qu.ax Open in urlscan Pro
2606:4700:3033::ac43:da93 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://qu.ax/
Effective URL:
https://qu.ax/
Submission: On July 04 via manual (July 4th 2024, 5:22:18 am UTC) from KR — Scanned from DE

Summary HTTP 15 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3033::ac43:da93, located in United States and belongs to CLOUDFLARENET, US. The main domain is qu.ax. The Cisco Umbrella rank of the primary domain is 59152.
TLS certificate: Issued by GTS CA 1P5 on May 7th 2024. Valid for: 3 months.

This is the only time qu.ax was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 16	2606:4700:303... 2606:4700:3033::ac43:da93	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a01:4f8:222:... 2a01:4f8:222:d::222	24940 (HETZNER-AS) (HETZNER-AS)
15	2

16 2606:4700:3033::ac43:da93 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

qu.ax	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4f8:222:d::222 (Ehingen, Germany)

ASN24940 (HETZNER-AS, DE)

plausib.1337.la	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	qu.ax 2 redirects qu.ax — Cisco Umbrella Rank: 59152	142 KB
1	1337.la plausib.1337.la	219 B
15	2

	Domain	Requested by
16	qu.ax	2 redirects qu.ax
1	plausib.1337.la	qu.ax
15	2

This site contains links to these domains. Also see Links.

Domain
tracker.qu.ax
revolt.chat
getsharex.com
curl.se

Subject Issuer	Validity	Valid
qu.ax GTS CA 1P5	`2024-05-07` - `2024-08-05`	3 months	crt.sh
plausib.1337.la R3	`2024-05-11` - `2024-08-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://qu.ax/
Frame ID: CB764D781F1DAA6D4D6A3EECC94066AF
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

qu.ax · smol and private filehosting

Page URL History Show full URLs

http://qu.ax/ HTTP 307
https://qu.ax/ Page URL
https://qu.ax/cdn-cgi/phish-bypass?atok=Shp9U0GmR.P0hKz3V4qzgC4fv4kYMwia8uqcPtf_qog-172007... HTTP 301
https://qu.ax/ Page URL

Page Statistics

15
Requests

93 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

142 kB
Transfer

192 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://tracker.qu.ax/
Title: Tracker

Search URL Search Domain Scan URL

URL: https://revolt.chat/
Title: Revolt.chat

Search URL Search Domain Scan URL

URL: https://getsharex.com/
Title: ShareX

Search URL Search Domain Scan URL

URL: https://curl.se/
Title: curl

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://qu.ax/ HTTP 307
https://qu.ax/ Page URL
https://qu.ax/cdn-cgi/phish-bypass?atok=Shp9U0GmR.P0hKz3V4qzgC4fv4kYMwia8uqcPtf_qog-1720070529-0.0.1.1-%2F HTTP 301
https://qu.ax/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://qu.ax/ HTTP 307
https://qu.ax/

Request Chain 10

https://qu.ax/grill.php HTTP 302
https://qu.ax/img/grills/5.png

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

/ Show response
qu.ax/
Redirect Chain

http://qu.ax/
https://qu.ax/

4 KB
2 KB

61ms
24ms

Document
text/html

2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f5a2d09fc87c3c32095d9f0fe21317a89ce083c8b8ba75614dc2a9284fa2f51

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cf-ray: 89dcad06df0c037c-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 04 Jul 2024 05:22:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ocLZwY%2BH7Ej2lhNRucXojFED%2FkPlRRuyi8BkSTgpP2zpY94PVxAj9WfyGapuQxqCQTlw5TNfXBRmA%2FNZxd7SmQSOeIjmkVwa20ij5GK4pyUbPZXFj6DxUWEB71Ohk5nXcCAP9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://qu.ax/
Non-Authoritative-Reason: HSTS

GET
H3 200 cf.errors.css
qu.ax/cdn-cgi/styles/ 23 KB
5 KB 22ms
22ms Stylesheet
text/css 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/cdn-cgi/styles/cf.errors.css

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 28 Jun 2024 11:25:31 GMT
server: cloudflare
etag: W/"667e9dab-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 89dcad070f40037c-FRA
expires: Thu, 04 Jul 2024 07:22:09 GMT

GET
H3 200 icon-exclamation.png
qu.ax/cdn-cgi/images/ 452 B
634 B 22ms
22ms Image
image/png 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://qu.ax/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: qu.ax
URL: https://qu.ax/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/cdn-cgi/styles/cf.errors.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 28 Jun 2024 11:25:31 GMT
server: cloudflare
etag: "667e9dab-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 89dcad072f64037c-FRA
content-length: 452
expires: Thu, 04 Jul 2024 07:22:09 GMT

GET
H3 200 favicon.ico
qu.ax/ 20 KB
21 KB 30ms
30ms Other
image/x-icon 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9374e3620b1daa8f7ce59acc9250129e15dae90354280f4ce3b8369209ebdd31

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:09 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 05 Jun 2022 23:07:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 160573
x-cache-status: HIT
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tw4UvscgxFiaGmR2gOFo%2BIu5LJLqJgkR0aYFJcOY1%2FDIHr6o%2FSXSWT4iWOcAOrNGqopsZbcl3W%2BQJ1fkhbFDL4EAlNAnLrZ7oxqDXhZBpZgXY%2BVn6B%2BCZgs1Hb7dvxU9chdq5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: max-age=2678400
cf-ray: 89dcad075f90037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3

200

Primary Request / Show response
qu.ax/
Redirect Chain

https://qu.ax/cdn-cgi/phish-bypass?atok=Shp9U0GmR.P0hKz3V4qzgC4fv4kYMwia8uqcPtf_qog-1720070529-0.0.1.1-%2F
https://qu.ax/

8 KB
3 KB

36ms
35ms

Document
text/html

2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a49d4b1e49153daa3de14aba39873fb0f2db4ae2f8c080f20dfbe5590d1ecb23

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://qu.ax/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 1875907
alt-svc: h3=":443"; ma=86400
cache-control: max-age=2678400
cf-cache-status: HIT
cf-ray: 89dcad244f0d037c-FRA
content-encoding: br
content-type: text/html
date: Thu, 04 Jul 2024 05:22:13 GMT
last-modified: Sun, 12 May 2024 09:01:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kUabevIQwuJl%2F3wKMDqebCtIFn4hIIUAxBL4EBQnBEbGp7TPQFpYfoNpOCQPpV3oE5AktmsGYHXxTzSLxY%2FLo%2FYDoKWfz2Qr0GE5nUOZUB9GCNEoS5uJ%2BBT08eofNAAUa73Xww%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-cache-status: MISS
x-xss-protection: 1; mode=block

Redirect headers

cache-control: private, no-cache
cf-ray: 89dcad241ee8037c-FRA
content-length: 167
content-type: text/html
date: Thu, 04 Jul 2024 05:22:13 GMT
location: https://qu.ax/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 css.css
qu.ax/static/ 5 KB
1018 B 35ms
35ms Stylesheet
text/css 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/static/css.css

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf223269a8720b1d10664a96ec0d3d0dcfd06751c6bb27e14b97bc674df9a966

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 17 Jan 2024 21:34:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2137522
x-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FJ9pQb%2FdrdoX3eHgmlYrOUO7ywfgdqN0cmxigorloAJq%2BCjM%2BPqmkCy8E%2FvU8z5UUkWrVGFkK%2B5Z5%2FBFrjJcAAK4OiOTeVV6JFvFlY7%2BVH8KGT5jR%2FggkUCtkb2%2B%2B5dxiiwOvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2678400
cf-ray: 89dcad248f3f037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 200 reset.css
qu.ax/static/ 773 B
872 B 31ms
30ms Stylesheet
text/css 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/static/reset.css

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Jan 2024 09:12:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2234536
x-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3YBMiNe1NzhDYSmmmzGp3IK1kba7qQIiUoj1I1O2e19uwYGMSt9693HZ87Is%2FyKDNkw8Qbs9p4UuplWjWamHwI8VF%2FWrHFHlJvrvap9Q%2BLm4Eh3X3nBZkFD4HS5W8Nd2ZQ41Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2678400
cf-ray: 89dcad248f40037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 200 styles.css
qu.ax/static/ 3 KB
1 KB 32ms
31ms Stylesheet
text/css 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/static/styles.css

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b76bf9c16dcd4abf2a85b180aa4e7f701b2f478d49bd32f8cccea6079bcd1288

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Jan 2024 09:12:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1341521
x-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NiKXgVmdaobIddakxNIaHwOjBbwWwqU0x3FLaxwH3cc0HQWaPr6XqNipi1DkNxdtwDnhTIgrF8ZE07D6lQftfIUiT8Y7g9gF7L1hSqDoM2Ld2tqKGnS1IQrzz9rHzANnqRVpIg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2678400
cf-ray: 89dcad248f41037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 200 script.js Show response
qu.ax/static/js/ 1 KB
1 KB 30ms
30ms Script
application/javascript 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/static/js/script.js

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75d35d14854161d83f03f0fe9b97ec5fcd449663ee09792ad1e46917260fc4ee

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 Jan 2024 20:41:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 36753
x-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y7rGBG%2FLEC9HXLP0T6VPDqZBigisCprEDg9%2Fpsw1bv7q%2BL1u1BdexfbkLADdVpcOMB0uW2Q5vbwIshwOFnX3u3DN4QNfcjYx8gXwT%2FE5%2Fo6ImKa2lUjml0So5OCpSYOLxCXnGg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2678400
cf-ray: 89dcad249f4e037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 200 email-decode.min.js Show response
qu.ax/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 23ms
23ms Script
application/javascript 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 28 Jun 2024 11:26:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"667e9dca-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IX2L2VomWBDbOw6fuN2iKdKInxu6ZojCLYLwzaVG29ERQMfPyFnezW83u7hoXGw0lclo3%2BVd9PSFSf2ofYxdESHl6qE3nPRhgBRBjxDXPtaWvF0wP5Gyhbc08%2Bd8GhVsXQxwzg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 89dcad248f42037c-FRA
expires: Sat, 06 Jul 2024 05:22:13 GMT

GET
H3 200 main.js Show response
qu.ax/static/js/ 3 KB
2 KB 32ms
31ms Script
application/javascript 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/static/js/main.js

Requested by

Host: qu.ax
URL: https://qu.ax/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b32135a1438ed85fd84ff2ba60da4369218417db7cd299c37c4762bc26797266

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 08 Jun 2022 22:32:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1089231
x-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6SYrFGoCI9tFpg1sfjeKVJW4cyJ6Zjmca4I2QNeQXAD8LDyo1UMB9gTtBS9UkH6Ih3F3NEUCKi9lsDm3zWvUAka2%2BUrAgY1ld8%2FlGuurt4B6jR3QWGRThuZJ5FyZkeVKni8TiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2678400
cf-ray: 89dcad248f44037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3

200

5.png
qu.ax/img/grills/
Redirect Chain

https://qu.ax/grill.php
https://qu.ax/img/grills/5.png

58 KB
59 KB

33ms
33ms

Image
image/png

2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://qu.ax/img/grills/5.png

Requested by

Host: qu.ax
URL: https://qu.ax/static/styles.css

Protocol

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

125ef4738097d26a0a3df08f00eef81a2a3c434e522cedfbef6216e7f3c80d94

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://qu.ax/static/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 133897
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
content-length: 59503
x-xss-protection: 1; mode=block
last-modified: Sun, 05 Jun 2022 14:37:01 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gyvjlwOM68ihIia0FJti2%2FKTBrovXYQ7X0Gb8R5tcbxduVcgHKF8Si2eyRm9RP0Ke3BFL8kEMkSAzee4G8sEJjXlQjO3HRTN3%2FjXJvhN57ZWFf14ZB9jppBHfOOGKipn2DKRpw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 89dcad250fb4037c-FRA

Redirect headers

date: Thu, 04 Jul 2024 05:22:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jqrIalMhvcsocPx8Yf6HEc1xF%2BvEwiIEZDQIs4qmyHZxnAZtwYWsgG4UFBJGR%2B5bUXI1rU4VvlCKKhWYjD0GvHG03eKfN1EwTD9iwavDH%2FS9bLJbxIo8L3BTlI9r7etVwCOD2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://qu.ax/img/grills/5.png
cf-ray: 89dcad24bf6b037c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 muw.woff2
qu.ax/static/ 44 KB
44 KB 32ms
31ms Font
font/woff2 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/static/muw.woff2

Requested by

Host: qu.ax
URL: https://qu.ax/static/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/static/css.css
Origin: https://qu.ax
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1080296
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
content-length: 44856
x-xss-protection: 1; mode=block
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XfCKTafA%2F2novFfoCRbphXqLP2HEIL1faYV29ZFDMnZWLHxLg3CjqQSMUc3Tsp%2BF%2BnjU8jMgNMwTQqw%2BB74OJjCQcs6l6fzwR6M8a6SU9agH2u5GQxddt2Ybn%2BRbjEp7KewnZg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 89dcad24df7a037c-FRA

POST
H2 202 event Show response
plausib.1337.la/api/ 2 B
219 B 117ms
26ms XHR
text/plain 2a01:4f8:222:d::222
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://plausib.1337.la/api/event
Requested by: Host: qu.ax
URL: https://qu.ax/static/js/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a01:4f8:222:d::222 Ehingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 04 Jul 2024 05:22:13 GMT
server: nginx
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 2
x-request-id: F97rCY7Vm6uwf7oAEuQB

GET
H3 200 favicon.ico
qu.ax/ 20 KB
0 0ms
0ms Other
image/x-icon 2606:4700:3033::ac43:da93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://qu.ax/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:da93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9374e3620b1daa8f7ce59acc9250129e15dae90354280f4ce3b8369209ebdd31

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://qu.ax/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 05:22:09 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 05 Jun 2022 23:07:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 160573
x-cache-status: HIT
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tw4UvscgxFiaGmR2gOFo%2BIu5LJLqJgkR0aYFJcOY1%2FDIHr6o%2FSXSWT4iWOcAOrNGqopsZbcl3W%2BQJ1fkhbFDL4EAlNAnLrZ7oxqDXhZBpZgXY%2BVn6B%2BCZgs1Hb7dvxU9chdq5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: max-age=2678400
cf-ray: 89dcad075f90037c-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| plausible

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.qu.ax/	1970-01-20 21:49:16	Name: __cf_mw_byp Value: Shp9U0GmR.P0hKz3V4qzgC4fv4kYMwia8uqcPtf_qog-1720070529-0.0.1.1-/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

plausib.1337.la
qu.ax
2606:4700:3033::ac43:da93
2a01:4f8:222:d::222
125ef4738097d26a0a3df08f00eef81a2a3c434e522cedfbef6216e7f3c80d94
1f5a2d09fc87c3c32095d9f0fe21317a89ce083c8b8ba75614dc2a9284fa2f51
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
75d35d14854161d83f03f0fe9b97ec5fcd449663ee09792ad1e46917260fc4ee
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
9374e3620b1daa8f7ce59acc9250129e15dae90354280f4ce3b8369209ebdd31
a49d4b1e49153daa3de14aba39873fb0f2db4ae2f8c080f20dfbe5590d1ecb23
b32135a1438ed85fd84ff2ba60da4369218417db7cd299c37c4762bc26797266
b76bf9c16dcd4abf2a85b180aa4e7f701b2f478d49bd32f8cccea6079bcd1288
cf223269a8720b1d10664a96ec0d3d0dcfd06751c6bb27e14b97bc674df9a966
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

qu.ax Open in urlscan Pro 2606:4700:3033::ac43:da93 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

15 Requests

93 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

142 kBTransfer

192 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

qu.ax Open in urlscan Pro
2606:4700:3033::ac43:da93 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

142 kB
Transfer

192 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!