nhj7y2.link Open in urlscan Pro
172.67.200.237 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://shortx.net/downloadelamigos.php
Effective URL:
https://nhj7y2.link/
Submission: On December 09 via api (December 9th 2024, 4:46:20 am UTC) from KR — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 18 HTTP transactions. The main IP is 172.67.200.237, located in United States and belongs to CLOUDFLARENET, US. The main domain is nhj7y2.link.
TLS certificate: Issued by WE1 on November 28th 2024. Valid for: 3 months.

This is the only time nhj7y2.link was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	91.223.82.132 91.223.82.132	199968 (IWSNET IW...) (IWSNET IWS NETWORKS LLC)
6	142.250.186.40 142.250.186.40	15169 (GOOGLE) (GOOGLE)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	172.67.200.237 172.67.200.237	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.170 142.250.185.170	15169 (GOOGLE) (GOOGLE)
18	7

1 91.223.82.132 (Armenia)

ASN199968 (IWSNET IWS NETWORKS LLC, AM)
PTR: pink.warez-host.com

shortx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.40 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

ser678uikl.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

gh12k.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.67.200.237 (United States)

ASN13335 (CLOUDFLARENET, US)

nhj7y2.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	108 KB
5	nhj7y2.link nhj7y2.link	26 KB
2	gh12k.link gh12k.link	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
1	ser678uikl.xyz ser678uikl.xyz	867 B
1	shortx.net shortx.net	787 B
0	google-analytics.com Failed region1.google-analytics.com Failed
18	7

	Domain	Requested by
6	www.googletagmanager.com	shortx.net
5	nhj7y2.link	gh12k.link nhj7y2.link
2	gh12k.link	ser678uikl.xyz
1	fonts.googleapis.com	nhj7y2.link
1	ser678uikl.xyz	shortx.net
1	shortx.net
0	region1.google-analytics.com Failed	www.googletagmanager.com
18	7

This site contains no links.

Subject Issuer	Validity	Valid
*.erogam.com R10	`2024-12-04` - `2025-03-04`	3 months	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
ser678uikl.xyz WE1	`2024-11-14` - `2025-02-12`	3 months	crt.sh
gh12k.link WE1	`2024-11-28` - `2025-02-26`	3 months	crt.sh
nhj7y2.link WE1	`2024-11-28` - `2025-02-26`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nhj7y2.link/
Frame ID: FA9CD33CBD5A39256A38F8961E46237F
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Secure Download File

Page URL History Show full URLs

https://shortx.net/downloadelamigos.php Page URL
http://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup HTTP 307
https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup Page URL
https://gh12k.link/?s=Setup&p=818 Page URL
https://nhj7y2.link/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

18
Requests

89 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

140 kB
Transfer

455 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shortx.net/downloadelamigos.php Page URL
http://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup HTTP 307
https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup Page URL
https://gh12k.link/?s=Setup&p=818 Page URL
https://nhj7y2.link/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup HTTP 307
https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 downloadelamigos.php Show response
shortx.net/ 749 B
787 B 150ms
19ms Document
text/html 91.223.82.132
IWSNET IWS NETWOR...

General

Check archive.org

Show headers Download Go to

Full URL

https://shortx.net/downloadelamigos.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.223.82.132 , Armenia, ASN199968 (IWSNET IWS NETWORKS LLC, AM),

Reverse DNS

pink.warez-host.com

Software

LiteSpeed /

Resource Hash

61ddec6b059d2a33212623376655a19e6eeec53e3577f49f97ccc65585496c52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 09 Dec 2024 04:46:15 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent,User-Agent
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 js
www.googletagmanager.com/gtag/ 323 KB
108 KB 351ms
24ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4DC2MZ45QP

Requested by

Host: shortx.net
URL: https://shortx.net/downloadelamigos.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://shortx.net/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 09 Dec 2024 04:46:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 09 Dec 2024 04:46:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109710
x-xss-protection: 0
server: Google Tag Manager

GET
H2

200

/ Show response
ser678uikl.xyz/
Redirect Chain

http://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup
https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup

135 B
867 B

393ms
35ms

Document
text/html

188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup
Requested by: Host: shortx.net
URL: https://shortx.net/downloadelamigos.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07214fb36b9547c6b95d2cd68eb9529373a5bf999f9ff3570a329e839a9f9e41

Request headers

Referer: https://shortx.net/downloadelamigos.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8ef259bb0ffc65de-FRA
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Mon, 09 Dec 2024 04:46:16 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HtkTI06cLUVokU9YUQLAgSBoJ9h0tSSJh2CiTw8qB2iE8uI1PyxLRblBswu%2BUHKAXmheoyxmZfVhe1cKuNQRep%2Br13bkBb4j3RkCfUjr%2BkdWcDQoVxmJR2IpZ4EWhju3xg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=5749&min_rtt=5702&rtt_var=964&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3918&recv_bytes=2306&delivery_rate=693177&cwnd=222&unsent_bytes=0&cid=87628fe47a019c2c&ts=38&x=0"
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

Redirect headers

Location: https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup
Non-Authoritative-Reason: HttpsUpgrades

POST collect
region1.google-analytics.com/g/ 0
0

GET
H2 200 a
www.googletagmanager.com/ 0
270 B 15ms
14ms Image
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-4DC2MZ45QP&v=3&t=t&pid=1153153718&cv=1&rv=4c40&tc=15&tag_exp=101925629~102067555~102067808~102081485&es=1&e=gtm.init_consent&eid=-1&u=AAAAAAAAAAAAAACA&h=Ag&z=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://shortx.net/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:654:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:654:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Mon, 09 Dec 2024 04:46:16 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 a
www.googletagmanager.com/ 0
52 B 15ms
14ms Image
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-4DC2MZ45QP&v=3&t=t&pid=1153153718&cv=1&rv=4c40&tc=15&tag_exp=101925629~102067555~102067808~102081485&es=1&e=gtm.init&eid=0&u=AAAAAAAAAAAAAACA&h=Ag&tr=1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ccdgaregscope.1ccdemdownload.1ccdemform.1ccdemoutboundclick.1ccdempageview.1ccdemscroll.1ccdemsitesearch.1ccdemvideo.1ccdconversionmarking.1ccdautoredact.1ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaregscope.2ccdemdownload.2ccdemform.2ccdemoutboundclick.2ccdempageview.2ccdemscroll.2ccdemsitesearch.2ccdemvideo.2ccdconversionmarking.2ccdautoredact.2ccdgalast&z=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://shortx.net/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:654:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:654:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Mon, 09 Dec 2024 04:46:16 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 a
www.googletagmanager.com/ 0
52 B 15ms
14ms Image
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://shortx.net/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:654:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:654:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Mon, 09 Dec 2024 04:46:16 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 a
www.googletagmanager.com/ 0
52 B 16ms
16ms Image
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://shortx.net/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:654:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:654:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Mon, 09 Dec 2024 04:46:16 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 a
www.googletagmanager.com/ 0
52 B 22ms
22ms Image
text/html 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-4DC2MZ45QP&v=3&t=t&pid=1153153718&cv=1&rv=4c40&tc=15&tag_exp=101925629~102067555~102067808~102081485&es=1&e=*&eid=8&u=AAAAAAAAAAAAACCA&h=Ag&epr=1G.2G&z=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://shortx.net/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:654:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:654:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
date: Mon, 09 Dec 2024 04:46:16 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

POST collect
region1.google-analytics.com/g/ 0
0

GET
H2 200 / Show response
gh12k.link/ 3 KB
2 KB 364ms
35ms Document
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gh12k.link/?s=Setup&p=818
Requested by: Host: ser678uikl.xyz
URL: https://ser678uikl.xyz/?ayrq1=10&d=1&x=818&ayrq1=7&p=Setup
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55d0a3cb7daeb98df95d656b7323b283954d5e7da5a195461ee8c746b5c0b810

Request headers

Referer: https://ser678uikl.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8ef259bd7911bb67-FRA
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Mon, 09 Dec 2024 04:46:17 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ncd0Oz9T5NtZFv9%2BWNvLHPLt1T58lrpTnV36jis6CBQ%2BTX22AodGt2grXCPeQOMHKJ8W3vwRBLLXYYRexKYp%2BsFh7z9UoRqumclZ6jwzbQGaBdsxDjVUH32Qp395"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=5772&min_rtt=5687&rtt_var=959&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3910&recv_bytes=2307&delivery_rate=693296&cwnd=232&unsent_bytes=0&cid=79023be6cbaadfc8&ts=39&x=0"
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 404 favicon.ico
gh12k.link/ 1 KB
1 KB 30ms
30ms Other
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gh12k.link/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7becc0246aa4fcb8127b3459b2b8c6c04879c6855b0fcf370f8c83d2de88d319

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://gh12k.link/?s=Setup&p=818

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: BYPASS
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KGIx0mfgWiqeiSbOxaBi5xBxg8KzjsvmqeVlhAnpS5pMLPAFoeIgVUbi%2BOQoSAuLdwz1vQojTHufbaU7GIRpxLFtGWvn2KHDnxpLkBkjtAjgWbxhXYvFiDzvQFll"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ef259bdc927bb67-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=7881&min_rtt=5687&rtt_var=4754&sent=11&recv=13&lost=0&retrans=0&sent_bytes=6008&recv_bytes=2505&delivery_rate=693296&cwnd=235&unsent_bytes=0&cid=79023be6cbaadfc8&ts=85&x=0"
date: Mon, 09 Dec 2024 04:46:17 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 200 Primary Request / Show response
nhj7y2.link/ 3 KB
2 KB 375ms
36ms Document
text/html 172.67.200.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhj7y2.link/
Requested by: Host: gh12k.link
URL: https://gh12k.link/?s=Setup&p=818
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.200.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2e0be9731d9b61cdf41b0fde77ecab81bbb42d271e1275182c5b4ee21d940da

Request headers

Referer: https://gh12k.link/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8ef259c46af17185-FRA
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Mon, 09 Dec 2024 04:46:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2Fvb7Qa%2BBSNAvFd49gj%2BUNnOvepWuASXskFXx%2FEmgRDGHdPPUKnfaW7SpPY4UgCHKSz7Dy6wA0kmhXIVj3KSaMBh5faaWQKowr9EbusK8eoq22jLiUbUl63cvYG%2BMg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=6044&min_rtt=5947&rtt_var=1006&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3933&recv_bytes=2291&delivery_rate=664585&cwnd=217&unsent_bytes=0&cid=2a4585eb5ef91067&ts=52&x=0"
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
1 KB 339ms
16ms Stylesheet
text/css 142.250.185.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:wght@400;900&family=Oswald&display=swap

Requested by

Host: nhj7y2.link
URL: https://nhj7y2.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f10.1e100.net

Software

ESF /

Resource Hash

6cbc3b65fd2789de755383ba27894c650870043b14914eeab4fe0325e2f67dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nhj7y2.link/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 09 Dec 2024 04:46:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 09 Dec 2024 04:46:18 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 09 Dec 2024 04:40:55 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 main.css
nhj7y2.link/assets/css/ 60 B
571 B 19ms
17ms Stylesheet
text/css 172.67.200.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhj7y2.link/assets/css/main.css
Requested by: Host: nhj7y2.link
URL: https://nhj7y2.link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.200.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49cdfb2ffd8299fd89dc739dcf7ab89c0dac0e2ee68b862e783d1ad855b3bcb0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nhj7y2.link/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 254539
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MUPu15EaEyJBnUjR40qRF2gK7RqMRPMqsDDA94XIymkgk5rzw7iaWjXEndkEjof6UgsQaX%2FR4jHZ3xGT2y0keeF%2Btdw6YmUoDxXF%2F1dx1dS9PZERU%2BF5JythN0ahMA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 13 Dec 2024 06:03:59 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6848&min_rtt=5741&rtt_var=2295&sent=11&recv=13&lost=0&retrans=0&sent_bytes=5841&recv_bytes=2447&delivery_rate=664585&cwnd=220&unsent_bytes=0&cid=2a4585eb5ef91067&ts=74&x=0"
date: Mon, 09 Dec 2024 04:46:18 GMT
content-type: text/css
last-modified: Fri, 06 Dec 2024 09:50:38 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ef259c4ab087185-FRA
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 200 bootstrap.min.css
nhj7y2.link/assets/css/ 119 KB
21 KB 17ms
17ms Stylesheet
text/css 172.67.200.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhj7y2.link/assets/css/bootstrap.min.css
Requested by: Host: nhj7y2.link
URL: https://nhj7y2.link/assets/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.200.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nhj7y2.link/assets/css/main.css

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 254538
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5NjAu9gT7y9ApgAI3zk6GBW%2FlShBOHR6nZMgVpLhS3IqyIy9lvSTkhKoHI2uK3940eNKCJm6yO%2BneRoKSj%2B7L5MtU9WZvtwCoClJ874udXz4klzxTQwZZwubaCw6PA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 13 Dec 2024 06:04:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6732&min_rtt=5741&rtt_var=1953&sent=16&recv=16&lost=0&retrans=0&sent_bytes=7419&recv_bytes=2613&delivery_rate=664585&cwnd=220&unsent_bytes=0&cid=2a4585eb5ef91067&ts=94&x=0"
date: Mon, 09 Dec 2024 04:46:18 GMT
content-type: text/css
last-modified: Fri, 06 Dec 2024 09:52:24 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ef259c4cb137185-FRA
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 200 styles.css
nhj7y2.link/assets/css/ 811 B
875 B 17ms
16ms Stylesheet
text/css 172.67.200.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhj7y2.link/assets/css/styles.css
Requested by: Host: nhj7y2.link
URL: https://nhj7y2.link/assets/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.200.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e2760ddae786a3b527c521f83fbfde7727442854bda92276b2610d3e4eb81bf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nhj7y2.link/assets/css/main.css

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 254538
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nk%2FeaT9Xg%2BsLfqJ6lyncICpAMsLEWnnCv%2Bf1XB1grDkZQi9Q0JOUY959Th61merENEh40Ovc%2BaHrlLq6wr6TptYoD1JeExivJyPa40XKYGO94FVO9kKm4sN0FnAPfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 13 Dec 2024 06:04:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6732&min_rtt=5741&rtt_var=1953&sent=14&recv=16&lost=0&retrans=0&sent_bytes=6478&recv_bytes=2613&delivery_rate=664585&cwnd=220&unsent_bytes=0&cid=2a4585eb5ef91067&ts=93&x=0"
date: Mon, 09 Dec 2024 04:46:18 GMT
content-type: text/css
last-modified: Fri, 06 Dec 2024 09:51:44 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8ef259c4cb147185-FRA
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 404 favicon.ico
nhj7y2.link/ 1 KB
1 KB 31ms
31ms Other
text/html 172.67.200.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhj7y2.link/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.200.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7becc0246aa4fcb8127b3459b2b8c6c04879c6855b0fcf370f8c83d2de88d319

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://nhj7y2.link/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: BYPASS
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dX1PMgJsBm25WopyravQnEbWWbACvS0IPSE4P98XcFm3TbodudYCGem5jXsZIhmHT24R%2Be8C5cN2ccIVTtmiSy6faqgCdNSc6sUVe2CryCAUgtYyn0S08yh%2FG0g02g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ef259c6cbee7185-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=11472&min_rtt=5741&rtt_var=10335&sent=37&recv=29&lost=0&retrans=0&sent_bytes=29801&recv_bytes=2736&delivery_rate=4078668&cwnd=220&unsent_bytes=0&cid=2a4585eb5ef91067&ts=433&x=0"
date: Mon, 09 Dec 2024 04:46:18 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/html
vary: Accept-Encoding
server: cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-4DC2MZ45QP&gtm=45je4c40v9186243936za200&_p=1733719576346&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1926614953.1733719577&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1733719576&sct=1&seg=0&dl=https%3A%2F%2Fshortx.net%2Fdownloadelamigos.php&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=547

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-4DC2MZ45QP&gtm=45je4c40v9186243936za200&_p=1733719576346&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1926614953.1733719577&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1733719576&sct=1&seg=0&dl=https%3A%2F%2Fshortx.net%2Fdownloadelamigos.php&dt=&en=redirect&_ee=1&ep.event_category=ElAmigos&ep.event_label=ElAmigos%20ser678uikl.xyz&_et=2&tfd=555

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| copyLink

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.shortx.net/	1970-01-21 11:11:19	Name: _ga Value: GA1.1.1926614953.1733719577
.shortx.net/	1970-01-21 11:11:19	Name: _ga_4DC2MZ45QP Value: GS1.1.1733719576.1.0.1733719576.0.0.0
ser678uikl.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: b414c2bc83e1111b560da27b814f2120
gh12k.link/	1969-12-31 23:59:59	Name: PHPSESSID Value: 24041960328b000f6d1c90a396e43a7a
nhj7y2.link/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1e9b5ba02b1effbddeb1ead42b4e17fd

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://gh12k.link/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://nhj7y2.link/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
gh12k.link
nhj7y2.link
region1.google-analytics.com
ser678uikl.xyz
shortx.net
www.googletagmanager.com
region1.google-analytics.com
142.250.185.170
142.250.186.40
172.67.200.237
188.114.96.3
188.114.97.3
91.223.82.132
07214fb36b9547c6b95d2cd68eb9529373a5bf999f9ff3570a329e839a9f9e41
2e2760ddae786a3b527c521f83fbfde7727442854bda92276b2610d3e4eb81bf
49cdfb2ffd8299fd89dc739dcf7ab89c0dac0e2ee68b862e783d1ad855b3bcb0
55d0a3cb7daeb98df95d656b7323b283954d5e7da5a195461ee8c746b5c0b810
61ddec6b059d2a33212623376655a19e6eeec53e3577f49f97ccc65585496c52
6cbc3b65fd2789de755383ba27894c650870043b14914eeab4fe0325e2f67dd7
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
7becc0246aa4fcb8127b3459b2b8c6c04879c6855b0fcf370f8c83d2de88d319
f2e0be9731d9b61cdf41b0fde77ecab81bbb42d271e1275182c5b4ee21d940da

nhj7y2.link Open in urlscan Pro 172.67.200.237 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

89 %HTTPS

0 %IPv6

7 Domains

7 Subdomains

7 IPs

3 Countries

140 kBTransfer

455 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

5 Cookies

2 Console Messages

Security Headers

Indicators

nhj7y2.link Open in urlscan Pro
172.67.200.237 Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

89 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

140 kB
Transfer

455 kB
Size

5
Cookies

18 HTTP transactions
0 data transactions