xx551002.com Open in urlscan Pro
34.92.135.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://xx551002.com/
Effective URL:
https://xx551002.com:8989/
Submission: On December 02 via manual (December 2nd 2023, 1:24:52 am UTC) from US — Scanned from DE

Summary HTTP 32 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 32 HTTP transactions. The main IP is 34.92.135.156, located in Hong Kong, Hong Kong and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is xx551002.com.
TLS certificate: Issued by R3 on November 25th 2023. Valid for: 3 months.

This is the only time xx551002.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bet365 (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
6	34.92.135.156 34.92.135.156	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
10	240e:615:6e01... 240e:615:6e01:afd4:1::9	() ()
32	3

6 34.92.135.156 (Hong Kong, Hong Kong)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 156.135.92.34.bc.googleusercontent.com

xx551002.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 240e:615:6e01:afd4:1::9 (None, )

ASN- ()

1gruet.wushuidianciliuliangji.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	wushuidianciliuliangji.xyz 1gruet.wushuidianciliuliangji.xyz	96 KB
6	xx551002.com xx551002.com	117 KB
32	2

	Domain	Requested by
10	1gruet.wushuidianciliuliangji.xyz	xx551002.com 1gruet.wushuidianciliuliangji.xyz
6	xx551002.com	xx551002.com
32	2

This site contains no links.

Subject Issuer	Validity	Valid
xx551002.com R3	`2023-11-25` - `2024-02-23`	3 months	crt.sh
*.wushuidianciliuliangji.xyz Certum Domain Validation CA SHA2	`2023-11-30` - `2024-11-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://xx551002.com:8989/
Frame ID: 8C30BB5D239C3D59F4ECC16B323164CC
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://xx551002.com/ Page URL
https://xx551002.com:8989/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

47 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

213 kB
Transfer

884 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xx551002.com/ Page URL
https://xx551002.com:8989/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
xx551002.com/ 84 B
413 B 1034ms
231ms Document
text/html 34.92.135.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

http://xx551002.com/

Protocol

HTTP/1.1

Server

34.92.135.156 Hong Kong, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

156.135.92.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sat, 02 Dec 2023 01:24:44 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK Primary Request / Show response
xx551002.com/ 426 KB
74 KB 936ms
472ms Document
text/html 34.92.135.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.92.135.156 Hong Kong, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

156.135.92.34.bc.googleusercontent.com

Software

Resource Hash

b73d62a3a386e528105f8de8f8aedb0de9cb9b565b1282595ea9575b2ea9519c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://xx551002.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sat, 02 Dec 2023 01:24:45 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-html-cache: HIT-3600
out-line: gb-site-050
uuid: -

GET
H/1.1 200
OK gui-base.css
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/ 81 KB
17 KB 5700ms
936ms Stylesheet
text/css 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-base.css

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-NT-MP-01-17 /

Resource Hash

2f6fa5669c0d38a7652ec88e57d2382ab4d39974181dcf2bc2d4648e449f7db6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541980
x-link-via: hkct212:443;ntmp01:80;
X-Cache-Status: HIT from KS-CLOUD-NT-MP-01-17, HIT from KS-CLOUD-HK-CT-212-09
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 17085
Last-Modified: Fri, 10 Nov 2023 09:15:19 GMT
Server: Default-server-KS-CLOUD-NT-MP-01-17
ETag: W/"654df4a7-144ec"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 911c1309b3ee53a1ce9c672e6ca6c767
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET
H/1.1 200
OK gui-skin-default.css
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/ 31 KB
7 KB 5142ms
379ms Stylesheet
text/css 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-skin-default.css

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-HA-MP-14-16 /

Resource Hash

42a5a785e7ab2956f273d32e8c4a03e91a57a1c55cc9e952da66724bd9d48b5b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541979
x-link-via: hkct212:443;hamp14:80;
X-Cache-Status: HIT from KS-CLOUD-HA-MP-14-16, HIT from KS-CLOUD-HK-CT-212-17
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 6253
Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT
Server: Default-server-KS-CLOUD-HA-MP-14-16
ETag: W/"64ad1569-7b6e"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: fdf26b1a0025f7fced78f93b9494fc09
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET
H/1.1 200
OK common.css
1gruet.wushuidianciliuliangji.xyz/ftl/bet365-1761/themes/style/ 19 KB
5 KB 5152ms
386ms Stylesheet
text/css 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/bet365-1761/themes/style/common.css

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-LY-MP-01-04 /

Resource Hash

3f01d819d9341c2c85647a64a9fa180d9d378811eb3ca1fc5cf7a6ca3bdc98f3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541979
x-link-via: hkct212:443;lymp01:80;
X-Cache-Status: HIT from KS-CLOUD-LY-MP-01-04, HIT from KS-CLOUD-HK-CT-212-15
X-Cache: MISS
Connection: keep-alive
uuid: -
Content-Length: 4200
Last-Modified: Wed, 18 Oct 2023 01:45:40 GMT
Server: Default-server-KS-CLOUD-LY-MP-01-04
ETag: W/"652f38c4-4d04"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 33137b0c430abae794bcffb34f4f982d
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET
H/1.1 200
OK bootstrap-dialog.min.css
1gruet.wushuidianciliuliangji.xyz/ftl/bet365-1761/themes/style/ 3 KB
1 KB 5153ms
385ms Stylesheet
text/css 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/bet365-1761/themes/style/bootstrap-dialog.min.css

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-FZ-MP-33-01 /

Resource Hash

7fd1c34d205f2165ee1b3cc3c2fe54af6f115c58bbd849907c3cf2be6814b159

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541979
x-link-via: hkct212:443;fzmp33:80;
X-Cache-Status: HIT from KS-CLOUD-FZ-MP-33-01, HIT from KS-CLOUD-HK-CT-212-09
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 625
Last-Modified: Thu, 05 Oct 2023 06:35:45 GMT
Server: Default-server-KS-CLOUD-FZ-MP-33-01
ETag: W/"651e5941-adc"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: ab90ee33454b6298c8c733efe1261edd
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET
H/1.1 200
OK i18n.js Show response
xx551002.com/commonPage/lan/ 1 KB
1 KB 456ms
231ms Script
application/javascript 34.92.135.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xx551002.com:8989/commonPage/lan/i18n.js?t=1701480285.597

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.92.135.156 Hong Kong, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

156.135.92.34.bc.googleusercontent.com

Software

Resource Hash

337b7e82979b3f325e9b02327c7f887b0961a466e267ad0c39ae342e3ebdfd73

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Sat, 02 Dec 2023 01:24:46 GMT
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Connection: keep-alive
uuid: 01761-02-00000000-1701480286cc4b
out-line: gb-site-050

GET
H/1.1 200
OK ads1.png
xx551002.com/ftl/commonPage/zh_CN/pubads/images/ 12 KB
12 KB 685ms
227ms Image
image/png 34.92.135.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xx551002.com:8989/ftl/commonPage/zh_CN/pubads/images/ads1.png

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.92.135.156 Hong Kong, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

156.135.92.34.bc.googleusercontent.com

Software

Resource Hash

01cf3c6ca09d7b6003faf27cdf6ff31dc52ec67f73070a6c81bfcb50b7b9ea4c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Sat, 02 Dec 2023 01:24:46 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
ETag: "5d848f4f-2e75"
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
out-line: gb-site-050
uuid: -
Content-Length: 11893
Expires: Sun, 03 Dec 2023 01:24:46 GMT

GET
H/1.1 200
OK ads2.png
xx551002.com/ftl/commonPage/zh_CN/pubads/images/ 19 KB
19 KB 687ms
230ms Image
image/png 34.92.135.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xx551002.com:8989/ftl/commonPage/zh_CN/pubads/images/ads2.png

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.92.135.156 Hong Kong, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

156.135.92.34.bc.googleusercontent.com

Software

Resource Hash

13e5348ceb8b66112851439602497e44bcb574bf16794598bce46340f784d533

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Sat, 02 Dec 2023 01:24:46 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
ETag: "5d848f4f-4bbc"
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
out-line: gb-site-050
uuid: -
Content-Length: 19388
Expires: Sun, 03 Dec 2023 01:24:46 GMT

GET
H/1.1 200
OK jquery-1.11.3.min.js Show response
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/jquery/ 94 KB
33 KB 4567ms
465ms Script
application/javascript 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/jquery/jquery-1.11.3.min.js

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-LD-MP-13-14 /

Resource Hash

329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:12 GMT
Content-Encoding: gzip
Age: 1541978
x-link-via: hkct212:443;ldmp13:80;
X-Cache-Status: HIT from KS-CLOUD-LD-MP-13-14, HIT from KS-CLOUD-HK-CT-212-18
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 33545
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Server: Default-server-KS-CLOUD-LD-MP-13-14
ETag: W/"5d848f4f-176d4"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 979aab3173b5d11f9be68613007dba9a
Expires: Thu, 14 Dec 2023 05:05:12 GMT

GET
H/1.1 200
OK float.js Show response
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 7 KB
3 KB 4477ms
388ms Script
application/javascript 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/float.js

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-XY-MP-04-09 /

Resource Hash

1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541979
x-link-via: hkct212:443;xymp04:80;
X-Cache-Status: HIT from KS-CLOUD-XY-MP-04-09, HIT from KS-CLOUD-HK-CT-212-25
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 1929
Last-Modified: Thu, 26 Aug 2021 07:50:18 GMT
Server: Default-server-KS-CLOUD-XY-MP-04-09
ETag: W/"612747ba-1b2f"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 6a42beca28152876fa614e788dcfce52
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET
H/1.1 200
OK idangerous.swiper.min.js Show response
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 44 KB
12 KB 447ms
447ms Script
application/javascript 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/idangerous.swiper.min.js

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-QD-MP-02-22 /

Resource Hash

1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:12 GMT
Content-Encoding: gzip
Age: 1541979
x-link-via: hkct212:443;qdmp02:80;
X-Cache-Status: HIT from KS-CLOUD-QD-MP-02-22, HIT from KS-CLOUD-HK-CT-212-17
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 11957
Last-Modified: Fri, 11 Aug 2023 04:30:09 GMT
Server: Default-server-KS-CLOUD-QD-MP-02-22
ETag: W/"64d5b951-b083"
Vary: Accept-Encoding, Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 1c8f44ab56a494f5878883a606795e14
Expires: Thu, 14 Dec 2023 05:05:12 GMT

GET Comet.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/websocket/ 0
0

GET
H/1.1 200
OK CometMarathon.js Show response
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/websocket/ 12 KB
4 KB 401ms
401ms Script
application/javascript 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/websocket/CometMarathon.js

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-HUZ-MP-04-01 /

Resource Hash

e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:12 GMT
Content-Encoding: gzip
Age: 1541979
x-link-via: hkct212:443;huzmp04:80;
X-Cache-Status: HIT from KS-CLOUD-HUZ-MP-04-01, HIT from KS-CLOUD-HK-CT-212-13
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 3316
Last-Modified: Thu, 21 Apr 2022 04:30:12 GMT
Server: Default-server-KS-CLOUD-HUZ-MP-04-01
ETag: W/"6260ddd4-2f13"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-204
X-Cdn-Request-ID: 485e398930e2f9dd6f18db007d36310d
Expires: Thu, 14 Dec 2023 05:05:12 GMT

GET PopUp.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/websocket/ 0
0

GET
H/1.1 200 message_zh_CN.js Show response
xx551002.com/ 32 KB
10 KB 232ms
231ms Script
application/javascript 34.92.135.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xx551002.com:8989/message_zh_CN.js?v=1701251130492

Requested by

Host: xx551002.com
URL: https://xx551002.com:8989/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.92.135.156 Hong Kong, Hong Kong, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

156.135.92.34.bc.googleusercontent.com

Software

Resource Hash

ad194b3c9e03ab63b64bccd568d8c277db23a273c5ac4f3ef670decb7417a7ed

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xx551002.com:8989/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Sat, 02 Dec 2023 01:24:52 GMT
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
X-Cache: HIT
Vary: Accept-Encoding
Cache-Control: max-age=86400
Connection: keep-alive
uuid: 01761-02-00000000-170148029282b3
out-line: gb-site-050
Expires: Sun, 03 Dec 2023 01:24:52 GMT

GET lazyload.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 0
0

GET gui-base.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 0
0

GET bootstrap-dialog.min.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 0
0

GET layer.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 0
0

GET jquery.super-marquee.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/jquery/ 0
0

GET jquery.nicescroll.min.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/jquery/ 0
0

GET jquery.validate.js
1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/js/jquery/plugins/jquery.validate/ 0
0

GET jquery.validate.extend.msites.js
1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/js/gamebox/common/ 0
0

GET moment.js
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/ 0
0

GET pc.css
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/hb/css/ 0
0

GET gb.validation.min.js
1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/static/js/ 0
0

GET gb.validation.min.css
1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/static/css/ 0
0

GET special_3.jpg
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/zh_CN/mobileTopic/images/ 0
0

GET
H/1.1 200
OK hongbao.css
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/ 53 KB
6 KB 402ms
402ms Stylesheet
text/css 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/hongbao.css

Requested by

Host: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-base.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-FZ-MP-22-26 /

Resource Hash

5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541980
x-link-via: hkct212:443;fzmp22:80;
X-Cache-Status: HIT from KS-CLOUD-FZ-MP-22-26, HIT from KS-CLOUD-HK-CT-212-22
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 5666
Last-Modified: Thu, 30 Mar 2023 06:38:07 GMT
Server: Default-server-KS-CLOUD-FZ-MP-22-26
ETag: W/"64252e4f-d530"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: 2d306db06b3f0279d4af0e9755871261
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET
H/1.1 200
OK gui-layer.css
1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/ 50 KB
7 KB 396ms
395ms Stylesheet
text/css 240e:615:6e01:afd4:1::9

General

Check archive.org

Show headers Download Go to

Full URL

https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-layer.css

Requested by

Host: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-base.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

240e:615:6e01:afd4:1::9 -, , ASN (),

Reverse DNS

Software

Default-server-KS-CLOUD-HA-MP-14-05 /

Resource Hash

9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/gui-base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 05:05:11 GMT
Content-Encoding: gzip
Age: 1541980
x-link-via: hkct212:443;hamp14:80;
X-Cache-Status: HIT from KS-CLOUD-HA-MP-14-05, HIT from KS-CLOUD-HK-CT-212-19
X-Cache: HIT
Connection: keep-alive
uuid: -
Content-Length: 6923
Last-Modified: Thu, 17 Aug 2023 08:10:09 GMT
Server: Default-server-KS-CLOUD-HA-MP-14-05
ETag: W/"64ddd5e1-c760"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Accept-Ranges: bytes
out-line: gb-cdn-205
X-Cdn-Request-ID: ca3fb395d6581c0ef13a9f23eaae5182
Expires: Thu, 14 Dec 2023 05:05:11 GMT

GET partner-hongtu-white.png
xx551002.com/ftl/commonPage/images/partner/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/websocket/Comet.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/websocket/PopUp.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/lazyload.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/gui-base.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/bootstrap-dialog.min.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/layer.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/jquery/jquery.super-marquee.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/jquery/jquery.nicescroll.min.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/js/moment.js

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/themes/hb/css/pc.css

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/static/js/gb.validation.min.js?v=1701251130492

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/061410/rcenter/common/static/css/gb.validation.min.css

Domain: 1gruet.wushuidianciliuliangji.xyz
URL: https://1gruet.wushuidianciliuliangji.xyz/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg

Domain: xx551002.com
URL: https://xx551002.com:8989/ftl/commonPage/images/partner/partner-hongtu-white.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bet365 (Entertainment)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1gruet.wushuidianciliuliangji.xyz
xx551002.com
1gruet.wushuidianciliuliangji.xyz
xx551002.com
240e:615:6e01:afd4:1::9
34.92.135.156
01cf3c6ca09d7b6003faf27cdf6ff31dc52ec67f73070a6c81bfcb50b7b9ea4c
13e5348ceb8b66112851439602497e44bcb574bf16794598bce46340f784d533
1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27
1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271
2f6fa5669c0d38a7652ec88e57d2382ab4d39974181dcf2bc2d4648e449f7db6
329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10
337b7e82979b3f325e9b02327c7f887b0961a466e267ad0c39ae342e3ebdfd73
3f01d819d9341c2c85647a64a9fa180d9d378811eb3ca1fc5cf7a6ca3bdc98f3
42a5a785e7ab2956f273d32e8c4a03e91a57a1c55cc9e952da66724bd9d48b5b
5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894
7fd1c34d205f2165ee1b3cc3c2fe54af6f115c58bbd849907c3cf2be6814b159
9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf
ad194b3c9e03ab63b64bccd568d8c277db23a273c5ac4f3ef670decb7417a7ed
b73d62a3a386e528105f8de8f8aedb0de9cb9b565b1282595ea9575b2ea9519c
e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf

xx551002.com Open in urlscan Pro 34.92.135.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

32 Requests

47 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

213 kBTransfer

884 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

xx551002.com Open in urlscan Pro
34.92.135.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

47 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

213 kB
Transfer

884 kB
Size

0
Cookies

32 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!