loh.zero41.com Open in urlscan Pro
2a09:8280:1::4f:8e34:0 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://loh.zero41.com/
Submission: On November 11 via api (November 11th 2024, 12:40:41 am UTC) from US — Scanned from DE

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 2a09:8280:1::4f:8e34:0, located in United States and belongs to FLY, US. The main domain is loh.zero41.com.
TLS certificate: Issued by E5 on November 10th 2024. Valid for: 3 months.

This is the only time loh.zero41.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	2a09:8280:1::... 2a09:8280:1::4f:8e34:0	40509 (FLY) (FLY)
1	2606:4700:303... 2606:4700:3038::6815:eaeb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

5 2a09:8280:1::4f:8e34:0 (United States)

ASN40509 (FLY, US)

loh.zero41.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3038::6815:eaeb (United States)

ASN13335 (CLOUDFLARENET, US)

rsms.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	zero41.com loh.zero41.com	75 KB
1	rsms.me rsms.me — Cisco Umbrella Rank: 9083	2 KB
6	2

	Domain	Requested by
5	loh.zero41.com	loh.zero41.com
1	rsms.me	loh.zero41.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
loh.zero41.com E5	`2024-11-10` - `2025-02-08`	3 months	crt.sh
rsms.me WE1	`2024-10-19` - `2025-01-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://loh.zero41.com/
Frame ID: A2DF62F5A597AFC4FDFDDF61620727FF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Assessments - Lights On Handwriting

Page Statistics

6
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

77 kB
Transfer

216 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
loh.zero41.com/ 19 KB
4 KB 4820ms
4626ms Document
text/html 2a09:8280:1::4f:8e34:0
FLY

General

Check archive.org

Show headers Download Go to

Full URL

https://loh.zero41.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a09:8280:1::4f:8e34:0 , United States, ASN40509 (FLY, US),

Reverse DNS

Software

Fly/2936d2942 (2024-10-30) /

Resource Hash

c0f9129b076ee0d67cc9e5a4dd97eece3bcbaa96ed02fb2d49d7cb3149eb33bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 3199
content-type: text/html; charset=utf-8
date: Mon, 11 Nov 2024 00:40:34 GMT
fly-request-id: 01JCCAMFQJZ6VNWX1JWQ2RK922-fra
referrer-policy: strict-origin-when-cross-origin
server: Fly/2936d2942 (2024-10-30)
vary: accept-encoding
via: 2 fly.io
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: GAbDHMmsoxPZspcAAAcR

GET
H3 200 inter.css
rsms.me/inter/ 7 KB
2 KB 133ms
34ms Stylesheet
text/css 2606:4700:3038::6815:eaeb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rsms.me/inter/inter.css
Requested by: Host: loh.zero41.com
URL: https://loh.zero41.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3038::6815:eaeb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8fedfb7def1421aa9d58d1732be7164e33eec27b9c87193e010b9ddaa67b6a18

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://loh.zero41.com/

Response headers

x-fastly-request-id: 2affa177a9fdd79d9dea0b6157f8d04ad6530f6e
content-encoding: gzip
cf-cache-status: HIT
etag: W/"6601abff-1b8d"
age: 403
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9EvLdb3bU%2FpdnFswzjW75cO3d8gqMDHpAwy10ju7UEMR8G4JZfiVvtDcSiYrhYRWRyQXSjYAV5t%2BimRteF92nkHG3c4H93QFzlrdcKFAd3F%2FezQR%2Fp78otCWeLHnaGeKzc%2BeTJmf"}],"group":"cf-nel","max_age":604800}
x-github-request-id: 4E08:0DA1:58A2F00:5AF0C2D:67190A3B
expires: Wed, 23 Oct 2024 14:47:47 GMT
x-proxy-cache: MISS
alt-svc: h3=":443"; ma=86400
x-cache: HIT
server-timing: cfL4;desc="?proto=QUIC&rtt=33160&sent=12&recv=8&lost=0&retrans=0&sent_bytes=4155&recv_bytes=4259&delivery_rate=94351&cwnd=12000&unsent_bytes=0&cid=e9fbc407c074c1f0&ts=96&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 11 Nov 2024 00:40:35 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230102-FRA
x-cache-hits: 1
last-modified: Mon, 25 Mar 2024 16:53:19 GMT
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-timer: S1730520158.317278,VS0,VE1
via: 1.1 varnish
cf-ray: 8e0a3b563a6d362a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 712
x-origin-cache: HIT
server: cloudflare

GET
H2 200 app-4d52725ece37ce0d8dd6592d3f9f6d12.css
loh.zero41.com/assets/ 54 KB
12 KB 262ms
260ms Stylesheet
text/css 2a09:8280:1::4f:8e34:0
FLY

General

Check archive.org

Show headers Download Go to

Full URL: https://loh.zero41.com/assets/app-4d52725ece37ce0d8dd6592d3f9f6d12.css?vsn=d
Requested by: Host: loh.zero41.com
URL: https://loh.zero41.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a09:8280:1::4f:8e34:0 , United States, ASN40509 (FLY, US),
Reverse DNS
Software: Fly/2936d2942 (2024-10-30) /
Resource Hash: c0646762371d52ec337cfaf0577beaac56aed4712f6f8438acb920ee7d2a36d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://loh.zero41.com/

Response headers

cache-control: public, max-age=31536000, immutable
content-encoding: zstd
via: 2 fly.io
accept-ranges: bytes
date: Mon, 11 Nov 2024 00:40:34 GMT
content-type: text/css
server: Fly/2936d2942 (2024-10-30)
fly-request-id: 01JCCAMMC3VEKJBG7GYCWGAHEB-fra

GET
H2 200 app-2626a6f59e93b8010b6f2cfb85d1b131.js Show response
loh.zero41.com/assets/ 118 KB
43 KB 276ms
274ms Script
text/javascript 2a09:8280:1::4f:8e34:0
FLY

General

Check archive.org

Show headers Download Go to

Full URL: https://loh.zero41.com/assets/app-2626a6f59e93b8010b6f2cfb85d1b131.js?vsn=d
Requested by: Host: loh.zero41.com
URL: https://loh.zero41.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a09:8280:1::4f:8e34:0 , United States, ASN40509 (FLY, US),
Reverse DNS
Software: Fly/2936d2942 (2024-10-30) /
Resource Hash: 22d7d9f56e1850d266014f038bfc2e4ccefb85a2472d837e8e5d269cc1e10c14

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://loh.zero41.com/

Response headers

cache-control: public, max-age=31536000, immutable
content-encoding: zstd
via: 2 fly.io
accept-ranges: bytes
date: Mon, 11 Nov 2024 00:40:34 GMT
content-type: text/javascript
server: Fly/2936d2942 (2024-10-30)
fly-request-id: 01JCCAMMFF1SC028AW1DX8HB3X-fra

GET
H2 200 logo.png
loh.zero41.com/images/ 14 KB
14 KB 271ms
268ms Image
image/png 2a09:8280:1::4f:8e34:0
FLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loh.zero41.com/images/logo.png
Requested by: Host: loh.zero41.com
URL: https://loh.zero41.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a09:8280:1::4f:8e34:0 , United States, ASN40509 (FLY, US),
Reverse DNS
Software: Fly/2936d2942 (2024-10-30) /
Resource Hash: f63c4f99ef6825b71bdf237d1f4ab3547beb675bc2088cfedf38178c32da21dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://loh.zero41.com/

Response headers

cache-control: public
etag: "759C405"
via: 2 fly.io
accept-ranges: bytes
content-length: 14482
date: Mon, 11 Nov 2024 00:40:34 GMT
content-type: image/png
server: Fly/2936d2942 (2024-10-30)
fly-request-id: 01JCCAMMFFB571QP2T8973V4AD-fra

GET
DATA 200
OK truncated
/ 877 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ae56713e9c48b81ed27c4f69a11ede834a29a9171b3d826728d4210be143df3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://loh.zero41.com
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 553 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09b7b20f0bb81a762dcb1df565c75db996cb34c708f3683b9b2b8e79ebfc5a83

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://loh.zero41.com
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 361 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e27e6cc2dbb943c409111c388cf786a4ad1313ad906dd6c451bb5cc41eab5b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://loh.zero41.com
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 favicon-32x32.png
loh.zero41.com/ 2 KB
2 KB 268ms
256ms Other
image/png 2a09:8280:1::4f:8e34:0
FLY

General

Check archive.org

Show headers Download Go to

Full URL: https://loh.zero41.com/favicon-32x32.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a09:8280:1::4f:8e34:0 , United States, ASN40509 (FLY, US),
Reverse DNS
Software: Fly/2936d2942 (2024-10-30) /
Resource Hash: c5703ee41ebba17183b98e525774296b7ba0b37752f6a4a51410f792b00b6df3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://loh.zero41.com/

Response headers

cache-control: public
etag: "E3717C"
via: 2 fly.io
accept-ranges: bytes
content-length: 1709
date: Mon, 11 Nov 2024 00:40:35 GMT
content-type: image/png
server: Fly/2936d2942 (2024-10-30)
fly-request-id: 01JCCAMN91NJ0K9GM869KD30ST-fra

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| liveSocket

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			loh.zero41.com/	1969-12-31 23:59:59	Name: _loh_key Value: SFMyNTY.g3QAAAABbQAAAAtfY3NyZl90b2tlbm0AAAAYX21zWUFLaUc4MEpZNF9wSUdhLUN6S1Jq.89Fq-1wKeaSFKsKmeV-xSII_V7QKXxBINiwRA_piPpI

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

loh.zero41.com
rsms.me
2606:4700:3038::6815:eaeb
2a09:8280:1::4f:8e34:0
09b7b20f0bb81a762dcb1df565c75db996cb34c708f3683b9b2b8e79ebfc5a83
22d7d9f56e1850d266014f038bfc2e4ccefb85a2472d837e8e5d269cc1e10c14
6e27e6cc2dbb943c409111c388cf786a4ad1313ad906dd6c451bb5cc41eab5b3
8ae56713e9c48b81ed27c4f69a11ede834a29a9171b3d826728d4210be143df3
8fedfb7def1421aa9d58d1732be7164e33eec27b9c87193e010b9ddaa67b6a18
c0646762371d52ec337cfaf0577beaac56aed4712f6f8438acb920ee7d2a36d0
c0f9129b076ee0d67cc9e5a4dd97eece3bcbaa96ed02fb2d49d7cb3149eb33bc
c5703ee41ebba17183b98e525774296b7ba0b37752f6a4a51410f792b00b6df3
f63c4f99ef6825b71bdf237d1f4ab3547beb675bc2088cfedf38178c32da21dd

loh.zero41.com Open in urlscan Pro 2a09:8280:1::4f:8e34:0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

77 kBTransfer

216 kBSize

1 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

loh.zero41.com Open in urlscan Pro
2a09:8280:1::4f:8e34:0 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

77 kB
Transfer

216 kB
Size

1
Cookies

6 HTTP transactions
3 data transactions