nextstephire.net Open in urlscan Pro
2606:4700:3034::ac43:86ae Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://reviewingsamazon.com/
Effective URL:
https://nextstephire.net/qr.php
Submission Tags: falconsandbox
Submission: On November 02 via api (November 2nd 2024, 10:36:07 am UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 8 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3034::ac43:86ae, located in United States and belongs to CLOUDFLARENET, US. The main domain is nextstephire.net.
TLS certificate: Issued by WE1 on October 26th 2024. Valid for: 3 months.

This is the only time nextstephire.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	151.101.2.184 151.101.2.184	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1 1	52.51.136.65 52.51.136.65	16509 (AMAZON-02) (AMAZON-02)
2 2	18.202.12.61 18.202.12.61	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700:303... 2606:4700:3034::ac43:86ae	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	195.201.128.178 195.201.128.178	24940 (HETZNER-AS) (HETZNER-AS)
3	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
13	6

4 151.101.2.184 (San Francisco, United States)

ASN54113 (FASTLY, US)

reviewingsamazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.136.65 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-136-65.eu-west-1.compute.amazonaws.com

www.rewardstck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.202.12.61 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-202-12-61.eu-west-1.compute.amazonaws.com

glitchy.go2cloud.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3034::ac43:86ae (United States)

ASN13335 (CLOUDFLARENET, US)

nextstephire.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.201.128.178 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.178.128.201.195.clients.your-server.de

api.qrserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	reviewingsamazon.com reviewingsamazon.com	43 KB
3	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3643
3	nextstephire.net nextstephire.net	7 KB
2	go2cloud.org 2 redirects glitchy.go2cloud.org — Cisco Umbrella Rank: 534550	2 KB
1	qrserver.com api.qrserver.com — Cisco Umbrella Rank: 51637	610 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	107 KB
1	rewardstck.com 1 redirects www.rewardstck.com	518 B
1	gstatic.com fonts.gstatic.com	18 KB
13	8

	Domain	Requested by
4	reviewingsamazon.com	reviewingsamazon.com
3	region1.google-analytics.com	www.googletagmanager.com
3	nextstephire.net	reviewingsamazon.com nextstephire.net
2	glitchy.go2cloud.org	2 redirects
1	api.qrserver.com	nextstephire.net
1	www.googletagmanager.com	nextstephire.net
1	www.rewardstck.com	1 redirects
1	fonts.gstatic.com	reviewingsamazon.com
13	8

This site contains no links.

Subject Issuer	Validity	Valid
reviewingsamazon.com Certainly Intermediate R1	`2024-11-02` - `2024-12-02`	a month	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
nextstephire.net WE1	`2024-10-26` - `2025-01-24`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.qrserver.com R11	`2024-10-06` - `2025-01-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nextstephire.net/qr.php
Frame ID: 48F096345CBBDEA37FE8D12871A7A1F1
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QRCode

Page URL History Show full URLs

https://reviewingsamazon.com/ Page URL
https://www.rewardstck.com/aff_c?offer_id=144&aff_id=11513 HTTP 302
http://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513 HTTP 307
https://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513 HTTP 302
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=11513&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D... HTTP 302
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb Page URL
https://nextstephire.net/qr.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

6
IPs

3
Countries

176 kB
Transfer

521 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://reviewingsamazon.com/ Page URL
https://www.rewardstck.com/aff_c?offer_id=144&aff_id=11513 HTTP 302
http://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513 HTTP 307
https://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513 HTTP 302
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=11513&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D10266ee686d683cc01e25c5db91abb&urlauth=609395220291458685086024125215 HTTP 302
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb Page URL
https://nextstephire.net/qr.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://www.rewardstck.com/aff_c?offer_id=144&aff_id=11513 HTTP 302
http://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513 HTTP 307
https://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513 HTTP 302
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=11513&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D10266ee686d683cc01e25c5db91abb&urlauth=609395220291458685086024125215 HTTP 302
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
reviewingsamazon.com/ 17 KB
6 KB 49ms
12ms Document
text/html 151.101.2.184
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://reviewingsamazon.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.184 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e2e20b85b9bc0a541ed40b0b4da230d719fe49c33534c757a9cfa95317366a21

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 935070
content-encoding: gzip
content-length: 5834
content-type: text/html; charset=UTF-8
date: Sat, 02 Nov 2024 10:35:57 GMT
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin <https://images.funnelish.com>; rel=preconnect; crossorigin <https://img.youtube.com>; rel=preconnect; crossorigin
vary: X-Country, Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-country: de
x-index: 7
x-page: F_45666_341283_1042073_1141208
x-served-by: cache-fra-etou8220100-FRA, cache-fra-etou8220154-FRA
x-timer: S1730543757.146092,VS0,VE1

GET
H2 200 core.min.js Show response
reviewingsamazon.com/ 90 KB
26 KB 329ms
329ms Script
text/javascript 151.101.2.184
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://reviewingsamazon.com/core.min.js
Requested by: Host: reviewingsamazon.com
URL: https://reviewingsamazon.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.184 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e6b56c5b5a94c34b53b5a8334701acf419dd227f80ec03a0f955d10bc925456d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://reviewingsamazon.com/

Response headers

cache-control: no-store
content-encoding: gzip
x-timer: S1730543757.168204,VS0,VE320
age: 0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
x-cache: MISS, HIT
content-length: 25997
date: Sat, 02 Nov 2024 10:35:57 GMT
last-modified: Wed, 03 Jul 2024 03:31:14 GMT
content-type: text/javascript; charset=utf-8
x-served-by: cache-fra-etou8220154-FRA, cache-fra-etou8220154-FRA
x-cache-hits: 0, 1
vary: Accept-Encoding

GET
H2 200 core.min.css
reviewingsamazon.com/ 49 KB
10 KB 317ms
317ms Stylesheet
text/css 151.101.2.184
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://reviewingsamazon.com/core.min.css
Requested by: Host: reviewingsamazon.com
URL: https://reviewingsamazon.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.184 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a0a05c21853e95f250a516ecdd8b2e15cf8168e39a292ca4b402701c099a708b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://reviewingsamazon.com/

Response headers

cache-control: no-store
content-encoding: gzip
x-timer: S1730543757.168179,VS0,VE310
age: 0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
x-cache: MISS, HIT
content-length: 9837
date: Sat, 02 Nov 2024 10:35:57 GMT
last-modified: Wed, 30 Oct 2024 22:03:16 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230063-FRA, cache-fra-etou8220154-FRA
x-cache-hits: 0, 1
vary: Accept-Encoding

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 29ms
7ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: reviewingsamazon.com
URL: https://reviewingsamazon.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://reviewingsamazon.com
Referer: https://reviewingsamazon.com/

Response headers

age: 335835
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 29 Oct 2025 13:18:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 13:18:42 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H2 200 favicon.ico
reviewingsamazon.com/ 4 KB
1 KB 157ms
157ms Other
image/vnd.microsoft.icon 151.101.2.184
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://reviewingsamazon.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.184 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 29597fc227664aeed48067d1bf49eeee45e4a048d62aa91d366e6cfb680189a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://reviewingsamazon.com/

Response headers

cache-control: public, max-age=10000
content-encoding: gzip
x-timer: S1730543758.531439,VS0,VE131
age: 0
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 1080
date: Sat, 02 Nov 2024 10:35:57 GMT
content-type: image/vnd.microsoft.icon
last-modified: Sat, 16 Jan 2021 00:36:37 GMT
x-served-by: cache-fra-etou8220154-FRA
x-cache-hits: 0
vary: Accept-Encoding

GET
H3

200

/
nextstephire.net/
Redirect Chain

https://www.rewardstck.com/aff_c?offer_id=144&aff_id=11513
http://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513
https://glitchy.go2cloud.org/aff_c?offer_id=144&aff_id=11513
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=11513&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D10266ee686d683cc01e25c5db91abb&urlauth=6093952202...
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb

19 KB
4 KB

856ms
844ms

Document
text/html

2606:4700:3034::ac43:86ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb
Requested by: Host: reviewingsamazon.com
URL: https://reviewingsamazon.com/core.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:86ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8dc37b1cc8b190d7-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 02 Nov 2024 10:35:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2P1hqWrNa5qJuLEyCBSrFMk8EGMt5CgOMj4EF49r9OSJQ8vGMy2Ta4kpAgaoX%2BkaJ1LCzDXMpAPVqpK2pb1x7ml4owdygIngt082QZB7p9K5UIKGsMqxxeL5YqKxCSuu7l2cxLFJzUfdPQY9YQeQ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=6891&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4162&recv_bytes=4462&delivery_rate=850&cwnd=12000&unsent_bytes=0&cid=5f8c48bba9b46318&ts=848&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding

Redirect headers

Accept-Ch: Sec-Ch-Dpr, Dpr, Sec-Ch-Ua-Model
Access-Control-Allow-Headers: Tune-SDK-Version
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 285
Content-Type: text/html; charset=iso-8859-1
Date: Sat, 02 Nov 2024 10:35:58 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Location: https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb
Pragma: no-cache
Server: nginx
X-Request-Id: a296879ada9799a1f6090da8d00a9c6e

GET
H3 200 Primary Request qr.php Show response
nextstephire.net/ 1 KB
1 KB 29ms
28ms Document
text/html 2606:4700:3034::ac43:86ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextstephire.net/qr.php
Requested by: Host: nextstephire.net
URL: https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:86ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41d2b57b5c1020c2d39f04e5399436abac29d7a8460113ba6ab0d7b9394cfd87

Request headers

Referer: https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=10266ee686d683cc01e25c5db91abb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8dc37b227c6290d7-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 02 Nov 2024 10:35:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ryMARvHmxEJVNeavIHjWmkJa6OM%2FERLHVrK6bAKBuGnk3vgTL8gSMtByah4gzbiENE%2F9oRHh3EJyVGT9lD66DeUysuoPHQQhl%2FJJ291qhKRMr2EiNj7s5aAVfh7glRy0xZx0Ydier1uaQm%2Fpds6j"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=6749&sent=17&recv=13&lost=0&retrans=0&sent_bytes=8161&recv_bytes=5020&delivery_rate=636870&cwnd=12000&unsent_bytes=0&cid=5f8c48bba9b46318&ts=936&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
107 KB 58ms
36ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729

Requested by

Host: nextstephire.net
URL: https://nextstephire.net/qr.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0007d85fb65a1810bff805dea9932efeb738471367c5b364741eb0f7996f05c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 02 Nov 2024 10:35:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 02 Nov 2024 10:35:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 108953
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 /
api.qrserver.com/v1/create-qr-code/ 345 B
610 B 56ms
11ms Image
image/png 195.201.128.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=https://nextstephire.net/?QR
Requested by: Host: nextstephire.net
URL: https://nextstephire.net/qr.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 195.201.128.178 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.128.201.195.clients.your-server.de
Software: nginx /
Resource Hash: 479fc4ed986206329b6c79b573d035421e88f08328c079dc73daf8c7596dae46

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, Origin, Authorization, X-Requested-With, Client-Security-Token
access-control-max-age: 7200
access-control-allow-origin: *
date: Sat, 02 Nov 2024 10:35:59 GMT
content-type: image/png
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 38ms
16ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4au0v9188976620za200&_p=1730543759790&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101878899~101878944~101925629&cid=1178424803.1730543760&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1730543759&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D10266ee686d683cc01e25c5db91abb&dt=QRCode&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=170
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://nextstephire.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 02 Nov 2024 10:35:59 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 29ms
14ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4au0v9188976620za200&_p=1730543759790&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101878899~101878944~101925629&cid=1178424803.1730543760&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1730543759&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D10266ee686d683cc01e25c5db91abb&dt=QRCode&en=QRTest&_ee=1&_et=2&tfd=177
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://nextstephire.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 02 Nov 2024 10:35:59 GMT
content-type: text/plain
server: Golfe2

GET
H3 404 favicon.ico
nextstephire.net/ 3 KB
2 KB 42ms
42ms Other
text/html 2606:4700:3034::ac43:86ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextstephire.net/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:86ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://nextstephire.net/qr.php

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qkWBIA3ordIMNIh1ZTAdudl5mQK%2FkVtVCkDE9cq3o%2F2E5B99Uxae%2BdpxI5vYiqstO6z8PRCIud0jgxe%2FewILAyLGJChbigEdmJ0uM9A5R865wcivkVANnCynFjyTXfV%2FbQ%2BA9iFbCg8spiAocnog"}],"group":"cf-nel","max_age":604800}
cf-ray: 8dc37b238d2590d7-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=6684&sent=21&recv=16&lost=0&retrans=0&sent_bytes=9517&recv_bytes=5554&delivery_rate=49560&cwnd=12000&unsent_bytes=0&cid=5f8c48bba9b46318&ts=1122&x=1", cfHdrFlush;dur=0
date: Sat, 02 Nov 2024 10:35:59 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare
last-modified: Mon, 26 Aug 2024 11:32:37 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 16ms
14ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4au0v9188976620za200&_p=1730543759790&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101878899~101878944~101925629&cid=1178424803.1730543760&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=3&sid=1730543759&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D10266ee686d683cc01e25c5db91abb&dt=QRCode&en=scroll&epn.percent_scrolled=90&_et=1&tfd=5177
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://nextstephire.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 02 Nov 2024 10:36:04 GMT
content-type: text/plain
server: Golfe2

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
reviewingsamazon.com/	1969-12-31 23:59:59	Name: x-country_code Value: DE
reviewingsamazon.com/	1969-12-31 23:59:59	Name: x-geo-city Value: busum
reviewingsamazon.com/	1969-12-31 23:59:59	Name: x-geo-latitude Value: 54.130
reviewingsamazon.com/	1969-12-31 23:59:59	Name: x-geo-longitude Value: 8.850
reviewingsamazon.com/	1969-12-31 23:59:59	Name: X-ResourcesToken Value: 1730550957_0x415b0815dbaa31ab66631ceef3ae9685baf21eec
reviewingsamazon.com/	1969-12-31 23:59:59	Name: X-Page Value: F_45666_341283_1042073_1141208
glitchy.go2cloud.org/	1970-01-21 01:25:35	Name: enc_aff_session_407 Value: ENC0310b0f2c51b036e5c6abec90d520d408213edce3bbd0e46aeef71e06e54e9133f944f14faf28c7c7647cd8727aa75abe040924c64c98c56bf4024ba406e90fad32c94e2979ca583f568a2f4c9d09d568b006d889eab4d08e93e5e1345547ee2c6f467821d25f3d9d1c7b13472bd50a5ce9390ac5d13755a52e4892c16dd7c6271210818d9
glitchy.go2cloud.org/	1970-01-21 10:18:23	Name: ho_mob Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMzAiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTMwLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==
nextstephire.net/	1969-12-31 23:59:59	Name: o Value: 1a3c22261071dd169ca0e9acc3bc0bd3bf38dc0d
.nextstephire.net/	1970-01-21 10:18:23	Name: _ga Value: GA1.1.1178424803.1730543760
.nextstephire.net/	1970-01-21 10:18:23	Name: _ga_QG5EZY4729 Value: GS1.1.1730543759.1.0.1730543759.0.0.0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nextstephire.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.qrserver.com
fonts.gstatic.com
glitchy.go2cloud.org
nextstephire.net
region1.google-analytics.com
reviewingsamazon.com
www.googletagmanager.com
www.rewardstck.com
151.101.2.184
18.202.12.61
195.201.128.178
2001:4860:4802:32::36
2606:4700:3034::ac43:86ae
2a00:1450:4001:813::2003
2a00:1450:4001:830::2008
52.51.136.65
0007d85fb65a1810bff805dea9932efeb738471367c5b364741eb0f7996f05c8
29597fc227664aeed48067d1bf49eeee45e4a048d62aa91d366e6cfb680189a1
41d2b57b5c1020c2d39f04e5399436abac29d7a8460113ba6ab0d7b9394cfd87
479fc4ed986206329b6c79b573d035421e88f08328c079dc73daf8c7596dae46
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
a0a05c21853e95f250a516ecdd8b2e15cf8168e39a292ca4b402701c099a708b
d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615
e2e20b85b9bc0a541ed40b0b4da230d719fe49c33534c757a9cfa95317366a21
e6b56c5b5a94c34b53b5a8334701acf419dd227f80ec03a0f955d10bc925456d

nextstephire.net Open in urlscan Pro 2606:4700:3034::ac43:86ae Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

8 Domains

8 Subdomains

6 IPs

3 Countries

176 kBTransfer

521 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

11 Cookies

1 Console Messages

Indicators

nextstephire.net Open in urlscan Pro
2606:4700:3034::ac43:86ae Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

6
IPs

3
Countries

176 kB
Transfer

521 kB
Size

11
Cookies

13 HTTP transactions
0 data transactions