Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well.

  curl -sI http://stealmybitcoin.com/
  HTTP/1.1 301 Moved Permanently
  Server: nginx
  Date: Sat, 24 Oct 2026 22:01:11 GMT
  Content-Type: text/html
  Content-Length: 162
  Connection: keep-alive
  Location: https://stealmybitcoin.com/