urlscan.io logo urlscan.io
SecurityTrails logo

ca-tracking.redirectme.net Open in urlscan Pro
104.168.167.185  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://cilaran263.clickfunnels.com/optini4ein9g7
Effective URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Submission: On August 05 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 8 domains to perform 31 HTTP transactions. The main IP is 104.168.167.185, located in United States and belongs to HOSTWINDS, US. The main domain is ca-tracking.redirectme.net.
TLS certificate: Issued by R3 on August 4th 2022. Valid for: 3 months.
This is the only time ca-tracking.redirectme.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canada Post (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 8 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
3 20 104.168.167.185 54290 (HOSTWINDS)
1 2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2 2606:4700:303... 13335 (CLOUDFLAR...)
31 7
8    2606:4700::6810:10c2 (United States)

ASN13335 (CLOUDFLARENET, US)
cilaran263.clickfunnels.com
app.clickfunnels.com
images.clickfunnels.com
2    2606:4700:3032::ac43:a9f7 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
2    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700:440e::6812:2fe6 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
20    104.168.167.185 (United States)

ASN54290 (HOSTWINDS, US)
PTR: hwsrv-985960.hostwindsdns.com
ca-tracking.redirectme.net
2    2a02:26f0:3500:891::1dc5 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
www.canadapost.ca
www.canadapost-postescanada.ca
2    2606:4700:3038::6815:e9c5 (United States)

ASN13335 (CLOUDFLARENET, US)
zupimages.net
www.zupimages.net
Apex Domain
Subdomains		 Transfer
20 redirectme.net
ca-tracking.redirectme.net
122 KB
8 clickfunnels.com
cilaran263.clickfunnels.com
app.clickfunnels.com — Cisco Umbrella Rank: 29132
images.clickfunnels.com — Cisco Umbrella Rank: 76127
760 KB
2 zupimages.net
zupimages.net — Cisco Umbrella Rank: 131199
www.zupimages.net — Cisco Umbrella Rank: 147900
5 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
4 KB
2 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 951
17 KB
1 canadapost-postescanada.ca
www.canadapost-postescanada.ca — Cisco Umbrella Rank: 109355
5 KB
1 canadapost.ca
www.canadapost.ca — Cisco Umbrella Rank: 106527
301 B
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 1249
5 KB
31 8
Domain Requested by
20 ca-tracking.redirectme.net 3 redirects cilaran263.clickfunnels.com
ca-tracking.redirectme.net
5 app.clickfunnels.com cilaran263.clickfunnels.com
2 fonts.googleapis.com cilaran263.clickfunnels.com
2 use.fontawesome.com cilaran263.clickfunnels.com
2 cilaran263.clickfunnels.com 1 redirects
1 www.zupimages.net ca-tracking.redirectme.net
1 zupimages.net 1 redirects
1 www.canadapost-postescanada.ca ca-tracking.redirectme.net
1 www.canadapost.ca 1 redirects
1 static.cloudflareinsights.com cilaran263.clickfunnels.com
1 images.clickfunnels.com cilaran263.clickfunnels.com
31 11

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-07-23 -
2023-07-23		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
ca-tracking.redirectme.net
R3		 2022-08-04 -
2022-11-02		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Frame ID: D26A188657E657237A6F7C2FA00A8E23
Requests: 20 HTTP requests in this frame

Frame: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Frame ID: D564D2A34C5A3A65D80E029280B473EC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Facturation en ligne

Page URL History Show full URLs

  1. http://cilaran263.clickfunnels.com/optini4ein9g7 HTTP 302
    https://cilaran263.clickfunnels.com/optin1659641567962 Page URL
  2. https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD HTTP 301
    https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/ HTTP 302
    https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/6... HTTP 301
    https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/6... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

31
Requests

94 %
HTTPS

86 %
IPv6

8
Domains

11
Subdomains

7
IPs

2
Countries

914 kB
Transfer

3316 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cilaran263.clickfunnels.com/optini4ein9g7 HTTP 302
    https://cilaran263.clickfunnels.com/optin1659641567962 Page URL
  2. https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD HTTP 301
    https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/ HTTP 302
    https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb HTTP 301
    https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://cilaran263.clickfunnels.com/optini4ein9g7 HTTP 302
  • https://cilaran263.clickfunnels.com/optin1659641567962
Request Chain 15
  • https://www.canadapost.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg HTTP 301
  • https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
Request Chain 28
  • https://zupimages.net/up/20/38/e429.png HTTP 301
  • https://www.zupimages.net/up/20/38/e429.png

31 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
optin1659641567962
cilaran263.clickfunnels.com/
Redirect Chain
  • http://cilaran263.clickfunnels.com/optini4ein9g7
  • https://cilaran263.clickfunnels.com/optin1659641567962
62 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Phusion Passenger Enterprise 6.0.7
Resource Hash
7546b97e735c1c0a805e9480f152882723bfaac6db773f80b7b92e3ca71c348f
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin
*
cache-control
max-age=60, public, s-maxage=600, r-maxage=10
cf-cache-status
REVALIDATED
cf-ray
7360ba801edb690a-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 05 Aug 2022 15:57:26 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified
Thu, 04 Aug 2022 22:28:26 GMT
server
cloudflare
status
200 OK
strict-transport-security
max-age=0
vary
Accept-Encoding
x-content-digest
85fef90244cd0d7e2ee696199ffeb87df9030118
x-frame-options
ALLOWALL
x-powered-by
Phusion Passenger Enterprise 6.0.7
x-rack-cache
fresh
x-request-id
110644914ecbe7ebe118e2575f00b83c
x-runtime
0.365507

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Access-Control-Allow-Methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Origin
*
CF-Cache-Status
MISS
CF-Ray
7360ba7dea0d910a-FRA
Cache-Control
no-cache
Connection
keep-alive
Content-Security-Policy-Report-Only
script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=mvA_KFYtfiHHv0L6aCLcfPV3ejn0ERZVjrXwhJCGvj0-1659715046-0-AXxti4YCFChFCw4NDIXJ4qfYA_W-FlBoIcK8v0KcKCneT2rggbNX8NyQRKUXRSB0eGCYrtfllYzEg_2MOvcb5YmaL7YqYt8WzxIq9zvXVAAJ; report-to cf-csp-endpoint
Content-Type
text/html; charset=utf-8
Date
Fri, 05 Aug 2022 15:57:26 GMT
Location
https://cilaran263.clickfunnels.com/optin1659641567962
Report-To
{"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=mvA_KFYtfiHHv0L6aCLcfPV3ejn0ERZVjrXwhJCGvj0-1659715046-0-AXxti4YCFChFCw4NDIXJ4qfYA_W-FlBoIcK8v0KcKCneT2rggbNX8NyQRKUXRSB0eGCYrtfllYzEg_2MOvcb5YmaL7YqYt8WzxIq9zvXVAAJ"}],"group":"cf-csp-endpoint","max_age":86400}
Server
cloudflare
Status
302 Found
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Frame-Options
ALLOWALL
X-Powered-By
Phusion Passenger Enterprise 6.0.7
X-Rack-Cache
miss
X-Request-Id
66c9d602799282ca680528551dd1f8bd
X-Runtime
0.084284
lander.css
app.clickfunnels.com/assets/ 		425 KB
70 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/assets/lander.css
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
944
last-modified
Tue, 02 Aug 2022 17:16:19 GMT
server
cloudflare
etag
W/"62e95be3-6a514"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
7360ba815884690a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 05 Aug 2022 16:17:26 GMT
all.css
use.fontawesome.com/releases/v5.9.0/css/ 		55 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:a9f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
16603138
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
R6NH4GJ7K569R50W
x-amz-id-2
UMzeQ4xVVEzkt+nMXUeDEUQvy+wpjX5qBC4xjuMDX2OaDkyj9B0Hmp1pqTpRuUYIak+jxrdXODQ=
last-modified
Wed, 30 Jun 2021 15:48:06 GMT
server
cloudflare
etag
W/"dbf9d822cefe851ba6f66e1ad57e8987"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0XOa1N9iKD%2FBb1kTorvxD24Drkuit3DJoYfA%2BbJ90W77ltkCS9ayeed0agD3a59yGR64iwcwW7YJKmS2VfI%2FzAk0BtIyckvGOgfJlS6RT%2FeCRhZ8CmrprL1XYl0i3NtIrXahFk9PtjV%2FCOxMAtH5hgwP"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
7360ba819fcf9250-FRA
v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ 		26 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:a9f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
16603043
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
RB5BPRT48JBAE6TP
x-amz-id-2
gCI0BCd4N0Ze41wUUC9fQ5XlRt+jkrB7evHnqcM8HM5N2U+Yr/0Hi6JfxMBuYiohKnNmeTq+oho=
last-modified
Wed, 30 Jun 2021 15:48:06 GMT
server
cloudflare
etag
W/"e140a7d32f343530f016095df3cc2ae4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6nre5%2BgqCbgjHPaRE6jNshk97M2eH%2FFjp6a6kaAHPzPlCJ808lJ1FIpSQtgbleNjPk9Pm9V5oyt3PNYy%2B4dy1lsxVpdhBLWi2cTcv%2F4KPWUGZba1CQOqb7%2BUaJoEH1G1wSv5Gnx%2BW5we1KuUwCyg9k4A"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
7360ba819fd39250-FRA
css
fonts.googleapis.com/ 		45 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
84b5e4a70a3e74c3de277df4d596bb8a8b75ae07c5c731a1287d97b7c17a7dc1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 05 Aug 2022 14:58:27 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 05 Aug 2022 15:57:26 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 05 Aug 2022 15:57:26 GMT
application.js
app.clickfunnels.com/assets/userevents/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/assets/userevents/application.js
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
729
last-modified
Tue, 02 Aug 2022 17:16:19 GMT
server
cloudflare
etag
W/"62e95be3-1353"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
7360ba82093e690a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 05 Aug 2022 16:17:26 GMT
css
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Montserrat%7Csans-serif%7CMontserrat%7Csans-serif%7CMontserrat%7Csans-serif%7C%7C
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 05 Aug 2022 15:57:26 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 05 Aug 2022 15:57:26 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 05 Aug 2022 15:57:26 GMT
lander.js
app.clickfunnels.com/assets/ 		2 MB
661 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/assets/lander.js
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
952
last-modified
Tue, 02 Aug 2022 17:17:20 GMT
server
cloudflare
etag
W/"62e95c20-238c65"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
7360ba815885690a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 05 Aug 2022 16:17:26 GMT
ClickfunnelsTag.png
images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
cf-cache-status
HIT
age
3679
cf-polished
origFmt=png, origSize=9030
cf-ray
7360ba8269d3690a-FRA
last-modified
Fri, 03 Jan 2020 17:41:49 GMT
content-disposition
inline; filename="ClickfunnelsTag.webp"
content-length
5276
x-amz-id-2
CaWGn92VYCL4bs/hP/zUWPCv6Gp16O/tEl3q1lahH2HHkXUpOVA0pPTmEbPMjdx9yHUJz+Sb5MM=
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"a633777156a5ffeb58c92d3d59fa4e34"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
x-amz-request-id
CMZ99TVJN368Y43Z
cache-control
public, max-age=2073600
accept-ranges
bytes
content-type
image/webp
expires
Mon, 29 Aug 2022 15:57:26 GMT
mailcheck.min.js
app.clickfunnels.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/mailcheck.min.js
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
5841
content-security-policy-report-only
script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=4vtL6SyKeB7xW_jCbyUKBQcM0xXEZnr.9ULwRXzJZC8-1659715046-0-Aa-UpgFpF25gT9wJYH8RRo5H99Y189RIbGvOcUClJYf-O_sShOcpOd5rWmUPr1uVE4xSewgZw-7nRO1wLpOF-O16xoWv6M8TN3CFJ3POq6z5; report-to cf-csp-endpoint
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
last-modified
Tue, 02 Aug 2022 17:16:19 GMT
server
cloudflare
etag
W/"62e95be3-a8d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=4vtL6SyKeB7xW_jCbyUKBQcM0xXEZnr.9ULwRXzJZC8-1659715046-0-Aa-UpgFpF25gT9wJYH8RRo5H99Y189RIbGvOcUClJYf-O_sShOcpOd5rWmUPr1uVE4xSewgZw-7nRO1wLpOF-O16xoWv6M8TN3CFJ3POq6z5"}],"group":"cf-csp-endpoint","max_age":86400}
content-type
application/x-javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
7360ba82aa32690a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
pushcrew.js
app.clickfunnels.com/assets/ 		637 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.clickfunnels.com/assets/pushcrew.js
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cilaran263.clickfunnels.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
851
content-security-policy-report-only
script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=NciJJ_p5Bef7hVrXewefJdlzU.l4rFPt.pt7oEK0eHg-1659715046-0-AcY77I6-MG8ARJjFbDgJN-schWpt5Kc0I_HT3FQoZ8SR8ZuQ8Lr7WhmMIyEONHW6mLOTtBdqJK0V-QBAge4jG-Rm5kktdtZG6X-eI9IxCAHq; report-to cf-csp-endpoint
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
last-modified
Tue, 02 Aug 2022 17:16:18 GMT
server
cloudflare
etag
W/"62e95be2-27d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0
report-to
{"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=NciJJ_p5Bef7hVrXewefJdlzU.l4rFPt.pt7oEK0eHg-1659715046-0-AcY77I6-MG8ARJjFbDgJN-schWpt5Kc0I_HT3FQoZ8SR8ZuQ8Lr7WhmMIyEONHW6mLOTtBdqJK0V-QBAge4jG-Rm5kktdtZG6X-eI9IxCAHq"}],"group":"cf-csp-endpoint","max_age":86400}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
7360ba82eaa2690a-FRA
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 05 Aug 2022 16:17:26 GMT
v652eace1692a40cfa3763df669d7439c1639079717194
static.cloudflareinsights.com/beacon.min.js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://cilaran263.clickfunnels.com/
Origin
https://cilaran263.clickfunnels.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:26 GMT
content-encoding
gzip
last-modified
Thu, 09 Dec 2021 19:55:17 GMT
server
cloudflare
etag
W/2021.12.0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
7360ba837b589018-FRA
Primary Request /
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Redirect Chain
  • https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD
  • https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/
  • https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb
  • https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Requested by
Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
0ddc5d3fc9c5b0bdfead804f08815333fec10366c095258c33399f807d382b0e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://cilaran263.clickfunnels.com/optin1659641567962
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Fri, 05 Aug 2022 15:57:28 GMT
etag
W/"62ed3de8-884"
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

content-length
162
content-type
text/html
date
Fri, 05 Aug 2022 15:57:28 GMT
location
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
server
nginx
strict-transport-security
max-age=31536000
bootstrap.min.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/ 		107 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/bootstrap.min.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:28 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-1abce"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:28 GMT
desktop.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/ 		10 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/desktop.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:28 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-28aa"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:28 GMT
pubup.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ 		3 KB
777 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/pubup.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
f99f5e80bb4c60e94c0e572536bb8416e40730e50bc31ff6af974742b1078429
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:28 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-d08"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:28 GMT
cpc-main-logo.svg
www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/
Redirect Chain
  • https://www.canadapost.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
  • https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
12 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
HTTP/1.1
Server
2a02:26f0:3500:891::1dc5 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Security-Policy
frame-ancestors 'self'
Content-Encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
p3p
CP="NON CUR OTPi OUR NOR UNI"
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
3967
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
Last-Modified
Mon, 15 May 2017 20:24:36 GMT
x-frame-options
SAMEORIGIN
Date
Fri, 05 Aug 2022 15:57:29 GMT
strict-transport-security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubdomains; preload
Content-Type
image/svg+xml
Cache-Control
max-age=86400, private
ETag
"591a0e84-3037"
Accept-Ranges
bytes
Expires
Mon, 22 Mar 2021 13:03:07 GMT

Redirect headers

Location
https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
Date
Fri, 05 Aug 2022 15:57:28 GMT
Server
AkamaiGHost
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=31536000; includeSubdomains; preload
ifram.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ 		807 B
1010 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ifram.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:28 GMT
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
"62ed3de8-327"
strict-transport-security
max-age=31536000
content-type
text/css
cache-control
max-age=43200
accept-ranges
bytes
content-length
807
expires
Sat, 06 Aug 2022 03:57:28 GMT
2020-08-18_151724.png
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/images/ 		335 B
540 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/images/2020-08-18_151724.png
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
dd7f24bcd34389ae222dabca96a9afdc2727212c5f42a6dd88ea2df60aae2d06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:28 GMT
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
"62ed3de8-14f"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
335
expires
Sun, 04 Sep 2022 15:57:28 GMT
Open_Sans.woff
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/Open_Sans.woff
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/desktop.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/desktop.css
Origin
https://ca-tracking.redirectme.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
server
nginx
content-length
548
content-type
text/html
sandokhan.html
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ Frame D564 		20 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
d58f2738b979cb35922c8d9e356a0414417a3b3cace4638294fb0611f247cff4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Fri, 05 Aug 2022 15:57:29 GMT
etag
W/"62ed3de8-5192"
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
cvv.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ Frame D564 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/cvv.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
server
nginx
content-length
548
content-type
text/html
index.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ Frame D564 		11 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/index.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
2a65f408fa9e249c423ee1c9c5398a1253030f2912dc8d0f009eb3ade2e80ca8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-2bb1"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:29 GMT
jquery-3.1.1.slim.min.js
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/js/ Frame D564 		95 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/js/jquery-3.1.1.slim.min.js
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-17d82"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:29 GMT
jquery-1.9.1.min.js
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/js/ Frame D564 		87 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/js/jquery-1.9.1.min.js
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-15db7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:29 GMT
jquery-confirm.min.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/css/ Frame D564 		23 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/css/jquery-confirm.min.css
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-5df6"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:29 GMT
jquery-confirm.min.js
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/js/ Frame D564 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/tpl-v17/js/jquery-confirm.min.js
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
W/"62ed3de8-5373"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
strict-transport-security
max-age=31536000
expires
Sat, 06 Aug 2022 03:57:29 GMT
img0001.png
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/images/ Frame D564 		476 B
681 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/images/img0001.png
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
"62ed3de8-1dc"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
476
expires
Sun, 04 Sep 2022 15:57:29 GMT
img0002.png
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/images/ Frame D564 		476 B
681 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/images/img0002.png
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
last-modified
Fri, 05 Aug 2022 15:57:28 GMT
server
nginx
etag
"62ed3de8-1dc"
strict-transport-security
max-age=31536000
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
476
expires
Sun, 04 Sep 2022 15:57:29 GMT
e429.png
www.zupimages.net/up/20/38/ Frame D564
Redirect Chain
  • https://zupimages.net/up/20/38/e429.png
  • https://www.zupimages.net/up/20/38/e429.png
4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zupimages.net/up/20/38/e429.png
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Server
2606:4700:3038::6815:e9c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9c28fdd41dc48085360a73964739895c453d4b32314f236fed3c4370ec0ce8a
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
cf-cache-status
EXPIRED
last-modified
Fri, 05 Aug 2022 12:16:58 GMT
server
cloudflare
date
Fri, 05 Aug 2022 15:57:29 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3j2jH9MaN0BH7TI8tElxfd5StTjwFQZFPPWJyJ9wDgfs4TAk2wx3HlUthG9aeQrkJM8HQFtnk1CDLhy7aB6T3xdxm5fYeEkVjHfZOgUVS4N4VWonjSN1USfbjAlXe35pYCKBo1F95oAW7PKuJFxj0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2678400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-disposition
filename="e429.png"
cf-ray
7360ba921bab9a09-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block

Redirect headers

date
Fri, 05 Aug 2022 15:57:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ltarv83av75lzkYpwuxrQL2ewT4fcJ9mcIegU7x7%2FD1Fx1NYhsEaitn%2BUAi1VGyaAeSuaJbMcYwq4OXyB76PAHStEuNoVw%2F%2FBVvnaqWzM5ToXEw80JDLH1XTFoDkJ5blOP7oWvph95uSOTD8"}],"group":"cf-nel","max_age":604800}
location
https://www.zupimages.net/up/20/38/e429.png
cache-control
max-age=3600
cf-ray
7360ba91db399a09-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Fri, 05 Aug 2022 16:57:29 GMT
jquery-3.1.1.slim.min.js
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/js/ Frame D564 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/js/jquery-3.1.1.slim.min.js
Requested by
Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-985960.hostwindsdns.com
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/sandokhan.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 15:57:29 GMT
server
nginx
content-length
548
content-type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canada Post (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Domain/Path Name / Value
.clickfunnels.com/ Name: __cf_bm
Value: LagMDltjo7QDh8ixRcyZHSbaTWpmi6P.lFryormIpJ4-1659715046-0-AaMQV0imWT8w0ZWPrH+zvyiIIFBF251hS6aCuWesyL2lJCkG7jnpOoNYUJOJmE5RXu/YThtWlz5+iiznRZsl2hckBFZEk+rFKmBTjCTfhVir

3 Console Messages

Source Level URL
Text
network error URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/ekos/Open_Sans.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/cvv.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/63acb/js/jquery-3.1.1.slim.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Frame-Options ALLOWALL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.clickfunnels.com
ca-tracking.redirectme.net
cilaran263.clickfunnels.com
fonts.googleapis.com
images.clickfunnels.com
static.cloudflareinsights.com
use.fontawesome.com
www.canadapost-postescanada.ca
www.canadapost.ca
www.zupimages.net
zupimages.net
104.168.167.185
2606:4700:3032::ac43:a9f7
2606:4700:3038::6815:e9c5
2606:4700:440e::6812:2fe6
2606:4700::6810:10c2
2a00:1450:4001:812::200a
2a02:26f0:3500:891::1dc5
024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d
0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8
0ddc5d3fc9c5b0bdfead804f08815333fec10366c095258c33399f807d382b0e
2a65f408fa9e249c423ee1c9c5398a1253030f2912dc8d0f009eb3ade2e80ca8
4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c
736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81
7546b97e735c1c0a805e9480f152882723bfaac6db773f80b7b92e3ca71c348f
84b5e4a70a3e74c3de277df4d596bb8a8b75ae07c5c731a1287d97b7c17a7dc1
93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75
a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb
aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08
b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732
c9c28fdd41dc48085360a73964739895c453d4b32314f236fed3c4370ec0ce8a
d58f2738b979cb35922c8d9e356a0414417a3b3cace4638294fb0611f247cff4
dd7f24bcd34389ae222dabca96a9afdc2727212c5f42a6dd88ea2df60aae2d06
e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87
f99f5e80bb4c60e94c0e572536bb8416e40730e50bc31ff6af974742b1078429