0.bluetopper.online Open in urlscan Pro
104.248.199.158 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://xcel.energy/
Effective URL:
https://0.bluetopper.online/index.php?p=gqyggylcgu5dkmryga&sub1=cristopher&sub2=spacer
Submission: On March 29 via manual (March 29th 2022, 3:44:50 pm UTC) from US — Scanned from US

Summary HTTP 29 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 7 domains to perform 29 HTTP transactions. The main IP is 104.248.199.158, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is 0.bluetopper.online.
TLS certificate: Issued by R3 on March 28th 2022. Valid for: 3 months.

This is the only time 0.bluetopper.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	168.195.218.201 168.195.218.201	27775 (Telecommu...) (Telecommunicationcompany Suriname - TeleSur)
8	111.90.143.157 111.90.143.157	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
1	2607:f8b0:400... 2607:f8b0:4006:817::200a	15169 (GOOGLE) (GOOGLE)
2	104.248.199.158 104.248.199.158	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
29	5

2 168.195.218.201 (Suriname) 1 redirects

ASN27775 (Telecommunicationcompany Suriname - TeleSur, SR)

xcel.energy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 111.90.143.157 (Kuala Lumpur, Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la

ads.specialadves.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
local.specialadves.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
brend.specialadves.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.248.199.158 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

bluetopper.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.bluetopper.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	specialadves.com ads.specialadves.com — Cisco Umbrella Rank: 378519 local.specialadves.com — Cisco Umbrella Rank: 352753 Failed brend.specialadves.com — Cisco Umbrella Rank: 401321	6 KB
2	bluetopper.online bluetopper.online — Cisco Umbrella Rank: 771881 Failed 0.bluetopper.online	70 KB
2	xcel.energy 1 redirects xcel.energy	20 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 107	1 KB
0	se18.biz Failed se18.biz Failed
0	google.com Failed translate.google.com Failed
0	challenge.energy Failed challenge.energy Failed
29	7

	Domain	Requested by
6	ads.specialadves.com	xcel.energy
2	xcel.energy	1 redirects xcel.energy
1	0.bluetopper.online	xcel.energy
1	bluetopper.online	brend.specialadves.com
1	brend.specialadves.com	local.specialadves.com
1	local.specialadves.com	ads.specialadves.com
1	fonts.googleapis.com	xcel.energy
0	se18.biz Failed	xcel.energy
0	translate.google.com Failed	xcel.energy
0	challenge.energy Failed	xcel.energy
29	10

This site contains no links.

Subject Issuer	Validity	Valid
xcel.energy R3	`2022-01-14` - `2022-04-14`	3 months	crt.sh
specialadves.com R3	`2022-03-19` - `2022-06-17`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
local.specialadves.com R3	`2022-03-25` - `2022-06-23`	3 months	crt.sh
brend.specialadves.com R3	`2022-03-19` - `2022-06-17`	3 months	crt.sh
bluetopper.online R3	`2022-03-28` - `2022-06-26`	3 months	crt.sh

This page contains 1 frames:

Frame: https://se18.biz/?auf=gbrgczjxge5dcnrqgixtkmrygaxtilzsmvstim3fmmyc6mruf4ytmnbygu3dqnrygy&p=b&sub1=cristopher&sub2=spacer&sub3=&sub4=&cpc=0&cpm=0
Frame ID: DC3567E97BED4837B50E35CEA3E57AB3
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://xcel.energy/ HTTP 301
https://xcel.energy/ Page URL
https://local.specialadves.com/1QtY8z Page URL
https://brend.specialadves.com/away.php?id=223&sid=5267&pid=1643 Page URL
https://bluetopper.online/go/gqyggylcgu5dkmryga?sub1=cristopher&sub2=spacer Page URL
https://0.bluetopper.online/index.php?p=gqyggylcgu5dkmryga&sub1=cristopher&sub2=spacer Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

29
Requests

41 %
HTTPS

25 %
IPv6

7
Domains

10
Subdomains

5
IPs

4
Countries

98 kB
Transfer

272 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xcel.energy/ HTTP 301
https://xcel.energy/ Page URL
https://local.specialadves.com/1QtY8z Page URL
https://brend.specialadves.com/away.php?id=223&sid=5267&pid=1643 Page URL
https://bluetopper.online/go/gqyggylcgu5dkmryga?sub1=cristopher&sub2=spacer Page URL
https://0.bluetopper.online/index.php?p=gqyggylcgu5dkmryga&sub1=cristopher&sub2=spacer Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://xcel.energy/ HTTP 301
https://xcel.energy/

29 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
xcel.energy/
Redirect Chain

http://xcel.energy/
https://xcel.energy/

177 KB
20 KB

7110ms
6896ms

Document
text/html

168.195.218.201
TeleSur

General

Check archive.org

Show headers Download Go to

Full URL: https://xcel.energy/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 168.195.218.201 , Suriname, ASN27775 (Telecommunicationcompany Suriname - TeleSur, SR),
Reverse DNS
Software: nginx / PHP/7.4.27 PleskLin
Resource Hash: 38af5f529bf2061c3b7b613c158a97352500ec6aa7f3a01db08bf78d5885902d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: en-US,en;q=0.9

Response headers

server: nginx
date: Tue, 29 Mar 2022 15:44:35 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.27 PleskLin
link: <https://xcel.energy/index.php/wp-json/>; rel="https://api.w.org/", <https://xcel.energy/index.php/wp-json/wp/v2/pages/298>; rel="alternate"; type="application/json", <https://xcel.energy/>; rel=shortlink
content-encoding: br

Redirect headers

Server: nginx
Date: Tue, 29 Mar 2022 15:44:31 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://xcel.energy/

GET
H/1.1 200
OK steingerball.js
ads.specialadves.com/ 499 B
656 B 1134ms
261ms Stylesheet
text/plain 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/plugins/gtranslate/gtranslate-style24_css&ver=5.9
Requested by: Host: xcel.energy
URL: https://xcel.energy/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash: 96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 23:44:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 499
Content-Type: text/plain; charset=utf-8

GET
H/1.1 200
OK steingerball.js
ads.specialadves.com/ 499 B
656 B 1121ms
245ms Stylesheet
text/plain 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/css/dist/block-library/style_min_css&ver=5.9
Requested by: Host: xcel.energy
URL: https://xcel.energy/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash: 96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 23:44:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 499
Content-Type: text/plain; charset=utf-8

GET
H/1.1 200
OK steingerball.js
ads.specialadves.com/ 499 B
656 B 1133ms
244ms Stylesheet
text/plain 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/themes/mh-magazine/mh-magazine/style_css&ver=5.9
Requested by: Host: xcel.energy
URL: https://xcel.energy/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash: 96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 23:44:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 499
Content-Type: text/plain; charset=utf-8

GET
H/1.1 200
OK steingerball.js
ads.specialadves.com/ 499 B
656 B 1181ms
277ms Stylesheet
text/plain 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/themes/mh-magazine/mh-magazine/includes/font-awesome.min.css
Requested by: Host: xcel.energy
URL: https://xcel.energy/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash: 96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 23:44:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 499
Content-Type: text/plain; charset=utf-8

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 36ms
20ms Stylesheet
text/css 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Requested by

Host: xcel.energy
URL: https://xcel.energy/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

04a391894f53929ef3fc81d5a87162bc5742cd87c0e15e0a4c1181b90cc64612

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 29 Mar 2022 14:50:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 29 Mar 2022 15:44:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 29 Mar 2022 15:44:39 GMT

GET
H/1.1 200
OK steingerball.js
ads.specialadves.com/ 499 B
656 B 1300ms
329ms Stylesheet
text/plain 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/uploads/pum/pum-site-styles_css?generated=1643479656&ver=1.16.4
Requested by: Host: xcel.energy
URL: https://xcel.energy/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash: 96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 23:44:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 499
Content-Type: text/plain; charset=utf-8

GET
H/1.1 200
OK steingerball.js Show response
ads.specialadves.com/ 499 B
656 B 1373ms
252ms Script
text/plain 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/jquery/jquery_min_js&ver=3.6.0
Requested by: Host: xcel.energy
URL: https://xcel.energy/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash: 96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Tue, 29 Mar 2022 23:44:44 GMT
Server: nginx
Connection: keep-alive
Content-Length: 499
Content-Type: text/plain; charset=utf-8

GET steingerball.js
ads.specialadves.com/ 0
0

GET en.png
challenge.energy/wp-content/plugins/gtranslate/flags/24/ 0
0

GET element.js
translate.google.com/translate_a/ 0
0

GET 91n7DC4PkKS._AC_SL1500_.jpg
xcel.energy/wp-content/uploads/2021/07/ 0
0

GET 717cuPCG1MS._AC_SL1500_.jpg
xcel.energy/wp-content/uploads/2021/07/ 0
0

GET 81kDIA6I8UL._AC_SL1500_.jpg
xcel.energy/wp-content/uploads/2021/07/ 0
0

GET 81TxeAdgKiL._AC_SL1500_.jpg
xcel.energy/wp-content/uploads/2021/07/ 0
0

GET steingerball.js
ads.specialadves.com/ 0
0

GET 1QtY8z
local.specialadves.com/ 0
0

GET
H/1.1 200
OK 1QtY8z
local.specialadves.com/ 719 B
1 KB 2211ms
787ms Document
text/html 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://local.specialadves.com/1QtY8z
Requested by: Host: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/jquery/jquery_min_js&ver=3.6.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: en-US,en;q=0.9
Referer: https://xcel.energy/

Response headers

Server: nginx
Date: Tue, 29 Mar 2022 23:44:46 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 719
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
Expires: 0
Last-Modified: Tue, 29 Mar 2022 15:44:42 GMT
Pragma: no-cache
Vary: Accept-Encoding
Access-Control-Allow-Origin: *

GET
H/1.1 200
OK away.php
brend.specialadves.com/ 844 B
614 B 1157ms
260ms Document
text/html 111.90.143.157
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://brend.specialadves.com/away.php?id=223&sid=5267&pid=1643
Requested by: Host: local.specialadves.com
URL: https://local.specialadves.com/1QtY8z
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 111.90.143.157 Kuala Lumpur, Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: en-US,en;q=0.9
Referer: https://local.specialadves.com/

Response headers

Server: nginx
Date: Tue, 29 Mar 2022 23:44:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 411
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

GET gqyggylcgu5dkmryga
bluetopper.online/go/ 0
0

GET
H2 200 gqyggylcgu5dkmryga Show response
bluetopper.online/go/ 18 KB
18 KB 1754ms
93ms Document
text/html 104.248.199.158
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://bluetopper.online/go/gqyggylcgu5dkmryga?sub1=cristopher&sub2=spacer

Requested by

Host: brend.specialadves.com
URL: https://brend.specialadves.com/away.php?id=223&sid=5267&pid=1643

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.248.199.158 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

e12f8d742fc12c1f7dddbe3a3eeafe31267cd51fddff36e8785037e6d8a7bf47

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: en-US,en;q=0.9
Referer: https://brend.specialadves.com/

Response headers

server: nginx
date: Tue, 29 Mar 2022 15:44:45 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests

GET b71698fd2.js
bluetopper.online/ 0
0

GET
H2 200 Primary Request index.php Show response
0.bluetopper.online/ 52 KB
52 KB 880ms
94ms Document
text/html 104.248.199.158
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://0.bluetopper.online/index.php?p=gqyggylcgu5dkmryga&sub1=cristopher&sub2=spacer

Requested by

Host: xcel.energy
URL: https://xcel.energy/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.248.199.158 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

750a17757cecaa2de57e31909ac227a656b02c09f33875ed442741c7a443ac6d

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: en-US,en;q=0.9
Referer: https://bluetopper.online/

Response headers

server: nginx
date: Tue, 29 Mar 2022 15:44:46 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests

GET b71698fd2.js
0.bluetopper.online/ 0
0

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7

Request headers

Accept-Language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/gif

GET /
se18.biz/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/jquery/jquery-migrate_min_js&ver=3.3.2

Domain: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/themes/mh-magazine/mh-magazine/js/scripts_js&ver=5.9

Domain: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/uploads/2021/07/challengeenergy-01.png

Domain: challenge.energy
URL: https://challenge.energy/wp-content/plugins/gtranslate/flags/24/en.png

Domain: translate.google.com
URL: https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit2

Domain: xcel.energy
URL: https://xcel.energy/wp-content/uploads/2021/07/91n7DC4PkKS._AC_SL1500_.jpg

Domain: xcel.energy
URL: https://xcel.energy/wp-content/uploads/2021/07/717cuPCG1MS._AC_SL1500_.jpg

Domain: xcel.energy
URL: https://xcel.energy/wp-content/uploads/2021/07/81kDIA6I8UL._AC_SL1500_.jpg

Domain: xcel.energy
URL: https://xcel.energy/wp-content/uploads/2021/07/81TxeAdgKiL._AC_SL1500_.jpg

Domain: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/jquery/ui/core_min_js&ver=1.13.0

Domain: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-content/uploads/pum/pum-site-scripts_js?defer&generated=1643479657&ver=1.16.4

Domain: ads.specialadves.com
URL: https://ads.specialadves.com/steingerball.js?v=23.9.3&/wp-includes/js/wp-emoji-release.min.js?ver=5.9

Domain: local.specialadves.com
URL: https://local.specialadves.com/1QtY8z

Domain: bluetopper.online
URL: https://bluetopper.online/go/gqyggylcgu5dkmryga?sub1=cristopher&sub2=spacer

Domain: bluetopper.online
URL: https://bluetopper.online/b71698fd2.js

Domain: 0.bluetopper.online
URL: https://0.bluetopper.online/b71698fd2.js

Domain: se18.biz
URL: https://se18.biz/?auf=gbrgczjxge5dcnrqgixtkmrygaxtilzsmvstim3fmmyc6mruf4ytmnbygu3dqnrygy&p=b&sub1=cristopher&sub2=spacer&sub3=&sub4=&cpc=0&cpm=0

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
local.specialadves.com/	1970-01-20 02:40:47	Name: _subid Value: 3u0sm8k6243296a7e30a
local.specialadves.com/	1970-02-08 03:53:43	Name: af1c2 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjE0XCI6MTY0ODU2ODY4Mn0sXCJjYW1wYWlnbnNcIjp7XCIxXCI6MTY0ODU2ODY4Mn0sXCJ0aW1lXCI6MTY0ODU2ODY4Mn0ifQ.o-binsLtVzD6baDln8O70Lu0XD89vXW_IdYcMQNPqms
.bluetopper.online/	1970-01-20 02:39:20	Name: uuid Value: 63f70b3f-c26f-4dca-87cc-7ca29a6c9b2d
.0.bluetopper.online/	1970-01-20 02:39:20	Name: uuid Value: 63f70b3f-c26f-4dca-87cc-7ca29a6c9b2d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.bluetopper.online
ads.specialadves.com
bluetopper.online
brend.specialadves.com
challenge.energy
fonts.googleapis.com
local.specialadves.com
se18.biz
translate.google.com
xcel.energy
0.bluetopper.online
ads.specialadves.com
bluetopper.online
challenge.energy
local.specialadves.com
se18.biz
translate.google.com
xcel.energy
104.248.199.158
111.90.143.157
168.195.218.201
2607:f8b0:4006:817::200a
04a391894f53929ef3fc81d5a87162bc5742cd87c0e15e0a4c1181b90cc64612
38af5f529bf2061c3b7b613c158a97352500ec6aa7f3a01db08bf78d5885902d
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7
750a17757cecaa2de57e31909ac227a656b02c09f33875ed442741c7a443ac6d
96481e2f18408b727eecf133520b71bf09559bd597e6ee386d50908faa1da190
e12f8d742fc12c1f7dddbe3a3eeafe31267cd51fddff36e8785037e6d8a7bf47

0.bluetopper.online Open in urlscan Pro 104.248.199.158 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

41 %HTTPS

25 %IPv6

7 Domains

10 Subdomains

5 IPs

4 Countries

98 kBTransfer

272 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

4 Cookies

Indicators

0.bluetopper.online Open in urlscan Pro
104.248.199.158 Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

41 %
HTTPS

25 %
IPv6

7
Domains

10
Subdomains

5
IPs

4
Countries

98 kB
Transfer

272 kB
Size

4
Cookies

29 HTTP transactions
1 data transactions