Submitted URL: https://bit.ly/3E1IemX
Effective URL: https://0.blockleftheaders.best/index.php?p=mzrtgzjzgy5dmojrg4&subid3=biggest&=8&subid4=torry
Submission: On December 17 via manual from IN — Scanned from DE

Summary

This website contacted 5 IPs in 5 countries across 7 domains to perform 11 HTTP transactions. The main IP is 167.71.64.21, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is 0.blockleftheaders.best.
TLS certificate: Issued by R3 on December 16th 2021. Valid for: 3 months.
This is the only time 0.blockleftheaders.best was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 396982 (GOOGLE-PR...)
1 2 139.59.57.64 14061 (DIGITALOC...)
1 1 146.59.0.60 16276 (OVH)
1 199.59.243.200 16509 (AMAZON-02)
1 4 80.78.24.100 39287 (ABSTRACT)
2 167.71.64.21 14061 (DIGITALOC...)
11 5
Domain Requested by
3 trick.trainresistor.cc left.trainresistor.cc
trick.trainresistor.cc
2 blog.arrowbycrossbow.com 1 redirects
1 0.blockleftheaders.best blog.arrowbycrossbow.com
1 blockleftheaders.best trick.trainresistor.cc
1 left.trainresistor.cc blog.arrowbycrossbow.com
1 patoghestan.com
1 irc.lovegreenpencils.ga 1 redirects
1 bit.ly 1 redirects
0 usequalitytips.world Failed blog.arrowbycrossbow.com
11 9

This site contains no links.

Subject Issuer Validity Valid
left.trainresistor.cc
ZeroSSL RSA Domain Secure Site CA
2021-12-10 -
2022-03-10
3 months crt.sh
trick.trainresistor.cc
ZeroSSL RSA Domain Secure Site CA
2021-12-10 -
2022-03-10
3 months crt.sh
blockleftheaders.best
R3
2021-12-16 -
2022-03-16
3 months crt.sh

This page contains 1 frames:

Primary Page: https://0.blockleftheaders.best/index.php?p=mzrtgzjzgy5dmojrg4&subid3=biggest&=8&subid4=torry
Frame ID: 36215612CE471D67E6AE56F23B1C1D50
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

Ich bin kein Roboter

Page URL History Show full URLs

  1. https://bit.ly/3E1IemX HTTP 301
    http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexp... Page URL
  2. https://trick.trainresistor.cc/a.php?sid=65859&utm_source=754845 HTTP 302
    https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378 Page URL
  3. https://trick.trainresistor.cc/come.php?id=76967-55-43567896-4 Page URL
  4. https://blockleftheaders.best/go/mzrtgzjzgy5dmojrg4?subid3=biggest&=8&subid4=torry Page URL
  5. https://0.blockleftheaders.best/index.php?p=mzrtgzjzgy5dmojrg4&subid3=biggest&=8&subid4=torry Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

11
Requests

45 %
HTTPS

0 %
IPv6

7
Domains

9
Subdomains

5
IPs

5
Countries

106 kB
Transfer

167 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3E1IemX HTTP 301
    http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically Page URL
  2. https://trick.trainresistor.cc/a.php?sid=65859&utm_source=754845 HTTP 302
    https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378 Page URL
  3. https://trick.trainresistor.cc/come.php?id=76967-55-43567896-4 Page URL
  4. https://blockleftheaders.best/go/mzrtgzjzgy5dmojrg4?subid3=biggest&=8&subid4=torry Page URL
  5. https://0.blockleftheaders.best/index.php?p=mzrtgzjzgy5dmojrg4&subid3=biggest&=8&subid4=torry Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/3E1IemX HTTP 301
  • http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically
Request Chain 1
  • http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/l HTTP 302
  • https://irc.lovegreenpencils.ga/ryery?id=584&rs=2 HTTP 302
  • http://patoghestan.com/
Request Chain 2
  • https://usequalitytips.world/finger.php?a=1nor&c=d&s=11263 HTTP 303
  • https://usequalitytips.world/intl/uiwe/compl?bhu=CWrKCPpy8eo76DTcQUioYUE85u2TRHuC4RoDx
Request Chain 5
  • https://trick.trainresistor.cc/a.php?sid=65859&utm_source=754845 HTTP 302
  • https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
index.php
blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/
Redirect Chain
  • https://bit.ly/3E1IemX
  • http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically
6 KB
3 KB
Document
General
Full URL
http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically
Protocol
HTTP/1.1
Server
139.59.57.64 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.15.5 /
Resource Hash
76154a8174a9c05dae00a6e201ef5a77a01ed778bb93de6a7334f15a68d24845
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx/1.15.5
Date
Fri, 17 Dec 2021 19:51:12 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Content-Encoding
gzip

Redirect headers

server
nginx
date
Fri, 17 Dec 2021 19:51:11 GMT
content-type
text/html; charset=utf-8
content-length
293
cache-control
private, max-age=90
content-security-policy
referrer always;
location
http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically
referrer-policy
unsafe-url
via
1.1 google
alt-svc
clear
/
patoghestan.com/
Redirect Chain
  • http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/l
  • https://irc.lovegreenpencils.ga/ryery?id=584&rs=2
  • http://patoghestan.com/
0
0
Image
General
Full URL
http://patoghestan.com/
Protocol
HTTP/1.1
Server
199.59.243.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://blog.arrowbycrossbow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Fri, 17 Dec 2021 19:51:14 GMT
Last-Modified
Fri, 17 Dec 2021 19:51:14 GMT
Server
Apache/2.4.37 (centos) OpenSSL/1.1.1g
Content-Type
text/html; charset=UTF-8
location
http://patoghestan.com
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=1, max=5
Content-Length
0
Expires
on, 01 Jan 1970 00:00:00 GMT
compl
usequalitytips.world/intl/uiwe/
Redirect Chain
  • https://usequalitytips.world/finger.php?a=1nor&c=d&s=11263
  • https://usequalitytips.world/intl/uiwe/compl?bhu=CWrKCPpy8eo76DTcQUioYUE85u2TRHuC4RoDx
0
0

clear.js
left.trainresistor.cc/
1 KB
1 KB
Script
General
Full URL
https://left.trainresistor.cc/clear.js?v=1.4.8
Requested by
Host: blog.arrowbycrossbow.com
URL: http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
80.78.24.100 , Sweden, ASN39287 (ABSTRACT, FI),
Reverse DNS
504e1864.host.njalla.net
Software
nginx /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://blog.arrowbycrossbow.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Fri, 17 Dec 2021 19:51:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Dec 2021 14:05:20 GMT
Server
nginx
ETag
W/"61b35ea0-5a8"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
a.php
trick.trainresistor.cc/
0
0

b.php
trick.trainresistor.cc/
Redirect Chain
  • https://trick.trainresistor.cc/a.php?sid=65859&utm_source=754845
  • https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378
902 B
715 B
Document
General
Full URL
https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378
Requested by
Host: left.trainresistor.cc
URL: https://left.trainresistor.cc/clear.js?v=1.4.8
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
80.78.24.100 , Sweden, ASN39287 (ABSTRACT, FI),
Reverse DNS
504e1864.host.njalla.net
Software
nginx / PHP/5.4.16
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically

Response headers

Server
nginx
Date
Fri, 17 Dec 2021 19:51:14 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Vary
Accept-Encoding
X-Powered-By
PHP/5.4.16
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Fri, 17 Dec 2021 19:51:14 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=60
X-Powered-By
PHP/5.4.16
Location
https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378
come.php
trick.trainresistor.cc/
0
0

come.php
trick.trainresistor.cc/
256 B
462 B
Document
General
Full URL
https://trick.trainresistor.cc/come.php?id=76967-55-43567896-4
Requested by
Host: trick.trainresistor.cc
URL: https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
80.78.24.100 , Sweden, ASN39287 (ABSTRACT, FI),
Reverse DNS
504e1864.host.njalla.net
Software
nginx / PHP/5.4.16
Resource Hash
ea0fbf921bbbbde650d23d5676f02af60809a54350328fa2f5246bbf31e0768e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://trick.trainresistor.cc/b.php?id=4585693-458-435-2342378

Response headers

Server
nginx
Date
Fri, 17 Dec 2021 19:51:14 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
256
Connection
keep-alive
Keep-Alive
timeout=60
X-Powered-By
PHP/5.4.16
mzrtgzjzgy5dmojrg4
blockleftheaders.best/go/
0
0

mzrtgzjzgy5dmojrg4
blockleftheaders.best/go/
50 KB
50 KB
Document
General
Full URL
https://blockleftheaders.best/go/mzrtgzjzgy5dmojrg4?subid3=biggest&=8&subid4=torry
Requested by
Host: trick.trainresistor.cc
URL: https://trick.trainresistor.cc/come.php?id=76967-55-43567896-4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.71.64.21 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
ca46885bb54db84d7958291399464871dab786997f550e7cf673de9a58d6b111
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://trick.trainresistor.cc/

Response headers

server
nginx
date
Fri, 17 Dec 2021 19:51:14 GMT
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
strict-transport-security
max-age=31536000
content-security-policy
img-src https: data:; upgrade-insecure-requests
truncated
/
24 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6cbf5ff9c2945171c3f93c38e9c67d4b98fb5354a3c95cf4910259780c1fb9b0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a72fd7760f623c9fd5fee0bd98df809a347471902fc479bcdae38681c1a071d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca7a07233506b5529a951fd2c4580757f5606d874b8a2b0a153d14a418b201ef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
Primary Request index.php
0.blockleftheaders.best/
50 KB
50 KB
Document
General
Full URL
https://0.blockleftheaders.best/index.php?p=mzrtgzjzgy5dmojrg4&subid3=biggest&=8&subid4=torry
Requested by
Host: blog.arrowbycrossbow.com
URL: http://blog.arrowbycrossbow.com/3r9kbl/go/js/sticky/submitart/loginedit/forgot_password/index_recent/techexpert/index.php?camellia=x112u6sv3fuwbdh&hypoxias=sacheverell&tautologous=electroosmotically
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.71.64.21 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
7271673ac95fff44e237ced4be15452e2df0032f0f980223fca16263fd7bf577
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://blockleftheaders.best/

Response headers

server
nginx
date
Fri, 17 Dec 2021 19:51:14 GMT
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
strict-transport-security
max-age=31536000
content-security-policy
img-src https: data:; upgrade-insecure-requests
truncated
/
24 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6cbf5ff9c2945171c3f93c38e9c67d4b98fb5354a3c95cf4910259780c1fb9b0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a72fd7760f623c9fd5fee0bd98df809a347471902fc479bcdae38681c1a071d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca7a07233506b5529a951fd2c4580757f5606d874b8a2b0a153d14a418b201ef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
378 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
377 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
usequalitytips.world
URL
https://usequalitytips.world/intl/uiwe/compl?bhu=CWrKCPpy8eo76DTcQUioYUE85u2TRHuC4RoDx
Domain
trick.trainresistor.cc
URL
https://trick.trainresistor.cc/a.php?sid=65859&utm_source=754845
Domain
trick.trainresistor.cc
URL
https://trick.trainresistor.cc/come.php?id=76967-55-43567896-4
Domain
blockleftheaders.best
URL
https://blockleftheaders.best/go/mzrtgzjzgy5dmojrg4?subid3=biggest&=8&subid4=torry

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| urlB64ToUint8Array

5 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: lbhjPb-4a432f1c9e22d9d02f-00K
usequalitytips.world/ Name: UUID
Value: U2443-85-6843-429837-131857
usequalitytips.world/ Name: _data
Value: HeFSMLLhbq9Wvb1sk81ChsGzpEof67NKKNbNC
.blockleftheaders.best/ Name: uuid
Value: 876a94b9-a357-45ba-9976-b2e94c528c1f
.0.blockleftheaders.best/ Name: uuid
Value: 876a94b9-a357-45ba-9976-b2e94c528c1f

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block