1wjan.com Open in urlscan Pro
190.115.24.78 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://1wxht.com/application/apk/1win.apk
Effective URL:
https://1wjan.com/application/apk/1win.apk
Submission: On June 16 via api (June 16th 2024, 6:49:42 am UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 190.115.24.78, located in Belize and belongs to IQWEB, AE. The main domain is 1wjan.com. The Cisco Umbrella rank of the primary domain is 624909.
TLS certificate: Issued by R3 on May 28th 2024. Valid for: 3 months.

This is the only time 1wjan.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Incomplete 1win.apk 40 MB

Size: 40 MB (41755314 bytes, 37% done)

Downloaded from: https://1wjan.com/application/apk/1win.apk

Domain & IP information

	IP Address	AS Autonomous System
1 9	190.115.24.78 190.115.24.78	59692 (IQWEB) (IQWEB)
2	185.129.100.100 185.129.100.100	57724 (DDOS-GUARD) (DDOS-GUARD)
10	3

9 190.115.24.78 (Belize) 1 redirects

ASN59692 (IQWEB, AE)
PTR: ddos-guard.net

1wxht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
1wjan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.129.100.100 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: ddos-guard.net

check.ddos-guard.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	1wjan.com 1wjan.com — Cisco Umbrella Rank: 624909	190 KB
2	ddos-guard.net check.ddos-guard.net — Cisco Umbrella Rank: 182616	746 B
1	1wxht.com 1 redirects 1wxht.com	195 B
10	3

	Domain	Requested by
8	1wjan.com	1wjan.com
2	check.ddos-guard.net	1wjan.com
1	1wxht.com	1 redirects
10	3

This site contains links to these domains. Also see Links.

Domain
ddos-guard.net

Subject Issuer	Validity	Valid
1wjan.com R3	`2024-05-28` - `2024-08-26`	3 months	crt.sh
*.ddos-guard.net Sectigo RSA Domain Validation Secure Server CA	`2023-08-04` - `2024-07-30`	a year	crt.sh

This page contains 1 frames:

Frame: https://1wjan.com/application/apk/1win.apk
Frame ID: 945C412F315F7F40BC950EFA6E9F6CA2
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DDoS-Guard

Page URL History Show full URLs

http://1wxht.com/application/apk/1win.apk HTTP 307
https://1wxht.com/application/apk/1win.apk HTTP 301
https://1wjan.com/application/apk/1win.apk Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

191 kB
Transfer

193 kB
Size

7
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://ddos-guard.net/en?utm_source=1wjan.com&utm_medium=preloader
Title: DDoS protection by DDoS-Guard

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://1wxht.com/application/apk/1win.apk HTTP 307
https://1wxht.com/application/apk/1win.apk HTTP 301
https://1wjan.com/application/apk/1win.apk Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	Primary Request 1win.apk Show response 1wjan.com/application/apk/ Redirect Chain http://1wxht.com/application/apk/1win.apk https://1wxht.com/application/apk/1win.apk https://1wjan.com/application/apk/1win.apk	747 B 1 KB	309ms 135ms	Document text/html	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `62d7de601e108ea0e4c50e165872efa95fef735c7a51481d513bb5b36a568cde` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers cache-control no-cache, no-store, must-revalidate content-length 747 content-type text/html; charset=UTF-8 date Sun, 16 Jun 2024 06:49:37 GMT server ddos-guard Redirect headers access-control-allow-origin * content-encoding br content-type text/html date Sun, 16 Jun 2024 06:49:37 GMT location https://1wjan.com/application/apk/1win.apk server ddos-guard vary Accept-Encoding
GET H2	200	index.css 1wjan.com/.well-known/ddos-guard/js-challenge/	3 KB 3 KB	76ms 75ms	Stylesheet text/css	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/.well-known/ddos-guard/js-challenge/index.css Requested by Host: 1wjan.com URL: https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `3bcbb22ed60fc8cac1887b4f7adbc62e578dc7c5e814768b9a8192decdc55137` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/application/apk/1win.apk Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-type text/css date Sun, 16 Jun 2024 06:49:37 GMT server ddos-guard content-length 2961 expires Sun, 16 Jun 2024 07:49:37 GMT
GET H2	200	view.js Show response 1wjan.com/.well-known/ddos-guard/js-challenge/	43 KB 43 KB	158ms 158ms	Script application/javascript	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/.well-known/ddos-guard/js-challenge/view.js Requested by Host: 1wjan.com URL: https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `71158fa7308057865c78415e48ae462926774b56656c99bff642a0788ed5370f` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/application/apk/1win.apk Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-type application/javascript date Sun, 16 Jun 2024 06:49:37 GMT server ddos-guard content-length 44401 expires Sun, 16 Jun 2024 07:49:37 GMT
GET H2	200	index.js Show response 1wjan.com/.well-known/ddos-guard/js-challenge/	141 KB 142 KB	85ms 85ms	Script application/javascript	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/.well-known/ddos-guard/js-challenge/index.js Requested by Host: 1wjan.com URL: https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `1178bdeab6cbf37326ade037d83cca061c27e1a1ae463dedea7141702f526008` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/application/apk/1win.apk Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-type application/javascript date Sun, 16 Jun 2024 06:49:38 GMT server ddos-guard content-length 144676 expires Sun, 16 Jun 2024 07:49:38 GMT
GET H2	200	check.js Show response check.ddos-guard.net/	152 B 493 B	290ms 82ms	Script application/javascript	185.129.100.100 DDOS-GUARD
General Check archive.org Show headers Download Go to Full URL https://check.ddos-guard.net/check.js Requested by Host: 1wjan.com URL: https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.129.100.100 , Russian Federation, ASN57724 (DDOS-GUARD, RU), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `80e412d8728ad1d81f80783f7942a48daded7851afb657e52f298dcd1e54cd19` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 16 Jun 2024 06:49:38 GMT last-modified Thu, 01 Jan 1970 00:00:00 GMT server ddos-guard etag I6KoRZa99RTAYkG6 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type application/javascript cache-control private, s-maxage=0, max-age=31536000 content-length 152 expires Mon, 16 Jun 2025 06:49:38 GMT
GET H2	200	I6KoRZa99RTAYkG6 1wjan.com/.well-known/ddos-guard/id/	68 B 214 B	125ms 124ms	Image image/png	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Show image Full URL https://1wjan.com/.well-known/ddos-guard/id/I6KoRZa99RTAYkG6 Requested by Host: 1wjan.com URL: https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/application/apk/1win.apk Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-type image/png date Sun, 16 Jun 2024 06:49:38 GMT cache-control no-cache server ddos-guard content-length 68 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	I6KoRZa99RTAYkG6 check.ddos-guard.net/set/id/	68 B 253 B	81ms 81ms	Image image/png	185.129.100.100 DDOS-GUARD
General Check archive.org Show headers Download Go to Show image Full URL https://check.ddos-guard.net/set/id/I6KoRZa99RTAYkG6 Requested by Host: 1wjan.com URL: https://1wjan.com/application/apk/1win.apk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.129.100.100 , Russian Federation, ASN57724 (DDOS-GUARD, RU), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Sun, 16 Jun 2024 06:49:38 GMT server ddos-guard p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type image/png cache-control no-cache content-length 68 expires Thu, 01 Jan 1970 00:00:00 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7aef33eaeca96404d97e03fbbbf2484d298711c0312b87f282e120cb409d7b70` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	450 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `46de0b42e2dc03ba6d16b37e3e864f0eef8f328f6eebbdd4f472bfa560009f33` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	555 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `781f9640521a0e58c8bfa567d0b6646fd227fb85ff3530f737ebec5998633ce0` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	403	favicon.ico 1wjan.com/	747 B 776 B	116ms 116ms	Other text/html	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash `62d7de601e108ea0e4c50e165872efa95fef735c7a51481d513bb5b36a568cde` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://1wjan.com/application/apk/1win.apk Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 16 Jun 2024 06:49:38 GMT cache-control no-cache, no-store, must-revalidate server ddos-guard content-length 747 content-type text/html; charset=UTF-8
POST H2	200	/ 1wjan.com/.well-known/ddos-guard/mark/	0 0	226ms 152ms	Fetch	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/.well-known/ddos-guard/mark/ Requested by Host: 1wjan.com URL: https://1wjan.com/.well-known/ddos-guard/js-challenge/index.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-platform "Win32" Referer https://1wjan.com/application/apk/1win.apk Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Sun, 16 Jun 2024 06:49:37 GMT content-length 0 server ddos-guard
GET H2	200	1win.apk 1wjan.com/application/apk/	0 0	182ms 182ms	Document application/vnd.android.package-archive	190.115.24.78 IQWEB
General Check archive.org Show headers Download Go to Full URL https://1wjan.com/application/apk/1win.apk Requested by Host: 1wjan.com URL: https://1wjan.com/.well-known/ddos-guard/js-challenge/index.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 190.115.24.78 , Belize, ASN59692 (IQWEB, AE), Reverse DNS ddos-guard.net Software ddos-guard / Resource Hash Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://1wjan.com/application/apk/1win.apk Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-origin * content-disposition attachment; filename=1win.apk content-length 41755314 content-type application/vnd.android.package-archive date Sun, 16 Jun 2024 06:49:40 GMT server ddos-guard

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.1wxht.com/	1970-01-21 06:07:36	Name: __ddg1_ Value: UFftpR2idRslqsOItU5I
.1wjan.com/	1970-01-21 06:07:36	Name: __ddgid_ Value: cruKPnZnG7xFRzv6
.1wjan.com/	1970-01-20 21:23:26	Name: __ddgmark_ Value: OYKoTODRXIFL9Xca
.1wjan.com/	1970-01-20 21:22:11	Name: __ddg5_ Value: DKiQy9453o9IctBq
.check.ddos-guard.net/	1970-01-21 06:07:36	Name: __ddg2 Value: I6KoRZa99RTAYkG6
.1wjan.com/	1970-01-21 06:07:36	Name: __ddg2_ Value: I6KoRZa99RTAYkG6
.1wjan.com/	1970-01-21 06:07:36	Name: __ddg1_ Value: r7nmamFU9GcZHOeUvQ9X

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://1wjan.com/application/apk/1win.apk Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://1wjan.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1wjan.com
1wxht.com
check.ddos-guard.net
185.129.100.100
190.115.24.78
1178bdeab6cbf37326ade037d83cca061c27e1a1ae463dedea7141702f526008
3bcbb22ed60fc8cac1887b4f7adbc62e578dc7c5e814768b9a8192decdc55137
46de0b42e2dc03ba6d16b37e3e864f0eef8f328f6eebbdd4f472bfa560009f33
62d7de601e108ea0e4c50e165872efa95fef735c7a51481d513bb5b36a568cde
71158fa7308057865c78415e48ae462926774b56656c99bff642a0788ed5370f
781f9640521a0e58c8bfa567d0b6646fd227fb85ff3530f737ebec5998633ce0
7aef33eaeca96404d97e03fbbbf2484d298711c0312b87f282e120cb409d7b70
80e412d8728ad1d81f80783f7942a48daded7851afb657e52f298dcd1e54cd19
f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710

1wjan.com Open in urlscan Pro 190.115.24.78 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

191 kBTransfer

193 kBSize

7 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

7 Cookies

2 Console Messages

Indicators

1wjan.com Open in urlscan Pro
190.115.24.78 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

191 kB
Transfer

193 kB
Size

7
Cookies

10 HTTP transactions
3 data transactions