![](/screenshots/860287a0-ff70-4748-8dfc-3764bbcf7011.png)
wp.xianyujc.com
Open in
urlscan Pro
106.52.183.222
Malicious Activity!
Public Scan
Effective URL: https://wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/backlink.php?sides=kh91pqquqab2t30a&certain=race&meet=foot
Submission: On April 19 via api from US
Summary
TLS certificate: Issued by TrustAsia TLS RSA CA on January 6th 2021. Valid for: a year.
This is the only time wp.xianyujc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Investment Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 106.52.183.222 106.52.183.222 | 45090 (CNNIC-TEN...) (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 4 |
ASN45090 (CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)
wp.xianyujc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
cloudflare.com
cdnjs.cloudflare.com |
28 KB |
2 |
xianyujc.com
wp.xianyujc.com |
773 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
17 KB |
5 | 3 |
Domain | Requested by | |
---|---|---|
2 | cdnjs.cloudflare.com |
wp.xianyujc.com
|
2 | wp.xianyujc.com |
wp.xianyujc.com
|
1 | stackpath.bootstrapcdn.com |
wp.xianyujc.com
|
5 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
wp.xianyujc.com TrustAsia TLS RSA CA |
2021-01-06 - 2022-01-05 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-01 - 2022-02-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/backlink.php?sides=kh91pqquqab2t30a&certain=race&meet=foot
Frame ID: 7FB2A47391D8B72449DC117B7D1C37F8
Requests: 25 HTTP requests in this frame
Screenshot
![](/screenshots/860287a0-ff70-4748-8dfc-3764bbcf7011.png)
Page URL History Show full URLs
- https://wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/backlink.php?thick=1xgm11bu1ty0bmk&lis... Page URL
- https://wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/backlink.php?sides=kh91pqquqab2t30a&ce... Page URL
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/backlink.php?thick=1xgm11bu1ty0bmk&list=horse&stand=open Page URL
- https://wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/backlink.php?sides=kh91pqquqab2t30a&certain=race&meet=foot Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
backlink.php
wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
backlink.php
wp.xianyujc.com/ogretmenevi/js/productimage/disclamer/ |
1 MB 771 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/3.3.1/css/ |
111 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.8.1/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ |
86 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
54 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
54 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
72 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
63 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
250 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
27 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
26 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
20 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
44 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
21 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Investment Scam (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
stackpath.bootstrapcdn.com
wp.xianyujc.com
106.52.183.222
2606:4700::6810:135e
2606:4700::6812:bcf
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
133771dea9e842dc402c42caff112015a06070bb2b0a5bb78d26b82309247003
2489b6150efecee42d4a6ac44e7412e24694b800deaab4750c42d42d38180853
276f1db3a3178abdc581d679cd4c3091d9cfc96f6524549a42c05c518cdf2bf3
2f4f281ca7166ffb19a8c790150f45e19b7dc9e0fcec5d783e7325e8bb16f8dc
36a93f5572ec03df86621e681c994f8e832ad06b5ce59d235130c61182940f9f
3a7bddde59764b263f7d46caab05581ab00b223ac6b1b7b5d05640d329f7e9c3
4805432d3e214ba35c2982a58e009762eddbcf3c450ee74402cce7bfac6a7929
4827101a742d037bfd1abee57a8381e03727e3e69595778307a67a61928ac11d
518ee730c5ba149592d3e18e7c34c65eb931aaea55f921902ddd5d625cc6a1d2
558ff4e312e5f7cfb6a66e493102c119f477e9e9002b2e851b90d1b26b842ca6
57293343c9504c30cfcdd5b04350b48d9040e3567095dd6605a37216b5832780
89551df7776d88c155ec7ebc8ff0fdb5132e555d76811739f4bfffd7979c2916
93569c6f0b34f2761d855b028675ecc9bfdc5b1bf7c85157c6681d8351449b09
981a38f436032637ba92058f73de969a85115c98512d4eafa0f101f3e08b1914
b2e9c24008dd7f7fa8b3a4ca375b6b00cbb164607afde5b63a1328a569a84874
cf0dd246573146bdec90a87c9512ee0c31c26f05aa9835397c2c496aec6f85be
d01ccd1570627430c58350525cd032e892063f9a839fe30827d9c0415e06d3b8
d699f303990ce9bd7d7c97e9bd3cad6a46ecf2532f475cf22ae58213237821b9
edf9ec1bdee3b45f4c359515f66a389347d1a0df463c81af5f3a72acb6cf00ad
f10db81437bdf52d935dfb99d2dbc823d7e683b14e6de520046a1371266494ae
f405f28d3fc780dcd00b5febfb853a2c521ba8d9f2cbc2968a9c5787747b6f88
f723cc6e270fa155f6c9c9950393f5876a52ee93f22d77864b49bc3fc24a5fa3
f98da04e4fe7961d6187060290a6c399fd5b2ce7517585a046559a12b902ecff