Submitted URL: http://0l6la.ticgeo.pt/index.php
Effective URL: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Submission: On November 28 via manual from PT — Scanned from PT

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 104.21.9.104, located in and belongs to CLOUDFLARENET, US. The main domain is jploogsshitt.top.
TLS certificate: Issued by GTS CA 1P5 on November 10th 2023. Valid for: 3 months.
This is the only time jploogsshitt.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 94.46.180.1 24768 (ALMOUROLTEC)
2 9 104.21.9.104 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains
Transfer
9 jploogsshitt.top
jploogsshitt.top
18 KB
2 ticgeo.pt
0l6la.ticgeo.pt
635 B
8 2
Domain Requested by
9 jploogsshitt.top 2 redirects 0l6la.ticgeo.pt
jploogsshitt.top
2 0l6la.ticgeo.pt 1 redirects
8 2

This site contains no links.

Subject Issuer Validity Valid
*.ticgeo.pt
R3
2023-11-09 -
2024-02-07
3 months crt.sh
jploogsshitt.top
GTS CA 1P5
2023-11-10 -
2024-02-08
3 months crt.sh

This page contains 3 frames:

Primary Page: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Frame ID: 8B2EF242447C4D496B8CEBA813BBB7C7
Requests: 4 HTTP requests in this frame

Frame: https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: B876F7E64BA0569A54F10B2AD5BF5172
Requests: 2 HTTP requests in this frame

Frame: https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: 0964587FE71AA5ED01A97FE1CA0CCDA4
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

403 Forbidden

Page URL History Show full URLs

  1. http://0l6la.ticgeo.pt/index.php HTTP 301
    https://0l6la.ticgeo.pt/index.php Page URL
  2. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL
  3. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL

Page Statistics

8
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

18 kB
Transfer

23 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://0l6la.ticgeo.pt/index.php HTTP 301
    https://0l6la.ticgeo.pt/index.php Page URL
  2. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL
  3. https://jploogsshitt.top/XX_Corp/xxxx/?e= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://0l6la.ticgeo.pt/index.php HTTP 301
  • https://0l6la.ticgeo.pt/index.php
Request Chain 3
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Request Chain 5
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
index.php
0l6la.ticgeo.pt/
Redirect Chain
  • http://0l6la.ticgeo.pt/index.php
  • https://0l6la.ticgeo.pt/index.php
108 B
383 B
Document
General
Full URL
https://0l6la.ticgeo.pt/index.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
94.46.180.1 , Portugal, ASN24768 (ALMOUROLTEC, PT),
Reverse DNS
cp10.webserver.pt
Software
nginx / PHP/8.0.30
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
pt-PT,pt;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 28 Nov 2023 10:02:16 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.30
x-scale
YXBvY2FzQGdpdGh1Yg==

Redirect headers

Connection
keep-alive
Content-Length
241
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 28 Nov 2023 10:02:15 GMT
Location
https://0l6la.ticgeo.pt/index.php
Server
nginx
X-Scale
YXBvY2FzQGdpdGh1Yg==
/
jploogsshitt.top/XX_Corp/xxxx/
7 KB
7 KB
Document
General
Full URL
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Requested by
Host: 0l6la.ticgeo.pt
URL: https://0l6la.ticgeo.pt/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aaee7a12b141229c63ebc4b4d358e8684e5ac39785568a55dcb0e8e2b8547633
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://0l6la.ticgeo.pt/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
pt-PT,pt;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
82d1c63da912215f-MAD
content-type
text/html; charset=utf-8
date
Tue, 28 Nov 2023 10:02:16 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9UB2vOvQuqmmjWHsosbDh1u58zbDfM00tlLZLKlok%2B4%2BoDFvz4oRAPk3%2FFeo9iP2XgOVygbBka7p%2BTffsYgQZkgJASGr8PHAgZfyl64oLDmDs1XV%2FjMwcldbDgclMVlT78D%2B"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block 1; mode=block
/
jploogsshitt.top/XX_Corp/xxxx/
0
708 B
XHR
General
Full URL
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Requested by
Host: 0l6la.ticgeo.pt
URL: https://0l6la.ticgeo.pt/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

uXD21peHMIhh722YIispgYXXzBE
47343150
X-Requested-TimeStamp-Expire
accept-language
pt-PT,pt;q=0.9
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination
GET
Content-type
application/x-www-form-urlencoded
X-Requested-Type
GET
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer
https://jploogsshitt.top/XX_Corp/xxxx/?e=
X-Requested-with
XMLHttpRequest
X-Requested-TimeStamp
YXIbQTNXmXZEEWcKfnpgAyNbto
ExdENjNFhgdKaL16zkKeJp-gOGE

Response headers

pragma
no-cache
date
Tue, 28 Nov 2023 10:02:17 GMT
x-server-powered-by
Engintron
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tPXuPF5JM5FoPNtY80bbVBtHxSW0NSJekOLWlr%2Fize9NwN%2B3mFHDKMrBCtqkwGcpQJDjD8kfgbplqgpPYW1gMWijv5Zz6YFzkJv1iJlJRatqQjU3K%2B7xJ50whTeRkNmPqv55"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82d1c6409dd0215f-MAD
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
expires
0
main.js
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame B876
Redirect Chain
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
7 KB
4 KB
Script
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Protocol
H2
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6cc593e8a1d251ca4cdbf0ff60b1a328d689ff3aaac88bc684aa248fcd9caa6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pt-PT,pt;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 10:02:17 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zRyg2McvHrjUZ3CwNvW4b4ZTmK7r3cpzUsNUuo8bFuWDiS6BbqMtkeiSpkp11%2B9ba%2FDJobqOsL8xBoI%2FDslvg6ajnoph2Y4bJg8myWzEiXORm7KjjRqyIWvPoSzmD0YY6xx7"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
82d1c6411ed5215f-MAD
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Tue, 28 Nov 2023 10:02:17 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RmIBbJU91mXqbSYa0rFeOVXp1IYOjCXEKuR%2F8zc3oV01FQmDK2i9c%2BJf7vcL0dZxP0Da7SBVWMvoG6YZmhnej%2BhpYrSQbPyMOEBGe6HPF46k%2B31mBPDa8KFUu6URuL87vn5R"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
82d1c640adde215f-MAD
alt-svc
h3=":443"; ma=86400
82d1c63da912215f
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame B876
0
579 B
XHR
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/82d1c63da912215f
Requested by
Host: jploogsshitt.top
URL: https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
accept-language
pt-PT,pt;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 28 Nov 2023 10:02:17 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2O489z05p8ZiZ7MtKGPYiWXxYU7lTPpwg1YBlbTqe8kB8lDnzfMh%2FjJLEii2Hbl6flKR2L4KbXkzgaHj5WHwSJiuXTuacMoI4zEpPO1oCki%2FXhEjYsDq23nzeDyPGfzQgOBg"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
82d1c6422b3d3cfb-CDG
alt-svc
h3=":443"; ma=86400
Primary Request /
jploogsshitt.top/XX_Corp/xxxx/
2 KB
995 B
Document
General
Full URL
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Requested by
Host: 0l6la.ticgeo.pt
URL: https://0l6la.ticgeo.pt/index.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5957975408a4296714f0cff4cfc81c66adaaab0e6dc9d17dbdf203dc5e0b94b2
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://jploogsshitt.top/XX_Corp/xxxx/?e=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
pt-PT,pt;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82d1c6425b773cfb-CDG
content-encoding
br
content-type
text/html
date
Tue, 28 Nov 2023 10:02:17 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sj9uIOvr3IL%2F7%2BlkG3Vfbyj%2B2kqSbP2FdkoNZ40mcg9SIDerFlNubz6iCEkushG9RFg1lyvkOXMo1SBJdU9UAha4o95oao%2BgqIJP1Dm4jbPLDAL%2B7ce23qRQhU8gqt3O3xbM"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block 1; mode=block
main.js
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame 0964
Redirect Chain
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
7 KB
4 KB
Script
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Protocol
H3
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3bfd8992f19e12c73956e8754f6c1b0584c29721f84fa9abd14e706aacf7ab8a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
pt-PT,pt;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 28 Nov 2023 10:02:17 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B4lTtDc7OO%2Bus4c%2FBVutTggJ4WTeUeSMUpBWJrtysNI4ZSNdv4yZcWz8yFu5ILMzQc9WQ1GAa1yiDOToxrl%2FC0DbKgmacTaAc%2Fm0LbwRaPUQMg3MrnpTjf6uZMx3pn8phkMG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
82d1c6460f693cfb-CDG
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Tue, 28 Nov 2023 10:02:17 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ILvTDFgICOy3dlH9V33etKHRa4lqMpEfRe61xQHkwV%2BnZgdFF7AhHtl44ruVg8xXgt0N%2BaCxDfXrQgGE4eowzblJYDJcOqstEEgBTZ7MEafN9Kg8Hykt1RYIfvT7rB7Ztf1"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
cache-control
max-age=300, public
cf-ray
82d1c6457ed43cfb-CDG
alt-svc
h3=":443"; ma=86400
82d1c6425b773cfb
jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 0964
0
545 B
XHR
General
Full URL
https://jploogsshitt.top/cdn-cgi/challenge-platform/h/g/jsd/r/82d1c6425b773cfb
Requested by
Host: jploogsshitt.top
URL: https://jploogsshitt.top/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.9.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
pt-PT,pt;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 28 Nov 2023 10:02:18 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mPOwMC6RWbHJyXoN2PJMVgJs0HjjOBvyUIayZ3JNPEQwKXiwwzQzgeLzPm3yPadnyR6oyiF4L199LibReVP1jCr66M6NrYJNb3s7ZO%2FRj2PY%2FZRPpFIveSUNY6kNz6pbRoZ6"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
82d1c647088e3cfb-CDG
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture

12 Cookies

Domain/Path Name / Value
0l6la.ticgeo.pt/ Name: PHPSESSID
Value: p1gv7tlon9ev4t7epb5r7tvoji
jploogsshitt.top/ Name: LBj7JVfcfokf92eV3YRepRgBrd0
Value: B-DCwUKu7jCWp-f77Pxir7K0hLg
jploogsshitt.top/ Name: 1CY72yMJRoX-a51T4W-C3Sndt4M
Value: 1701165729
jploogsshitt.top/ Name: uhScPfVLmnINld5_38bNMHsbGqI
Value: 1701252129
jploogsshitt.top/ Name: X6IAZSwF3BsLyFhIZoM5QuElWjw
Value: jAbcYTW8-ENJdIX9ISF9AsxkAGE
jploogsshitt.top/ Name: lEdFaRgfENZGS3Mzf0OncP44Hrs
Value: sXF42wSXyVepsIa9HyALC4VZZtM
jploogsshitt.top/ Name: YD7jeGXfpOtKInCp3lKV4dagSnY
Value: oZBJS2s6bHkLWB_KhlUn5dfYruY
jploogsshitt.top/ Name: eyISRxv3-V9-EBDa25U1toGBNeQ
Value: 1701165736
jploogsshitt.top/ Name: qyQ6VvOQVDEJHJURA7McuAN-iow
Value: 1701252136
jploogsshitt.top/ Name: EuBOfOFZ5XXK5s7uotKKm79XhWk
Value: eebVyOMpeWWDwFv9KK-0H-svcvI
jploogsshitt.top/ Name: XuxhzJxq7e6ygt-k7o0Nvi84XcA
Value: 0PWugj5uwjHElx7QvZ7CVaW0HnQ
.jploogsshitt.top/ Name: cf_clearance
Value: Us3nf6YvzIk7FivFY6FltQhJNObUBDrq_00i21CBoxU-1701165738-0-1-6612ff99.92bbf614.bbbb2617-0.2.1701165738

2 Console Messages

Source Level URL
Text
network error URL: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://jploogsshitt.top/XX_Corp/xxxx/?e=
Message:
Failed to load resource: the server responded with a status of 403 ()