Submitted URL: https://blox.it/
Effective URL: https://www.blox.it/
Submission Tags: phishingrod
Submission: On June 13 via api from DE — Scanned from IT

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 13 HTTP transactions. The main IP is 89.46.109.35, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.blox.it.
TLS certificate: Issued by Actalis Domain Validation Server CA G3 on June 13th 2024. Valid for: a year.
This is the only time www.blox.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 11 89.46.109.35 31034 (ARUBA-ASN)
1 2 192.229.221.25 15133 (EDGECAST)
13 3
Apex Domain
Subdomains
Transfer
11 blox.it
blox.it
www.blox.it
119 KB
1 paypalobjects.com
www.paypalobjects.com — Cisco Umbrella Rank: 2736
1 KB
1 paypal.com
www.paypal.com — Cisco Umbrella Rank: 3002
903 B
0 google-analytics.com Failed
www.google-analytics.com Failed
0 vivistats.com Failed
count.vivistats.com Failed
13 5
Domain Requested by
10 www.blox.it www.blox.it
1 www.paypalobjects.com www.blox.it
1 www.paypal.com 1 redirects
1 blox.it 1 redirects
0 www.google-analytics.com Failed www.blox.it
0 count.vivistats.com Failed www.blox.it
13 6

This site contains links to these domains. Also see Links.

Domain
www.omad.it
Subject Issuer Validity Valid
*.blox.it
Actalis Domain Validation Server CA G3
2024-06-13 -
2025-07-14
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.blox.it/
Frame ID: 6C3488B0168E23C272176BE549432B30
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Blox - Smarty

Page URL History Show full URLs

  1. https://blox.it/ HTTP 301
    https://www.blox.it/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • paypalobjects\.com

Page Statistics

13
Requests

77 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

3
IPs

2
Countries

120 kB
Transfer

141 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://blox.it/ HTTP 301
    https://www.blox.it/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://www.paypal.com/it_IT/i/btn/x-click-but01.gif HTTP 301
  • https://www.paypalobjects.com/it_IT/i/btn/x-click-but01.gif

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.blox.it/
Redirect Chain
  • https://blox.it/
  • https://www.blox.it/
18 KB
4 KB
Document
General
Full URL
https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
0da0673875881c7ebf64e5a8b3fe70940361541e581e6283bd6d65228c8b7f0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
gzip
content-type
text/html
date
Thu, 13 Jun 2024 03:41:54 GMT
server
aruba-proxy
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-servername
ipvsproxy182.ad.aruba.it

Redirect headers

content-type
text/html
date
Thu, 13 Jun 2024 03:41:54 GMT
location
https://www.blox.it/
server
aruba-proxy
x-servername
ipvsproxy182.ad.aruba.it
stile.css
www.blox.it/scripts/
11 KB
2 KB
Stylesheet
General
Full URL
https://www.blox.it/scripts/stile.css
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
c330eeb7ee895ecf37b16c5a6c4c6476fc7d62d26e82df946d2d3fc249754679
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 18 May 2011 08:10:30 GMT
server
aruba-proxy
vary
Accept-Encoding
content-type
text/css
blox_banner_800x200.png
www.blox.it/images/
53 KB
53 KB
Image
General
Full URL
https://www.blox.it/images/blox_banner_800x200.png
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
3de4d50c594f8a741d200ed0bb6e132dd024b4d8cf8141b34f4140db6fa9c696
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Mon, 07 Dec 2015 14:27:31 GMT
server
aruba-proxy
content-type
image/png
accept-ranges
bytes
content-length
53988
1pixel.gif
www.blox.it/images/
51 B
251 B
Image
General
Full URL
https://www.blox.it/images/1pixel.gif
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
7455bacb03f7ef04d79010638db14d8434cf7a349914c2ee99eb5d4220338675
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 18 May 2011 08:10:27 GMT
server
aruba-proxy
content-type
image/gif
accept-ranges
bytes
content-length
51
blox_banner.jpg
www.blox.it/images/
34 KB
35 KB
Image
General
Full URL
https://www.blox.it/images/blox_banner.jpg
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
7997c24977832d5629bdd8e6e164a879b7a0476a9876206733312320968416c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 18 May 2011 08:10:28 GMT
server
aruba-proxy
content-type
image/jpeg
accept-ranges
bytes
content-length
35299
x-click-but01.gif
www.paypalobjects.com/it_IT/i/btn/
Redirect Chain
  • https://www.paypal.com/it_IT/i/btn/x-click-but01.gif
  • https://www.paypalobjects.com/it_IT/i/btn/x-click-but01.gif
1 KB
1 KB
Image
General
Full URL
https://www.paypalobjects.com/it_IT/i/btn/x-click-but01.gif
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Server
192.229.221.25 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (mil/6C99) /
Resource Hash
bebbb2e1cef69e02ac86b451fec286992dcd162d952540d548c9d19f5432e6b3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
it-IT,it;q=0.9;q=0.9
Referer
https://www.blox.it/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 13 Jun 2024 03:41:55 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-cache
HIT
paypal-debug-id
aee6fa10f08a3
dc
ccg11-origin-www-1.paypal.com
content-length
1051
last-modified
Fri, 16 Aug 2019 04:57:39 GMT
server
ECAcc (mil/6C99)
traceparent
00-0000000000000000000aee6fa10f08a3-92888706b1a0accb-01
etag
"5d5637c3-41b"
content-type
image/gif
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
expires
Thu, 13 Jun 2024 04:41:55 GMT

Redirect headers

date
Thu, 13 Jun 2024 03:41:55 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Full
server
ECAcc (frc/4CD9)
traceparent
00-00000000000000000000143869411b36-200a20239ebd89c4-01
vary
Accept-Encoding
location
https://www.paypalobjects.com/it_IT/i/btn/x-click-but01.gif
paypal-debug-id
0143869411b36
cache-control
max-age=0, no-cache, no-store, must-revalidate
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
server-timing
content-encoding;desc="", x-cdn;desc="edgecast"
dc
ccg11-origin-www-1.paypal.com
timing-allow-origin
*
content-length
20
pay4.jpg
www.blox.it/images/
6 KB
6 KB
Image
General
Full URL
https://www.blox.it/images/pay4.jpg
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
c37c320e2b44af1f6e10ac2b3946b2d1d18c0ebf8dbe72d185b7754cbb1aef6f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 18 May 2011 08:10:29 GMT
server
aruba-proxy
content-type
image/jpeg
accept-ranges
bytes
content-length
6179
imm_blox.jpg
www.blox.it/images/
10 KB
10 KB
Image
General
Full URL
https://www.blox.it/images/imm_blox.jpg
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
d0e0c99f39b6a32053cb159058603b5eabef612e618a2b327770d48bf28d5699
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 18 May 2011 08:10:28 GMT
server
aruba-proxy
content-type
image/jpeg
accept-ranges
bytes
content-length
10401
imm_smarty.jpg
www.blox.it/images/
7 KB
7 KB
Image
General
Full URL
https://www.blox.it/images/imm_smarty.jpg
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
7d97a90835fd3e9de5c9a27ed0bfa6401b835d3c73d456fa0e9e60684b3b2366
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 18 May 2011 08:10:28 GMT
server
aruba-proxy
content-type
image/jpeg
accept-ranges
bytes
content-length
7334
laser.asp
count.vivistats.com/
0
0

urchin.js
www.google-analytics.com/
0
0

1pixelgrigio.gif
www.blox.it/images/
43 B
243 B
Image
General
Full URL
https://www.blox.it/images/1pixelgrigio.gif
Requested by
Host: www.blox.it
URL: https://www.blox.it/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
dd5b1fd5b1b1789571a87341bc9b62b8eda9504c0c1b7d66d8ded52f1576e06d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-servername
ipvsproxy182.ad.aruba.it
date
Thu, 13 Jun 2024 03:41:54 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Wed, 18 May 2011 08:10:27 GMT
server
aruba-proxy
content-type
image/gif
accept-ranges
bytes
content-length
43
favicon.ico
www.blox.it/
196 B
333 B
Other
General
Full URL
https://www.blox.it/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.46.109.35 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1364.aruba.it
Software
aruba-proxy /
Resource Hash
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.blox.it/
Accept-Language
it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 03:41:55 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
aruba-proxy
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
count.vivistats.com
URL
http://count.vivistats.com/laser.asp?CountId=21781
Domain
www.google-analytics.com
URL
http://www.google-analytics.com/urchin.js

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| numeralsOnly function| verificaZero function| checkvalues function| calcola function| roundTo string| _uacct

2 Cookies

Domain/Path Name / Value
.paypal.com/ Name: ts
Value: vreXpYrS%3D1812858115%26vteXpYrS%3D1718251915%26vr%3D0fb0105a1900ad1090166dc2ffc38d9a%26vt%3D0fb0105a1900ad1090166dc2ffc38d99%26vtyp%3Dnew
.paypal.com/ Name: ts_c
Value: vr%3D0fb0105a1900ad1090166dc2ffc38d9a%26vt%3D0fb0105a1900ad1090166dc2ffc38d99

8 Console Messages

Source Level URL
Text
security warning URL: https://www.blox.it/
Message:
Mixed Content: The page at 'https://www.blox.it/' was loaded over HTTPS, but requested an insecure element 'http://www.paypal.com/it_IT/i/btn/x-click-but01.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.blox.it/(Line 416)
Message:
Mixed Content: The page at 'https://www.blox.it/' was loaded over HTTPS, but requested an insecure element 'http://www.paypal.com/it_IT/i/btn/x-click-but01.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://www.blox.it/
Message:
Mixed Content: The page at 'https://www.blox.it/' was loaded over HTTPS, but requested an insecure script 'http://count.vivistats.com/laser.asp?CountId=21781'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://www.blox.it/
Message:
Mixed Content: The page at 'https://www.blox.it/' was loaded over HTTPS, but requested an insecure script 'http://www.google-analytics.com/urchin.js'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://www.blox.it/(Line 431)
Message:
Mixed Content: The page at 'https://www.blox.it/' was loaded over HTTPS, but requested an insecure element 'http://www.paypal.com/it_IT/i/btn/x-click-but01.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
other warning URL: https://www.blox.it/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://www.blox.it/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
network error URL: https://www.blox.it/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload