auth.qrqrq.com Open in urlscan Pro
99.86.2.66 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://auth.qrqrq.com/
Submission: On October 21 via automatic, source certstream-suspicious (October 21st 2020, 12:44:12 am UTC)

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 99.86.2.66, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is auth.qrqrq.com.
TLS certificate: Issued by Amazon on November 19th 2019. Valid for: a year.

This is the only time auth.qrqrq.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
6	99.86.2.66 99.86.2.66		16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42:3::621 2a04:4e42:3::621		54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a		20446 (HIGHWINDS3) (HIGHWINDS3)
9	3

6 99.86.2.66 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-2-66.fra6.r.cloudfront.net

auth.qrqrq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	qrqrq.com auth.qrqrq.com	17 KB
2	jsdelivr.net cdn.jsdelivr.net	39 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com	23 KB
9	3

	Domain	Requested by
6	auth.qrqrq.com	auth.qrqrq.com
2	cdn.jsdelivr.net	auth.qrqrq.com
1	stackpath.bootstrapcdn.com	auth.qrqrq.com
9	3

This site contains links to these domains. Also see Links.

Domain
m.qrqrq.com

Subject Issuer	Validity	Valid
auth.qrqrq.com Amazon	`2019-11-19` - `2020-12-19`	a year	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-05` - `2021-04-17`	6 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://auth.qrqrq.com/
Frame ID: 16EEC1AF12DE9D6B50D16440621347D0
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /(?:\/([\d.]+))?\/vue(?:\.min)?\.js/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers via /\(CloudFront\)$/i
headers server /^AmazonS3$/i

Amazon Cloudfront (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /\(CloudFront\)$/i

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Page Statistics

9
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

78 kB
Transfer

272 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://m.qrqrq.com/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
auth.qrqrq.com/ 5 KB
5 KB 1115ms
1031ms Document
text/html 99.86.2.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.qrqrq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.66 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-66.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08b82e3302c79567aa3cfd17e99bf66d3412a8e6133046f06df6f087a39feff6

Request headers

:method: GET
:authority: auth.qrqrq.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-type: text/html
content-length: 5156
date: Wed, 21 Oct 2020 00:43:55 GMT
last-modified: Wed, 30 Sep 2020 14:44:39 GMT
etag: "293af992d264619a8199aee0ea00a03f"
accept-ranges: bytes
server: AmazonS3
x-cache: Miss from cloudfront
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: xRT6Sm-LLefcIjVvFqXSFfwoYrPOHPUNdXN_d3btw8uw0uAAOAzG_w==

GET
H2 200 vue.min.js Show response
cdn.jsdelivr.net/npm/vue/dist/ 91 KB
33 KB 23ms
7ms Script
application/javascript 2a04:4e42:3::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue/dist/vue.min.js

Requested by

Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

29296ccacaa9ed35ed168fc51e36f54fd6f8db9c7786bbf38cc59a27229ba5c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 10468
x-cache: HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 34100
etag: W/"16de6-5V3x99bCiO5z1Dm6sm3QBv/uevM"
x-served-by: cache-fra19156-FRA
date: Wed, 21 Oct 2020 00:43:54 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 axios.min.js Show response
cdn.jsdelivr.net/npm/axios/dist/ 14 KB
5 KB 22ms
6ms Script
application/javascript 2a04:4e42:3::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Requested by

Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

2b26394aac8199778cd337d8046535b6ea9cb2dc698e4102029ca963e080e19f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 3682
x-cache: HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 4932
etag: W/"37b9-liNZyM1jo/hDYXGtRtl9nymrrE0"
x-served-by: cache-fra19156-FRA
date: Wed, 21 Oct 2020 00:43:54 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ 152 KB
23 KB 26ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css

Requested by

Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

/

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://auth.qrqrq.com
Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:43:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Feb 2019 16:40:50 GMT
status: 200
etag: "1550076050"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 23237

GET
H2 200 loading.js Show response
auth.qrqrq.com/ 177 B
503 B 1057ms
1055ms Script
application/javascript 99.86.2.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.qrqrq.com/loading.js
Requested by: Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.66 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-66.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8671d66207ea79f5bde42fb13634453dfb82ad584b2115a4b31fd6d58583b7d5

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:43:56 GMT
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
last-modified: Wed, 24 Jun 2020 01:58:26 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "3728d75f5a220843652a30ae86d7c4b8"
x-cache: Miss from cloudfront
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 177
x-amz-cf-id: OOOjZy9PmQmM3wJKyNrGu1b0chmNjoSaqmJuJMneq4dN8ovShGqPbA==

GET
H2 200 loading.css
auth.qrqrq.com/css/ 347 B
663 B 1096ms
1094ms Stylesheet
text/css 99.86.2.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.qrqrq.com/css/loading.css
Requested by: Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.66 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-66.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bb9f665df5af5d96edc9577d65feaebd226a883d00b891feb310d71f6c74f924

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:43:56 GMT
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
last-modified: Mon, 27 Apr 2020 15:31:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "e1125bb0c349c94094dd4b2abb3d987b"
x-cache: Miss from cloudfront
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 347
x-amz-cf-id: s9NjTTToADNd7E7s2DuvOfbtF0ywfRVlt6uEUdBvHl2-8NTXan7_SA==

GET
H2 200 qrqr_id.css
auth.qrqrq.com/css/ 3 KB
3 KB 1055ms
1053ms Stylesheet
text/css 99.86.2.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.qrqrq.com/css/qrqr_id.css
Requested by: Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.66 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-66.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e1f67e93578e2393c707f62996f3b7d52729c3603c1c6c68650883f4b6b9d434

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:43:56 GMT
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
last-modified: Wed, 30 Sep 2020 14:44:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "edbd0a56867ae26daa66cf00247924b9"
x-cache: Miss from cloudfront
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 3074
x-amz-cf-id: BU4G76n__6IhHFWrlPvoQe-nekTm5wpkQ99EeUrq8KgqS2qPXTg4xA==

GET
H2 200 qs_environment.js Show response
auth.qrqrq.com/ 443 B
769 B 1041ms
1040ms Script
application/javascript 99.86.2.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.qrqrq.com/qs_environment.js
Requested by: Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.66 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-66.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3af88e416f619925f9df81c2885527769a7c4f7326802eac055bef4248cb0e2e

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:43:56 GMT
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
last-modified: Thu, 30 Apr 2020 02:14:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "7528899da3efd9ba13ed1be73a133bb4"
x-cache: Miss from cloudfront
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 443
x-amz-cf-id: QGYvoVPeuc4SqSKBnVZ3F3k_D-EaImeDlh_DbkgCP40hZ5fxnbG9dg==

GET
H2 200 qrqr-logo.png
auth.qrqrq.com/images/ 6 KB
6 KB 1043ms
1042ms Image
image/png 99.86.2.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.qrqrq.com/images/qrqr-logo.png
Requested by: Host: auth.qrqrq.com
URL: https://auth.qrqrq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.66 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-66.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da78305d9ce7f51ae95d5cfb1c916738113c6b5665d2301370545a6e7b1d3aee

Request headers

Referer: https://auth.qrqrq.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:43:57 GMT
via: 1.1 2f471134491a4de5cfcaef646caf9dde.cloudfront.net (CloudFront)
last-modified: Mon, 27 Apr 2020 15:31:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "7fb5e8e156dd77776b0da4cff0fcece5"
x-cache: Miss from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 6119
x-amz-cf-id: 3VJHbZshpwad6M7wERNjGIyzIyMYCv65UUoXUTKN5Uzg8Ad2icRE2g==

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| Vue function| axios

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.qrqrq.com
cdn.jsdelivr.net
stackpath.bootstrapcdn.com
2001:4de0:ac19::1:b:3a
2a04:4e42:3::621
99.86.2.66
08b82e3302c79567aa3cfd17e99bf66d3412a8e6133046f06df6f087a39feff6
29296ccacaa9ed35ed168fc51e36f54fd6f8db9c7786bbf38cc59a27229ba5c2
2b26394aac8199778cd337d8046535b6ea9cb2dc698e4102029ca963e080e19f
3af88e416f619925f9df81c2885527769a7c4f7326802eac055bef4248cb0e2e
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
8671d66207ea79f5bde42fb13634453dfb82ad584b2115a4b31fd6d58583b7d5
bb9f665df5af5d96edc9577d65feaebd226a883d00b891feb310d71f6c74f924
da78305d9ce7f51ae95d5cfb1c916738113c6b5665d2301370545a6e7b1d3aee
e1f67e93578e2393c707f62996f3b7d52729c3603c1c6c68650883f4b6b9d434