kdfg98whr.f3en4wgy.live Open in urlscan Pro
13.249.91.115 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://kdfg98whr.f3en4wgy.live/client/
Submission: On February 05 via api (February 5th 2026, 11:13:58 am UTC) from HK — Scanned from CA

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 3 domains to perform 27 HTTP transactions. The main IP is 13.249.91.115, located in United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is kdfg98whr.f3en4wgy.live.
TLS certificate: Issued by Amazon RSA 2048 M02 on July 28th 2025. Valid for: a year.

This is the only time kdfg98whr.f3en4wgy.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 18	13.249.91.115 13.249.91.115	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	101.33.21.122 101.33.21.122	139341 (ACE-AS-AP...) (ACE-AS-AP ACE)
5	43.174.225.10 43.174.225.10	139341 (ACE-AS-AP...) (ACE-AS-AP ACE)
1	118.25.42.241 118.25.42.241	45090 (TENCENT-N...) (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
1	43.174.224.10 43.174.224.10	139341 (ACE-AS-AP...) (ACE-AS-AP ACE)
27	6

18 13.249.91.115 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-249-91-115.jfk52.r.cloudfront.net

kdfg98whr.f3en4wgy.live	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 101.33.21.122 (Singapore)

ASN139341 (ACE-AS-AP ACE, SG)

static.meiqia.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 43.174.225.10 (Singapore)

ASN139341 (ACE-AS-AP ACE, SG)

edge-api.meiqia.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
new-api.meiqia.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 118.25.42.241 (Shanghai, China)

ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

cdn.dcloud.net.cn	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 43.174.224.10 (Singapore)

ASN139341 (ACE-AS-AP ACE, SG)

camorope-client-a.meiqia.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
18	f3en4wgy.live 1 redirects kdfg98whr.f3en4wgy.live	2 MB
9	meiqia.com static.meiqia.com — Cisco Umbrella Rank: 453079 edge-api.meiqia.com — Cisco Umbrella Rank: 434433 new-api.meiqia.com — Cisco Umbrella Rank: 348290 camorope-client-a.meiqia.com — Cisco Umbrella Rank: 468195	427 KB
1	dcloud.net.cn cdn.dcloud.net.cn — Cisco Umbrella Rank: 62527	420 B
27	3

	Domain	Requested by
18	kdfg98whr.f3en4wgy.live	1 redirects kdfg98whr.f3en4wgy.live
3	new-api.meiqia.com	static.meiqia.com
3	static.meiqia.com	kdfg98whr.f3en4wgy.live static.meiqia.com
2	edge-api.meiqia.com	static.meiqia.com
1	camorope-client-a.meiqia.com	static.meiqia.com
1	cdn.dcloud.net.cn	kdfg98whr.f3en4wgy.live
27	6

This site contains no links.

Subject Issuer	Validity	Valid
*.f3en4wgy.live Amazon RSA 2048 M02	`2025-07-28` - `2026-08-26`	a year	crt.sh
*.meiqia.com RapidSSL TLS RSA CA G1	`2025-06-24` - `2026-07-24`	a year	crt.sh
*.dcloud.net.cn Certum Domain Validation CA SHA2	`2025-08-26` - `2026-09-25`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://kdfg98whr.f3en4wgy.live/client/
Frame ID: 8279FA83DDDFD4997A7A0E2DDF9BE157
Requests: 28 HTTP requests in this frame

Frame: https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/app-v1.5.5.prod.20251128_164.js
Frame ID: CC49FE01ED5A3E315CF07C06D63F7754
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://kdfg98whr.f3en4wgy.live/client HTTP 301
http://kdfg98whr.f3en4wgy.live/client/ HTTP 307
https://kdfg98whr.f3en4wgy.live/client/ Page URL

Detected technologies

Vue.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<(?!svg)[^>]+\sdata-v(?:ue)?-

Page Statistics

27
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

6
Subdomains

6
IPs

3
Countries

2118 kB
Transfer

3716 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kdfg98whr.f3en4wgy.live/client HTTP 301
http://kdfg98whr.f3en4wgy.live/client/ HTTP 307
https://kdfg98whr.f3en4wgy.live/client/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
kdfg98whr.f3en4wgy.live/client/
Redirect Chain

https://kdfg98whr.f3en4wgy.live/client
http://kdfg98whr.f3en4wgy.live/client/
https://kdfg98whr.f3en4wgy.live/client/

802 B
1 KB

241ms
240ms

Document
text/html

13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 7e45a34518a28ed67670a91113e4cd0c2b91db1ebb6dbd0b9b2181b90ce42ec0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-length: 802
content-type: text/html
date: Thu, 05 Feb 2026 11:14:07 GMT
etag: "65182a44-322"
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
x-amz-cf-id: mpT8OJUHrOGgHzmLtJrJzV_m_7Tn82Wwc0ng3WlnZI64ZIE3VjaaKw==
x-amz-cf-pop: JFK52-P9
x-cache: Miss from cloudfront

Redirect headers

Location: https://kdfg98whr.f3en4wgy.live/client/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 index.97465e7b.css
kdfg98whr.f3en4wgy.live/client/static/ 94 KB
34 KB 250ms
249ms Stylesheet
text/css 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/index.97465e7b.css
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: f6789ee8a50f44f18ba717956bd34c4cd17b1d658443e92408976907b83a0242

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: W/"65182a44-17894"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 05 Feb 2026 23:14:08 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: _tdB48G7PSzcALysFXYf_tf_SfwpiRkR0HkV_cZz6oj8JzMuGBhC-Q==
date: Thu, 05 Feb 2026 11:14:08 GMT
content-type: text/css
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9
vary: Accept-Encoding

GET
H2 200 chunk-vendors.2bb2bd16.js Show response
kdfg98whr.f3en4wgy.live/client/static/js/ 780 KB
327 KB 248ms
233ms Script
application/javascript 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/js/chunk-vendors.2bb2bd16.js
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: d1ab345eec508cb538216a33dcc1c9967fecd77abf635c0bc86c61053d35f96a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: W/"65182a44-c2e94"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 05 Feb 2026 23:14:08 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: Fv6VRv6r3rnkGw6WHLmk8zfzoexGsjE7gFF9G75hNaQuN3Loln3ydA==
date: Thu, 05 Feb 2026 11:14:08 GMT
content-type: application/javascript
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9
vary: Accept-Encoding

GET
H2 200 index.a4a4e6ea.js Show response
kdfg98whr.f3en4wgy.live/client/static/js/ 169 KB
66 KB 268ms
259ms Script
application/javascript 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/js/index.a4a4e6ea.js
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: a510716ed7d7cae50dd63d07b1938c1cf16108af24ea9321cff8c47d6287579f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: W/"69312bae-2a58d"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 05 Feb 2026 23:14:08 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: 4Cm_2ZBhUqHPmf2yQrIUzJVu9JO-vSxMX0KCCq7Re6x6I_G6VqV01A==
date: Thu, 05 Feb 2026 11:14:08 GMT
content-type: application/javascript
last-modified: Thu, 04 Dec 2025 06:35:26 GMT
server: nginx
x-amz-cf-pop: JFK52-P9
vary: Accept-Encoding

GET
H2 200 pages-index-index2.04ed4e92.js Show response
kdfg98whr.f3en4wgy.live/client/static/js/ 19 KB
12 KB 234ms
231ms Script
application/javascript 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/js/pages-index-index2.04ed4e92.js
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/static/js/index.a4a4e6ea.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 8f0c541d27d6eb599dcfb09c7a0e72e3b14b45b2dda57e46c4eb768549ac3175

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=43200
content-encoding: gzip
etag: W/"65182a44-4c65"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 05 Feb 2026 23:14:09 GMT
x-cache: Miss from cloudfront
x-amz-cf-id: _DDooMKvyMXX4ikiwq4tg06oKf6UhVJiiuOrG7Phfnk7VMl9zOGkKQ==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: application/javascript
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9
vary: Accept-Encoding

GET
H2 200 hangqingicon.png
kdfg98whr.f3en4wgy.live/client/static/icon/ 3 KB
3 KB 266ms
256ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/icon/hangqingicon.png
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: c1befdf82ddd58a00b25eb866a81234a529f55b227f1d479ca84facca8aa2c45

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "65182a44-ae3"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 2787
x-amz-cf-id: kaJujsoy5cezk9u94byE4qQLmvuOoiprlf2oAvFzkFlhcnQR0b2zWQ==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

GET
H2 200 jiaoyi.png
kdfg98whr.f3en4wgy.live/client/static/icon/ 2 KB
3 KB 251ms
243ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/icon/jiaoyi.png
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 870e2ceda552bbcf2a38b2f06dfe7e8ab67e34a29f823e63920a44f92ea2c880

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "65182a44-92f"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 2351
x-amz-cf-id: UDmlATq2rpJ8mG7QXB0hV1U7U-r0cQ9RWVIdLPaRocWH5q-OhQAEXw==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

GET
H2 200 deal.png
kdfg98whr.f3en4wgy.live/client/static/icon/ 2 KB
2 KB 261ms
254ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/icon/deal.png
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: ec7142c42f89ddcc2cc4acb36fa553228573fd81b9efd8b32bfb0ae8c64eceaf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "65182a44-70f"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 1807
x-amz-cf-id: c1et6EokW1WL6U-Qs8GeWYk_HrE7y2E_rrZstZJMWJG3vo-60Gb68g==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

GET
H2 200 my.png
kdfg98whr.f3en4wgy.live/client/static/icon/ 3 KB
3 KB 250ms
243ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/client/static/icon/my.png
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 5db1c6bc3f3036dc8e0d12c94354888bc8e030bc609d1c04936013f884ad63f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "65182a44-c1b"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 3099
x-amz-cf-id: KjoKg_5fb1RKYH04hpjGoHrMEiIJgoB2mNtjH8k1a0u9cnnZYchjJA==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sat, 30 Sep 2023 14:01:40 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

POST
H2 200 getconfig Show response
kdfg98whr.f3en4wgy.live/index/api/ 3 KB
4 KB 244ms
238ms XHR
application/json 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/index/api/getconfig
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/static/js/chunk-vendors.2bb2bd16.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 1b76375798854a1284791ec8a23c3b8396bcc790d723de19940f3b3b8ed0dc00

Request headers

Referer: https://kdfg98whr.f3en4wgy.live/client/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded

Response headers

cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, POST, PUT,DELETE,OPTIONS,PATCH
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: LV4wSLz6mG_nZilB8i8OzIFu17AwKorHuSc_QAxrQwabXIutjebQhg==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: application/json; charset=utf-8
x-amz-cf-pop: JFK52-P9
server: nginx
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,token,uid

POST
H2 200 getWapConfig Show response
kdfg98whr.f3en4wgy.live/index/login/ 121 KB
122 KB 265ms
261ms XHR
application/json 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/index/login/getWapConfig
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/static/js/chunk-vendors.2bb2bd16.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 92dd4614289b34ecd1d4477f71358e4ee610267275ada3fa92cf1f6b23cd3da4

Request headers

Referer: https://kdfg98whr.f3en4wgy.live/client/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded

Response headers

cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, POST, PUT,DELETE,OPTIONS,PATCH
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: XFC46NyPi6UnmRgx13uiEVDjkec8YJGoOTftk9kiKaTsBICMnWT-nw==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: application/json; charset=utf-8
x-amz-cf-pop: JFK52-P9
server: nginx
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,token,uid

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f668186c670ee6d483568f020bac0f37ebb535a1ca2e1731631b72d5bdf338c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6c45149b475bc9c126f5c9ec4070f6adbf84f2fdc44ed7a13664aced7e94e09

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2c2561d0f3fc840ec06d3c1188fedb7773069b5ea059ac94678ec5c2801226b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 55a1031400edc79e419ddda2d997e265a12aaaa44f8544bfb6e39003c7832fac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 404 favicon.ico
kdfg98whr.f3en4wgy.live/ 7 KB
3 KB 248ms
242ms Other
text/html 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://kdfg98whr.f3en4wgy.live/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: eda47c581ef7b463a77aa50df1a93c595a02a0e292a9183a05725d2bc42494e1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-methods: GET, POST, PUT,DELETE,OPTIONS,PATCH
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin: *
x-cache: Error from cloudfront
x-amz-cf-id: 2-nCFBK9Qpmrg0n4y5O-yTdrnqVSrBVzHSm_y1aa9OW6jkFV9taAGA==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: nginx
x-amz-cf-pop: JFK52-P9
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,token,uid

GET
H2 200 loader.js Show response
static.meiqia.com/widget/ 16 KB
6 KB 643ms
87ms Script
application/javascript 101.33.21.122
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL

https://static.meiqia.com/widget/loader.js

Requested by

Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/static/js/index.a4a4e6ea.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

101.33.21.122 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),

Reverse DNS

Software

Resource Hash

07b10d9c31fb3e5df8c7dbb2522da941d49be31f596add069f068a3d83823231

Security Headers

Name	Value
Strict-Transport-Security	max-age=1;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/

Response headers

content-md5: ABhPCpPR94Z833gvPfGrUw==
x-oss-storage-class: Standard
content-encoding: gzip
x-oss-object-type: Normal
date: Tue, 16 Sep 2025 08:07:15 GMT
x-oss-server-time: 90
last-modified: Fri, 10 May 2024 09:15:03 GMT
content-type: application/javascript
vary: Accept-Encoding
content-disposition: inline
strict-transport-security: max-age=1;
x-nws-log-uuid: 14693864735528974901
x-oss-hash-crc64ecma: 14476346677076018366
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5741
x-oss-request-id: 68C91AB326974235330BACE4
x-cache-lookup: Cache Hit

GET
H2 404 7f27dedad06db6282c57b3065c2d9528.png
kdfg98whr.f3en4wgy.live/upload/20251112/ 548 B
548 B 264ms
258ms Image
text/html 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/upload/20251112/7f27dedad06db6282c57b3065c2d9528.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
x-cache: Error from cloudfront
content-length: 548
x-amz-cf-id: AZph-Na7uA8gPvAgOHml6IoJU914QLUYxwa33eOD4gTYglTZNgL-7w==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: text/html
x-amz-cf-pop: JFK52-P9
server: nginx

GET
H2 200 fe668b9005ffa7621ca2e85b37f386d5.png
kdfg98whr.f3en4wgy.live/upload/20231001/ 329 KB
330 KB 258ms
252ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/upload/20231001/fe668b9005ffa7621ca2e85b37f386d5.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: f3ac0f0adcaec5699fb459583742019f6c482073982a803bd2bbde62c745f499

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "6518f783-52595"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 337301
x-amz-cf-id: LoHit2NLvOVtZ5EMz9fcYEkOdjxbauL2O5RVvyy82ZKOdWdrRVYt4g==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sun, 01 Oct 2023 04:37:23 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

GET
H2 200 082b7a3fa1437c07494919962c7991cb.png
kdfg98whr.f3en4wgy.live/upload/20231001/ 295 KB
295 KB 250ms
246ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/upload/20231001/082b7a3fa1437c07494919962c7991cb.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 5d2811532415bbbdf881050d2338d76c60ade88d29f719469aef0fba71398de8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "6921a752-49a01"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 301569
x-amz-cf-id: q07b77V_ilQEi4jXW-S4o-ekTBcIk_icIK-fQgGgl-qDxHh2KltNcQ==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sat, 22 Nov 2025 12:06:42 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

GET
H2 200 617df9c40cc400fd67e86bc1dc1cce98.png
kdfg98whr.f3en4wgy.live/upload/20231001/ 484 KB
485 KB 236ms
231ms Image
image/png 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/upload/20231001/617df9c40cc400fd67e86bc1dc1cce98.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: 69e975491f6efd2be1b2fbd3484d8e1f61f12f7e7a78d878799d1d20df55e998

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

cache-control: max-age=2592000
etag: "6518f783-78eb8"
via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
expires: Sat, 07 Mar 2026 11:14:09 GMT
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 495288
x-amz-cf-id: fcmwf2ES5na5rTBJhado3oQVpboqj2PHJxmRgOTWU2QfcQHewPgoPg==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: image/png
last-modified: Sun, 01 Oct 2023 04:37:23 GMT
server: nginx
x-amz-cf-pop: JFK52-P9

GET
H2 404 d0e1853eaa462cabe9105d1ad836914f.png
kdfg98whr.f3en4wgy.live/upload/20251112/ 548 B
548 B 252ms
248ms Image
text/html 13.249.91.115
Amazon.com

General

Check archive.org

Download Go to Show image

Full URL: https://kdfg98whr.f3en4wgy.live/upload/20251112/d0e1853eaa462cabe9105d1ad836914f.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.91.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-249-91-115.jfk52.r.cloudfront.net
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/client/

Response headers

via: 1.1 8bb89a3cee8ba9c529a18ccefcb29254.cloudfront.net (CloudFront)
x-cache: Error from cloudfront
content-length: 548
x-amz-cf-id: dSPsXf6QEm6KOXMbJ9X36-UZFZzSk7fWyMroAQoWAJSi2mS87BaYKQ==
date: Thu, 05 Feb 2026 11:14:09 GMT
content-type: text/html
x-amz-cf-pop: JFK52-P9
server: nginx

POST
H/1.1 200
OK match Show response
edge-api.meiqia.com/summer/widget/route/ 996 B
1014 B 354ms
352ms XHR
application/json 43.174.225.10
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL: https://edge-api.meiqia.com/summer/widget/route/match
Requested by: Host: static.meiqia.com
URL: https://static.meiqia.com/widget/loader.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 43.174.225.10 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: istio-envoy /
Resource Hash: 9c977fd1358d2cc930d5e6b74719715b2735c243a2e35cc94277d43e6b2838aa

Request headers

x-ent-id: ba39e0a132e2ddcda0f8a59a4a9b8ab8
Referer: https://kdfg98whr.f3en4wgy.live/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
content-type: application/json

Response headers

access-control-expose-headers: *
content-encoding: gzip
EO-LOG-UUID: 13862125982708733639
req-cost-time: 2
Date: Thu, 05 Feb 2026 11:14:10 GMT
content-type: application/json;charset=UTF-8
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
req-arrive-time: 1770290051066
Transfer-Encoding: chunked
EO-Cache-Status: MISS
x-envoy-upstream-service-time: 2
resp-start-time: 1770290051069
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-origin: https://kdfg98whr.f3en4wgy.live
server: istio-envoy

OPTIONS
H/1.1 200
OK match
edge-api.meiqia.com/summer/widget/route/ Frame 0
0 531ms
389ms Preflight 43.174.225.10
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL: https://edge-api.meiqia.com/summer/widget/route/match
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 43.174.225.10 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: istio-envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-ent-id
Access-Control-Request-Method: POST
Origin: https://kdfg98whr.f3en4wgy.live
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Thu, 05 Feb 2026 11:14:10 GMT
EO-Cache-Status: MISS
EO-LOG-UUID: 4204435665396725161
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-ent-id
access-control-allow-methods: GET,POST,PUT,DELETE,HEAD,OPTIONS,PATCH
access-control-allow-origin: https://kdfg98whr.f3en4wgy.live
access-control-expose-headers: *
access-control-max-age: 86400
server: istio-envoy

GET
H2 200 entrypoint-v1.5.5.prod.20251128_164.js Show response
static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/ 190 KB
64 KB 104ms
98ms Script
text/javascript 101.33.21.122
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL

https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/entrypoint-v1.5.5.prod.20251128_164.js

Requested by

Host: static.meiqia.com
URL: https://static.meiqia.com/widget/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

101.33.21.122 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),

Reverse DNS

Software

Resource Hash

20b7430e9ed5da2ea82f9fb50aafce7476e531219989ccbddbdf66749a4328b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=1;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/

Response headers

content-md5: sXRarDZqD9WA/aofXehhrg==
x-oss-storage-class: Standard
content-encoding: gzip
etag: "B1745AAC366A0FD580FDAA1F5DE861AE"
x-oss-object-type: Normal
date: Thu, 25 Dec 2025 09:02:29 GMT
x-oss-server-time: 13
last-modified: Fri, 28 Nov 2025 06:40:28 GMT
content-type: text/javascript
content-disposition: inline
strict-transport-security: max-age=1;
x-nws-log-uuid: 2728245559808504761
x-oss-hash-crc64ecma: 15216682669980824568
accept-ranges: bytes
access-control-allow-origin: *
content-length: 64763
x-oss-request-id: 694CFDA5460E903934968A9F
x-cache-lookup: Cache Hit

GET
H2 200 shadow-grey.png
cdn.dcloud.net.cn/img/ 136 B
420 B 2797ms
699ms Image
image/png 118.25.42.241
TENCENT-NET-AP Sh...

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.dcloud.net.cn/img/shadow-grey.png
Requested by: Host: kdfg98whr.f3en4wgy.live
URL: https://kdfg98whr.f3en4wgy.live/client/static/index.97465e7b.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 118.25.42.241 Shanghai, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer: https://kdfg98whr.f3en4wgy.live/

Response headers

cache-control: max-age=14400
etag: "5cf8b5bf-88"
expires: Thu, 05 Feb 2026 15:14:14 GMT
accept-ranges: bytes
content-length: 136
date: Thu, 05 Feb 2026 11:14:14 GMT
content-type: image/png
last-modified: Thu, 06 Jun 2019 06:42:07 GMT
server: nginx

GET
H2 200 app-v1.5.5.prod.20251128_164.js Show response
static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/ Frame CC49 1 MB
349 KB 94ms
92ms Script
text/javascript 101.33.21.122
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL

https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/app-v1.5.5.prod.20251128_164.js

Requested by

Host: static.meiqia.com
URL: https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/entrypoint-v1.5.5.prod.20251128_164.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

101.33.21.122 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),

Reverse DNS

Software

Resource Hash

8156e064a7d0999960d1dd3f8a6c5c0dc97d0ea589a93642d8d679346eabecdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=1;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

content-md5: xOZCJaIEiaW+PF6IEA3Tjg==
x-oss-storage-class: Standard
content-encoding: gzip
etag: "C4E64225A20489A5BE3C5E88100DD38E"
x-oss-object-type: Normal
date: Thu, 25 Dec 2025 09:02:31 GMT
x-oss-server-time: 22
last-modified: Fri, 28 Nov 2025 06:40:28 GMT
content-type: text/javascript
content-disposition: inline
strict-transport-security: max-age=1;
x-nws-log-uuid: 16288540742491530264
x-oss-hash-crc64ecma: 16588518196627940506
accept-ranges: bytes
access-control-allow-origin: *
content-length: 356967
x-oss-request-id: 694CFDA7460E90393418A09F
x-cache-lookup: Cache Hit

GET
H/1.1 200
OK get_base_config Show response
new-api.meiqia.com/hikari/visit/visit/ 1 KB
1 KB 692ms
369ms XHR
application/json 43.174.225.10
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL: https://new-api.meiqia.com/hikari/visit/visit/get_base_config?ent_id=ba39e0a132e2ddcda0f8a59a4a9b8ab8
Requested by: Host: static.meiqia.com
URL: https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/entrypoint-v1.5.5.prod.20251128_164.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 43.174.225.10 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: istio-envoy /
Resource Hash: 424b8fc44eaad471796a45b75fa3eb1530b035aa9e3c3a47a45301b37812913b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Accept: application/json
Referer: https://kdfg98whr.f3en4wgy.live/

Response headers

EO-Cache-Status: MISS
access-control-expose-headers: *
x-envoy-upstream-service-time: 6
resp-start-time: 1770290052730
EO-LOG-UUID: 12030982019042071711
Connection: keep-alive
access-control-allow-credentials: true
req-cost-time: 6
access-control-allow-origin: https://kdfg98whr.f3en4wgy.live
Content-Length: 1034
Date: Thu, 05 Feb 2026 11:14:12 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: istio-envoy
req-arrive-time: 1770290052724

GET
H/1.1 200
OK start Show response
new-api.meiqia.com/hikari/visit/visit/ 5 KB
5 KB 411ms
408ms XHR
application/json 43.174.225.10
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL: https://new-api.meiqia.com/hikari/visit/visit/start?ent_id=ba39e0a132e2ddcda0f8a59a4a9b8ab8&track_id=&title=&referrer_url=&url=https:%2F%2Fkdfg98whr.f3en4wgy.live%2Fclient%2F%23%2F&is_standalone=false
Requested by: Host: static.meiqia.com
URL: https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/entrypoint-v1.5.5.prod.20251128_164.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 43.174.225.10 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: istio-envoy /
Resource Hash: 25867a7e77c280a4644e7f6ac39bd1e8634a1fbaee98521890237b439f45be2b

Request headers

X-Is-Meiqia-Domain: undefined
X-Is-Standalone: false
Referer: https://kdfg98whr.f3en4wgy.live/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Accept: application/json

Response headers

Transfer-Encoding: chunked
EO-Cache-Status: MISS
access-control-expose-headers: *
x-envoy-upstream-service-time: 37
resp-start-time: 1770290053511
EO-LOG-UUID: 12683402516614086649
Connection: keep-alive
access-control-allow-credentials: true
req-cost-time: 38
access-control-allow-origin: https://kdfg98whr.f3en4wgy.live
Date: Thu, 05 Feb 2026 11:14:13 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: istio-envoy
req-arrive-time: 1770290053473

OPTIONS
H/1.1 200
OK start
new-api.meiqia.com/hikari/visit/visit/ Frame 0
0 362ms
361ms Preflight 43.174.225.10
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL: https://new-api.meiqia.com/hikari/visit/visit/start?ent_id=ba39e0a132e2ddcda0f8a59a4a9b8ab8&track_id=&title=&referrer_url=&url=https:%2F%2Fkdfg98whr.f3en4wgy.live%2Fclient%2F%23%2F&is_standalone=false
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 43.174.225.10 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: istio-envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-is-meiqia-domain,x-is-standalone
Access-Control-Request-Method: GET
Origin: https://kdfg98whr.f3en4wgy.live
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Thu, 05 Feb 2026 11:14:12 GMT
EO-Cache-Status: MISS
EO-LOG-UUID: 110921696041766373
access-control-allow-credentials: true
access-control-allow-headers: x-is-meiqia-domain,x-is-standalone
access-control-allow-methods: GET,POST,PUT,DELETE,HEAD,OPTIONS,PATCH
access-control-allow-origin: https://kdfg98whr.f3en4wgy.live
access-control-expose-headers: *
access-control-max-age: 86400
server: istio-envoy

GET
H/1.1 200
OK info Show response
camorope-client-a.meiqia.com/push/ Frame CC49 78 B
632 B 929ms
556ms XHR
application/json 43.174.224.10
ACE-AS-AP ACE

General

Check archive.org

Download Go to

Full URL: https://camorope-client-a.meiqia.com/push/info?browser_id=b0aef1343d58d1fd85bb5909ccc040e9&ent_id=509752&track_id=39FRuOUQaLvN8xnzdwFOJZxjRon&visit_id=39FRuNbueVx1yQBfNMfDJYxY9Hv&t=1770290053771
Requested by: Host: static.meiqia.com
URL: https://static.meiqia.com/fe-widget/v1.5.5.prod.20251128_164/app-v1.5.5.prod.20251128_164.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 43.174.224.10 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: istio-envoy /
Resource Hash: 17a0ceba18139eca32fb89f7b753f7dd929f1df54428780e0064ad57f210b18f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer

Response headers

EO-Cache-Status: MISS
access-control-expose-headers: *
Cache-Control: must-revalidate, no-transform, no-cache, no-store, max-age=0
x-envoy-upstream-service-time: 1
resp-start-time: 1770290054525
EO-LOG-UUID: 4664690156230819573
Connection: keep-alive
access-control-allow-credentials: true
req-cost-time: 1
access-control-allow-origin: https://kdfg98whr.f3en4wgy.live
Content-Length: 78
Date: Thu, 05 Feb 2026 11:14:14 GMT
content-type: application/json; charset=UTF-8
server: istio-envoy
req-arrive-time: 1770290054524

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

25 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
kdfg98whr.f3en4wgy.live/	1969-12-31 23:59:59	Name: PHPSESSID Value: nmo7sslqkb64nj5uul6rphpfs5
.f3en4wgy.live/	1970-01-21 21:20:50	Name: MEIQIA_TRACK_ID Value: 39FRuOUQaLvN8xnzdwFOJZxjRon
.f3en4wgy.live/	1970-01-21 21:20:50	Name: MEIQIA_VISIT_ID Value: 39FRuNbueVx1yQBfNMfDJYxY9Hv
.dcloud.net.cn/	1970-01-21 21:20:50	Name: __uni__uid Value: rBEQMWmEe4aDP6GfAzSGAg==

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://kdfg98whr.f3en4wgy.live/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://kdfg98whr.f3en4wgy.live/upload/20251112/d0e1853eaa462cabe9105d1ad836914f.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://kdfg98whr.f3en4wgy.live/upload/20251112/7f27dedad06db6282c57b3065c2d9528.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

camorope-client-a.meiqia.com
cdn.dcloud.net.cn
edge-api.meiqia.com
kdfg98whr.f3en4wgy.live
new-api.meiqia.com
static.meiqia.com
101.33.21.122
118.25.42.241
13.249.91.115
43.174.224.10
43.174.225.10
07b10d9c31fb3e5df8c7dbb2522da941d49be31f596add069f068a3d83823231
0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3
17a0ceba18139eca32fb89f7b753f7dd929f1df54428780e0064ad57f210b18f
1b76375798854a1284791ec8a23c3b8396bcc790d723de19940f3b3b8ed0dc00
20b7430e9ed5da2ea82f9fb50aafce7476e531219989ccbddbdf66749a4328b0
25867a7e77c280a4644e7f6ac39bd1e8634a1fbaee98521890237b439f45be2b
2c2561d0f3fc840ec06d3c1188fedb7773069b5ea059ac94678ec5c2801226b2
424b8fc44eaad471796a45b75fa3eb1530b035aa9e3c3a47a45301b37812913b
55a1031400edc79e419ddda2d997e265a12aaaa44f8544bfb6e39003c7832fac
5d2811532415bbbdf881050d2338d76c60ade88d29f719469aef0fba71398de8
5db1c6bc3f3036dc8e0d12c94354888bc8e030bc609d1c04936013f884ad63f8
69e975491f6efd2be1b2fbd3484d8e1f61f12f7e7a78d878799d1d20df55e998
7e45a34518a28ed67670a91113e4cd0c2b91db1ebb6dbd0b9b2181b90ce42ec0
8156e064a7d0999960d1dd3f8a6c5c0dc97d0ea589a93642d8d679346eabecdb
870e2ceda552bbcf2a38b2f06dfe7e8ab67e34a29f823e63920a44f92ea2c880
8f0c541d27d6eb599dcfb09c7a0e72e3b14b45b2dda57e46c4eb768549ac3175
92dd4614289b34ecd1d4477f71358e4ee610267275ada3fa92cf1f6b23cd3da4
9c977fd1358d2cc930d5e6b74719715b2735c243a2e35cc94277d43e6b2838aa
a510716ed7d7cae50dd63d07b1938c1cf16108af24ea9321cff8c47d6287579f
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f
c1befdf82ddd58a00b25eb866a81234a529f55b227f1d479ca84facca8aa2c45
d1ab345eec508cb538216a33dcc1c9967fecd77abf635c0bc86c61053d35f96a
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
e6c45149b475bc9c126f5c9ec4070f6adbf84f2fdc44ed7a13664aced7e94e09
ec7142c42f89ddcc2cc4acb36fa553228573fd81b9efd8b32bfb0ae8c64eceaf
eda47c581ef7b463a77aa50df1a93c595a02a0e292a9183a05725d2bc42494e1
f3ac0f0adcaec5699fb459583742019f6c482073982a803bd2bbde62c745f499
f668186c670ee6d483568f020bac0f37ebb535a1ca2e1731631b72d5bdf338c3
f6789ee8a50f44f18ba717956bd34c4cd17b1d658443e92408976907b83a0242

kdfg98whr.f3en4wgy.live Open in urlscan Pro 13.249.91.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

27 Requests

100 %HTTPS

0 %IPv6

3 Domains

6 Subdomains

6 IPs

3 Countries

2118 kBTransfer

3716 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

27 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

kdfg98whr.f3en4wgy.live Open in urlscan Pro
13.249.91.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

6
Subdomains

6
IPs

3
Countries

2118 kB
Transfer

3716 kB
Size

4
Cookies

27 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!