Submitted URL: https://glstrck.com/aff_c?offer_id=1304&aff_id=42176&source=julie
Effective URL: https://nextstephire.net/qr.php
Submission: On December 30 via manual from US — Scanned from NL

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3032::6815:19d2, located in United States and belongs to CLOUDFLARENET, US. The main domain is nextstephire.net.
TLS certificate: Issued by WE1 on December 24th 2024. Valid for: 3 months.
This is the only time nextstephire.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 188.114.97.3 13335 (CLOUDFLAR...)
2 2 18.202.12.61 16509 (AMAZON-02)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 159.69.246.187 24940 (HETZNER-A...)
2 2001:4860:480... 15169 (GOOGLE)
1 172.67.134.174 13335 (CLOUDFLAR...)
7 5
Apex Domain
Subdomains
Transfer
3 nextstephire.net
nextstephire.net
7 KB
2 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3353
2 go2cloud.org
glitchy.go2cloud.org — Cisco Umbrella Rank: 665802
2 KB
1 qrserver.com
api.qrserver.com — Cisco Umbrella Rank: 52328
771 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
108 KB
1 glstrck.com
glstrck.com — Cisco Umbrella Rank: 736292
681 B
7 6
Domain Requested by
3 nextstephire.net nextstephire.net
2 region1.google-analytics.com www.googletagmanager.com
2 glitchy.go2cloud.org 2 redirects
1 api.qrserver.com nextstephire.net
1 www.googletagmanager.com nextstephire.net
1 glstrck.com 1 redirects
7 6

This site contains no links.

Subject Issuer Validity Valid
nextstephire.net
WE1
2024-12-24 -
2025-03-24
3 months crt.sh
*.google-analytics.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
*.qrserver.com
R11
2024-12-06 -
2025-03-06
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nextstephire.net/qr.php
Frame ID: A6BA0F1E7C969B4D42F6191CF1E29042
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

QRCode

Page URL History Show full URLs

  1. https://glstrck.com/aff_c?offer_id=1304&aff_id=42176&source=julie HTTP 302
    https://glitchy.go2cloud.org/aff_c?offer_id=1304&aff_id=42176&source=julie HTTP 302
    https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=42176&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D... HTTP 302
    https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab Page URL
  2. https://nextstephire.net/qr.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

7
Requests

100 %
HTTPS

43 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

116 kB
Transfer

346 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://glstrck.com/aff_c?offer_id=1304&aff_id=42176&source=julie HTTP 302
    https://glitchy.go2cloud.org/aff_c?offer_id=1304&aff_id=42176&source=julie HTTP 302
    https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=42176&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D1024b4717916baddc1f8690684b2ab&urlauth=743173244230331471774737948849 HTTP 302
    https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab Page URL
  2. https://nextstephire.net/qr.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://glstrck.com/aff_c?offer_id=1304&aff_id=42176&source=julie HTTP 302
  • https://glitchy.go2cloud.org/aff_c?offer_id=1304&aff_id=42176&source=julie HTTP 302
  • https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=42176&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D1024b4717916baddc1f8690684b2ab&urlauth=743173244230331471774737948849 HTTP 302
  • https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
nextstephire.net/
Redirect Chain
  • https://glstrck.com/aff_c?offer_id=1304&aff_id=42176&source=julie
  • https://glitchy.go2cloud.org/aff_c?offer_id=1304&aff_id=42176&source=julie
  • https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=42176&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D1024b4717916baddc1f8690684b2ab&urlauth=7431732442...
  • https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab
18 KB
4 KB
Document
General
Full URL
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:19d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b565a5a6316497b1e36244e19f020765fcaf7dbb0965e3c9ab6285edb79188c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f9f360a1b1b9fba-AMS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Mon, 30 Dec 2024 04:15:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K4BFEuqbUKNVBSb97U7FXkUhPqqowxUe9VjcSxUw2NkNXdi9FbqYhh8hBECDt7yZeHsk%2ByOsJmetbZ7DCibGOJ9GEpHJUiD%2FgeY8xnEeIq3KxgDkSzgI%2BBvEL5XEtIfnk5eAE0WY8SzNLjwY08k7"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=22694&min_rtt=15828&rtt_var=12818&sent=7&recv=12&lost=0&retrans=0&sent_bytes=4379&recv_bytes=2397&delivery_rate=208308&cwnd=254&unsent_bytes=0&cid=4229aa245e150fda&ts=835&x=0"
vary
Accept-Encoding

Redirect headers

Accept-Ch
Sec-Ch-Dpr, Dpr, Sec-Ch-Ua-Model
Access-Control-Allow-Headers
Tune-SDK-Version
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
285
Content-Type
text/html; charset=iso-8859-1
Date
Mon, 30 Dec 2024 04:15:51 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Location
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab
Pragma
no-cache
Server
nginx
X-Request-Id
e053d991a247516dd0f8caef851b0caa
Primary Request qr.php
nextstephire.net/
2 KB
1 KB
Document
General
Full URL
https://nextstephire.net/qr.php
Requested by
Host: nextstephire.net
URL: https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:19d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3f0899ae72eb7bba19926de5507fea1c9ca1bdc99a15f4072c1f7628f48c7d6

Request headers

Referer
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=1024b4717916baddc1f8690684b2ab
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f9f360f6ed49fba-AMS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Mon, 30 Dec 2024 04:15:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JK9tBtNnrRd08ZMqtBtAkZTOOXtMn4422g4%2FLM5pMEmvLa9%2BE1sebMDIapUoMJR6J2XEuLDOQ4wA8b%2BNdEz%2FLIbVV0856kP9qWhWmjBwCn%2Fj4TdTEE0fIV2EZggQhyNKOVZveBnPMroJZ8ai1c%2Bd"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=19240&min_rtt=15543&rtt_var=6946&sent=12&recv=18&lost=0&retrans=0&sent_bytes=8432&recv_bytes=2560&delivery_rate=413584&cwnd=257&unsent_bytes=0&cid=4229aa245e150fda&ts=897&x=0"
vary
Accept-Encoding
js
www.googletagmanager.com/gtag/
323 KB
108 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Requested by
Host: nextstephire.net
URL: https://nextstephire.net/qr.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e930994b1ff46a394125c022dfc2dd45d8163834b645e9441b46514b5843e60d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Mon, 30 Dec 2024 04:15:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 04:15:52 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
109842
x-xss-protection
0
server
Google Tag Manager
/
api.qrserver.com/v1/create-qr-code/
506 B
771 B
Image
General
Full URL
https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=https://captcha.club/f192a05fdadf40792c8a47cc5822b282d49b12ed
Requested by
Host: nextstephire.net
URL: https://nextstephire.net/qr.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.69.246.187 Nuremberg, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS
static.187.246.69.159.clients.your-server.de
Software
nginx /
Resource Hash
5836edf9a31807e3a0db2f4ff61cd242c3b3fbc72ae141f6f62ebc69d6733350

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

access-control-allow-headers
Accept, Accept-Language, Content-Language, Content-Type, Origin, Authorization, X-Requested-With, Client-Security-Token
access-control-max-age
7200
access-control-allow-origin
*
date
Mon, 30 Dec 2024 04:15:52 GMT
content-type
image/png
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PUT
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4cc1v9188976620za200&_p=1735532152266&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509156~101925629~102067555~102067808~102081485~102198178&cid=918785915.1735532152&ul=nl-nl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1735532152&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D1024b4717916baddc1f8690684b2ab&dt=QRCode&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=237
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://nextstephire.net
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 04:15:52 GMT
content-type
text/plain
server
Golfe2
collect
region1.google-analytics.com/g/
0
0
Fetch
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4cc1v9188976620za200&_p=1735532152266&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509156~101925629~102067555~102067808~102081485~102198178&cid=918785915.1735532152&ul=nl-nl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1735532152&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fqr.php&dr=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D1024b4717916baddc1f8690684b2ab&dt=QRCode&en=QRTest&_ee=1&_et=2&tfd=244
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nextstephire.net/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://nextstephire.net
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 30 Dec 2024 04:15:52 GMT
content-type
text/plain
server
Golfe2
favicon.ico
nextstephire.net/
3 KB
2 KB
Other
General
Full URL
https://nextstephire.net/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.134.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nextstephire.net/qr.php

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9VmGhuTbCz%2FviePtEob3FMzxvFZxfQ0wU0CTwylEWqC3X2hafONRrrpvgpXX4kP8JwqtjrqGuK4uozwuaBH3e3sV9iRF%2FuyW2HW4RUJ91Xo%2BaNt%2BiELMBpd6FX7KBVOx4v3s"}],"group":"cf-nel","max_age":604800}
cf-ray
8f9f3610ead09711-AMS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=17241&min_rtt=16705&rtt_var=3156&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4264&recv_bytes=4547&delivery_rate=648&cwnd=12000&unsent_bytes=0&cid=76b54c9105d74203&ts=290&x=1", cfExtPri, cfHdrFlush;dur=0
date
Mon, 30 Dec 2024 04:15:52 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
server
cloudflare
last-modified
Mon, 26 Aug 2024 11:32:37 GMT
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal

5 Cookies

Domain/Path Name / Value
glitchy.go2cloud.org/ Name: enc_aff_session_407
Value: ENC038f911d8831df3b342f598c990bc41f02fd388c7bbedd3804d34c0bac8b9f9346a95c5945769b6ea01b6664f62c3649e288fd52f0d7f85273bc36f6e2e310c38bb25ab8a3f2684eaf98cc5a3c553fa282d4815f42ebe307144e4d75cc997c08305069bf35e3c3bb0d949581433546f49e63d0277a71793c32ff12b6b2b54409141abb5bb4
glitchy.go2cloud.org/ Name: ho_mob
Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMzEiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTMxLjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJubC1OTCxubDtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==
nextstephire.net/ Name: o
Value: d8695267417089d0b6548def1a819df2ff386439
.nextstephire.net/ Name: _ga
Value: GA1.1.918785915.1735532152
.nextstephire.net/ Name: _ga_QG5EZY4729
Value: GS1.1.1735532152.1.0.1735532152.0.0.0

1 Console Messages

Source Level URL
Text
network error URL: https://nextstephire.net/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()