180.101.203.208 180.101.203.208	140292 (CHINATELE...) (CHINATELECOM-JIANGSU-SUZHOU-5G-NETWORK CHINATELECOM Jiangsu province Suzhou 5G network)
1	39.105.39.126 39.105.39.126	37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.)
5	4

2 154.64.248.132 (Hong Kong, Hong Kong)

ASN979 (NETLAB-SDN, US)

xrxqa8.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.152.140.107 (Singapore)

ASN139341 (ACE-AS-AP ACE, SG)

web.cdn.openinstall.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 180.101.203.208 (China)

ASN140292 (CHINATELECOM-JIANGSU-SUZHOU-5G-NETWORK CHINATELECOM Jiangsu province Suzhou 5G network, CN)

fq.rnxx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 39.105.39.126 (Beijing, China)

ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)

web-tj87f9.openinstall.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	xrxqa8.top xrxqa8.top	2 KB
1	openinstall.com web-tj87f9.openinstall.com	884 B
1	rnxx.net fq.rnxx.net	778 KB
1	openinstall.io web.cdn.openinstall.io — Cisco Umbrella Rank: 107572	18 KB
5	4

	Domain	Requested by
2	xrxqa8.top
1	web-tj87f9.openinstall.com	web.cdn.openinstall.io
1	fq.rnxx.net	xrxqa8.top
1	web.cdn.openinstall.io	xrxqa8.top
5	4

This site contains no links.

Subject Issuer	Validity	Valid
ybi4tn.top R10	`2024-11-02` - `2025-01-31`	3 months	crt.sh
*.cdn.openinstall.io Encryption Everywhere DV TLS CA - G1	`2024-09-05` - `2025-09-12`	a year	crt.sh
fq.rnxx.net Encryption Everywhere DV TLS CA - G2	`2024-09-20` - `2025-09-19`	a year	crt.sh
*.openinstall.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2024-05-10` - `2025-05-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://xrxqa8.top/
Frame ID: 8346F999A9A0843DDB55F05AF194DAAF
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

夜巴黎

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

799 kB
Transfer

829 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
xrxqa8.top/ 3 KB
2 KB 1956ms
430ms Document
text/html 154.64.248.132
NETLAB-SDN

General

Check archive.org

Show headers Download Go to

Full URL

https://xrxqa8.top/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

154.64.248.132 Hong Kong, Hong Kong, ASN979 (NETLAB-SDN, US),

Reverse DNS

Software

nginx /

Resource Hash

53a680f639c73403aff45676830fda62005f92233ad42b4e8afa3f2a501a5ca4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 03 Nov 2024 10:34:03 GMT
etag: W/"66f659d1-a18"
last-modified: Fri, 27 Sep 2024 07:08:01 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 openinstall.js Show response
web.cdn.openinstall.io/ 48 KB
18 KB 246ms
78ms Script
application/javascript 43.152.140.107
ACE-AS-AP ACE

General

Check archive.org

Show headers Download Go to

Full URL: https://web.cdn.openinstall.io/openinstall.js
Requested by: Host: xrxqa8.top
URL: https://xrxqa8.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.152.140.107 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: tencent-cos /
Resource Hash: 41cbb83bc41881c21ef29d25151b65e6ed572e3df02ddb120d9ff850fa651e2e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://xrxqa8.top/

Response headers

cache-control: max-age=7200
x-nws-log-uuid: 8908390870392226929
content-encoding: gzip
x-cos-request-id: NjcyNmQ5ZTdfNGI1MzQwOV9hOTM1XzgyNGY4MmI=
etag: "69bf137b8e03aa5285c157bbbabbcfa6"
x-cos-hash-crc64ecma: 7118329964760731834
accept-ranges: bytes
content-length: 17659
date: Sun, 03 Nov 2024 02:03:19 GMT
x-cache-lookup: Cache Hit
last-modified: Tue, 10 Sep 2024 07:39:35 GMT
content-type: application/javascript
server: tencent-cos

GET
H/1.1 200
OK ybl_d.js
fq.rnxx.net/ 777 KB
778 KB 2591ms
391ms Image
application/javascript 180.101.203.208
CHINATELECOM-JIAN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fq.rnxx.net/ybl_d.js
Requested by: Host: xrxqa8.top
URL: https://xrxqa8.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 180.101.203.208 , China, ASN140292 (CHINATELECOM-JIANGSU-SUZHOU-5G-NETWORK CHINATELECOM Jiangsu province Suzhou 5G network, CN),
Reverse DNS
Software: Tengine /
Resource Hash: dd0562ce40e03cf1ac791d72daaaaf80e3ef99ee642e37a20adc9e18283d30f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://xrxqa8.top/

Response headers

x-oss-cdn-auth: success
Content-MD5: o618U6vM2peKCkpIkNN0pg==
x-oss-storage-class: Standard
Content-Encoding: gzip
Age: 0
x-oss-object-type: Normal
X-Cache: HIT TCP_REFRESH_HIT dirn:9:211715792
Date: Sun, 03 Nov 2024 10:34:05 GMT
x-oss-server-time: 6
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Fri, 03 May 2024 12:43:30 GMT
X-Swift-CacheTime: 3600
Timing-Allow-Origin: *
x-oss-hash-crc64ecma: 7424810926506013932
Connection: keep-alive
Via: cache4.l2cn7478[114,127,304-0,H], cache36.l2cn7478[128,0], kunlun2.cn2528[146,148,200-0,H], kunlun7.cn2528[151,0]
Ali-Swift-Global-Savetime: 1730630045
X-Swift-SaveTime: Sun, 03 Nov 2024 10:34:05 GMT
Accept-Ranges: bytes
EagleId: b465cb8917306300458448494e
Content-Length: 796037
x-oss-request-id: 6727519D2836363632C2BBAC
Server: Tengine

POST
H2 200 init2 Show response
web-tj87f9.openinstall.com/web/tj87f9/_/ 584 B
884 B 1224ms
530ms XHR
text/plain 39.105.39.126
ALIBABA-CN-NET Ha...

General

Check archive.org

Show headers Download Go to

Full URL: https://web-tj87f9.openinstall.com/web/tj87f9/_/init2?av=0&cv=0&hash=&sw=p6Cmpg&sh=p6Smpg&sp=1&li=p6GkuKehuKa4p6M
Requested by: Host: web.cdn.openinstall.io
URL: https://web.cdn.openinstall.io/openinstall.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 39.105.39.126 Beijing, China, ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: /
Resource Hash: dbf6f4a14c5cfcd3ca59143ee11a65bcea7754703487e433ca21aa7f4a922a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://xrxqa8.top/

Response headers

access-control-allow-origin: https://xrxqa8.top
content-length: 584
date: Sun, 03 Nov 2024 10:34:04 GMT
content-type: text/plain
vary: Origin
access-control-allow-credentials: true

GET
H2 404 favicon.ico
xrxqa8.top/ 548 B
611 B 226ms
225ms Other
text/html 154.64.248.132
NETLAB-SDN

General

Check archive.org

Show headers Download Go to

Full URL: https://xrxqa8.top/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 154.64.248.132 Hong Kong, Hong Kong, ASN979 (NETLAB-SDN, US),
Reverse DNS
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://xrxqa8.top/

Response headers

content-length: 548
date: Sun, 03 Nov 2024 10:34:07 GMT
content-type: text/html
server: nginx

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| OpenInstall object| data

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xrxqa8.top/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fq.rnxx.net
web-tj87f9.openinstall.com
web.cdn.openinstall.io
xrxqa8.top
154.64.248.132
180.101.203.208
39.105.39.126
43.152.140.107
41cbb83bc41881c21ef29d25151b65e6ed572e3df02ddb120d9ff850fa651e2e
53a680f639c73403aff45676830fda62005f92233ad42b4e8afa3f2a501a5ca4
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
dbf6f4a14c5cfcd3ca59143ee11a65bcea7754703487e433ca21aa7f4a922a36
dd0562ce40e03cf1ac791d72daaaaf80e3ef99ee642e37a20adc9e18283d30f4

xrxqa8.top Open in urlscan Pro 154.64.248.132 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

799 kBTransfer

829 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

xrxqa8.top Open in urlscan Pro
154.64.248.132 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

799 kB
Transfer

829 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions