ttrk.ringocount.com Open in urlscan Pro
35.201.98.21 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://lnk.profitguruonline.com/vtrack?clientid=177372&ul=VwoEWglXBB8EGlQJUV9TElgXVQBQHQN2AVUCCgoXVg5aTk0=&ml=VQcDUkxTTlcBVgMd&s...
Effective URL:
https://ttrk.ringocount.com/t/NTVfOTQw/?url_id=53&p1=25167X1100XXY9c4EP6RX21610X864814204
Submission: On September 17 via manual (September 17th 2023, 9:26:39 pm UTC) from CA — Scanned from CA

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 2 HTTP transactions. The main IP is 35.201.98.21, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is ttrk.ringocount.com.
TLS certificate: Issued by R3 on September 13th 2023. Valid for: 3 months.

This is the only time ttrk.ringocount.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.66.103.195 52.66.103.195	16509 (AMAZON-02) (AMAZON-02)
1 1	164.68.104.198 164.68.104.198	51167 (CONTABO) (CONTABO)
1	62.171.137.2 62.171.137.2	51167 (CONTABO) (CONTABO)
1	35.201.98.21 35.201.98.21	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2

1 52.66.103.195 (Mumbai, India) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-66-103-195.ap-south-1.compute.amazonaws.com

lnk.profitguruonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 164.68.104.198 (Nuremberg, Germany) 1 redirects

ASN51167 (CONTABO, DE)
PTR: vmi281451.contaboserver.net

bitshrt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.171.137.2 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: convoadz.com

www.phoenixads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.98.21 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 21.98.201.35.bc.googleusercontent.com

ttrk.ringocount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	ringocount.com ttrk.ringocount.com	280 B
1	phoenixads.net www.phoenixads.net	1 KB
1	bitshrt.com 1 redirects bitshrt.com	379 B
1	profitguruonline.com 1 redirects lnk.profitguruonline.com	189 B
2	4

	Domain	Requested by
1	ttrk.ringocount.com	www.phoenixads.net
1	www.phoenixads.net
1	bitshrt.com	1 redirects
1	lnk.profitguruonline.com	1 redirects
2	4

This site contains no links.

Subject Issuer	Validity	Valid
track.mobiletopc.com R3	`2023-09-13` - `2023-12-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ttrk.ringocount.com/t/NTVfOTQw/?url_id=53&p1=25167X1100XXY9c4EP6RX21610X864814204
Frame ID: 249F8D1E1BDAA6F0B67DCB18E0296EF1
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://lnk.profitguruonline.com/vtrack?clientid=177372&ul=VwoEWglXBB8EGlQJUV9TElgXVQBQHQN2AVUCCgoXVg5aTk0=&m... HTTP 302
http://bitshrt.com/2fQ HTTP 302
http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836 Page URL
https://ttrk.ringocount.com/t/NTVfOTQw/?url_id=53&p1=25167X1100XXY9c4EP6RX21610X864814204 Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

2 kB
Transfer

0 kB
Size

13
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://lnk.profitguruonline.com/vtrack?clientid=177372&ul=VwoEWglXBB8EGlQJUV9TElgXVQBQHQN2AVUCCgoXVg5aTk0=&ml=VQcDUkxTTlcBVgMd&sl=Jk5zHmUwTjB4MksNXlkcFkIKVg1AA0dEE1cNDw9XUE9UXVxOVA==&pp=0&c=0000&fl=DEZEEgpMHQFcEkQJQkYcBV8IH1ZSNQ==&ext= HTTP 302
http://bitshrt.com/2fQ HTTP 302
http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836 Page URL
https://ttrk.ringocount.com/t/NTVfOTQw/?url_id=53&p1=25167X1100XXY9c4EP6RX21610X864814204 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://lnk.profitguruonline.com/vtrack?clientid=177372&ul=VwoEWglXBB8EGlQJUV9TElgXVQBQHQN2AVUCCgoXVg5aTk0=&ml=VQcDUkxTTlcBVgMd&sl=Jk5zHmUwTjB4MksNXlkcFkIKVg1AA0dEE1cNDw9XUE9UXVxOVA==&pp=0&c=0000&fl=DEZEEgpMHQFcEkQJQkYcBV8IH1ZSNQ==&ext= HTTP 302
http://bitshrt.com/2fQ HTTP 302
http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	click.asp www.phoenixads.net/track/ Redirect Chain http://lnk.profitguruonline.com/vtrack?clientid=177372&ul=VwoEWglXBB8EGlQJUV9TElgXVQBQHQN2AVUCCgoXVg5aTk0=&ml=VQcDUkxTTlcBVgMd&sl=Jk5zHmUwTjB4MksNXlkcFkIKVg1AA0dEE1cNDw9XUE9UXVxOVA==&pp=0&c=0000&fl... http://bitshrt.com/2fQ http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836	221 B 1 KB	479ms 264ms	Document text/html	62.171.137.2 CONTABO
General Check archive.org Show headers Download Go to Full URL http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836 Protocol HTTP/1.1 Server 62.171.137.2 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS convoadz.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers Cache-Control private Content-Length 221 Content-Type text/html Date Sun, 17 Sep 2023 21:26:33 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET X-Powered-By-Plesk PleskWin Redirect headers Cache-Control private Content-Length 216 Content-Type text/html Date Sun, 17 Sep 2023 17:56:53 GMT Location http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836 Server Microsoft-IIS/10.0 X-Powered-By ASP.NET X-Powered-By-Plesk PleskWin
GET H2	200	Primary Request / Show response ttrk.ringocount.com/t/NTVfOTQw/	79 B 280 B	172ms 110ms	Document text/html	35.201.98.21 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ttrk.ringocount.com/t/NTVfOTQw/?url_id=53&p1=25167X1100XXY9c4EP6RX21610X864814204 Requested by Host: www.phoenixads.net URL: http://www.phoenixads.net/track/click.asp?cid=25167&pid=1100&did=21610&code=4069836 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.98.21 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 21.98.201.35.bc.googleusercontent.com Software nginx / Resource Hash `56bb5156ea5d206956a6484c89014b4987ad0d021bd8c2a447b473d97c8aa339` Request headers Referer http://www.phoenixads.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers accept-ch Sec-CH-UA-Platform-Version, Sec-CH-UA-Model alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 79 content-type text/html date Sun, 17 Sep 2023 21:26:33 GMT server nginx via 1.1 google x-err PUB_BLOCKED_ON_CAMP x-rt 2

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bitshrt.com/	1969-12-31 23:59:59	Name: ASPSESSIONIDSSQQDDBQ Value: JFONDPEDLDGPMMLCBELAIDOL
www.phoenixads.net/	1970-01-20 23:36:48	Name: phxKeyValuexxx25167 Value:
www.phoenixads.net/	1970-01-20 23:36:48	Name: phxCreativeIdxxx25167 Value: 21610
www.phoenixads.net/	1970-01-20 23:36:48	Name: phxReferrerxxx25167 Value:
www.phoenixads.net/	1970-01-20 23:36:48	Name: phxPublisherIdxxx25167 Value: 1100
www.phoenixads.net/	1970-01-20 23:36:48	Name: PhxClickDateTimexxx25167 Value: 9%2F18%2F2023+2%3A56%3A33+AM
www.phoenixads.net/	1970-01-20 23:36:48	Name: subIdxxx25167 Value:
www.phoenixads.net/	1969-12-31 23:59:59	Name: phxUnique Value:
www.phoenixads.net/	1970-01-20 23:36:48	Name: txnIdxxx25167 Value: 25167X1100XXY9c4EP6RX21610X864814204
www.phoenixads.net/	1970-01-20 23:36:48	Name: subId3xxx25167 Value:
www.phoenixads.net/	1969-12-31 23:59:59	Name: isoffext25167110021610 Value: 9%2F18%2F2023+2%3A56%3A33+AM
www.phoenixads.net/	1970-01-20 23:36:48	Name: subId2xxx25167 Value:
www.phoenixads.net/	1969-12-31 23:59:59	Name: ASPSESSIONIDQAQADCAQ Value: ENDDJBBDPDFNGCICPKFMJGNL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bitshrt.com
lnk.profitguruonline.com
ttrk.ringocount.com
www.phoenixads.net
164.68.104.198
35.201.98.21
52.66.103.195
62.171.137.2
56bb5156ea5d206956a6484c89014b4987ad0d021bd8c2a447b473d97c8aa339

ttrk.ringocount.com Open in urlscan Pro 35.201.98.21 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

2 kBTransfer

0 kBSize

13 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

13 Cookies

Indicators

ttrk.ringocount.com Open in urlscan Pro
35.201.98.21 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

2 kB
Transfer

0 kB
Size

13
Cookies

2 HTTP transactions
0 data transactions