safe.w0pt0p.online - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 198.143.165.220, located in Chicago, United States and belongs to SINGLEHOP-LLC - SingleHop LLC, US. The main domain is safe.w0pt0p.online.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 26th 2019. Valid for: 3 months.

This is the only time safe.w0pt0p.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	212.32.250.1 212.32.250.1	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	198.143.165.220 198.143.165.220	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
5	3

3 212.32.250.1 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

comnmon.chaffinchtracking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
out.tictaktrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.143.165.220 (Chicago, United States)

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: server04.com-2.mobi

safe.w0pt0p.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	chaffinchtracking.com comnmon.chaffinchtracking.com	675 B
1	w0pt0p.online safe.w0pt0p.online	2 KB
1	tictaktrack.com out.tictaktrack.com	373 B
5	3

	Domain	Requested by
2	comnmon.chaffinchtracking.com
1	safe.w0pt0p.online	safe.w0pt0p.online
1	out.tictaktrack.com
5	3

This site contains no links.

Subject Issuer	Validity	Valid
*.chaffinchtracking.com Sectigo RSA Domain Validation Secure Server CA	`2019-11-15` - `2020-11-22`	a year	crt.sh
out.tictaktrack.com Sectigo RSA Domain Validation Secure Server CA	`2019-06-17` - `2020-06-24`	a year	crt.sh
safe.w0pt0p.online Let's Encrypt Authority X3	`2019-12-26` - `2020-03-25`	3 months	crt.sh

This page contains 1 frames:

Frame: https://safe.w0pt0p.online/?utm_term=6778756349401498048&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e
Frame ID: 34D4CBB2FA132841337CF965C7715262
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://comnmon.chaffinchtracking.com/click?pid=100&offer_id=6240&sub1=981316143&sub2=100_86611 Page URL
https://comnmon.chaffinchtracking.com/click?pid=100&offer_id=6242&sub1=981316143&sub2=100_86611 Page URL
https://out.tictaktrack.com/sl?id=59ce054ca1e3c53000000001&pid=2&sub1=981316143&sub2=100&sub3=100_86611&... Page URL
https://safe.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpo... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

3 kB
Transfer

4 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://comnmon.chaffinchtracking.com/click?pid=100&offer_id=6240&sub1=981316143&sub2=100_86611 Page URL
https://comnmon.chaffinchtracking.com/click?pid=100&offer_id=6242&sub1=981316143&sub2=100_86611 Page URL
https://out.tictaktrack.com/sl?id=59ce054ca1e3c53000000001&pid=2&sub1=981316143&sub2=100&sub3=100_86611&sub4=6242&sub5=BE&sub6=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_6%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F79.0.3945.88+Safari%2F537.36 Page URL
https://safe.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=5e12faf3d96845000177a7b1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 click Show response
comnmon.chaffinchtracking.com/ 212 B
276 B 7462ms
22ms Document
text/html 212.32.250.1
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://comnmon.chaffinchtracking.com/click?pid=100&offer_id=6240&sub1=981316143&sub2=100_86611
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx /
Resource Hash: 81dc2d8788a19a0a914db8248845fd3bbb6a59ceed352663ed323eaa1eae4c77

Request headers

:method: GET
:authority: comnmon.chaffinchtracking.com
:scheme: https
:path: /click?pid=100&offer_id=6240&sub1=981316143&sub2=100_86611
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Mon, 06 Jan 2020 09:16:31 GMT
content-type: text/html; charset=utf-8
content-encoding: gzip

GET
H2 200 click Show response
comnmon.chaffinchtracking.com/ 384 B
399 B 21ms
20ms Document
text/html 212.32.250.1
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://comnmon.chaffinchtracking.com/click?pid=100&offer_id=6242&sub1=981316143&sub2=100_86611
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0b9d2e94cb8507edfe5ceaa951a83ff3b8255bff8512f7000251da0f4dc3c665

Request headers

:method: GET
:authority: comnmon.chaffinchtracking.com
:scheme: https
:path: /click?pid=100&offer_id=6242&sub1=981316143&sub2=100_86611
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 06 Jan 2020 09:16:31 GMT
content-type: text/html; charset=utf-8
content-encoding: gzip

GET
H2 200 sl Show response
out.tictaktrack.com/ 257 B
373 B 3879ms
24ms Document
text/html 212.32.250.1
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://out.tictaktrack.com/sl?id=59ce054ca1e3c53000000001&pid=2&sub1=981316143&sub2=100&sub3=100_86611&sub4=6242&sub5=BE&sub6=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_6%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F79.0.3945.88+Safari%2F537.36
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 212.32.250.1 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx /
Resource Hash: 51edc4edd2a741d30e5ba95c0826721f1d4d9d7ae9aca75490b6a6547f2b34da

Request headers

:method: GET
:authority: out.tictaktrack.com
:scheme: https
:path: /sl?id=59ce054ca1e3c53000000001&pid=2&sub1=981316143&sub2=100&sub3=100_86611&sub4=6242&sub5=BE&sub6=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_6%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F79.0.3945.88+Safari%2F537.36
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 06 Jan 2020 09:16:35 GMT
content-type: text/html; charset=utf-8
set-cookie: afclick=5e12faf3d96845000177a7b1; Expires=Tue, 05 Jan 2021 09:16:35 GMT
content-encoding: gzip

GET
H2 200 Primary Request / Show response
safe.w0pt0p.online/ 3 KB
2 KB 9071ms
117ms Document
text/html 198.143.165.220
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://safe.w0pt0p.online/?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=5e12faf3d96845000177a7b1

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

198.143.165.220 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),

Reverse DNS

server04.com-2.mobi

Software

nginx / PHP/7.3.4

Resource Hash

d300b0fcce76ded3d3888285b9c35e74f900829c55916e067d224252e3d8c1e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

:method: GET
:authority: safe.w0pt0p.online
:scheme: https
:path: /?utm_medium=87671f8c08ef26a74e7462a6173ac3de0a8f8639&utm_campaign=redirectpool&1=100&cid=5e12faf3d96845000177a7b1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 06 Jan 2020 09:16:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.4
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=68e4555acf1924f8581e0d788bbf1db6; expires=Tue, 05-Jan-2021 09:16:44 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip

GET /
safe.w0pt0p.online/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: safe.w0pt0p.online
URL: https://safe.w0pt0p.online/?utm_term=6778756349401498048&clickverify=1&utm_content=e6c2c6dcd68fd49594fc9695a6a795938a8bb8888c8f8cbdb2c6b0c4b6b78583babb88b8bcbfbc8dafb5b081b68784b49a9b98f5fff1f8eef1f2e0f4bbe7e6fc878a9a90eedeecaa8d8c878d83c7ad8b99d5f8cbcaffcec9f2f3f085848291f5cafac8f8f8fffccdf3f1f0f1c6c7c45e

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			out.tictaktrack.com/	1970-01-19 15:10:38	Name: afclick Value: 5e12faf3d96845000177a7b1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

comnmon.chaffinchtracking.com
out.tictaktrack.com
safe.w0pt0p.online
safe.w0pt0p.online
198.143.165.220
212.32.250.1
0b9d2e94cb8507edfe5ceaa951a83ff3b8255bff8512f7000251da0f4dc3c665
51edc4edd2a741d30e5ba95c0826721f1d4d9d7ae9aca75490b6a6547f2b34da
81dc2d8788a19a0a914db8248845fd3bbb6a59ceed352663ed323eaa1eae4c77
d300b0fcce76ded3d3888285b9c35e74f900829c55916e067d224252e3d8c1e9

safe.w0pt0p.online Open in urlscan Pro 198.143.165.220 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

3 kBTransfer

4 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

1 Cookies

Indicators

safe.w0pt0p.online Open in urlscan Pro
198.143.165.220 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

3 kB
Transfer

4 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions