Submitted URL: http://0l6la.ticgeo.pt/index.php
Effective URL: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Submission: On November 28 via manual from PT — Scanned from PT

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 104.21.9.104, located in and belongs to CLOUDFLARENET, US. The main domain is jploogsshitt.top.
TLS certificate: Issued by GTS CA 1P5 on November 10th 2023. Valid for: 3 months.
This is the only time jploogsshitt.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 94.46.180.1 24768 (ALMOUROLTEC)
2 9 104.21.9.104 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains
Transfer
9 jploogsshitt.top
jploogsshitt.top
18 KB
2 ticgeo.pt
0l6la.ticgeo.pt
635 B
8 2
Domain Requested by
9 jploogsshitt.top 2 redirects 0l6la.ticgeo.pt
jploogsshitt.top
2 0l6la.ticgeo.pt 1 redirects
8 2

This site contains no links.

Subject Issuer Validity Valid
*.ticgeo.pt
R3
2023-11-09 -
2024-02-07
3 months crt.sh
jploogsshitt.top
GTS CA 1P5
2023-11-10 -
2024-02-08
3 months crt.sh

This page contains 3 frames:

Primary Page: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Frame ID: 12B7FC6DA8821DDF82EEE795726F45D8
Requests: 4 HTTP requests in this frame

Frame: https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: E103625574E82408306035334BFCC79C
Requests: 2 HTTP requests in this frame

Frame: https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: A44E75CA11DBF91FC0E6A87552967979
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

403 Forbidden

Page URL History Show full URLs

  1. http://0l6la.ticgeo.pt/index.php HTTP 301
    https://0l6la.ticgeo.pt/index.php Page URL
  2. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL
  3. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL

Page Statistics

8
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

18 kB
Transfer

23 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://0l6la.ticgeo.pt/index.php HTTP 301
    https://0l6la.ticgeo.pt/index.php Page URL
  2. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL
  3. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://0l6la.ticgeo.pt/index.php HTTP 301
  • https://0l6la.ticgeo.pt/index.php
Request Chain 3
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Request Chain 5
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
index.php
0l6la.ticgeo.pt/
Redirect Chain
  • http://0l6la.ticgeo.pt/index.php
  • https://0l6la.ticgeo.pt/index.php
108 B
383 B
Document
General
Full URL
https://0l6la.ticgeo.pt/index.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
94.46.180.1 , Portugal, ASN24768 (ALMOUROLTEC, PT),
Reverse DNS
cp10.webserver.pt
Software
nginx / PHP/8.0.30
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
pt-PT,pt;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 28 Nov 2023 10:10:59 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.30
x-scale
YXBvY2FzQGdpdGh1Yg==

Redirect headers

Connection
keep-alive
Content-Length
241
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 28 Nov 2023 10:10:59 GMT
Location
https://0l6la.ticgeo.pt/index.php
Server
nginx
X-Scale
YXBvY2FzQGdpdGh1Yg==
/
jploogsshitt.top/XX_Corp/xxxx/
7 KB
8 KB
Document
General
Full URL
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Requested by
Host: 0l6la.ticgeo.pt
URL: https://0l6la.ticgeo.pt/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c9ac09703b089bf16360e85f4fad2a04c507ff2f7ac1d4cace52613756ab752
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://0l6la.ticgeo.pt/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
pt-PT,pt;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
82d1d306097b2fa5-MAD
content-type
text/html; charset=utf-8
date
Tue, 28 Nov 2023 10:11:00 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jh2Vc2iGlKPrVQ0BvpyrX7Qg0rjn9k8O0bVbcIjODo6q7yO%2BHkCCaev9B5Efz6HbMaZb3EjAhMowhFNafQERh0CGyCfT45SW2oGnFXW5wKNpR4Wm%2B7NeB5mTJ5NPdlVzVJmL"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block 1; mode=block
/
jploogsshitt.top/XX_Corp/xxxx/
0
714 B
XHR
General
Full URL
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Requested by
Host: 0l6la.ticgeo.pt
URL: https://0l6la.ticgeo.pt/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

uXD21peHMIhh722YIispgYXXzBE
47343150
X-Requested-TimeStamp-Expire
accept-language
pt-PT,pt;q=0.9
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination
GET
Content-type
application/x-www-form-urlencoded
X-Requested-Type
GET
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer
https://jploogsshitt.top/XX_Corp/xxxx/?e=
X-Requested-with
XMLHttpRequest
X-Requested-TimeStamp
YXIbQTNXmXZEEWcKfnpgAyNbto
ExdENjNFhgdKaL16zkKeJp-gOGE

Response headers

pragma
no-cache
date
Tue, 28 Nov 2023 10:11:00 GMT
x-server-powered-by
Engintron
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zlVXLzgQLzI1muoMDEM%2Fx7mSlAkK%2BaZRNjUwIYMSGZV6hd%2FiCThrcX%2FV8it9S5lmHBhI7xlLY9lq9mEImB8HHz6mPU1FIVWGLLCSSx%2FkafJt%2B6WDUqO4Vf6uCDSDR9n%2Bm50S"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82d1d3090e452fa5-MAD
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
expires
0
main.js
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame E103
Redirect Chain
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
7 KB
4 KB
Script
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Protocol
H2
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a60c226a14f93be9b611e655c2a6308a04ff6e7b822c650a66b8ab5d287a5408
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pt-PT,pt;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 10:11:00 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vuK5SpO7CIJFwLMuc1xav5%2BsJZ6hZB5TvjXMaFtlQdbemEKumPY94zqyl4XdW%2Bn0sRvn4Eifs0kDFbns6c7gqpEi4owcq5R%2FssuBulbzyRMBjyNcVBcPBXcHtQOWfNMeCyV3"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
82d1d3098f5f2fa5-MAD
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Tue, 28 Nov 2023 10:11:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VtunQQttZx45hAEoyu6eg2HxsYJklSZ3HucoYj%2FxsWs0ThQCTIGPa3WoA6%2B%2FvaP8vmwdncXplVL%2BkFQJDdOeuASM8ZR96zzNfb0ZtBac5335UeA8UE%2BVkhIV58Tn5g60wEwI"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
82d1d3090e4c2fa5-MAD
alt-svc
h3=":443"; ma=86400
82d1d306097b2fa5
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame E103
0
586 B
XHR
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/82d1d306097b2fa5
Requested by
Host: jploogsshitt.top
URL: https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
accept-language
pt-PT,pt;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 28 Nov 2023 10:11:00 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ja5osKaBm6Ez4DfCMRJiaDSk4SATYCM4sKh6%2F4JRnIUeFjvgZIdpc2IO29224ViFrWJqCKQqqxujTIbNIX4%2F%2BEK5wD6pmm%2Fc275XBI%2F9RNGONd%2FGxgQdt5bJo%2BXesRxtON9K"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
82d1d30a7d423852-MAD
alt-svc
h3=":443"; ma=86400
Primary Request /
jploogsshitt.top/XX_Corp/xxxx/
2 KB
992 B
Document
General
Full URL
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Requested by
Host: 0l6la.ticgeo.pt
URL: https://0l6la.ticgeo.pt/index.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de087b713410c3cbcea4f7795c876e55da3df165e0b86acb84ca60146919e9a4
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
pt-PT,pt;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82d1d30aad833852-MAD
content-encoding
br
content-type
text/html
date
Tue, 28 Nov 2023 10:11:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qNmNGBaOu4L9ztXqFedzTJrKY3UZ1GIvI7xFqQmiNl5E6toQfaTIrwXMPYmrxkkmEUjAAivzwPjPM37fKvwEDALuWU6UQjzPdYcuOej0cIFPUL1YcF5PxttoznWMD9uyg3ul"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block 1; mode=block
main.js
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame A44E
Redirect Chain
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
7 KB
4 KB
Script
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Protocol
H3
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1109f7db56e4f85f439d801f6f87ef7809fde8ebd26e9410be1d3b579fba0759
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pt-PT,pt;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 10:11:01 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8%2BzNp03j5tv6iEmXCHaFS4AfCE7%2BrMWUZBv%2FCSLaTp0GXbqkCUWYvsnQoL7MXUHQz7yRoEwDserfmYx1T8zkCUJFEvEkqp0scDmmIEvVaaxNEAjMIycwLkFPZWcUCcLS9XZT"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
82d1d30e0aae3852-MAD
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Tue, 28 Nov 2023 10:11:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BRgbVKIw9o2Lgw03fBXh5D%2FYXTfc3%2BlL1bsMIJd%2Fcet%2FeFbSB1VtuBVgj8QqPFn%2Bv815bggE%2BNS%2BuZRPkmqB3mnP4sKh6nAc1BigR9vep8oDVSksdk1NxlwYqVm0wIibv1Nz"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
cache-control
max-age=300, public
cf-ray
82d1d30d9a093852-MAD
alt-svc
h3=":443"; ma=86400
82d1d30aad833852
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame A44E
0
542 B
XHR
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/82d1d30aad833852
Requested by
Host: jploogsshitt.top
URL: https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
pt-PT,pt;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 28 Nov 2023 10:11:01 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ypvKi708wscTHNr5C2VegVYdMLC9IeLX3ATj1d2KBc4T%2BGivgwQqMVn1iMHdnF6x8iOCxTzQACQ%2FgD5m8KK8EqGCZV1CHjCWhb6qIe4MS5Rej3g05MK7QfjiRX5Wp0Av4HKA"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
82d1d30f0c463852-MAD
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture

13 Cookies

Domain/Path Name / Value
0l6la.ticgeo.pt/ Name: PHPSESSID
Value: 2vden25ursmdkm03epm3oik598
jploogsshitt.top/ Name: lxBnpfYJK0NfEMbmYBgPIPCCvJI
Value: 2iLZSFMl81Hx-wn-lmI9fMXsnr8
jploogsshitt.top/ Name: c-hACtd-w3zZuGF2vXYm8PuvEXw
Value: 1701166254
jploogsshitt.top/ Name: CDGRswnmJvhL2UMZlA8LOXE69nU
Value: 1701252654
jploogsshitt.top/ Name: GJort329onIH9f0Er2k5VYSDV7s
Value: Fcnsij0JCrvq9qlm_hFZsr8igdw
jploogsshitt.top/ Name: dYlZOadwtIfPArfAGk6IgEA1h3c
Value: 1VzSGjf0DFW4vGfmS5waWi2bc_Q
jploogsshitt.top/ Name: lEdFaRgfENZGS3Mzf0OncP44Hrs
Value: sXF42wSXyVepsIa9HyALC4VZZtM
jploogsshitt.top/ Name: YD7jeGXfpOtKInCp3lKV4dagSnY
Value: oZBJS2s6bHkLWB_KhlUn5dfYruY
jploogsshitt.top/ Name: eyISRxv3-V9-EBDa25U1toGBNeQ
Value: 1701166260
jploogsshitt.top/ Name: qyQ6VvOQVDEJHJURA7McuAN-iow
Value: 1701252660
jploogsshitt.top/ Name: EuBOfOFZ5XXK5s7uotKKm79XhWk
Value: heu4nyn7frd2apFnfutwTw5GvQY
jploogsshitt.top/ Name: XuxhzJxq7e6ygt-k7o0Nvi84XcA
Value: 0PWugj5uwjHElx7QvZ7CVaW0HnQ
.jploogsshitt.top/ Name: cf_clearance
Value: 6OpARewFi32UVvWrD4ba6YeqE6Vtv4FU8DaJbS2I3HY-1701166261-0-1-6612ff99.92bbf614.bbbb2617-0.2.1701166261

2 Console Messages

Source Level URL
Text
network error URL: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Message:
Failed to load resource: the server responded with a status of 403 ()