Submitted URL: https://morgenhealthcare.in/qucu/?1
Effective URL: https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoaQsg&exp=1686849623
Submission Tags: falconsandbox
Submission: On June 15 via api from US — Scanned from SG

Summary

This website contacted 6 IPs in 3 countries across 8 domains to perform 18 HTTP transactions. The main IP is 172.67.206.228, located in and belongs to . The main domain is tqnqt.tunnelbuilder.top.
TLS certificate: Issued by E1 on May 25th 2023. Valid for: 3 months.
This is the only time tqnqt.tunnelbuilder.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 184.168.102.96 26496 (AS-26496-...)
1 91.238.104.193 50321 (BYTES-AS)
1 4 2.59.222.113 209155 (ONEHOSTPL...)
1 3 134.209.192.77 14061 (DIGITALOC...)
1 1 104.21.22.161 ()
1 172.67.206.228 ()
18 6
Domain Requested by
2 0.desirebluestock.com 1 redirects morgenhealthcare.in
2 fire.descriptionscripts.com block.descriptionscripts.com
2 block.descriptionscripts.com morgenhealthcare.in
block.descriptionscripts.com
2 morgenhealthcare.in 1 redirects
1 tqnqt.tunnelbuilder.top morgenhealthcare.in
tqnqt.tunnelbuilder.top
1 tqnqt.rigelbetelgeuse.top 1 redirects
1 desirebluestock.com fire.descriptionscripts.com
1 click.clickandanalytics.com morgenhealthcare.in
0 js2json.com Failed tqnqt.tunnelbuilder.top
0 js.streampsh.top Failed tqnqt.tunnelbuilder.top
18 10

This site contains no links.

Subject Issuer Validity Valid
morgenhealthcare.in
Sectigo RSA Domain Validation Secure Server CA
2022-11-07 -
2023-11-07
a year crt.sh
click.clickandanalytics.com
R3
2023-05-21 -
2023-08-19
3 months crt.sh
block.descriptionscripts.com
R3
2023-04-28 -
2023-07-27
3 months crt.sh
fire.descriptionscripts.com
R3
2023-04-21 -
2023-07-20
3 months crt.sh
desirepurplestock.com
R3
2023-05-11 -
2023-08-09
3 months crt.sh
tunnelbuilder.top
E1
2023-05-25 -
2023-08-23
3 months crt.sh

This page contains 1 frames:

Primary Page: https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoaQsg&exp=1686849623
Frame ID: 63A510B99267F11019EB0DB077CFCE32
Requests: 19 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://morgenhealthcare.in/qucu/?1 HTTP 302
    https://morgenhealthcare.in/ Page URL
  2. https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463 HTTP 302
    https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus Page URL
  3. https://desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely Page URL
  4. https://0.desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely Page URL
  5. https://0.desirebluestock.com/?auf=ga4gcnzrmu5diojygyxtqmbrgixtemzpge3dqnrygq4tgmrs&s=1&sub1=&sub2=lonely&... HTTP 302
    https://tqnqt.rigelbetelgeuse.top/?pl=jPYNfiJs70uLjptRAgGw_A HTTP 302
    https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoa... Page URL

Page Statistics

18
Requests

44 %
HTTPS

0 %
IPv6

8
Domains

10
Subdomains

6
IPs

3
Countries

75 kB
Transfer

88 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://morgenhealthcare.in/qucu/?1 HTTP 302
    https://morgenhealthcare.in/ Page URL
  2. https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463 HTTP 302
    https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus Page URL
  3. https://desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely Page URL
  4. https://0.desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely Page URL
  5. https://0.desirebluestock.com/?auf=ga4gcnzrmu5diojygyxtqmbrgixtemzpge3dqnrygq4tgmrs&s=1&sub1=&sub2=lonely&sub3=&sub4=&cpc=0&cpm=0 HTTP 302
    https://tqnqt.rigelbetelgeuse.top/?pl=jPYNfiJs70uLjptRAgGw_A HTTP 302
    https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoaQsg&exp=1686849623 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://morgenhealthcare.in/qucu/?1 HTTP 302
  • https://morgenhealthcare.in/
Request Chain 5
  • https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463 HTTP 302
  • https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
morgenhealthcare.in/
Redirect Chain
  • https://morgenhealthcare.in/qucu/?1
  • https://morgenhealthcare.in/
3 KB
1 KB
Document
General
Full URL
https://morgenhealthcare.in/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.168.102.96 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
96.102.168.184.host.secureserver.net
Software
Apache / PHP/7.4.33
Resource Hash
427bb9a7938a54dce4ce088f2650e3eea2ed7ceb3cbe104077cd3b805a1fdede

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

cache-control
no-cache, must-revalidate, max-age=0
content-encoding
br
content-length
1020
content-type
text/html; charset=UTF-8
date
Thu, 15 Jun 2023 17:15:17 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
server
Apache
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

content-encoding
br
content-length
1
content-type
text/html; charset=UTF-8
date
Thu, 15 Jun 2023 17:15:16 GMT
location
/
server
Apache
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
take
click.clickandanalytics.com/
0
648 B
Script
General
Full URL
https://click.clickandanalytics.com/take
Requested by
Host: morgenhealthcare.in
URL: https://morgenhealthcare.in/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.238.104.193 , Ukraine, ASN50321 (BYTES-AS, UA),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://morgenhealthcare.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 15 Jun 2023 17:15:18 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
0
path.js
block.descriptionscripts.com/scripts/
2 KB
1 KB
Script
General
Full URL
https://block.descriptionscripts.com/scripts/path.js?v=1.0.3
Requested by
Host: morgenhealthcare.in
URL: https://morgenhealthcare.in/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.59.222.113 Kyiv, Ukraine, ASN209155 (ONEHOSTPLANET, CZ),
Reverse DNS
Software
nginx /
Resource Hash
73a3195d9570ffc6ab9d2488eb93144017f76a0c6e8d5afd66f16035a068db47
Security Headers
Name Value
Strict-Transport-Security max-age=15768000;

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://morgenhealthcare.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 15 Jun 2023 17:15:18 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000;
server
nginx
content-length
1134
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
main.js
block.descriptionscripts.com/
3 KB
2 KB
Script
General
Full URL
https://block.descriptionscripts.com/main.js
Requested by
Host: block.descriptionscripts.com
URL: https://block.descriptionscripts.com/scripts/path.js?v=1.0.3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.59.222.113 Kyiv, Ukraine, ASN209155 (ONEHOSTPLANET, CZ),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000;

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://morgenhealthcare.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 15 Jun 2023 17:15:18 GMT
strict-transport-security
max-age=15768000;
content-encoding
gzip
last-modified
Sat, 29 Apr 2023 07:22:16 GMT
server
nginx
etag
W/"644cc5a8-dd0"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
get.php
fire.descriptionscripts.com/
0
0

get.php
fire.descriptionscripts.com/
Redirect Chain
  • https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463
  • https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus
845 B
574 B
Document
General
Full URL
https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus
Requested by
Host: block.descriptionscripts.com
URL: https://block.descriptionscripts.com/main.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.59.222.113 Kyiv, Ukraine, ASN209155 (ONEHOSTPLANET, CZ),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000;

Request headers

Referer
https://morgenhealthcare.in/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

content-encoding
gzip
content-length
432
content-type
text/html; charset=UTF-8
date
Thu, 15 Jun 2023 17:15:20 GMT
server
nginx
strict-transport-security
max-age=15768000;
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Thu, 15 Jun 2023 17:15:20 GMT
location
https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus
server
nginx
strict-transport-security
max-age=15768000;
/
desirebluestock.com/
0
0

/
desirebluestock.com/
0
0

/
desirebluestock.com/
0
0

/
desirebluestock.com/
18 KB
18 KB
Document
General
Full URL
https://desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely
Requested by
Host: fire.descriptionscripts.com
URL: https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463&kid=Taurus
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
134.209.192.77 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
eff63dd9d5f2c70ea92afa0ff631be1c254e46a1b85a917ab27967a6efbfa48d
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://fire.descriptionscripts.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

access-control-allow-origin
*
content-security-policy
img-src https: data:; upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 15 Jun 2023 17:15:21 GMT
server
nginx
strict-transport-security
max-age=31536000
/
0.desirebluestock.com/
52 KB
52 KB
Document
General
Full URL
https://0.desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely
Requested by
Host: morgenhealthcare.in
URL: https://morgenhealthcare.in/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
134.209.192.77 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
d3e3c47c12024d5bf483b959525d54593fc31b39867b46745f8c3fc96d88c9b4
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://desirebluestock.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

access-control-allow-origin
*
content-security-policy
img-src https: data:; upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 15 Jun 2023 17:15:22 GMT
server
nginx
strict-transport-security
max-age=31536000
truncated
/
7 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Primary Request /
tqnqt.tunnelbuilder.top/eyes-robot/
Redirect Chain
  • https://0.desirebluestock.com/?auf=ga4gcnzrmu5diojygyxtqmbrgixtemzpge3dqnrygq4tgmrs&s=1&sub1=&sub2=lonely&sub3=&sub4=&cpc=0&cpm=0
  • https://tqnqt.rigelbetelgeuse.top/?pl=jPYNfiJs70uLjptRAgGw_A
  • https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoaQsg&exp=1686849623
1 KB
0
Document
General
Full URL
https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoaQsg&exp=1686849623
Requested by
Host: morgenhealthcare.in
URL: https://morgenhealthcare.in/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.206.228 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://0.desirebluestock.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d7c7471c9064cad-SIN
content-encoding
br
content-type
text/html
date
Thu, 15 Jun 2023 17:15:24 GMT
last-modified
Mon, 01 May 2023 15:50:37 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EWshepOl6BL8NS586uVfS8anfzhjIUs6Jw%2F%2BVSU8gi2jOTcv%2FE6LHYrTuf4%2BwjOVzCq%2FAHCqjvk9e7x2iBsZwP%2F8a52xnOURlOwTSLRsWtY%2FT2CqorqOcWMRbp%2B9sL3eP0d7YwndonmSoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, no-cache, no-store, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7d7c746f2f8487a8-SIN
content-length
0
date
Thu, 15 Jun 2023 17:15:23 GMT
location
https://tqnqt.tunnelbuilder.top/eyes-robot/?pl=jPYNfiJs70uLjptRAgGw_A&sm=eyes-robot&hash=EmWEb1AqNevwC5KKYoaQsg&exp=1686849623
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DxXpb2L6fENvDKplP2pvuFESh5k%2FuslBmg5XLvv%2BkZ9sSmghH6Nr0slKfi77Nb1sqnewUp9ZzKanD%2F80f2SJp8ykvShGUL0uVHXm8Hm12pCIyaIm2ezvyLrYPyAdCqc6HBdagoPKlKQqSNNK"}],"group":"cf-nel","max_age":604800}
server
cloudflare
trls.js
tqnqt.tunnelbuilder.top/eyes-robot/assets/
0
0

style.css
tqnqt.tunnelbuilder.top/eyes-robot/assets/
0
0

1.png
tqnqt.tunnelbuilder.top/eyes-robot/assets/
0
0

2.png
tqnqt.tunnelbuilder.top/eyes-robot/assets/
0
0

pl.js
js.streampsh.top/ps/
0
0

script.js
js2json.com/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fire.descriptionscripts.com
URL
https://fire.descriptionscripts.com/get.php?wid=215315&sid=32463463&gid=24563463
Domain
desirebluestock.com
URL
https://desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely
Domain
desirebluestock.com
URL
https://desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely
Domain
desirebluestock.com
URL
https://desirebluestock.com/?p=ha4tcolcmu5gi3bphaydcmq&sub2=lonely
Domain
tqnqt.tunnelbuilder.top
URL
https://tqnqt.tunnelbuilder.top/eyes-robot/assets/trls.js
Domain
tqnqt.tunnelbuilder.top
URL
https://tqnqt.tunnelbuilder.top/eyes-robot/assets/style.css
Domain
tqnqt.tunnelbuilder.top
URL
https://tqnqt.tunnelbuilder.top/eyes-robot/assets/1.png
Domain
tqnqt.tunnelbuilder.top
URL
https://tqnqt.tunnelbuilder.top/eyes-robot/assets/2.png
Domain
js.streampsh.top
URL
https://js.streampsh.top/ps/pl.js?edg=true&fullscreen=true
Domain
js2json.com
URL
https://js2json.com/script.js

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

5 Cookies

Domain/Path Name / Value
morgenhealthcare.in/ Name: wpcurrentimes
Value: 1
.desirebluestock.com/ Name: uuid
Value: 116c4814-31af-41b6-a438-700f50ad8554
.0.desirebluestock.com/ Name: uuid
Value: 116c4814-31af-41b6-a438-700f50ad8554
0.desirebluestock.com/ Name: uuid
Value: 116c4814-31af-41b6-a438-700f50ad8554
.0.desirebluestock.com/ Name: ccid
Value: %5B170878%5D

1 Console Messages

Source Level URL
Text
network error URL: https://morgenhealthcare.in/
Message:
Failed to load resource: the server responded with a status of 500 ()