Submitted URL: https://bit.ly/3rmpFHp
Effective URL: https://cticedamremoval.com/.well-known/pki-validation/helpie6/index.php?apicilar=1f0y5dv6b3hbd&colportage=starchedness&bubu...
Submission Tags: falconsandbox
Submission: On December 02 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 2 HTTP transactions. The main IP is 23.111.186.98, located in Tampa, United States and belongs to HVC-AS, US. The main domain is cticedamremoval.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 18th 2021. Valid for: 3 months.
This is the only time cticedamremoval.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.10 396982 (GOOGLE-PR...)
1 23.111.186.98 29802 (HVC-AS)
2 2
Apex Domain
Subdomains
Transfer
1 cticedamremoval.com
cticedamremoval.com
6 KB
1 bit.ly
bit.ly
332 B
0 tipsbestresult.world Failed
tipsbestresult.world Failed
2 3
Domain Requested by
1 cticedamremoval.com
1 bit.ly 1 redirects
0 tipsbestresult.world Failed cticedamremoval.com
2 3

This site contains no links.

Subject Issuer Validity Valid
cticedamremoval.com
cPanel, Inc. Certification Authority
2021-09-18 -
2021-12-17
3 months crt.sh

This page contains 1 frames:

Frame: https://tipsbestresult.world/busy.php?a=1nor&c=d&s=10563
Frame ID: 96C4941A0D92826CBF0DF1F405F46383
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://bit.ly/3rmpFHp HTTP 301
    https://cticedamremoval.com/.well-known/pki-validation/helpie6/index.php?apicilar=1f0y5dv6b3hbd&colporta... Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

6 kB
Transfer

5 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3rmpFHp HTTP 301
    https://cticedamremoval.com/.well-known/pki-validation/helpie6/index.php?apicilar=1f0y5dv6b3hbd&colportage=starchedness&bubulcus=yaffingale Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
cticedamremoval.com/.well-known/pki-validation/helpie6/
Redirect Chain
  • https://bit.ly/3rmpFHp
  • https://cticedamremoval.com/.well-known/pki-validation/helpie6/index.php?apicilar=1f0y5dv6b3hbd&colportage=starchedness&bubulcus=yaffingale
5 KB
6 KB
Document
General
Full URL
https://cticedamremoval.com/.well-known/pki-validation/helpie6/index.php?apicilar=1f0y5dv6b3hbd&colportage=starchedness&bubulcus=yaffingale
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.111.186.98 Tampa, United States, ASN29802 (HVC-AS, US),
Reverse DNS
23-111-186-98.static.hvvc.us
Software
Apache /
Resource Hash
08979431647ab47fd0ca0f4ef3112c5216a2793cd86608f10c8dbe0c42de25dc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Thu, 02 Dec 2021 21:46:11 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

server
nginx
date
Thu, 02 Dec 2021 21:46:10 GMT
content-type
text/html; charset=utf-8
content-length
234
cache-control
private, max-age=90
content-security-policy
referrer always;
location
https://cticedamremoval.com/.well-known/pki-validation/helpie6/index.php?apicilar=1f0y5dv6b3hbd&colportage=starchedness&bubulcus=yaffingale
referrer-policy
unsafe-url
via
1.1 google
alt-svc
clear
busy.php
tipsbestresult.world/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tipsbestresult.world
URL
https://tipsbestresult.world/busy.php?a=1nor&c=d&s=10563

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

1 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: lb2lKa-c828bfcfbe95c476a7-00Q

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
cticedamremoval.com
tipsbestresult.world
tipsbestresult.world
23.111.186.98
67.199.248.10
08979431647ab47fd0ca0f4ef3112c5216a2793cd86608f10c8dbe0c42de25dc