![](/screenshots/dc5a1697-5419-4ea9-b27f-fd1b64ebd7f7.png)
filippo.io
Open in
urlscan Pro
75.2.60.5
Public Scan
Effective URL: https://filippo.io/ticketbleed/
Submission: On September 05 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by R3 on August 11th 2021. Valid for: 3 months.
This is the only time filippo.io was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 217.70.184.55 217.70.184.55 | 29169 (GANDI-AS ...) (GANDI-AS Domain name registrar - www.gandi.net) | |
1 3 | 75.2.60.5 75.2.60.5 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
7 | 4 |
ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR)
PTR: webredir.gandi.net
ticketbleed.com |
ASN16509 (AMAZON-02, US)
PTR: acd89244c803f7181.awsglobalaccelerator.com
filippo.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
gstatic.com
fonts.gstatic.com |
83 KB |
3 |
filippo.io
1 redirects
filippo.io |
33 KB |
1 |
googleapis.com
fonts.googleapis.com |
807 B |
1 |
ticketbleed.com
1 redirects
ticketbleed.com |
95 B |
0 |
sandcats.io
Failed
ls4an735rucvfa6ps6bb.filippo.sandcats.io Failed |
|
7 | 5 |
Domain | Requested by | |
---|---|---|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
3 | filippo.io |
1 redirects
filippo.io
|
1 | fonts.googleapis.com |
filippo.io
|
1 | ticketbleed.com | 1 redirects |
0 | ls4an735rucvfa6ps6bb.filippo.sandcats.io Failed |
filippo.io
|
7 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.f5.com |
blog.filippo.io |
gist.github.com |
www.ssllabs.com |
www.bhost.net |
twitter.com |
googleprojectzero.blogspot.co.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.filosottile.info R3 |
2021-08-11 - 2021-11-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://filippo.io/ticketbleed/
Frame ID: 124E0096A4F2BD2BAD62FA518E79C782
Requests: 7 HTTP requests in this frame
Screenshot
![](/screenshots/dc5a1697-5419-4ea9-b27f-fd1b64ebd7f7.png)
Page Title
Ticketbleed (CVE-2016-9244)Page URL History Show full URLs
-
https://ticketbleed.com/
HTTP 301
https://filippo.io/Ticketbleed HTTP 301
https://filippo.io/ticketbleed/ Page URL
Detected technologies
Detected patterns
- headers server /^Netlify/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: article K05121675
Search URL Search Domain Scan URL
Title: the story of how Ticketbleed was found and a complete technical walkthrough
Search URL Search Domain Scan URL
Title: this Go script
Search URL Search Domain Scan URL
Title: SSL Labs online test
Search URL Search Domain Scan URL
Title: BHost
Search URL Search Domain Scan URL
Title: Filippo Valsorda
Search URL Search Domain Scan URL
Title: 90 + 15 days disclosure policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ticketbleed.com/
HTTP 301
https://filippo.io/Ticketbleed HTTP 301
https://filippo.io/ticketbleed/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
filippo.io/ticketbleed/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 807 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ticketbleed.png
filippo.io/ticketbleed/ |
29 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
embed.js
ls4an735rucvfa6ps6bb.filippo.sandcats.io/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
raxhHiqOu8IVPmnRc6SY1KXhnF_Y8fbfOLjOXQ.woff2
fonts.gstatic.com/s/bitter/v19/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v22/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4WjMDrMfIA.woff2
fonts.gstatic.com/s/raleway/v22/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ls4an735rucvfa6ps6bb.filippo.sandcats.io
- URL
- https://ls4an735rucvfa6ps6bb.filippo.sandcats.io:6080/embed.js
Verdicts & Comments Add Verdict or Comment
12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _paq0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
filippo.io
fonts.googleapis.com
fonts.gstatic.com
ls4an735rucvfa6ps6bb.filippo.sandcats.io
ticketbleed.com
ls4an735rucvfa6ps6bb.filippo.sandcats.io
217.70.184.55
2a00:1450:4001:827::2003
2a00:1450:4001:82f::200a
75.2.60.5
0f271e3a6adcd0201740f7a2ce565e4e6ac019aa94dceaf2456431488162a2c0
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
6e0660523a00d2c0e5ce33fbe00294fc6b0d93657b41a42a7a782740c6a8cb13
71e1d0bc62312fb6210df2feafa8450ec13dd8a7c5849b062235b3bc86873a4c
9448e5e35e9cfba49612fab330c7ef1384a4708be5205b028486288ae260b85f
d2fbfbe4f76c7cba63ceab257e1efa4eb79fc0389b16c097dabd20c87425da91