nextstephire.net Open in urlscan Pro
2606:4700:3032::6815:19d2 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://beautywows.com/
Effective URL:
https://nextstephire.net/ab.php?s1=&s2=typeB
Submission: On October 06 via manual (October 6th 2024, 8:26:13 pm UTC) from IT — Scanned from IT

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 7 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3032::6815:19d2, located in United States and belongs to CLOUDFLARENET, US. The main domain is nextstephire.net.
TLS certificate: Issued by WE1 on August 28th 2024. Valid for: 3 months.

This is the only time nextstephire.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	192.64.119.74 192.64.119.74	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2 2	52.210.2.133 52.210.2.133	16509 (AMAZON-02) (AMAZON-02)
1 4	2606:4700:303... 2606:4700:3032::6815:19d2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:26d... 2600:9000:26db:9000:14:a6ac:5e00:21	16509 (AMAZON-02) (AMAZON-02)
4	2600:9000:20a... 2600:9000:20ae:8800:9:d486:3380:21	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20a... 2600:9000:20ae:3400:9:d486:3380:21	16509 (AMAZON-02) (AMAZON-02)
13	7

1 192.64.119.74 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

beautywows.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.210.2.133 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-2-133.eu-west-1.compute.amazonaws.com

glitchy.go2cloud.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3032::6815:19d2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

nextstephire.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

speedcdn.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26db:9000:14:a6ac:5e00:21 (United States)

ASN16509 (AMAZON-02, US)

dojy0dg181308.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:20ae:8800:9:d486:3380:21 (United States)

ASN16509 (AMAZON-02, US)

d1ftkft7iiluq6.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20ae:3400:9:d486:3380:21 (United States)

ASN16509 (AMAZON-02, US)

d1ftkft7iiluq6.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	cloudfront.net dojy0dg181308.cloudfront.net d1ftkft7iiluq6.cloudfront.net	32 KB
4	nextstephire.net 1 redirects nextstephire.net	3 KB
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3643
2	go2cloud.org 2 redirects glitchy.go2cloud.org — Cisco Umbrella Rank: 534550	2 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	104 KB
1	speedcdn.org speedcdn.org	30 KB
1	beautywows.com 1 redirects beautywows.com	287 B
13	7

	Domain	Requested by
5	d1ftkft7iiluq6.cloudfront.net	dojy0dg181308.cloudfront.net
4	nextstephire.net	1 redirects
2	region1.google-analytics.com	www.googletagmanager.com
2	glitchy.go2cloud.org	2 redirects
1	dojy0dg181308.cloudfront.net	nextstephire.net
1	www.googletagmanager.com	nextstephire.net
1	speedcdn.org	nextstephire.net
1	beautywows.com	1 redirects
13	8

This site contains no links.

Subject Issuer	Validity	Valid
nextstephire.net WE1	`2024-08-28` - `2024-11-26`	3 months	crt.sh
speedcdn.org WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://nextstephire.net/ab.php?s1=&s2=typeB
Frame ID: 32BF396F4F116FCFB6B83A351234952A
Requests: 12 HTTP requests in this frame

Frame: https://d1ftkft7iiluq6.cloudfront.net/public/ct?cpguid=&pr=0&s2=typeB&it=4374672&w=1600&h=1200&key=95e19&m=0&r=E%11%14%0C%5B%01%1A%11%14%0C
Frame ID: 53F302D4607003985D9346DA5323BEA8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

🔒 Locked

Page URL History Show full URLs

http://beautywows.com/ HTTP 307
https://beautywows.com/ HTTP 307
http://beautywows.com/ HTTP 302
https://glitchy.go2cloud.org/aff_c?offer_id=713&aff_id=17255&source=Plt HTTP 302
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=17255&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D... HTTP 302
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c1e02226875b7b42d4f3428e9e8 HTTP 302
https://nextstephire.net/ab.php?s1=&s2=typeB Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

8
Subdomains

7
IPs

4
Countries

170 kB
Transfer

451 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://beautywows.com/ HTTP 307
https://beautywows.com/ HTTP 307
http://beautywows.com/ HTTP 302
https://glitchy.go2cloud.org/aff_c?offer_id=713&aff_id=17255&source=Plt HTTP 302
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=17255&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c1e02226875b7b42d4f3428e9e8&urlauth=520008263222179708199720555067 HTTP 302
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c1e02226875b7b42d4f3428e9e8 HTTP 302
https://nextstephire.net/ab.php?s1=&s2=typeB Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request ab.php Show response
nextstephire.net/
Redirect Chain

http://beautywows.com/
https://beautywows.com/
http://beautywows.com/
https://glitchy.go2cloud.org/aff_c?offer_id=713&aff_id=17255&source=Plt
https://glitchy.go2cloud.org/aff_r?offer_id=407&aff_id=17255&url=https%3A%2F%2Fnextstephire.net%2F%3Fa%3D4175%26c%3D21328%26p%3Dr%26s1%3Dglc%26s2%3D102c1e02226875b7b42d4f3428e9e8&urlauth=5200082632...
https://nextstephire.net/?a=4175&c=21328&p=r&s1=glc&s2=102c1e02226875b7b42d4f3428e9e8
https://nextstephire.net/ab.php?s1=&s2=typeB

1 KB
865 B

79ms
79ms

Document
text/html

2606:4700:3032::6815:19d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextstephire.net/ab.php?s1=&s2=typeB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:19d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db073a5d873f6aa2863fb7f78ee7b7c755b9338b51acbbf618227b362f1e97d2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8ce86279dddd7a48-DUS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 06 Oct 2024 20:26:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rXTfr7V2FzLJJmr7ike120BxLjUVsW0xIARFJKqEUiZcPeN7pAwRmNdrJSd5OfbKGTLdDcUSBQDS2YD6N3%2BpgmzyU30vjBS6OJosSgpHRAEK%2BEB7DOOwX4m1qEth3oOk%2F4KC1txtddLyyZt4GCUz"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 8ce862792ceb7a48-DUS
content-type: text/html; charset=UTF-8
date: Sun, 06 Oct 2024 20:26:08 GMT
location: /ab.php?s1=&s2=typeB
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eqGrj9iZOjfAieP%2Bz%2BXw93hsoYE8Pjmm5f1VZ%2B4WNrWXpfHI35ayV%2B0pw0JFUlGaa%2FNYg7dB4ZmoC8jG9VHocaahuSKObbdZJnc9A4LxzQ81BI692G9N%2FyMt3y5rM7gh9SV4JbvRDFn6zEVPFumA"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding

GET
H2 200 speculation
nextstephire.net/cdn-cgi/ 128 B
471 B 55ms
55ms Other
application/speculationrules+json 2606:4700:3032::6815:19d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextstephire.net/cdn-cgi/speculation
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:19d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://nextstephire.net
Referer: https://nextstephire.net/ab.php?s1=&s2=typeB

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BLnYh6s58mbYQL%2FG36KQEj%2FYJDwl6fdiljOOqEq095camA5YyDMz62nxyZKcuIrUWI%2FQWKHhbCcnunLzz7Uq5G%2B0JE4Qx9wwxx9%2BEsHYuRcRO0EFTLHfl1lKz4TxL1UU1T60FAW02o30zgaOHyzi"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ce8627a6ee97a48-DUS
access-control-allow-origin: https://nextstephire.net
content-length: 128
date: Sun, 06 Oct 2024 20:26:08 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 200 jquery.min.js Show response
speedcdn.org/ajax/libs/jquery/3.6.2/ 85 KB
30 KB 246ms
167ms Script
text/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://speedcdn.org/ajax/libs/jquery/3.6.2/jquery.min.js?integrity=6b5d4eba-6c47-11ef-9573-a22e3415d13e
Requested by: Host: nextstephire.net
URL: https://nextstephire.net/ab.php?s1=&s2=typeB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

cache-control: private, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GFi1zf4r%2BpUsYwDrregIri20XCI5ONiTqazWPgbKxwzzuw8t5RXewuRampDnTwzejXff4yJojysLygKTgcTfkrtZa3yyxcBYBMPUXMjCvus%2Fub8Q71BXkATIt4QQcNk%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ce8627ae8840168-CDG
expires: -1
date: Sun, 06 Oct 2024 20:26:08 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 312 KB
104 KB 237ms
92ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729

Requested by

Host: nextstephire.net
URL: https://nextstephire.net/ab.php?s1=&s2=typeB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

382227a77b4922e40592268133ea94e579397c9d68fc5731c8747ff3ea2f5ab0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 06 Oct 2024 20:26:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 06 Oct 2024 20:26:08 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105915
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 59e0327.js Show response
dojy0dg181308.cloudfront.net/ 26 KB
8 KB 637ms
441ms Script
application/javascript 2600:9000:26db:9000:14:a6ac:5e00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dojy0dg181308.cloudfront.net/59e0327.js
Requested by: Host: nextstephire.net
URL: https://nextstephire.net/ab.php?s1=&s2=typeB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26db:9000:14:a6ac:5e00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e5a5f2f94969f8ffc45bfc7f31e7fb87fe57193aa325efff901ab5a9d01c5eb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

content-encoding: gzip
etag: W/"f15e91e549ad0dd401be0dbc95bf744d"
age: 10
via: 1.1 918459d66ab0cca4258acacb6d3f6edc.cloudfront.net (CloudFront)
x-cache: Error from cloudfront
x-amz-cf-id: 0yeTHF426sg0KwIcsF1rl0A8aOxaYz5EeoLaRN4dWV1SQCzXXu3xwg==
date: Sun, 06 Oct 2024 20:26:02 GMT
content-type: application/javascript
last-modified: Sun, 22 Sep 2024 12:20:01 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P3
vary: Accept-Encoding

GET
H2 200 htmlxf.4374672.95e19.0.js Show response
d1ftkft7iiluq6.cloudfront.net/public/external/v2/ 15 KB
16 KB 382ms
227ms Script
application/javascript 2600:9000:20ae:8800:9:d486:3380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ftkft7iiluq6.cloudfront.net/public/external/v2/htmlxf.4374672.95e19.0.js
Requested by: Host: dojy0dg181308.cloudfront.net
URL: https://dojy0dg181308.cloudfront.net/59e0327.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:8800:9:d486:3380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: cbb1c96f15f0c7569825069be9f0ffb7cddece9a01907f1462de9b68d0d5dc6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

via: 1.1 258e5fe72bfca83e099f880853f68ab4.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: T4luXl3xOt5QlDwktQ-TABgJ-D0z7fz0KHHUirs717cD0JATjK1BBg==
date: Sun, 06 Oct 2024 20:26:09 GMT
content-type: application/javascript
x-powered-by: PHP/7.4.11
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: MUC50-P5

GET
H2 200 css_frontXF.css
d1ftkft7iiluq6.cloudfront.net/public/external/ 6 KB
6 KB 371ms
218ms Stylesheet
text/css 2600:9000:20ae:8800:9:d486:3380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ftkft7iiluq6.cloudfront.net/public/external/css_frontXF.css
Requested by: Host: dojy0dg181308.cloudfront.net
URL: https://dojy0dg181308.cloudfront.net/59e0327.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:8800:9:d486:3380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: 60a0f85900cf8e56c1607c8c120f68064a4f8d22a40637b224774cb611e93c2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

etag: "17f6-60315f2001356"
via: 1.1 258e5fe72bfca83e099f880853f68ab4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 6134
x-amz-cf-id: KO2wmG7DzCbtDgSZHZqGm2pNUQhON6sUjOb6oStR05z2jMfB4yqhQg==
date: Sun, 06 Oct 2024 20:26:09 GMT
content-type: text/css
last-modified: Thu, 17 Aug 2023 03:24:09 GMT
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: MUC50-P5

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 198ms
67ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4a20v9188976620za200&_p=1728246368683&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&cid=1296099986.1728246369&ul=it-it&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1728246369&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fab.php%3Fs1%3D%26s2%3DtypeB&dr=0day.today&dt=%F0%9F%94%92%20Locked&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5695
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://nextstephire.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 06 Oct 2024 20:26:09 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 184ms
67ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-QG5EZY4729&gtm=45je4a20v9188976620za200&_p=1728246368683&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&cid=1296099986.1728246369&ul=it-it&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1728246369&sct=1&seg=0&dl=https%3A%2F%2Fnextstephire.net%2Fab.php%3Fs1%3D%26s2%3DtypeB&dr=0day.today&dt=%F0%9F%94%92%20Locked&en=typeB&_ee=1&_et=4&tfd=5711
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QG5EZY4729
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://nextstephire.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 06 Oct 2024 20:26:09 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 cssXF.css
d1ftkft7iiluq6.cloudfront.net/public/clockers/PrimeApps/ 2 KB
2 KB 375ms
375ms Stylesheet
text/css 2600:9000:20ae:8800:9:d486:3380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ftkft7iiluq6.cloudfront.net/public/clockers/PrimeApps/cssXF.css
Requested by: Host: dojy0dg181308.cloudfront.net
URL: https://dojy0dg181308.cloudfront.net/59e0327.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:8800:9:d486:3380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: e6959d5cfed508bcc278587c05b26b361bc678f8a7f0502ca6f8ce01f2838cd5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

etag: "70c-603161857bc5e"
via: 1.1 258e5fe72bfca83e099f880853f68ab4.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Miss from cloudfront
content-length: 1804
x-amz-cf-id: C0A-Nd6uqfRDNhWDvEsWQGTgxaeBEf7_Zt7u7uQt1_gBP8zkOHBIIA==
date: Sun, 06 Oct 2024 20:26:09 GMT
content-type: text/css
last-modified: Thu, 17 Aug 2023 03:34:52 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: MUC50-P5

GET
H2 404 favicon.ico
nextstephire.net/ 3 KB
2 KB 125ms
125ms Other
text/html 2606:4700:3032::6815:19d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextstephire.net/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:19d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/ab.php?s1=&s2=typeB

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: EXPIRED
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dag9leKz32ckZ6fOv59rIfGK4nMsQMr6h0SkrnPiLm1tbIfrYSQyi8QGN4KYSR9oKuHl1bqELxyCg5n9dOS%2FfO2Vpb6HOQP5oW8LkJ8EoElp7RUO4MlfaT%2F4P%2FYWmvt1D4%2FoAT915uWpANd698gt"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ce862833d937a48-DUS
date: Sun, 06 Oct 2024 20:26:09 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare
last-modified: Mon, 26 Aug 2024 11:32:37 GMT

GET
H2 200 ct
d1ftkft7iiluq6.cloudfront.net/public/ Frame 53F3 0
0 568ms
448ms Document
text/html 2600:9000:20ae:3400:9:d486:3380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ftkft7iiluq6.cloudfront.net/public/ct?cpguid=&pr=0&s2=typeB&it=4374672&w=1600&h=1200&key=95e19&m=0&r=E%11%14%0C%5B%01%1A%11%14%0C
Requested by: Host: dojy0dg181308.cloudfront.net
URL: https://dojy0dg181308.cloudfront.net/59e0327.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:3400:9:d486:3380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.48 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash

Request headers

Referer: https://nextstephire.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-transform
content-type: text/html; charset=UTF-8
date: Sun, 06 Oct 2024 20:26:10 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
pragma: no-cache
server: Apache/2.4.48 () OpenSSL/1.0.2k-fips PHP/7.4.11
via: 1.1 3909cd34f904454f54cf78c975b2c198.cloudfront.net (CloudFront)
x-amz-cf-id: gzSvG6PDFSORu2i2MT3OF36nKN9a-kewM_TFszS6UvyumyhfdeIHKA==
x-amz-cf-pop: MUC50-P5
x-cache: Miss from cloudfront
x-powered-by: PHP/7.4.11

GET
H2 200 check.php Show response
d1ftkft7iiluq6.cloudfront.net/public/external/ 72 B
367 B 220ms
220ms Script
application/javascript 2600:9000:20ae:8800:9:d486:3380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ftkft7iiluq6.cloudfront.net/public/external/check.php?it=4374672&time=1728246371408
Requested by: Host: dojy0dg181308.cloudfront.net
URL: https://dojy0dg181308.cloudfront.net/59e0327.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:8800:9:d486:3380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 577d248638c57941b7e35d9a19ef4b5d88d52482f6e59254142d4266c57bad38

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://nextstephire.net/

Response headers

via: 1.1 258e5fe72bfca83e099f880853f68ab4.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 72
x-amz-cf-id: _gTvjeHSn4dlR937ZXbDjVhjYuMox3yReIclEX4eb9VfKqxjRlKWJQ==
date: Sun, 06 Oct 2024 20:26:11 GMT
content-type: application/javascript
x-powered-by: PHP/7.4.11
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: MUC50-P5

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
glitchy.go2cloud.org/	1970-01-21 00:48:44	Name: enc_aff_session_407 Value: ENC036748f177b6bc93dc753d5d3cb68dd94ce4b32e95ee5bf1065fe8d6ae27feb0c90bd30b67f56967960d18d6d7ab213d2edf256f6a9d1ec64009e40640524f020f805c86090ced6475e5605aa9948a106532d80e582ed09f634da8304cca38b1885eecca888a3f355815baffa19be4d8272574002a6e6722e5b5133fbd10e875842c0966bf
glitchy.go2cloud.org/	1970-01-21 09:40:06	Name: ho_mob Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMjkiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTI5LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJpdC1JVCxpdDtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==
.nextstephire.net/	1970-01-21 09:40:06	Name: _ga Value: GA1.1.1296099986.1728246369
.nextstephire.net/	1970-01-21 09:40:06	Name: _ga_QG5EZY4729 Value: GS1.1.1728246369.1.0.1728246369.0.0.0
i.gyazo.com/	1970-01-21 09:40:06	Name: Gyazo_cfwoker Value: i

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nextstephire.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

beautywows.com
d1ftkft7iiluq6.cloudfront.net
dojy0dg181308.cloudfront.net
glitchy.go2cloud.org
nextstephire.net
region1.google-analytics.com
speedcdn.org
www.googletagmanager.com
188.114.97.3
192.64.119.74
2001:4860:4802:34::36
2600:9000:20ae:3400:9:d486:3380:21
2600:9000:20ae:8800:9:d486:3380:21
2600:9000:26db:9000:14:a6ac:5e00:21
2606:4700:3032::6815:19d2
2a00:1450:4001:811::2008
52.210.2.133
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
382227a77b4922e40592268133ea94e579397c9d68fc5731c8747ff3ea2f5ab0
3e5a5f2f94969f8ffc45bfc7f31e7fb87fe57193aa325efff901ab5a9d01c5eb
577d248638c57941b7e35d9a19ef4b5d88d52482f6e59254142d4266c57bad38
60a0f85900cf8e56c1607c8c120f68064a4f8d22a40637b224774cb611e93c2f
cbb1c96f15f0c7569825069be9f0ffb7cddece9a01907f1462de9b68d0d5dc6c
d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615
db073a5d873f6aa2863fb7f78ee7b7c755b9338b51acbbf618227b362f1e97d2
e6959d5cfed508bcc278587c05b26b361bc678f8a7f0502ca6f8ce01f2838cd5
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

nextstephire.net Open in urlscan Pro 2606:4700:3032::6815:19d2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

67 %IPv6

7 Domains

8 Subdomains

7 IPs

4 Countries

170 kBTransfer

451 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

nextstephire.net Open in urlscan Pro
2606:4700:3032::6815:19d2 Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

8
Subdomains

7
IPs

4
Countries

170 kB
Transfer

451 kB
Size

5
Cookies

13 HTTP transactions
0 data transactions