URL: https://app1.t7a9m4.click/
Submission Tags: @phishunt_io
Submission: On September 18 via api from DE — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 212.24.127.227, located in Frankfurt (Oder), Germany and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is app1.t7a9m4.click.
TLS certificate: Issued by R10 on September 18th 2024. Valid for: 3 months.
This is the only time app1.t7a9m4.click was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 212.24.127.227 209242 (CLOUDFLAR...)
4 2
Apex Domain
Subdomains
Transfer
3 t7a9m4.click
app1.t7a9m4.click
609 KB
4 1
Domain Requested by
3 app1.t7a9m4.click app1.t7a9m4.click
4 1

This site contains no links.

Subject Issuer Validity Valid
app1.t7a9m4.click
R10
2024-09-18 -
2024-12-17
3 months crt.sh

This page contains 1 frames:

Primary Page: https://app1.t7a9m4.click/
Frame ID: FF42EF8A85D27388DB665B6D95241987
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

杏鑫娱乐 - 访问限制

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

609 kB
Transfer

649 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
app1.t7a9m4.click/
3 KB
2 KB
Document
General
Full URL
https://app1.t7a9m4.click/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.24.127.227 Frankfurt (Oder), Germany, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
**** /
Resource Hash
34e7bed0f96d308d2f553b906f6626f04a206233a6e962a4731687c1e574159a
Security Headers
Name Value
Strict-Transport-Security max-age=0; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 18 Sep 2024 18:20:44 GMT
etag
W/"5f230b7e-c91"
server
****
strict-transport-security
max-age=0; preload
vary
Accept-Encoding
x-cache
BYPASS
x-request-id
2c314df78fce7f338589309594589d08
err_warning.png
app1.t7a9m4.click/images/xc4-default/
4 KB
4 KB
Image
General
Full URL
https://app1.t7a9m4.click/images/xc4-default/err_warning.png
Requested by
Host: app1.t7a9m4.click
URL: https://app1.t7a9m4.click/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.24.127.227 Frankfurt (Oder), Germany, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
**** /
Resource Hash
064b88e99838ba5c47bf26a4974ce417ec29fe45de01015cc6b6f744963b763c
Security Headers
Name Value
Strict-Transport-Security max-age=0; preload
X-Xss-Protection 1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://app1.t7a9m4.click/

Response headers

strict-transport-security
max-age=0; preload
x-request-id
85e29c4a6bdc97e531102e0b024f6b62
cache-control
max-age=1800
etag
"5ef8183f-f15"
expires
Wed, 25 Sep 2024 18:20:44 GMT
accept-ranges
bytes
x-cache
MISS
content-length
3861
date
Wed, 18 Sep 2024 18:20:44 GMT
x-xss-protection
1
content-type
image/png
last-modified
Sun, 28 Jun 2020 04:10:39 GMT
server
****
login-white-bg.jpg
app1.t7a9m4.click/images/xc4-default/register/
642 KB
603 KB
Image
General
Full URL
https://app1.t7a9m4.click/images/xc4-default/register/login-white-bg.jpg
Requested by
Host: app1.t7a9m4.click
URL: https://app1.t7a9m4.click/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.24.127.227 Frankfurt (Oder), Germany, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
**** /
Resource Hash
0733769f835907215632acd26ee034eff095ae05973eb7b62637456600a16328
Security Headers
Name Value
Strict-Transport-Security max-age=0; preload
X-Xss-Protection 1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://app1.t7a9m4.click/

Response headers

strict-transport-security
max-age=0; preload
x-request-id
16a74e4478d96c5faf70f70f68c41176
cache-control
max-age=1800
content-encoding
gzip
etag
W/"5ef8183f-a0937"
expires
Wed, 25 Sep 2024 18:20:44 GMT
x-cache
MISS
date
Wed, 18 Sep 2024 18:20:45 GMT
x-xss-protection
1
content-type
image/jpeg
last-modified
Sun, 28 Jun 2020 04:10:39 GMT
server
****
vary
Accept-Encoding
favicon-xc4.ico
app1.t7a9m4.click/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
app1.t7a9m4.click
URL
https://app1.t7a9m4.click/favicon-xc4.ico

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
app1.t7a9m4.click/ Name: session_sslproxy_server
Value: 4aed2405-ecef-478cad3427c1f62297a19213a5d12973d5eb

1 Console Messages

Source Level URL
Text
network error URL: https://app1.t7a9m4.click/
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app1.t7a9m4.click
app1.t7a9m4.click
212.24.127.227
064b88e99838ba5c47bf26a4974ce417ec29fe45de01015cc6b6f744963b763c
0733769f835907215632acd26ee034eff095ae05973eb7b62637456600a16328
34e7bed0f96d308d2f553b906f6626f04a206233a6e962a4731687c1e574159a