Submitted URL: https://glstrck.com/aff_c?offer_id=680&aff_id=15793
Effective URL: https://nextstephire.net/qr.php
Submission: On November 04 via manual from VN — Scanned from NL

Summary

This website contacted 4 IPs in 4 countries across 6 domains to perform 7 HTTP transactions. The main IP is 172.67.134.174, located in United States and belongs to CLOUDFLARENET, US. The main domain is nextstephire.net.
TLS certificate: Issued by WE1 on October 26th 2024. Valid for: 3 months.
This is the only time nextstephire.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 188.114.97.3 13335 (CLOUDFLAR...)
2 2 18.202.12.61 16509 (AMAZON-02)
3 172.67.134.174 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 159.69.246.187 24940 (HETZNER-AS)
2 2001:4860:480... 15169 (GOOGLE)
7 4
Apex Domain
Subdomains
Transfer
3 nextstephire.net
nextstephire.net
7 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3643
2 go2cloud.org
glitchy.go2cloud.org — Cisco Umbrella Rank: 534550
2 KB
1 qrserver.com
api.qrserver.com — Cisco Umbrella Rank: 51637
610 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
107 KB
1 glstrck.com
glstrck.com
620 B
7 6
Domain Requested by
3 nextstephire.net nextstephire.net
2 region1.google-analytics.com www.googletagmanager.com
2 glitchy.go2cloud.org 2 redirects
1 api.qrserver.com nextstephire.net
1 www.googletagmanager.com nextstephire.net
1 glstrck.com 1 redirects
7 6

This site contains no links.

Subject Issuer Validity Valid
nextstephire.net
WE1
2024-10-26 -
2025-01-24
3 months crt.sh
*.google-analytics.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
*.qrserver.com
R11
2024-10-07 -
2025-01-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nextstephire.net/qr.php
Frame ID: 8AA908A7F5A96B937AA0839288A80309
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

QRCode

Page URL History Show full URLs

  1. https://glstrck.com/aff_c?offer_id=680&aff_id=15793 HTTP 302
    https://glitchy.go2cloud.org/aff_c?offer_id=680&aff_id=15793 HTTP 302
    https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=15793&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D... HTTP 302
    https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4 Page URL
  2. https://nextstephire.net/qr.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

4
IPs

4
Countries

115 kB
Transfer

343 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://glstrck.com/aff_c?offer_id=680&aff_id=15793 HTTP 302
    https://glitchy.go2cloud.org/aff_c?offer_id=680&aff_id=15793 HTTP 302
    https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=15793&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c939e366cb9e51d87feeb0bece4&urlauth=544884355369360641696294416512 HTTP 302
    https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4 Page URL
  2. https://nextstephire.net/qr.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://glstrck.com/aff_c?offer_id=680&aff_id=15793 HTTP 302
  • https://glitchy.go2cloud.org/aff_c?offer_id=680&aff_id=15793 HTTP 302
  • https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=15793&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c939e366cb9e51d87feeb0bece4&urlauth=544884355369360641696294416512 HTTP 302
  • https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
nextstephire.net/
Redirect Chain
  • https://glstrck.com/aff_c?offer_id=680&aff_id=15793
  • https://glitchy.go2cloud.org/aff_c?offer_id=680&aff_id=15793
  • https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=15793&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c939e366cb9e51d87feeb0bece4&urlauth=5448843553...
  • https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4
18 KB
4 KB
Document
General
Full URL
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.134.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8dd682534a6e0b67-AMS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Mon, 04 Nov 2024 18:01:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wVyVG436pZvRqXgVcdy7PT6b%2FzsSii6SE8k%2BxPrcFyABQv9LHR1LGg1sDps%2Bs%2FIbpTUexHMvlMR42i9E58%2FpBtzdgIwDX6OrH4LQ3WKiR7C13OqIhm%2BceujRN%2BgAohYm9k9o"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=15524&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4140&recv_bytes=4531&delivery_rate=662&cwnd=12000&unsent_bytes=0&cid=eef54153329af965&ts=813&x=1" cfHdrFlush;dur=0
vary
Accept-Encoding

Redirect headers

Accept-Ch
Sec-Ch-Dpr, Dpr, Sec-Ch-Ua-Model
Access-Control-Allow-Headers
Tune-SDK-Version
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
285
Content-Type
text/html; charset=iso-8859-1
Date
Mon, 04 Nov 2024 18:01:23 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Location
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4
Pragma
no-cache
Server
nginx
X-Request-Id
7c63dce46fa08b483eb800268c0463ca
Primary Request qr.php
nextstephire.net/
1 KB
1 KB
Document
General
Full URL
https://nextstephire.net/qr.php
Requested by
Host: nextstephire.net
URL: https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.134.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41d2b57b5c1020c2d39f04e5399436abac29d7a8460113ba6ab0d7b9394cfd87

Request headers

Referer
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c939e366cb9e51d87feeb0bece4
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8dd68258ae690b67-AMS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Mon, 04 Nov 2024 18:01:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mjEWwZ9%2F6mhXOumVCm3qXLkEm3Z52koPNbNZoMJmi3wxRFzF8Sasd6HzvYZZk1EIVNQKItiwfXUzNrLk6eVdRyX6dZqhG4TNbnd9ENw2oxmhBQ3hIZpTn6Ul%2Fz8oDP9jWyJJ"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=15452&sent=16&recv=13&lost=0&retrans=0&sent_bytes=8158&recv_bytes=5091&delivery_rate=262750&cwnd=12000&unsent_bytes=0&cid=eef54153329af965&ts=911&x=1" cfHdrFlush;dur=0
vary
Accept-Encoding
js
www.googletagmanager.com/gtag/
321 KB
107 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Requested by
Host: nextstephire.net
URL: https://nextstephire.net/qr.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
96f39e548932f95526e1a58e771d9e10b3331ea1b888919bd164b1cef715de31
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Mon, 04 Nov 2024 18:01:24 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 04 Nov 2024 18:01:24 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
108963
x-xss-protection
0
server
Google Tag Manager
/
api.qrserver.com/v1/create-qr-code/
345 B
610 B
Image
General
Full URL
https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=https://nextstephire.net/?QR
Requested by
Host: nextstephire.net
URL: https://nextstephire.net/qr.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.69.246.187 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.187.246.69.159.clients.your-server.de
Software
nginx /
Resource Hash
479fc4ed986206329b6c79b573d035421e88f08328c079dc73daf8c7596dae46

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

access-control-allow-headers
Accept, Accept-Language, Content-Language, Content-Type, Origin, Authorization, X-Requested-With, Client-Security-Token
access-control-max-age
7200
access-control-allow-origin
*
date
Mon, 04 Nov 2024 18:01:24 GMT
content-type
image/png
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PUT
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4au0v9188976620za200&_p=1730743284721&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101878899~101878944~101925629&cid=1282800723.1730743285&ul=nl-nl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1730743284&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c939e366cb9e51d87feeb0bece4&dt=QRCode&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=408
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://nextstephire.net
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 04 Nov 2024 18:01:25 GMT
content-type
text/plain
server
Golfe2
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4au0v9188976620za200&_p=1730743284721&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101823848~101878899~101878944~101925629&cid=1282800723.1730743285&ul=nl-nl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1730743284&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c939e366cb9e51d87feeb0bece4&dt=QRCode&en=QRTest&_ee=1&_et=7&tfd=428
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://nextstephire.net
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 04 Nov 2024 18:01:25 GMT
content-type
text/plain
server
Golfe2
favicon.ico
nextstephire.net/
3 KB
2 KB
Other
General
Full URL
https://nextstephire.net/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.134.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://nextstephire.net/qr.php

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SZAUKyjZmUEc3a4yJlDGp4AapNLNk1PDzU%2FVoX5QRStx%2BfoVAEda04Ofu0SNjh3h7wtVZIZUBcd2TBOKacm3DqvVAVLpo8Yhg%2BbsEFtTP4JTYEHbKWLOTob3M1dpYjHl%2FpxA"}],"group":"cf-nel","max_age":604800}
cf-ray
8dd6825b58170b67-AMS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=15480&sent=19&recv=15&lost=0&retrans=0&sent_bytes=9600&recv_bytes=5582&delivery_rate=33555&cwnd=12000&unsent_bytes=0&cid=eef54153329af965&ts=1368&x=1", cfHdrFlush;dur=0
date
Mon, 04 Nov 2024 18:01:25 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
last-modified
Mon, 26 Aug 2024 11:32:37 GMT

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal

5 Cookies

Domain/Path Name / Value
glitchy.go2cloud.org/ Name: enc_aff_session_407
Value: ENC03d990b5534c92899edb5b2b5dadf0a807dfb106b2017cbcf9bb6dc286a1cb76050e4796a3b2c007f37bf11ca6732fcb6daa586a04745cf7869baada5b126fca3c745b2b5fad85268bd7001162e5a39dd4f4c795f0d5e094bd8d19e220057dc23b18510eab8c91ff124b1b668de86f9c0dd8f8890deeaa3a9eb07c8d8d76c97f5c0afd9d5e
glitchy.go2cloud.org/ Name: ho_mob
Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMzAiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTMwLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJubC1OTCxubDtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==
nextstephire.net/ Name: o
Value: f949fd5cdfb3dd6e5a7333c9ee4f1570c47a3059
.nextstephire.net/ Name: _ga
Value: GA1.1.1282800723.1730743285
.nextstephire.net/ Name: _ga_QG5EZY4729
Value: GS1.1.1730743284.1.0.1730743284.0.0.0

1 Console Messages

Source Level URL
Text
network error URL: https://nextstephire.net/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()