bitly.com Open in urlscan Pro
67.199.248.14 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://go.curiosity-fromtheworld.org/235/1780/10524/731208/
Effective URL:
https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26af...
Submission: On August 04 via manual (August 4th 2020, 6:40:33 am UTC) from US

Summary HTTP 3 Redirects Links 3 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 67.199.248.14, located in United States and belongs to GOOGLE-PRIVATE-CLOUD, US. The main domain is bitly.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on August 27th 2018. Valid for: 2 years.

This is the only time bitly.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 1	151.1.245.27 151.1.245.27		3242 (ASN-ITNET) (ASN-ITNET)
1	178.255.74.54 178.255.74.54		20746 (ASN-IDC T...) (ASN-IDC T.NO.OM.I.NC)
1 1	67.199.248.11 67.199.248.11		396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
2	67.199.248.14 67.199.248.14		396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
3	2

1 151.1.245.27 (Italy) 1 redirects

ASN3242 (ASN-ITNET, IT)
PTR: www.be-mail.it

go.curiosity-fromtheworld.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.255.74.54 (Italy)

ASN20746 (ASN-IDC T.NO.OM.I.NC, IT)
PTR: borgomanero.espotter.net

affiliate.across.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.199.248.14 (United States)

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bitly.com

bitly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	bitly.com bitly.com	10 KB
1	bit.ly 1 redirects bit.ly	280 B
1	across.it affiliate.across.it	884 B
1	curiosity-fromtheworld.org 1 redirects go.curiosity-fromtheworld.org	284 B
3	4

	Domain	Requested by
2	bitly.com	bitly.com
1	bit.ly	1 redirects
1	affiliate.across.it
1	go.curiosity-fromtheworld.org	1 redirects
3	4

This site contains links to these domains. Also see Links.

Domain
tracking.gopsjump.com.au
www.stopbadware.org
www.antiphishing.org

Subject Issuer	Validity	Valid
www.ediscom.it GlobalSign Organization Validation CA - SHA256 - G2	`2019-03-11` - `2021-03-11`	2 years	crt.sh
*.bitly.com DigiCert SHA2 High Assurance Server CA	`2018-08-27` - `2020-09-08`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B
Frame ID: E36EF82A606A92392AD4AA77D9082396
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/3i1BCdJ?aff_sub2=xa15tp0zwt1hycbjj72C318206692 HTTP 302
https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3F... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_dav (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

11 kB
Transfer

9 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://tracking.gopsjump.com.au/aff_c?offer_id=6583&aff_id=8041&file_id=49478&aff_sub=;
Title: https://tracking.gopsjump.com.au/aff_c?offer_id=6583&aff_id=8041&file_id=49478&aff_sub=;

Search URL Search Domain Scan URL

URL: https://www.stopbadware.org/
Title: www.StopBadware.org

Search URL Search Domain Scan URL

URL: https://www.antiphishing.org/
Title: www.antiphishing.org

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3i1BCdJ?aff_sub2=xa15tp0zwt1hycbjj72C318206692 HTTP 302
https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://go.curiosity-fromtheworld.org/235/1780/10524/731208/ HTTP 302
https://affiliate.across.it/v2/click/xa15tp0zwt1hycbjj72

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set xa15tp0zwt1hycbjj72
affiliate.across.it/v2/click/
Redirect Chain

http://go.curiosity-fromtheworld.org/235/1780/10524/731208/
https://affiliate.across.it/v2/click/xa15tp0zwt1hycbjj72

0
884 B

374ms
96ms

Document
text/html

178.255.74.54
ASN-IDC T.NO.OM.I.NC

General

Check archive.org

Show headers Download Go to

Full URL: https://affiliate.across.it/v2/click/xa15tp0zwt1hycbjj72
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 178.255.74.54 , Italy, ASN20746 (ASN-IDC T.NO.OM.I.NC, IT),
Reverse DNS: borgomanero.espotter.net
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1c DAV/2 PHP/5.4.13 / PHP/5.4.13
Resource Hash

Request headers

Host: affiliate.across.it
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 04 Aug 2020 06:40:07 GMT
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1c DAV/2 PHP/5.4.13
X-Powered-By: PHP/5.4.13
Set-Cookie: tr[xa15tp0zwt1hycbjj72]=1; expires=Tue, 04-Aug-2020 07:40:07 GMT; path=/; samesite=None; secure track[4289]=xa15tp0zwt1hycbjj72C318206692; expires=Wed, 05-Aug-2020 06:40:07 GMT; path=/; samesite=None; secure track[0]=xa15tp0zwt1hycbjj72C318206692; expires=Wed, 05-Aug-2020 06:40:07 GMT; path=/; samesite=None; secure
P3P: policyref="https://affiliate.across.it/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa OUR NOR UNI COM NAV INT";
Refresh: 0; URL=https://bit.ly/3i1BCdJ?aff_sub2=xa15tp0zwt1hycbjj72C318206692
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 20
Keep-Alive: timeout=2
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

Redirect headers

Date: Tue, 04 Aug 2020 06:40:17 GMT
Server: Apache/2.4.6 (CentOS)
Location: https://affiliate.across.it/v2/click/xa15tp0zwt1hycbjj72
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H2

200

Primary Request warning Show response
bitly.com/a/
Redirect Chain

https://bit.ly/3i1BCdJ?aff_sub2=xa15tp0zwt1hycbjj72C318206692
https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B

7 KB
7 KB

231ms
158ms

Document
text/html

67.199.248.14
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

67.199.248.14 , United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

Software

nginx /

Resource Hash

ca502a6b3862155f7f1e5641fd342c8a9a088d3a64af6c054709d99830cb41ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

:method: GET
:authority: bitly.com
:scheme: https
:path: /a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://affiliate.across.it/v2/click/xa15tp0zwt1hycbjj72
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://affiliate.across.it/v2/click/xa15tp0zwt1hycbjj72

Response headers

status: 200
server: nginx
date: Tue, 04 Aug 2020 06:40:18 GMT
content-type: text/html; charset=UTF-8
content-length: 7069
set-cookie: anon_u=cHN1X19mNDJlZGZmMC1iYzkxLTQ2M2QtODdlNC04NmExN2I2ODdhNjI=|1596523218|80fac6b18e5dde1ebd8352baaf52974832f0a93b; Domain=bitly.com; expires=Wed, 04 Aug 2021 06:40:18 GMT; httponly; Path=/; secure
etag: "fb601bf15493a09ba3955ee121fb114dda29dea5"
pragma: no-cache
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-frame-options: DENY
p3p: CP="CAO PSA OUR"
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
server: nginx
date: Tue, 04 Aug 2020 06:40:18 GMT
content-type: text/html; charset=utf-8
content-length: 250
cache-control: private, max-age=90
content-security-policy: referrer always;
location: https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B
referrer-policy: unsafe-url
via: 1.1 google
alt-svc: clear

GET
H2 200 bitly_warning_hand.png
bitly.com/s/v468/graphics/ 2 KB
3 KB 151ms
150ms Image
image/png 67.199.248.14
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bitly.com/s/v468/graphics/bitly_warning_hand.png

Requested by

Host: bitly.com
URL: https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

67.199.248.14 , United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

Software

nginx /

Resource Hash

df60e8e9ab468a0075e0eb85959ba050f6dc1aad58248eeb627b8e21ba22cf58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://bitly.com/a/warning?hash=3i1BCdJ&url=https%3A%2F%2Ftracking.gopsjump.com.au%2Faff_c%3Foffer_id%3D6583%26aff_id%3D8041%26file_id%3D49478%26aff_sub%3D%3B
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 04 Aug 2020 06:40:18 GMT
via: 1.1 google
last-modified: Tue, 04 Jun 2019 19:03:06 GMT
server: nginx
etag: "b6b83f51c2ecbe118193eb84f7ca8fddac79fa1a"
strict-transport-security: max-age=31536000
content-type: image/png
status: 200
cache-control: public, max-age=315360000
alt-svc: clear
content-length: 2496
expires: Fri, 02 Aug 2030 06:40:18 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| addEvent function| removeEvent

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bitly.com/	1970-01-19 20:14:19	Name: anon_u Value: cHN1X19mNDJlZGZmMC1iYzkxLTQ2M2QtODdlNC04NmExN2I2ODdhNjI=\|1596523218\|80fac6b18e5dde1ebd8352baaf52974832f0a93b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

affiliate.across.it
bit.ly
bitly.com
go.curiosity-fromtheworld.org
151.1.245.27
178.255.74.54
67.199.248.11
67.199.248.14
ca502a6b3862155f7f1e5641fd342c8a9a088d3a64af6c054709d99830cb41ad
df60e8e9ab468a0075e0eb85959ba050f6dc1aad58248eeb627b8e21ba22cf58