urlscan.io logo urlscan.io
SecurityTrails logo

haxbyq.com Open in urlscan Pro
185.56.234.205  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://iragoldinvestments.org/
Effective URL: https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=eyJ&si1=&si2=blackfest
Submission: On November 13 via manual from US — Scanned from NZ
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 7 HTTP transactions. The main IP is 185.56.234.205, located in and belongs to . The main domain is haxbyq.com.
TLS certificate: Issued by R3 on October 10th 2022. Valid for: 3 months.
This is the only time haxbyq.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    142.44.212.173 (Beauharnois, Canada)

ASN16276 (OVH, FR)
PTR: ns553489.ip-142-44-212.net
iragoldinvestments.org
2    89.22.228.250 (Netherlands)

ASN399587 (UT, US)
PTR: host-89-22-228-250.hosted-by-vdsina.ru
news.weatherplllatform.com
3    193.169.195.64 (Latvia)

ASN50321 (BYTES-AS, UA)
PTR: 193.169.195.64
walk.cdnbestplatform.com
location.similarwebline.com
1    104.21.58.35 (None, )

ASN- ()
cqwajn.com
1    185.56.234.205 (None, )

ASN- ()
haxbyq.com
Apex Domain
Subdomains		 Transfer
2 similarwebline.com
location.similarwebline.com
1001 B
2 weatherplllatform.com
news.weatherplllatform.com — Cisco Umbrella Rank: 136116
3 KB
1 haxbyq.com
haxbyq.com
1 cqwajn.com
cqwajn.com Failed
543 B
1 cdnbestplatform.com
walk.cdnbestplatform.com — Cisco Umbrella Rank: 162081 Failed
298 B
1 iragoldinvestments.org
iragoldinvestments.org
411 B
7 6
Domain Requested by
2 location.similarwebline.com 1 redirects news.weatherplllatform.com
2 news.weatherplllatform.com iragoldinvestments.org
news.weatherplllatform.com
1 haxbyq.com location.similarwebline.com
1 cqwajn.com location.similarwebline.com
1 walk.cdnbestplatform.com news.weatherplllatform.com
1 iragoldinvestments.org
7 6

This site contains no links.

Subject Issuer Validity Valid
webmail.curestretchmarks.net
R3		 2022-10-28 -
2023-01-26		 3 months crt.sh
news.weatherplllatform.com
R3		 2022-11-05 -
2023-02-03		 3 months crt.sh
location.similarwebline.com
R3		 2022-11-12 -
2023-02-10		 3 months crt.sh
haxbyq.com
R3		 2022-10-10 -
2023-01-08		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=eyJ&si1=&si2=blackfest
Frame ID: 45DDA5C00CA7AC65A105BF93BC6FC7FC
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://iragoldinvestments.org/ Page URL
  2. https://walk.cdnbestplatform.com/away/follow.php?sid=547658&pid=765&lid=457486 HTTP 302
    https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234 HTTP 302
    https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64 Page URL
  3. https://cqwajn.com/gosl/InNpZCI6MTE2ODI1OSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=&s... HTTP 302
    https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=e... Page URL

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

4 kB
Transfer

20 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://iragoldinvestments.org/ Page URL
  2. https://walk.cdnbestplatform.com/away/follow.php?sid=547658&pid=765&lid=457486 HTTP 302
    https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234 HTTP 302
    https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64 Page URL
  3. https://cqwajn.com/gosl/InNpZCI6MTE2ODI1OSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=&si2=blackfest HTTP 302
    https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=eyJ&si1=&si2=blackfest Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://walk.cdnbestplatform.com/away/follow.php?sid=547658&pid=765&lid=457486 HTTP 302
  • https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234 HTTP 302
  • https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
iragoldinvestments.org/ 		580 B
411 B 		Document
General
Check archive.org
Download Go to
Full URL
https://iragoldinvestments.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.44.212.173 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns553489.ip-142-44-212.net
Software
LiteSpeed /
Resource Hash
81a030aca1e7c831af85e1a8c82cde17823fe145e1824eb145d6a01598edbc9f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
en-NZ,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
public, max-age=0
content-encoding
br
content-length
94
content-type
text/html; charset=UTF-8
date
Sun, 13 Nov 2022 13:57:48 GMT
expires
Sun, 13 Nov 2022 13:57:48 GMT
referrer-policy
no-referrer-when-downgrade
server
LiteSpeed
vary
Accept-Encoding
counter.js
news.weatherplllatform.com/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://news.weatherplllatform.com/counter.js?v=11.7777
Requested by
Host: iragoldinvestments.org
URL: https://iragoldinvestments.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.22.228.250 , Netherlands, ASN399587 (UT, US),
Reverse DNS
host-89-22-228-250.hosted-by-vdsina.ru
Software
nginx /
Resource Hash
88820103089856837bf09b160a6f52f1c3b625e8b38381bebb94dc861965657c

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://iragoldinvestments.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 13 Nov 2022 13:57:49 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Nov 2022 12:03:12 GMT
Server
nginx
ETag
W/"636ce880-a26"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
stat.js
news.weatherplllatform.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://news.weatherplllatform.com/stat.js?v=0.4.444
Requested by
Host: news.weatherplllatform.com
URL: https://news.weatherplllatform.com/counter.js?v=11.7777
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
89.22.228.250 , Netherlands, ASN399587 (UT, US),
Reverse DNS
host-89-22-228-250.hosted-by-vdsina.ru
Software
nginx /
Resource Hash
295e1abfe827a6e88901091a746692f04729afdbbaa3f3366e4fd73555bc5401

Request headers

accept-language
en-NZ,en;q=0.9
Referer
https://iragoldinvestments.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 13 Nov 2022 13:57:50 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Nov 2022 12:01:39 GMT
Server
nginx
ETag
W/"636ce823-b95"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
follow.php
walk.cdnbestplatform.com/away/ 		0
0
come.php
location.similarwebline.com/go/
Redirect Chain
  • https://walk.cdnbestplatform.com/away/follow.php?sid=547658&pid=765&lid=457486
  • https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234
  • https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64
982 B
682 B 		Document
General
Check archive.org
Download Go to
Full URL
https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64
Requested by
Host: news.weatherplllatform.com
URL: https://news.weatherplllatform.com/stat.js?v=0.4.444
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.169.195.64 , Latvia, ASN50321 (BYTES-AS, UA),
Reverse DNS
193.169.195.64
Software
nginx /
Resource Hash

Request headers

Referer
https://iragoldinvestments.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
en-NZ,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sun, 13 Nov 2022 13:57:53 GMT
Server
nginx
Transfer-Encoding
chunked

Redirect headers

Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Sun, 13 Nov 2022 13:57:52 GMT
Location
https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64
Server
nginx
Transfer-Encoding
chunked
InNpZCI6MTE2ODI1OSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs
cqwajn.com/gosl/ 		0
0
Primary Request loading
haxbyq.com/
Redirect Chain
  • https://cqwajn.com/gosl/InNpZCI6MTE2ODI1OSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=&si2=blackfest
  • https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=eyJ&si1=&si2=blackfest
13 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=eyJ&si1=&si2=blackfest
Requested by
Host: location.similarwebline.com
URL: https://location.similarwebline.com/go/come.php?id=64575685&sid=325478&mid=843-334-73234&fol=9567-23562-33-64
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.56.234.205 -, , ASN (),
Reverse DNS
Software
nginx/1.21.1 /
Resource Hash

Request headers

Referer
https://location.similarwebline.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language
en-NZ,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sun, 13 Nov 2022 13:57:55 GMT
server
nginx/1.21.1
vary
Accept-Encoding
x-zone
eu

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
769804e3ecf3ab07-SYD
content-type
text/html; charset=UTF-8
date
Sun, 13 Nov 2022 13:57:54 GMT
location
https://haxbyq.com/loading?h=waWQiOjEwNTQwMzAsInNpZCI6MTE2ODI1OSwid2lkIjozOTM4MDQsInNyYyI6Mn0=eyJ&si1=&si2=blackfest
max-age
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9zB6YgcnYSea6bLpOXQi85zQfBfUzizewTtP415UMAn7awB2gEak%2BnzZQ1vVFqjpN%2FuJpsp5UVqtGtlNspKf7QwzajVZTYgHZib80%2FML10ziIwu%2FgXmGt%2BHVMDtI"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-zone
eu

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
walk.cdnbestplatform.com
URL
https://walk.cdnbestplatform.com/away/follow.php?sid=547658&pid=765&lid=457486
Domain
cqwajn.com
URL
https://cqwajn.com/gosl/InNpZCI6MTE2ODI1OSwic21hcnRsaW5rIjp0cnVlfQ==eyJwaWQiOjEwNTQwMzAs?si1=&si2=blackfest

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
iragoldinvestments.org/ Name: trainmeassystt
Value: 1