ca-tracking.redirectme.net Open in urlscan Pro
104.168.167.185 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cilaran263.clickfunnels.com/optini4ein9g7
Effective URL:
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
Submission: On August 05 via manual (August 5th 2022, 6:15:04 am UTC) from AU — Scanned from DE

Summary HTTP 31 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 31 HTTP transactions. The main IP is 104.168.167.185, located in United States and belongs to HOSTWINDS, US. The main domain is ca-tracking.redirectme.net.
TLS certificate: Issued by R3 on August 4th 2022. Valid for: 3 months.

This is the only time ca-tracking.redirectme.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canada Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 8	2606:4700::68... 2606:4700::6810:dc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:303... 2606:4700:3033::6815:3f36	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:440e::ac40:9c1a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 20	104.168.167.185 104.168.167.185	54290 (HOSTWINDS) (HOSTWINDS)
1 2	2a02:26f0:dc:... 2a02:26f0:dc:184::1dc5	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2606:4700:303... 2606:4700:3038::6815:e9c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
31	7

8 2606:4700::6810:dc2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cilaran263.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3033::6815:3f36 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:440e::ac40:9c1a (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 104.168.167.185 (United States) 3 redirects

ASN54290 (HOSTWINDS, US)
PTR: hwsrv-985960.hostwindsdns.com

ca-tracking.redirectme.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:dc:184::1dc5 (Vienna, Austria) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

www.canadapost.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.canadapost-postescanada.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3038::6815:e9c5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

zupimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zupimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	redirectme.net 3 redirects ca-tracking.redirectme.net	122 KB
8	clickfunnels.com 1 redirects cilaran263.clickfunnels.com app.clickfunnels.com — Cisco Umbrella Rank: 29132 images.clickfunnels.com — Cisco Umbrella Rank: 76127	757 KB
2	zupimages.net 1 redirects zupimages.net — Cisco Umbrella Rank: 131199 www.zupimages.net — Cisco Umbrella Rank: 147900	5 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67	4 KB
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 951	17 KB
1	canadapost-postescanada.ca www.canadapost-postescanada.ca — Cisco Umbrella Rank: 109355	5 KB
1	canadapost.ca 1 redirects www.canadapost.ca — Cisco Umbrella Rank: 106527	301 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1249	5 KB
31	8

	Domain	Requested by
20	ca-tracking.redirectme.net	3 redirects cilaran263.clickfunnels.com ca-tracking.redirectme.net
5	app.clickfunnels.com	cilaran263.clickfunnels.com
2	fonts.googleapis.com	cilaran263.clickfunnels.com
2	use.fontawesome.com	cilaran263.clickfunnels.com
2	cilaran263.clickfunnels.com	1 redirects
1	www.zupimages.net	ca-tracking.redirectme.net
1	zupimages.net	1 redirects
1	www.canadapost-postescanada.ca	ca-tracking.redirectme.net
1	www.canadapost.ca	1 redirects
1	static.cloudflareinsights.com	cilaran263.clickfunnels.com
1	images.clickfunnels.com	cilaran263.clickfunnels.com
31	11

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-07-23` - `2023-07-23`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-07-11` - `2022-10-03`	3 months	crt.sh
ca-tracking.redirectme.net R3	`2022-08-04` - `2022-11-02`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
Frame ID: 5094BC0E59085DFAEDAEF602DAD466B9
Requests: 20 HTTP requests in this frame

Frame: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
Frame ID: A7835B9B450227769868BB35FBD65B18
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facturation en ligne

Page URL History Show full URLs

https://cilaran263.clickfunnels.com/optini4ein9g7 HTTP 302
https://cilaran263.clickfunnels.com/optin1659641567962 Page URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD HTTP 301
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/ HTTP 302
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f... HTTP 301
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

31
Requests

94 %
HTTPS

86 %
IPv6

8
Domains

11
Subdomains

7
IPs

3
Countries

913 kB
Transfer

3316 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cilaran263.clickfunnels.com/optini4ein9g7 HTTP 302
https://cilaran263.clickfunnels.com/optin1659641567962 Page URL
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD HTTP 301
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/ HTTP 302
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1 HTTP 301
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://cilaran263.clickfunnels.com/optini4ein9g7 HTTP 302
https://cilaran263.clickfunnels.com/optin1659641567962

Request Chain 15

https://www.canadapost.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg HTTP 301
https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg

Request Chain 28

https://zupimages.net/up/20/38/e429.png HTTP 301
https://www.zupimages.net/up/20/38/e429.png

31 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

optin1659641567962 Show response
cilaran263.clickfunnels.com/
Redirect Chain

https://cilaran263.clickfunnels.com/optini4ein9g7
https://cilaran263.clickfunnels.com/optin1659641567962

62 KB
16 KB

218ms
218ms

Document
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Phusion Passenger Enterprise 6.0.7

Resource Hash

ea17075fa9c7050b1b083a751acee8882544e42705dffac1e45b2438b80e918f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
cache-control: max-age=60, public, s-maxage=600, r-maxage=10
cf-cache-status: REVALIDATED
cf-ray: 735d65456ac45bdd-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 05 Aug 2022 06:14:58 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Thu, 04 Aug 2022 22:28:26 GMT
server: cloudflare
status: 200 OK
strict-transport-security: max-age=0
vary: Accept-Encoding
x-content-digest: 85fef90244cd0d7e2ee696199ffeb87df9030118
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: fresh
x-request-id: 110644914ecbe7ebe118e2575f00b83c
x-runtime: 0.365507

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
cf-cache-status: MISS
cf-ray: 735d6543b96e5bdd-FRA
content-type: text/html; charset=utf-8
date: Fri, 05 Aug 2022 06:14:58 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://cilaran263.clickfunnels.com/optin1659641567962
server: cloudflare
status: 302 Found
strict-transport-security: max-age=0
vary: Accept-Encoding
x-frame-options: ALLOWALL
x-powered-by: Phusion Passenger Enterprise 6.0.7
x-rack-cache: miss
x-request-id: 2f5283766d4aa15c138431afe11e1812
x-runtime: 0.100117

GET
H2 200 lander.css
app.clickfunnels.com/assets/ 425 KB
70 KB 72ms
57ms Stylesheet
text/css 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/lander.css

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 833
last-modified: Tue, 02 Aug 2022 17:16:19 GMT
server: cloudflare
etag: W/"62e95be3-6a514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 735d6546ebde5bdd-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Fri, 05 Aug 2022 06:34:58 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.9.0/css/ 55 KB
12 KB 145ms
45ms Stylesheet
text/css 2606:4700:3033::6815:3f36
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/all.css
Requested by: Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3f36 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 13615263
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 6Y8PV89KC9XPDZ8T
x-amz-id-2: CFX12FCvmZfEL+oB8PSM7BkmXntBiIF/Cy4Nwcxa2rCvbH0f99j2xL2eaLpYcI1CUjOY8b8jPi8=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"dbf9d822cefe851ba6f66e1ad57e8987"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHTzIundfKdBElN4%2FYbsq5BpvYCmnYUIu1bKI4mv9vZHwO1FBTjxaFXun%2B9By12bNqgPBn8eqrs%2BvKDLcLzs1Chh9O5wiBLvhPoAQECYz0CrXwIbJlYXb55SG0dajI%2Fsw5Litm%2BRvr1qgdt054BqpSXC"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 735d65476c909b83-FRA

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ 26 KB
5 KB 144ms
44ms Stylesheet
text/css 2606:4700:3033::6815:3f36
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.9.0/css/v4-shims.css
Requested by: Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3f36 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 13615231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 3ZFDB02TPD04KVSM
x-amz-id-2: Q+Yh9NWtHdNxTeGbi5Jy5M0eTfqcF+g9vq1am4/JhekyhOp4pfLm/0vFAqiRelD4miD66BZWdjI=
last-modified: Wed, 30 Jun 2021 15:48:06 GMT
server: cloudflare
etag: W/"e140a7d32f343530f016095df3cc2ae4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5YogBshII6fNK%2F%2BnnpckxIjGzWz%2F6nqhbWAIa7bfiy3IA3CD6gmD7GCl%2Ftdf8gpQX%2F%2FM%2FKfLr86xLFihxCuQ3fk7sgytChRiYc%2Bq5jezRilqwkb34SJ3lyCSRVoePdjNAKK%2BJ4elRqr3tQoXuZJhjMr"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 735d65476c939b83-FRA

GET
H2 200 css
fonts.googleapis.com/ 45 KB
3 KB 129ms
46ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700%7COswald:400,700%7CDroid+Sans:400,700%7CRoboto:400,700%7CLato:400,700%7CPT+Sans:400,700%7CSource+Sans+Pro:400,600,700%7CNoto+Sans:400,700%7CPT+Sans:400,700%7CUbuntu:400,700%7CBitter:400,700%7CPT+Serif:400,700%7CRokkitt:400,700%7CDroid+Serif:400,700%7CRaleway:400,700%7CInconsolata:400,700

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

84b5e4a70a3e74c3de277df4d596bb8a8b75ae07c5c731a1287d97b7c17a7dc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 05 Aug 2022 05:34:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 05 Aug 2022 06:14:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 05 Aug 2022 06:14:58 GMT

GET
H2 200 application.js
app.clickfunnels.com/assets/userevents/ 5 KB
2 KB 66ms
66ms Script
application/x-javascript 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/userevents/application.js

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 627
last-modified: Tue, 02 Aug 2022 17:16:19 GMT
server: cloudflare
etag: W/"62e95be3-1353"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 735d6547bc725bdd-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Fri, 05 Aug 2022 06:34:58 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
601 B 130ms
47ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat%7Csans-serif%7CMontserrat%7Csans-serif%7CMontserrat%7Csans-serif%7C%7C

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 05 Aug 2022 06:14:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 05 Aug 2022 06:14:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 05 Aug 2022 06:14:58 GMT

GET
H2 200 lander.js
app.clickfunnels.com/assets/ 2 MB
661 KB 96ms
82ms Script
application/x-javascript 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/lander.js

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 835
last-modified: Tue, 02 Aug 2022 17:17:20 GMT
server: cloudflare
etag: W/"62e95c20-238c65"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 735d6546ebe05bdd-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Fri, 05 Aug 2022 06:34:58 GMT

GET
H2 200 ClickfunnelsTag.png
images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ 5 KB
6 KB 74ms
64ms Image
image/webp 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ClickfunnelsTag.png
Requested by: Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
cf-cache-status: HIT
age: 5463
cf-polished: origFmt=png, origSize=9030
cf-ray: 735d65483ceb5bdd-FRA
last-modified: Fri, 03 Jan 2020 17:41:49 GMT
content-disposition: inline; filename="ClickfunnelsTag.webp"
content-length: 5276
x-amz-id-2: CaWGn92VYCL4bs/hP/zUWPCv6Gp16O/tEl3q1lahH2HHkXUpOVA0pPTmEbPMjdx9yHUJz+Sb5MM=
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "a633777156a5ffeb58c92d3d59fa4e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-amz-request-id: CMZ99TVJN368Y43Z
cache-control: public, max-age=2073600
accept-ranges: bytes
content-type: image/webp
expires: Mon, 29 Aug 2022 06:14:58 GMT

GET
H2 200 mailcheck.min.js
app.clickfunnels.com/ 3 KB
1 KB 61ms
61ms Script
application/x-javascript 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/mailcheck.min.js

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 6916
last-modified: Tue, 02 Aug 2022 17:16:19 GMT
server: cloudflare
etag: W/"62e95be3-a8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 735d65486d125bdd-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H2 200 pushcrew.js
app.clickfunnels.com/assets/ 637 B
747 B 57ms
57ms Script
application/x-javascript 2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.clickfunnels.com/assets/pushcrew.js

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cilaran263.clickfunnels.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 733
last-modified: Tue, 02 Aug 2022 17:16:18 GMT
server: cloudflare
etag: W/"62e95be2-27d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 735d65489d305bdd-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Fri, 05 Aug 2022 06:34:58 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 164ms
78ms Script
text/javascript 2606:4700:440e::ac40:9c1a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::ac40:9c1a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://cilaran263.clickfunnels.com/
Origin: https://cilaran263.clickfunnels.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:14:58 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 735d6549598bbb50-FRA

GET
H2

200

Primary Request / Show response
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
Redirect Chain

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1
https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

2 KB
1 KB

167ms
167ms

Document
text/html

104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Requested by

Host: cilaran263.clickfunnels.com
URL: https://cilaran263.clickfunnels.com/optin1659641567962

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

0ddc5d3fc9c5b0bdfead804f08815333fec10366c095258c33399f807d382b0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://cilaran263.clickfunnels.com/optin1659641567962
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Fri, 05 Aug 2022 06:15:00 GMT
etag: W/"62ecb563-884"
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

content-length: 162
content-type: text/html
date: Fri, 05 Aug 2022 06:15:00 GMT
location: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
server: nginx
strict-transport-security: max-age=31536000

GET
H2 200 bootstrap.min.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/ 107 KB
22 KB 336ms
336ms Stylesheet
text/css 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/bootstrap.min.css

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-1abce"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 desktop.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/ 10 KB
3 KB 337ms
336ms Stylesheet
text/css 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/desktop.css

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-28aa"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 pubup.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ 3 KB
777 B 338ms
337ms Stylesheet
text/css 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/pubup.css

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

f99f5e80bb4c60e94c0e572536bb8416e40730e50bc31ff6af974742b1078429

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-d08"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H/1.1

200
OK

cpc-main-logo.svg
www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/
Redirect Chain

https://www.canadapost.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg

12 KB
5 KB

312ms
87ms

Image
image/svg+xml

2a02:26f0:dc:184::1dc5
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

HTTP/1.1

Server

2a02:26f0:dc:184::1dc5 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self'
Content-Encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
p3p: CP="NON CUR OTPi OUR NOR UNI"
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3967
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
Last-Modified: Mon, 15 May 2017 20:24:36 GMT
x-frame-options: SAMEORIGIN
Date: Fri, 05 Aug 2022 06:15:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubdomains; preload
Content-Type: image/svg+xml
Cache-Control: max-age=86400, private
ETag: "591a0e84-3037"
Accept-Ranges: bytes
Expires: Mon, 06 Jun 2022 13:34:44 GMT

Redirect headers

Location: https://www.canadapost-postescanada.ca/cpc/assets/cpc/img/logos/cpc-main-logo.svg
Date: Fri, 05 Aug 2022 06:15:00 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=31536000; includeSubdomains; preload

GET
H2 200 ifram.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ 807 B
1010 B 323ms
322ms Stylesheet
text/css 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ifram.css

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: "62ecb563-327"
strict-transport-security: max-age=31536000
content-type: text/css
cache-control: max-age=43200
accept-ranges: bytes
content-length: 807
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 2020-08-18_151724.png
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/images/ 335 B
540 B 323ms
323ms Image
image/png 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/images/2020-08-18_151724.png

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

dd7f24bcd34389ae222dabca96a9afdc2727212c5f42a6dd88ea2df60aae2d06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: "62ecb563-14f"
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 335
expires: Sun, 04 Sep 2022 06:15:00 GMT

GET
H2 404 Open_Sans.woff
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/ 0
0 167ms
167ms Font
text/html 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/Open_Sans.woff
Requested by: Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/desktop.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-985960.hostwindsdns.com
Software: nginx /
Resource Hash

Request headers

Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/desktop.css
Origin: https://ca-tracking.redirectme.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
server: nginx
content-length: 548
content-type: text/html

GET
H2 200 sandokhan.html Show response
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ Frame A783 20 KB
7 KB 168ms
168ms Document
text/html 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

d58f2738b979cb35922c8d9e356a0414417a3b3cace4638294fb0611f247cff4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Fri, 05 Aug 2022 06:15:00 GMT
etag: W/"62ecb563-5192"
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 404 cvv.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ Frame A783 0
0 168ms
167ms Stylesheet
text/html 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/cvv.css
Requested by: Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-985960.hostwindsdns.com
Software: nginx /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
server: nginx
content-length: 548
content-type: text/html

GET
H2 200 index.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ Frame A783 11 KB
2 KB 169ms
167ms Stylesheet
text/css 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/index.css

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

2a65f408fa9e249c423ee1c9c5398a1253030f2912dc8d0f009eb3ade2e80ca8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-2bb1"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 jquery-3.1.1.slim.min.js Show response
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/js/ Frame A783 95 KB
38 KB 172ms
169ms Script
application/javascript 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/js/jquery-3.1.1.slim.min.js

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-17d82"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 jquery-1.9.1.min.js Show response
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/js/ Frame A783 87 KB
34 KB 338ms
336ms Script
application/javascript 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/js/jquery-1.9.1.min.js

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-15db7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 jquery-confirm.min.css
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/css/ Frame A783 23 KB
4 KB 169ms
167ms Stylesheet
text/css 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/css/jquery-confirm.min.css

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-5df6"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 jquery-confirm.min.js Show response
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/js/ Frame A783 21 KB
7 KB 339ms
337ms Script
application/javascript 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/tpl-v17/js/jquery-confirm.min.js

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
content-encoding: gzip
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: W/"62ecb563-5373"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
strict-transport-security: max-age=31536000
expires: Fri, 05 Aug 2022 18:15:00 GMT

GET
H2 200 img0001.png
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/images/ Frame A783 476 B
681 B 339ms
338ms Image
image/png 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/images/img0001.png

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: "62ecb563-1dc"
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 476
expires: Sun, 04 Sep 2022 06:15:00 GMT

GET
H2 200 img0002.png
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/images/ Frame A783 476 B
681 B 339ms
338ms Image
image/png 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/images/img0002.png

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

hwsrv-985960.hostwindsdns.com

Software

nginx /

Resource Hash

5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
last-modified: Fri, 05 Aug 2022 06:14:59 GMT
server: nginx
etag: "62ecb563-1dc"
strict-transport-security: max-age=31536000
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 476
expires: Sun, 04 Sep 2022 06:15:00 GMT

GET
H2

200

e429.png
www.zupimages.net/up/20/38/ Frame A783
Redirect Chain

https://zupimages.net/up/20/38/e429.png
https://www.zupimages.net/up/20/38/e429.png

4 KB
4 KB

101ms
86ms

Image
image/png

2606:4700:3038::6815:e9c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zupimages.net/up/20/38/e429.png

Requested by

Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html

Protocol

Server

2606:4700:3038::6815:e9c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9c28fdd41dc48085360a73964739895c453d4b32314f236fed3c4370ec0ce8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
cf-cache-status: EXPIRED
last-modified: Fri, 05 Aug 2022 02:09:35 GMT
server: cloudflare
date: Fri, 05 Aug 2022 06:15:01 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D1wbFcXCIBIR2th8XMaU99eM18JgSZpBZ1Ifnw4VTTjUblhE7sXK%2F9lCkEqTe%2FDZub0pm25Wq%2Bw%2BlZf8w89cwfadCtOcxrkVermR868UWj0vyKBSvKn5VJGyULcv7MqkKczfUssW68LjN1aR4PwxZw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-disposition: filename="e429.png"
cf-ray: 735d65576dcf885f-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block

Redirect headers

date: Fri, 05 Aug 2022 06:15:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SYFAx3Qtbqe52vplJzvyL4qcae9XTAJt%2B6kchWXpNvwXvc%2FUod0Ci6K3FLhveNwNFYDUeaF7p%2BO5FWGm3rLkIkHhF33ejOWtDCnnqp%2Fxoyl%2F1QFg775277yngZdGMcVsCKKKF0%2FW6Ij4ec2s"}],"group":"cf-nel","max_age":604800}
location: https://www.zupimages.net/up/20/38/e429.png
cache-control: max-age=3600
cf-ray: 735d6556fccf885f-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 05 Aug 2022 07:15:00 GMT

GET
H2 404 jquery-3.1.1.slim.min.js
ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/js/ Frame A783 0
0 339ms
338ms Script
text/html 104.168.167.185
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/js/jquery-3.1.1.slim.min.js
Requested by: Host: ca-tracking.redirectme.net
URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.168.167.185 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-985960.hostwindsdns.com
Software: nginx /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/sandokhan.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 06:15:00 GMT
server: nginx
content-length: 548
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canada Post (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.clickfunnels.com/	1970-01-20 05:01:21	Name: __cf_bm Value: .YLvNz6wA87HmIf0xyVukc59362_pA_iClIRgHU.1cY-1659680098-0-AbDzztGNgP/dkDNiLr0cDNL87pnzEXfQuJGMjorXEYx8OhJ5UX8PJULdWkhJthjNbWC8Kt6udplXLUtYTMTeWA0hiyDvH1c9Kg46n/1MuXjv

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/ekos/Open_Sans.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/cvv.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ca-tracking.redirectme.net/Fact=89OIDQJDKSJsyuidhfhcsdkqhdshkj/908790/fast=login=UHJBS7YUIJDCQJSKDJFD/f9ea1/js/jquery-3.1.1.slim.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Frame-Options	ALLOWALL

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.clickfunnels.com
ca-tracking.redirectme.net
cilaran263.clickfunnels.com
fonts.googleapis.com
images.clickfunnels.com
static.cloudflareinsights.com
use.fontawesome.com
www.canadapost-postescanada.ca
www.canadapost.ca
www.zupimages.net
zupimages.net
104.168.167.185
2606:4700:3033::6815:3f36
2606:4700:3038::6815:e9c5
2606:4700:440e::ac40:9c1a
2606:4700::6810:dc2
2a00:1450:4001:813::200a
2a02:26f0:dc:184::1dc5
024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d
0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8
0ddc5d3fc9c5b0bdfead804f08815333fec10366c095258c33399f807d382b0e
2a65f408fa9e249c423ee1c9c5398a1253030f2912dc8d0f009eb3ade2e80ca8
4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c
736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81
84b5e4a70a3e74c3de277df4d596bb8a8b75ae07c5c731a1287d97b7c17a7dc1
93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75
a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb
aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08
b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732
c9c28fdd41dc48085360a73964739895c453d4b32314f236fed3c4370ec0ce8a
caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d
d58f2738b979cb35922c8d9e356a0414417a3b3cace4638294fb0611f247cff4
dd7f24bcd34389ae222dabca96a9afdc2727212c5f42a6dd88ea2df60aae2d06
e467e89a41e68909313eef448847f3446650158fb5d046295fea70fd7d776b87
ea17075fa9c7050b1b083a751acee8882544e42705dffac1e45b2438b80e918f
f99f5e80bb4c60e94c0e572536bb8416e40730e50bc31ff6af974742b1078429

ca-tracking.redirectme.net Open in urlscan Pro 104.168.167.185 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

31 Requests

94 %HTTPS

86 %IPv6

8 Domains

11 Subdomains

7 IPs

3 Countries

913 kBTransfer

3316 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ca-tracking.redirectme.net Open in urlscan Pro
104.168.167.185 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

31
Requests

94 %
HTTPS

86 %
IPv6

8
Domains

11
Subdomains

7
IPs

3
Countries

913 kB
Transfer

3316 kB
Size

1
Cookies

31 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!