Submitted URL: https://pay.nxswm.top/
Effective URL: https://pay.nxswm.top/User/Login.php
Submission: On January 11 via api from US — Scanned from US

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 18 HTTP transactions. The main IP is 124.225.14.224, located in Haikou, China and belongs to CHINANET-BACKBONE No.31,Jin-rong Street, CN. The main domain is pay.nxswm.top.
TLS certificate: Issued by TrustAsia RSA DV TLS CA G2 on January 11th 2024. Valid for: a year.
This is the only time pay.nxswm.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 124.225.14.224 4134 (CHINANET-...)
2 4.14.239.108 3356 (LEVEL3)
1 2600:9000:212... 16509 (AMAZON-02)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 122.228.8.178 134771 (CHINATELE...)
1 1 58.49.150.222 58563 (CHINATELE...)
1 204.79.197.200 8068 (MICROSOFT...)
2 43.159.107.100 139341 (ACE-AS-AP...)
18 6
Apex Domain
Subdomains
Transfer
9 nxswm.top
pay.nxswm.top
47 KB
5 geetest.com
static.geetest.com — Cisco Umbrella Rank: 30808
api.geetest.com — Cisco Umbrella Rank: 59786
94 KB
2 staticfile.org
cdn.staticfile.org — Cisco Umbrella Rank: 43361
46 KB
1 bing.com
cn.bing.com — Cisco Umbrella Rank: 13737
293 KB
1 qqsuu.cn
api.qqsuu.cn
329 B
1 nanyinet.com
api.nanyinet.com
123 B
1 baomitu.com
lib.baomitu.com — Cisco Umbrella Rank: 130500
2 KB
18 7
Domain Requested by
9 pay.nxswm.top pay.nxswm.top
cdn.staticfile.org
3 static.geetest.com pay.nxswm.top
static.geetest.com
2 api.geetest.com static.geetest.com
2 cdn.staticfile.org pay.nxswm.top
1 cn.bing.com pay.nxswm.top
1 api.qqsuu.cn 1 redirects
1 api.nanyinet.com 1 redirects
1 lib.baomitu.com pay.nxswm.top
18 8

This site contains no links.

Subject Issuer Validity Valid
pay.nxswm.top
TrustAsia RSA DV TLS CA G2
2024-01-11 -
2025-01-10
a year crt.sh
*.staticfile.org
GeoTrust RSA CN CA G2
2023-09-08 -
2024-10-04
a year crt.sh
*.baomitu.com
WoTrus DV Server CA [Run by the Issuer]
2023-04-20 -
2024-04-19
a year crt.sh
*.geetest.com
GeoTrust TLS RSA CA G1
2023-03-28 -
2024-04-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://pay.nxswm.top/User/Login.php
Frame ID: 498B1F2FA3D0D44DCFACAF5A8B2C87AB
Requests: 18 HTTP requests in this frame

Screenshot

Page Title

商户登录-Pve_codePAY

Page URL History Show full URLs

  1. https://pay.nxswm.top/ Page URL
  2. https://pay.nxswm.top/User/ Page URL
  3. https://pay.nxswm.top/User/Login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

94 %
HTTPS

25 %
IPv6

7
Domains

8
Subdomains

6
IPs

3
Countries

481 kB
Transfer

953 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pay.nxswm.top/ Page URL
  2. https://pay.nxswm.top/User/ Page URL
  3. https://pay.nxswm.top/User/Login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://api.nanyinet.com/api/sjbz/api.php?method=pc&lx=fengjing HTTP 302
  • https://api.qqsuu.cn/api/dm-bing HTTP 302
  • https://cn.bing.com/th?id=OHR.BalloonDay_ZH-CN7571792218_1920x1080.jpg&rf=LaDigue_1920x1080.jpg&pid=hp

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
pay.nxswm.top/
114 B
482 B
Document
General
Full URL
https://pay.nxswm.top/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
bf35ed2eb1429e9e604634f19c83d5911357aec010c3442d6758a74bd0e10a99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
114
Content-Type
text/html
Date
Thu, 11 Jan 2024 10:37:24 GMT
ETag
"659f7923-72"
Last-Modified
Thu, 11 Jan 2024 05:14:11 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000
X-Cache-Lookup
Cache Miss Cache Miss
X-NWS-LOG-UUID
1639452798746729076
/
pay.nxswm.top/User/
78 B
617 B
Document
General
Full URL
https://pay.nxswm.top/User/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://pay.nxswm.top/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Cache-Control
must-revalidate, no-cache, no-store
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Thu, 11 Jan 2024 10:37:25 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Cache-Lookup
Cache Miss Cache Miss
X-NWS-LOG-UUID
1540201578491462138
Primary Request Login.php
pay.nxswm.top/User/
10 KB
4 KB
Document
General
Full URL
https://pay.nxswm.top/User/Login.php
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
63279dfdeb45257b4b85db927400851ab185243c96f370085211fcc6a4a9838e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://pay.nxswm.top/User/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Cache-Control
must-revalidate, no-cache, no-store
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Thu, 11 Jan 2024 10:37:25 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Cache-Lookup
Cache Miss Cache Miss
X-NWS-LOG-UUID
12921534766823914940
bootstrap.min.css
pay.nxswm.top/Core/Assets/Login/css/
138 KB
26 KB
Stylesheet
General
Full URL
https://pay.nxswm.top/Core/Assets/Login/css/bootstrap.min.css
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/User/Login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:26 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Tue, 26 Oct 2021 09:27:14 GMT
Server
nginx
Age
0
ETag
W/"6177c9f2-22688"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=43200
X-NWS-LOG-UUID
4313588929097609603
Connection
keep-alive
Expires
Thu, 11 Jan 2024 22:37:26 GMT
style.css
pay.nxswm.top/Core/Assets/Login/css/
4 KB
2 KB
Stylesheet
General
Full URL
https://pay.nxswm.top/Core/Assets/Login/css/style.css
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
f43c60a06057b19bb10ab858cbda7b433287240f54884679b9b3bb717cb35216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/User/Login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:26 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Tue, 26 Oct 2021 09:27:14 GMT
Server
nginx
Age
0
ETag
W/"6177c9f2-10e3"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=43200
X-NWS-LOG-UUID
5873860650020077003
Connection
keep-alive
Expires
Thu, 11 Jan 2024 22:37:26 GMT
index.js
pay.nxswm.top/Core/Assets/Login/js/
882 B
1 KB
Script
General
Full URL
https://pay.nxswm.top/Core/Assets/Login/js/index.js
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
3927d4c2a76478bc5455a5db145e70e12f3ffe567ef8f22dd4602ef5cd8d08cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/User/Login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:26 GMT
Strict-Transport-Security
max-age=31536000
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Mon, 02 May 2022 04:11:28 GMT
Server
nginx
Age
0
ETag
"626f59f0-372"
Content-Type
application/javascript
Cache-Control
max-age=43200
X-NWS-LOG-UUID
218989691639288881
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
882
Expires
Thu, 11 Jan 2024 22:37:26 GMT
jquery.min.js
cdn.staticfile.org/jquery/3.3.1/
85 KB
34 KB
Script
General
Full URL
https://cdn.staticfile.org/jquery/3.3.1/jquery.min.js
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
4.14.239.108 Washington, United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:26 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"1538f-DcMttKqcXwPzs4xH2IPb1P7ROq4"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Access-Control-Max-Age
31104000
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With,token
Access-Control-Allow-Methods
GET, POST
X-Ser
BC92_dx-lt-yd-zhejiang-jinhua-12-cache-5, BC92_dx-lt-yd-zhejiang-jinhua-12-cache-5, BC199_lt-obgp-fujian-xiamen-33-cache-1, BC32_US-Georgia-atlanta-1-cache-4, BC105_US-DistColumbia-washingtonDC-1-cache-1
bootstrap.min.js
cdn.staticfile.org/twitter-bootstrap/3.3.7/js/
36 KB
12 KB
Script
General
Full URL
https://cdn.staticfile.org/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
4.14.239.108 Washington, United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software
nginx /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:25 GMT
Content-Encoding
gzip
Server
nginx
ETag
W/"90b5-QwpEPXSDD+m+Ju/KQx9EjBs3QPk"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Access-Control-Max-Age
31104000
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With,token
Access-Control-Allow-Methods
GET, POST
X-Ser
BC23_dx-lt-yd-jiangsu-yancheng-8-cache-2, BC195_lt-obgp-fujian-xiamen-33-cache-1, BC31_US-Michigan-chieago-1-cache-1, BC106_US-DistColumbia-washingtonDC-1-cache-1
jquery.cookie.min.js
lib.baomitu.com/jquery-cookie/1.4.1/
1 KB
2 KB
Script
General
Full URL
https://lib.baomitu.com/jquery-cookie/1.4.1/jquery.cookie.min.js
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2127:cc00:1d:80d9:9400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sat, 19 Aug 2023 07:32:26 GMT
via
1.1 ca6609f4a83e693c532f54c00146f5f8.cloudfront.net (CloudFront)
kcs-via
HIT from w-fc01.lato;MISS from w-sc01.lyct
x-qstatic-hit
1
x-amz-cf-pop
PRG50-C1
age
12539101
x-cache
Hit from cloudfront
content-length
1300
last-modified
Mon, 01 Jan 2018 00:00:00 GMT
etag
W/"e310184644876d99"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, immutable
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
aqlWTVM06BI33BXS3J9FOpEP7uwBuI9Qd-gmT5-HT_eKXR3n6k-FXw==
expires
Tue, 16 Aug 2033 07:32:26 GMT
layer.js
pay.nxswm.top/Core/Assets/Layer/
22 KB
9 KB
Script
General
Full URL
https://pay.nxswm.top/Core/Assets/Layer/layer.js
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
3cb403b2abfeaf137ebf64eabb0107a01136d1831923b489d6835af431985544
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/User/Login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:26 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Mon, 02 May 2022 04:11:45 GMT
Server
nginx
Age
0
ETag
W/"626f5a01-5665"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
application/javascript
Cache-Control
max-age=43200
X-NWS-LOG-UUID
9736061052438833178
Connection
keep-alive
Expires
Thu, 11 Jan 2024 22:37:26 GMT
gt.js
static.geetest.com/static/tools/
9 KB
3 KB
Script
General
Full URL
https://static.geetest.com/static/tools/gt.js
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:5c1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da99a9fcec62584a8a85aaea4d27997d16ab4dea57b80d04a84428d4ec9d5f25

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 10:37:26 GMT
content-encoding
gzip
cf-cache-status
HIT
age
274558
x-guploader-uploadid
ABPtcPrq_qGKZdZsOO_sQN2aNRbnlv2QvmOFVx3VGwntbxuzOosk-AI9DrSzRe9_llj1RIbqB_kXl433HQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
last-modified
Fri, 22 Sep 2023 07:12:50 GMT
server
cloudflare
etag
W/"b7ef83f69e18bd9c2c631a41286a7b0b"
vary
Accept-Encoding
x-goog-generation
1695366770268370
content-type
text/javascript
access-control-allow-origin
*
x-goog-hash
crc32c=RKVg8g==, md5=t++D9p4YvZwsYxpBKGp7Cw==
access-control-expose-headers
Content-Type
cache-control
public, max-age=86400
x-goog-stored-content-length
9603
cf-ray
843c863e58d65c7d-MIA
expires
Fri, 12 Jan 2024 10:37:26 GMT
th
cn.bing.com/
Redirect Chain
  • https://api.nanyinet.com/api/sjbz/api.php?method=pc&lx=fengjing
  • https://api.qqsuu.cn/api/dm-bing
  • https://cn.bing.com/th?id=OHR.BalloonDay_ZH-CN7571792218_1920x1080.jpg&rf=LaDigue_1920x1080.jpg&pid=hp
292 KB
293 KB
Image
General
Full URL
https://cn.bing.com/th?id=OHR.BalloonDay_ZH-CN7571792218_1920x1080.jpg&rf=LaDigue_1920x1080.jpg&pid=hp
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/User/Login.php
Protocol
H2
Server
204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
a-0001.a-msedge.net
Software
/
Resource Hash
5bf7cb0dcdee5525ceb5c1e95ec161fd50c987078e16c64709c86e0c794a1bc3

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 10:37:29 GMT
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: FDB6FFC70F0546E6AED8466A36C11BAD Ref B: MIAEDGE1710 Ref C: 2024-01-11T10:37:29Z
access-control-allow-methods
GET, POST, OPTIONS
x-cache
TCP_MISS
access-control-allow-origin
*
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
content-type
image/jpeg
cache-control
public, max-age=691200
timing-allow-origin
*
access-control-allow-headers
*
content-length
298811

Redirect headers

pragma
no-cache
date
Thu, 11 Jan 2024 10:37:29 GMT
strict-transport-security
max-age=31536000
server
nginx
content-type
text/html; charset=UTF-8
location
http://cn.bing.com/th?id=OHR.BalloonDay_ZH-CN7571792218_1920x1080.jpg&rf=LaDigue_1920x1080.jpg&pid=hp
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT
layer.css
pay.nxswm.top/Core/Assets/Layer/theme/default/
14 KB
4 KB
Stylesheet
General
Full URL
https://pay.nxswm.top/Core/Assets/Layer/theme/default/layer.css?v=3.1.1
Requested by
Host: pay.nxswm.top
URL: https://pay.nxswm.top/Core/Assets/Layer/layer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
e3144d018a6a24f733c6fc2a2ee603fb583f0030585e9d4b71bec471b78e31fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/User/Login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date
Thu, 11 Jan 2024 10:37:27 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Cache-Lookup
Cache Miss, Cache Miss
Last-Modified
Tue, 26 Oct 2021 09:27:14 GMT
Server
nginx
Age
0
ETag
W/"6177c9f2-381f"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=43200
X-NWS-LOG-UUID
14570011782412474254
Connection
keep-alive
Expires
Thu, 11 Jan 2024 22:37:27 GMT
Ajax.php
pay.nxswm.top/User/
116 B
586 B
XHR
General
Full URL
https://pay.nxswm.top/User/Ajax.php?act=Captcha&t=1704969447453
Requested by
Host: cdn.staticfile.org
URL: https://cdn.staticfile.org/jquery/3.3.1/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
124.225.14.224 Haikou, China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
1ced1f38f1b410ae0c3f8dff5abf1a6d0925378a4b6ab400fa41bc6f5789da8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://pay.nxswm.top/User/Login.php
X-Requested-With
XMLHttpRequest
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 11 Jan 2024 10:37:27 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
X-Cache-Lookup
Cache Miss, Cache Miss
Server
nginx
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
Cache-Control
must-revalidate, no-cache, no-store
X-NWS-LOG-UUID
6279410849136725584
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT
gettype.php
api.geetest.com/
465 B
766 B
Script
General
Full URL
https://api.geetest.com/gettype.php?gt=b31335edde91b2f98dacd393f6ae6de8&callback=geetest_1704969449385
Requested by
Host: static.geetest.com
URL: https://static.geetest.com/static/tools/gt.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.159.107.100 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software
openresty /
Resource Hash
d931c1430758552b1f6005c99e404974e2faa0f7b5d3355a2334cb32baabacda

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jan 2024 10:37:28 GMT
server
openresty
eo-cache-status
MISS
etag
"36731b14a3ebfc589a05dc98fc068c15daacde2d"
content-type
text/javascript;charset=UTF-8
cache-control
must-revalidate, no-cache, no-store
eo-log-uuid
15512658137553899703
content-length
465
expires
0
fullpage.9.1.9-r8k4eq.js
static.geetest.com/static/js/
300 KB
83 KB
Script
General
Full URL
https://static.geetest.com/static/js/fullpage.9.1.9-r8k4eq.js
Requested by
Host: static.geetest.com
URL: https://static.geetest.com/static/tools/gt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:5c1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6fed8c675558304245621695feb3d23ae0e7ad4693777e738c11c90ac4bc231b

Request headers

Referer
https://pay.nxswm.top/
Origin
https://pay.nxswm.top
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 10:37:28 GMT
content-encoding
gzip
cf-cache-status
MISS
x-goog-meta-goog-reserved-file-mtime
1701849622
x-guploader-uploadid
ABPtcPoWL4TtvpGpKCqA7C49_Oz841NSQEbIryq_fh745TWM4j7zbZEIPsQDHykLP5i_B6ET1vg
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
last-modified
Thu, 07 Dec 2023 02:00:12 GMT
server
cloudflare
etag
W/"3d66dba858a7427381199b4baafa0553"
vary
Accept-Encoding
x-goog-generation
1701914412361551
content-type
application/javascript
access-control-allow-origin
*
x-goog-hash
crc32c=n+ouVw==, md5=PWbbqFinQnOBGZtLqvoFUw==
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=86400
x-goog-meta-mtime
2023-12-06T08:00:22Z
x-goog-stored-content-length
306872
cf-ray
843c864d68670355-MIA
expires
Fri, 12 Jan 2024 10:37:28 GMT
get.php
api.geetest.com/
1 KB
1 KB
Script
General
Full URL
https://api.geetest.com/get.php?gt=b31335edde91b2f98dacd393f6ae6de8&challenge=d76cd7b16e4c91e9874a6cd7dad77713&lang=zh-cn&pt=0&client_type=web&w=Gj2k9rcOhljeqrcqM9QUHCEqCKSLewXHKhegzdArbSn0SrKupzVhZlJgTibv)tNSMYz)m9nYKtuId3qGJ7MYgUBm9RlE6VSfW4hc1kTE7KbRm)J6wTBuSxXYTaidX)iJ5k26hRF7NZifqrHEd)IuOy3Uw(6Iz9t4cC0IGVC7fmXMFPPIZLEM2Q5vkcZ(NXeTs5GZfi4jvMD(cs(R63GcAzEc8SFZaF0rX)1hlMYSyNijew1UiG(vl1IiCXXIuWGwe44ccd(4MBJ)m7rszBGOv9s8vSPy743UvBhB6KkWLh5E1OFV)BXSJDY9PI1Ufkwh(JJ8wtJn(oX6RVy7Vzo5wE9mWfasH5FluVkbwlhRQXGuz(8e3a4cJBMdvsiZbPVGZUc)(1SHg0UMuTLGsQUhjPHwSbT4att7yNvhpQLQZ1X46DgQ4nZHg6oR09y1H0QTkiqjLcEARLz32KcwAMKwsZX(Intp1H8m)DsNimsljlpoTqSzXv7sk21fsH2ZEY4bJuETEP3(ThFN4lSp5R0LSFT9MQC)TvT0tZT9LfxD3eTEtAj0awfcXTEOqexVUbH6s0vaSBwPjY89cvcMp50uJVHU3u)kB3wtXyGSwkERwbkFjRyeV4B9siLvd5R8fJeVxbOqpl03TdUmt0J2EtnwwNUe(rsr7QWmP8zRCqtcScnsA2z2NFKiDcka)6TfBGBubhO01)LgnJm0tJOHhGVWewz5hz(HhIJARFBiX8dllMCqDajfeehxIQ(g6YeRKhXb2b)HpaC9A9YCI2dRBjACy5z20IjTSQ8kaP3KBU3cIBN6Yibcy5gmzSMDqmGdHJk1DMcp9cIa5PqrslNdYmq7Us)DA9)ysfLMLWtkSB1xtB3(4Hqpj9fiwWAuXTlEtvSUILyn7YxvV05efEXF035zAJhWfqQz5bZvrEAGjaXiTIOvjbQXZL(aLk6URzNXorDdWcnLTm)DMHdK3zk5L7tX6QZV93nMb8DGaMcwgZ(3mw5pV)qPgCSjQ)pc0W31UUk1CmHt4iQcPqKFlx5vsbW2SkiDKzBoSPco4PmnWPO0uM5LZBV(GR)ua4XNLQbgeGGgSINFyeKLqh1F)MOHtDUs8yDLxAxKecrTUUhXoWb94sHOOPJl1WpTUsjxXLyz5E)ToGPkG5Z0mfwpcKQytCCkTw..1c369ac5eae0748b37842cebe598b879ea3395bbec78009befb7ada397a015f976f4a125ac1ba358bbd5845c2efb53a7485a3db62b259f9776e2cc86b72d13235e1a1a04b5e9a34da72872007824b3f9e7d2ad625c097cb0dc6c3a524704c647ecd64b2991e40b7236ce556d5abe3883bea8f710267baf4d2c059141721de531&callback=geetest_1704969450888
Requested by
Host: static.geetest.com
URL: https://static.geetest.com/static/js/fullpage.9.1.9-r8k4eq.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.159.107.100 , Singapore, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software
openresty /
Resource Hash
581cfff1fb9a39786b586dc85213c55b31d0fdc0e0c59f688eaeae621c4a6620

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 11 Jan 2024 10:37:28 GMT
server
openresty
eo-cache-status
MISS
etag
"5a45acc2d1502e4c60705356e7bf1a0651546305"
content-type
text/javascript;charset=UTF-8
cache-control
must-revalidate, no-cache, no-store
eo-log-uuid
10623426440538158009
content-length
1272
expires
0
style_https.1.5.8.css
static.geetest.com/static/wind/
40 KB
5 KB
Stylesheet
General
Full URL
https://static.geetest.com/static/wind/style_https.1.5.8.css
Requested by
Host: static.geetest.com
URL: https://static.geetest.com/static/js/fullpage.9.1.9-r8k4eq.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:5c1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pay.nxswm.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Thu, 11 Jan 2024 10:37:29 GMT
content-encoding
gzip
cf-cache-status
HIT
x-goog-meta-goog-reserved-file-mtime
1585034197
age
274549
x-guploader-uploadid
ABPtcPo_mWeXwC8gwXDXf6YTp7EGDlx4vbHyGS2EHEd678eIvJJrg7gYHs1sW9zhUhl7GwVA4ML9wCUdfw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
last-modified
Tue, 09 May 2023 09:41:49 GMT
server
cloudflare
etag
W/"3fb6aacfd5ae2d3894f2f00b0d5f3236"
vary
Accept-Encoding
x-goog-generation
1683625309389336
content-type
text/css
access-control-allow-origin
*
x-goog-hash
crc32c=wyS03w==, md5=P7aqz9WuLTiU8vALDV8yNg==
access-control-expose-headers
Content-Type
cache-control
public, max-age=86400
x-goog-meta-mtime
2020-03-24T07:16:37Z
x-goog-stored-content-length
40702
cf-ray
843c86504add5c7d-MIA
expires
Fri, 12 Jan 2024 10:37:29 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| on_btn_click function| bg_change function| view_change function| $ function| jQuery object| layer function| initGeetest function| check_login function| handlerEmbed string| GeeGT string| GeeChallenge function| yCtOu string| FAIL undefined| pure function| Geetest

1 Cookies

Domain/Path Name / Value
pay.nxswm.top/ Name: PHPSESSID
Value: rodu4sp6a89h1fp5ir81odj785

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.geetest.com
api.nanyinet.com
api.qqsuu.cn
cdn.staticfile.org
cn.bing.com
lib.baomitu.com
pay.nxswm.top
static.geetest.com
122.228.8.178
124.225.14.224
204.79.197.200
2600:9000:2127:cc00:1d:80d9:9400:93a1
2606:4700::6811:5c1
4.14.239.108
43.159.107.100
58.49.150.222
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1ced1f38f1b410ae0c3f8dff5abf1a6d0925378a4b6ab400fa41bc6f5789da8a
3927d4c2a76478bc5455a5db145e70e12f3ffe567ef8f22dd4602ef5cd8d08cf
3cb403b2abfeaf137ebf64eabb0107a01136d1831923b489d6835af431985544
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
581cfff1fb9a39786b586dc85213c55b31d0fdc0e0c59f688eaeae621c4a6620
5bf7cb0dcdee5525ceb5c1e95ec161fd50c987078e16c64709c86e0c794a1bc3
63279dfdeb45257b4b85db927400851ab185243c96f370085211fcc6a4a9838e
6fed8c675558304245621695feb3d23ae0e7ad4693777e738c11c90ac4bc231b
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
8ba195fffe0097e44a5dd29c35c092f10039e126cc9c4113330e8bf690c2461e
bf35ed2eb1429e9e604634f19c83d5911357aec010c3442d6758a74bd0e10a99
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
d931c1430758552b1f6005c99e404974e2faa0f7b5d3355a2334cb32baabacda
da99a9fcec62584a8a85aaea4d27997d16ab4dea57b80d04a84428d4ec9d5f25
e3144d018a6a24f733c6fc2a2ee603fb583f0030585e9d4b71bec471b78e31fc
f43c60a06057b19bb10ab858cbda7b433287240f54884679b9b3bb717cb35216