billshipman.com Open in urlscan Pro
162.253.126.144  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response billshipman.com/	6 KB 7 KB	309ms 97ms	Document text/html	162.253.126.144 SAPIOTERRA
General Check archive.org Show headers Download Go to Full URL https://billshipman.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.253.126.144 , United States, ASN32767 (SAPIOTERRA, US), Reverse DNS xldz2.dailyrazor.com Software Apache/2.4.53 (cPanel) OpenSSL/1.1.1o mod_bwlimited/1.4 Phusion_Passenger/6.0.7 / Resource Hash 725d0a62464fefdf89c79784af3dcbc3e5e7db32edd2e9df2252c8b2952ff1fb Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-length 6482 content-type text/html date Wed, 01 Jun 2022 17:32:35 GMT etag "1952-5d57c7b961a32" last-modified Thu, 13 Jan 2022 20:25:09 GMT server Apache/2.4.53 (cPanel) OpenSSL/1.1.1o mod_bwlimited/1.4 Phusion_Passenger/6.0.7
GET H2	200	logo3r2.jpg billshipman.com/images/	171 KB 173 KB	97ms 96ms	Image image/jpeg	162.253.126.144 SAPIOTERRA
General Check archive.org Show headers Download Go to Show image Full URL https://billshipman.com/images/logo3r2.jpg Requested by Host: billshipman.com URL: https://billshipman.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.253.126.144 , United States, ASN32767 (SAPIOTERRA, US), Reverse DNS xldz2.dailyrazor.com Software Apache/2.4.53 (cPanel) OpenSSL/1.1.1o mod_bwlimited/1.4 Phusion_Passenger/6.0.7 / Resource Hash 9f02cefebd08ca50537657960db082aff8f77f750362e1e6a518b1f73096d3bb Request headers accept-language de-DE,de;q=0.9 Referer https://billshipman.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers date Wed, 01 Jun 2022 17:32:35 GMT last-modified Sat, 26 Jan 2019 17:52:20 GMT server Apache/2.4.53 (cPanel) OpenSSL/1.1.1o mod_bwlimited/1.4 Phusion_Passenger/6.0.7 accept-ranges bytes etag "2ad03-580601af36c70" content-length 175363 content-type image/jpeg
GET H/1.1	404 Not Found	counter2.cgi lfchosting.com/cgi-bin/	0 0	532ms 98ms	Image text/html	69.90.36.230 COGECO-PEER1
General Check archive.org Show headers Download Go to Show image Full URL https://lfchosting.com/cgi-bin/counter2.cgi?name=sssmith&size=6&style=10&rp=1 Requested by Host: billshipman.com URL: https://billshipman.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.90.36.230 Toronto, Canada, ASN13768 (COGECO-PEER1, CA), Reverse DNS infinity.websiteservername.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://billshipman.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers
GET H2	200	5793.js Show response pop.dojo.cc/	13 KB 5 KB	197ms 161ms	Script application/javascript	2606:4700:3108::ac42:2b3c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pop.dojo.cc/5793.js Requested by Host: billshipman.com URL: https://billshipman.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b3c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a7f11dda531385e2f28e959e73d3443e2c97bbfe53b32f983c1f1f048c72db09 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://billshipman.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers date Wed, 01 Jun 2022 17:32:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OAqGF4gt%2FJGfivlgtcflgtC9CIDobgW1Niu6gOkIv0gAtRWE%2FdJOxaD1EnFGpzNul6xpHQipUbULKDQj7tDjlgjd%2FgaAdd5MdPbWIJeR30Ls%2FPOO9GAoJl49Nsrl%2Ft2%2FF7wjVLtPNBBBtA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 vary Accept-Encoding cache-control no-cache, private cf-ray 7149b0807d376963-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-xss-protection 1; mode=block
GET H/1.1	403 Forbidden	invoke.js mailboxdoablebasically.com/fa03c953aeeea60a6ad70de5c8cafdf7/	0 0	1199ms 112ms	Script application/javascript	192.243.59.20 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://mailboxdoablebasically.com/fa03c953aeeea60a6ad70de5c8cafdf7/invoke.js Requested by Host: pop.dojo.cc URL: https://pop.dojo.cc/5793.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.20 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.17.9 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://billshipman.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Wed, 01 Jun 2022 17:32:36 GMT Server nginx/1.17.9 P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Access-Control-Allow-Origin * Connection keep-alive Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformSec-CH-UA-Platform-Version,User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA,x-Device-User-Agent Content-Type application/javascript Content-Length 0

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| referer_se function| referer_sm function| referer_empty function| referer_not_empty function| str_contains function| setInnerHTML function| inject function| create_pu function| dpu object| pu object| pux object| atOptions

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://billshipman.com/ Message: Mixed Content: The page at 'https://billshipman.com/' was loaded over HTTPS, but requested an insecure element 'http://lfchosting.com/cgi-bin/counter2.cgi?name=sssmith&size=6&style=10&rp=1'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://billshipman.com/(Line 149) Message: Mixed Content: The page at 'https://billshipman.com/' was loaded over HTTPS, but requested an insecure element 'http://lfchosting.com/cgi-bin/counter2.cgi?name=sssmith&size=6&style=10&rp=1'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://lfchosting.com/cgi-bin/counter2.cgi?name=sssmith&size=6&style=10&rp=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://mailboxdoablebasically.com/fa03c953aeeea60a6ad70de5c8cafdf7/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billshipman.com
lfchosting.com
mailboxdoablebasically.com
pop.dojo.cc
162.253.126.144
192.243.59.20
2606:4700:3108::ac42:2b3c
69.90.36.230
725d0a62464fefdf89c79784af3dcbc3e5e7db32edd2e9df2252c8b2952ff1fb
9f02cefebd08ca50537657960db082aff8f77f750362e1e6a518b1f73096d3bb
a7f11dda531385e2f28e959e73d3443e2c97bbfe53b32f983c1f1f048c72db09
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855