shuidi.xima.run Open in urlscan Pro
81.70.182.29 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://shuidi.xima.run/
Effective URL:
https://shuidi.xima.run/index.html
Submission: On July 25 via api (July 25th 2024, 5:31:18 am UTC) from US — Scanned from DE

Summary HTTP 7 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 81.70.182.29, located in China and belongs to TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN. The main domain is shuidi.xima.run.
TLS certificate: Issued by TrustAsia RSA DV TLS CA G2 on January 15th 2024. Valid for: a year.

This is the only time shuidi.xima.run was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	81.70.182.29 81.70.182.29	45090 (TENCENT-N...) (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
1	163.181.92.225 163.181.92.225	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
7	3

3 81.70.182.29 (China) 1 redirects

ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

shuidi.xima.run	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.181.92.225 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

fonts.goodq.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	xima.run 1 redirects shuidi.xima.run	107 KB
1	goodq.top fonts.goodq.top	18 KB
0	qifeiye.com Failed w-79532-19503-79151.47901444.sites.hk32.qifeiye.com Failed
7	3

	Domain	Requested by
3	shuidi.xima.run	1 redirects
1	fonts.goodq.top	shuidi.xima.run
0	w-79532-19503-79151.47901444.sites.hk32.qifeiye.com Failed	shuidi.xima.run
7	3

This site contains links to these domains. Also see Links.

Domain
w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
beian.miit.gov.cn

Subject Issuer	Validity	Valid
wukong.xima.run TrustAsia RSA DV TLS CA G2	`2024-01-15` - `2025-01-14`	a year	crt.sh
fonts.goodq.top Encryption Everywhere DV TLS CA - G2	`2024-03-29` - `2025-03-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://shuidi.xima.run/index.html
Frame ID: 93A0366D016FD38EDEF4289B7CFE41EC
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

一个新起飞页站点 | 首页

Page URL History Show full URLs

https://shuidi.xima.run/ HTTP 302
https://shuidi.xima.run/index.html Page URL

Page Statistics

7
Requests

14 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

125 kB
Transfer

124 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/?vceditor=true

Search URL Search Domain Scan URL

URL: https://beian.miit.gov.cn/
Title: 京ICP备20024192号

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shuidi.xima.run/ HTTP 302
https://shuidi.xima.run/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request index.html Show response shuidi.xima.run/ Redirect Chain https://shuidi.xima.run/ https://shuidi.xima.run/index.html	102 KB 102 KB	1058ms 1058ms	Document text/html	81.70.182.29 TENCENT-NET-AP Sh...
General Check archive.org Show headers Download Go to Full URL https://shuidi.xima.run/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 81.70.182.29 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN), Reverse DNS Software / Resource Hash `acaf9d8b9d0b8f5cc378185a0843143012b6f2d10c8838b118b5c1c732110efe` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Content-Length 104788 Content-Type text/html Date Thu, 25 Jul 2024 05:31:11 GMT Last-Modified Thu, 25 Jul 2024 01:22:48 GMT Redirect headers Content-Length 0 Date Thu, 25 Jul 2024 05:31:10 GMT Location https://shuidi.xima.run/index.html
GET		dummy.png w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/	0 0

GET		d30a0d487876ef5a57c948a1e328ee4f.css w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/	0 0

GET		00aa4ce547e01a43e3f3a18962fbb21d.js w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/	0 0

GET H2	200	zkgdh.woff fonts.goodq.top/201810/f60260dcbc706b9965894881ec67956a4/	18 KB 18 KB	2081ms 537ms	Font application/x-font-woff	163.181.92.225 TAOBAO Zhejiang T...
General Check archive.org Show headers Download Go to Full URL https://fonts.goodq.top/201810/f60260dcbc706b9965894881ec67956a4/zkgdh.woff Requested by Host: shuidi.xima.run URL: https://shuidi.xima.run/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 163.181.92.225 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN), Reverse DNS Software Tengine / Resource Hash `d87416d24e23e964e30f8ae6f8a04150544bd1baec3b079f70a8185ff2c6ac77` Request headers Referer https://shuidi.xima.run/ Origin https://shuidi.xima.run User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 24 Jul 2024 21:29:24 GMT via cache21.l2de2[479,479,200-0,H], cache8.l2de2[480,0], ens-cache7.de5[487,487,200-0,M], ens-cache13.de5[488,0] age 0 x-swift-cachetime 3600 x-cache MISS TCP_MISS dirn:-2:-2 x-swift-savetime Thu, 25 Jul 2024 05:31:15 GMT content-length 17964 last-modified Thu, 05 Nov 2015 08:07:02 GMT server Tengine etag "462c-523c69ca35580" ali-swift-global-savetime 1721885475 content-type application/x-font-woff access-control-allow-origin * accept-ranges bytes timing-allow-origin * eagleid a3b55ca117218854750761500e
GET		9903668b9ecc3a714be3af9d158c82de.css w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/	0 0

GET H/1.1	200	favicon.ico shuidi.xima.run/	4 KB 4 KB	225ms 224ms	Other image/x-icon	81.70.182.29 TENCENT-NET-AP Sh...
General Check archive.org Show headers Download Go to Full URL https://shuidi.xima.run/favicon.ico Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 81.70.182.29 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN), Reverse DNS Software / Resource Hash `357c6a8e64d722f6e2b71d51d17e36f1dfff5c24f4190ff4cb6e488a34def666` Request headers Referer https://shuidi.xima.run/index.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Thu, 25 Jul 2024 05:31:15 GMT Last-Modified Tue, 14 Feb 2023 06:29:12 GMT Accept-Ranges bytes Content-Length 4286 Content-Type image/x-icon

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
URL: https://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png

Domain: w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
URL: http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/d30a0d487876ef5a57c948a1e328ee4f.css

Domain: w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
URL: http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/00aa4ce547e01a43e3f3a18962fbb21d.js

Domain: w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
URL: http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/9903668b9ecc3a714be3af9d158c82de.css

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://shuidi.xima.run/index.html Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure element 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://shuidi.xima.run/index.html Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure element 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://shuidi.xima.run/index.html Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure element 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://shuidi.xima.run/index.html(Line 46) Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/d30a0d487876ef5a57c948a1e328ee4f.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://shuidi.xima.run/index.html Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure script 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/00aa4ce547e01a43e3f3a18962fbb21d.js'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://shuidi.xima.run/index.html(Line 447) Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure element 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://shuidi.xima.run/index.html(Line 447) Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure element 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://shuidi.xima.run/index.html(Line 447) Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure element 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/plugins/revslider/images/dummy.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://shuidi.xima.run/index.html(Line 2822) Message: Mixed Content: The page at 'https://shuidi.xima.run/index.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://w-79532-19503-79151.47901444.sites.hk32.qifeiye.com/qfy-content/cache/scripts/9903668b9ecc3a714be3af9d158c82de.css'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.goodq.top
shuidi.xima.run
w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
w-79532-19503-79151.47901444.sites.hk32.qifeiye.com
163.181.92.225
81.70.182.29
357c6a8e64d722f6e2b71d51d17e36f1dfff5c24f4190ff4cb6e488a34def666
acaf9d8b9d0b8f5cc378185a0843143012b6f2d10c8838b118b5c1c732110efe
d87416d24e23e964e30f8ae6f8a04150544bd1baec3b079f70a8185ff2c6ac77

shuidi.xima.run Open in urlscan Pro 81.70.182.29 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

14 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

125 kBTransfer

124 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

9 Console Messages

Indicators

shuidi.xima.run Open in urlscan Pro
81.70.182.29 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

14 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

125 kB
Transfer

124 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions