URL: http://9bsv.gz1.6hbz.fun/
Submission: On May 16 via manual from US

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 104.248.14.138, located in Clifton, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is 9bsv.gz1.6hbz.fun.
This is the only time 9bsv.gz1.6hbz.fun was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.248.14.138 14061 (DIGITALOC...)
1 18.195.11.218 16509 (AMAZON-02)
1 18.195.251.71 16509 (AMAZON-02)
1 35.227.196.138 15169 (GOOGLE)
4 4
Domain
Subdomains
Transfer
1 performanceonclick.com
0 B
1 l67.trade
579 B
1 m3jb.ninja
965 B
1 6hbz.fun
449 B
4 4

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
quy1o.m3jb.ninja
Let's Encrypt Authority X3
2019-04-13 -
2019-07-12
3 months

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i

Web
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
182 B
449 B
Document
General
Full URL
http://9bsv.gz1.6hbz.fun/
Protocol
HTTP/1.1
Server
104.248.14.138 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
gz1.6hbz.fun
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
9bsv.gz1.6hbz.fun
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 May 2019 05:07:36 GMT
Server
Apache/2.2.15 (CentOS)
Last-Modified
Wed, 15 May 2019 19:49:22 GMT
ETag
"168e-b6-588f272245480"
Accept-Ranges
bytes
Content-Length
182
Connection
close
Content-Type
text/html; charset=UTF-8
Cookie set 68e21b94-558d-4094-8364-ea8aea8b1bac
quy1o.m3jb.ninja/go
311 B
965 B
Document
General
Full URL
https://quy1o.m3jb.ninja/go/68e21b94-558d-4094-8364-ea8aea8b1bac
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.11.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-11-218.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
fe4dbb45d1398c94a7a5c584804c262a73591c508b61df7377e9f9ace9c3b76b
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains

Request headers

Host
quy1o.m3jb.ninja
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://9bsv.gz1.6hbz.fun/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://9bsv.gz1.6hbz.fun/

Response headers

Server
nginx
Date
Thu, 16 May 2019 05:07:36 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Origin
*
Set-Cookie
bemob-uniq-visit:68e21b94-558d-4094-8364-ea8aea8b1bac=1; Domain=quy1o.m3jb.ninja; Path=/; Expires=Fri, 17 May 2019 05:07:36 GMT; HttpOnly bemob-click-id=HUp93WyqKd4x4MBSBis2Qy; Domain=quy1o.m3jb.ninja; Path=/; Expires=Fri, 17 May 2019 05:07:36 GMT; HttpOnly
ETag
W/"137-vrTK+N2NR2OU7ooZtD7K8gt/IUs"
X-Response-Time
12.016ms
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control
no-cache
Strict-Transport-Security
max-age=0; includeSubDomains
Content-Encoding
gzip
?redirectUrl=http%3A%2F%2Fwww.performanceonclick.com%2Fjump%2Fnext.php%3Fr%3D2365323%26sub1%3D%7Bsource_id%7D%26pub_hash%3DHUp93WyqKd4x4MBSBis2Qy
quy1c.l67.trade
234 B
579 B
Document
General
Full URL
http://quy1c.l67.trade/?redirectUrl=http%3A%2F%2Fwww.performanceonclick.com%2Fjump%2Fnext.php%3Fr%3D2365323%26sub1%3D%7Bsource_id%7D%26pub_hash%3DHUp93WyqKd4x4MBSBis2Qy
Protocol
HTTP/1.1
Server
18.195.251.71 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-251-71.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f7c61038a15b0572a05fe114a1cdb1132597232bc9604b9b08ce6879e9c8ca6f

Request headers

Host
quy1c.l67.trade
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx
Date
Thu, 16 May 2019 05:07:37 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Origin
*
ETag
W/"ea-/2SRMh8cayyxhNDluCJ/yj5Qemo"
X-Response-Time
3.451ms
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control
no-cache
Content-Encoding
gzip
next.php?r=2365323&sub1=%7Bsource_id%7D&pub_hash=HUp93WyqKd4x4MBSBis2Qy
www.performanceonclick.com/jump
0
0
Document
General
Full URL
http://www.performanceonclick.com/jump/next.php?r=2365323&sub1={source_id}&pub_hash=HUp93WyqKd4x4MBSBis2Qy
Protocol
HTTP/1.1
Server
35.227.196.138 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
138.196.227.35.bc.googleusercontent.com
Software
openresty /
Resource Hash

Request headers

Host
www.performanceonclick.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://quy1c.l67.trade/?redirectUrl=http%3A%2F%2Fwww.performanceonclick.com%2Fjump%2Fnext.php%3Fr%3D2365323%26sub1%3D%7Bsource_id%7D%26pub_hash%3DHUp93WyqKd4x4MBSBis2Qy
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://quy1c.l67.trade/?redirectUrl=http%3A%2F%2Fwww.performanceonclick.com%2Fjump%2Fnext.php%3Fr%3D2365323%26sub1%3D%7Bsource_id%7D%26pub_hash%3DHUp93WyqKd4x4MBSBis2Qy

Response headers

Server
openresty
Date
Thu, 16 May 2019 05:07:37 GMT
Referrer-Policy
no-referrer
Via
1.1 google

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9bsv.gz1.6hbz.fun
quy1c.l67.trade
quy1o.m3jb.ninja
www.performanceonclick.com
104.248.14.138
18.195.11.218
18.195.251.71
35.227.196.138
f7c61038a15b0572a05fe114a1cdb1132597232bc9604b9b08ce6879e9c8ca6f
fe4dbb45d1398c94a7a5c584804c262a73591c508b61df7377e9f9ace9c3b76b