urlscan.io logo urlscan.io
SecurityTrails logo

tatrck.com Open in urlscan Pro
2a06:98c1:3121::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://betting.nordvpn.io/
Effective URL: https://tatrck.com/v1/go/?deeplink=https%3A%2F%2Fqwpeg.com%2Fg%2Fmai1uhgx164cc7b61b34004ed038cb%2F%3Fsubid%3D3Ceg4J...
Submission: On August 30 via automatic, source certstream-suspicious — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 10 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is tatrck.com. The Cisco Umbrella rank of the primary domain is 235178.
TLS certificate: Issued by WE1 on August 2nd 2024. Valid for: 3 months.
This is the only time tatrck.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 172.234.222.138 63949 (AKAMAI-LI...)
2 67.225.218.25 32244 (LIQUIDWEB)
1 2 15.197.224.234 16509 (AMAZON-02)
1 130.211.29.114 396982 (GOOGLE-CL...)
2 35.241.15.240 396982 (GOOGLE-CL...)
1 1 173.239.53.32 27257 (WEBAIR-IN...)
1 1 2a01:4f8:162:... 24940 (HETZNER-AS)
2 5 2a06:98c1:312... 13335 (CLOUDFLAR...)
10 6
1    172.234.222.138 (Chicago, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 172-234-222-138.ip.linodeusercontent.com
betting.nordvpn.io
2    67.225.218.25 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: lb07.parklogic.com
ww99.nordvpn.io
2    15.197.224.234 (United States)

ASN16509 (AMAZON-02, US)
PTR: ab226b763647f1870.awsglobalaccelerator.com
starchoice-1.online
1    130.211.29.114 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 114.29.211.130.bc.googleusercontent.com
cdn.perfdrive.com
2    35.241.15.240 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 240.15.241.35.bc.googleusercontent.com
cas.avalon.perfdrive.com
1    173.239.53.32 (New York, United States)

ASN27257 (WEBAIR-INTERNET, US)
xml-v4.setlitescmode-4.online
1    2a01:4f8:162:452::2 (Ehingen, Germany)

ASN24940 (HETZNER-AS, DE)
alfebio.com
5    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
oh-my-bot.com
tatrck.com
Apex Domain
Subdomains		 Transfer
3 tatrck.com
tatrck.com — Cisco Umbrella Rank: 235178
2 KB
3 perfdrive.com
cdn.perfdrive.com — Cisco Umbrella Rank: 61574
cas.avalon.perfdrive.com — Cisco Umbrella Rank: 17559
90 KB
3 nordvpn.io
betting.nordvpn.io
ww99.nordvpn.io
3 KB
2 oh-my-bot.com
oh-my-bot.com
2 KB
2 starchoice-1.online
starchoice-1.online — Cisco Umbrella Rank: 316472
21 KB
1 alfebio.com
alfebio.com
806 B
1 setlitescmode-4.online
xml-v4.setlitescmode-4.online
270 B
0 nordvpn.com Failed
nordvpn.com Failed
10 8
Domain Requested by
3 tatrck.com 1 redirects oh-my-bot.com
2 oh-my-bot.com 1 redirects starchoice-1.online
2 cas.avalon.perfdrive.com cdn.perfdrive.com
2 starchoice-1.online 1 redirects ww99.nordvpn.io
2 ww99.nordvpn.io ww99.nordvpn.io
1 alfebio.com 1 redirects
1 xml-v4.setlitescmode-4.online 1 redirects
1 cdn.perfdrive.com starchoice-1.online
1 betting.nordvpn.io 1 redirects
0 nordvpn.com Failed tatrck.com
10 10

This site contains no links.

Subject Issuer Validity Valid
pltraffic.com
pltraffic.com		 2022-08-15 -
2032-08-14		 10 years crt.sh
starchoice-1.online
Amazon RSA 2048 M02		 2024-07-03 -
2025-08-01		 a year crt.sh
*.perfdrive.com
Go Daddy Secure Certificate Authority - G2		 2023-09-21 -
2024-09-26		 a year crt.sh
cas.avalon.perfdrive.com
Go Daddy Secure Certificate Authority - G2		 2024-07-26 -
2025-08-05		 a year crt.sh
oh-my-bot.com
WE1		 2024-08-09 -
2024-11-07		 3 months crt.sh
tatrck.com
WE1		 2024-08-02 -
2024-10-31		 3 months crt.sh

This page contains 1 frames:

Frame: https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=2075099&utm_campaign=off15&utm_source=aff8214
Frame ID: 39B4AE26F29E975A6303E7E55ACE4D14
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Please wait

Page URL History Show full URLs

  1. https://betting.nordvpn.io/ HTTP 302
    http://ww99.nordvpn.io/ HTTP 307
    https://ww99.nordvpn.io/ Page URL
  2. https://ww99.nordvpn.io/page/bouncy.php?&bpae=GbhGdK0Gulx7j3O0ZS7jbyV%2B%2FbgMQaxxODEEpvcLBGxE9AYf8U... Page URL
  3. http://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8 HTTP 307
    https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8 Page URL
  4. https://starchoice-1.online/api/v1/pxcheck?impId=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8&minfo=eyJjb29r... HTTP 302
    http://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0 HTTP 307
    https://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0 HTTP 302
    https://alfebio.com/r/v2?u=bl&f=10&s1=1115058548&s2=nordvpn&s3=c7ccf4b89e6210b0acf81caa8&d=https... HTTP 302
    https://oh-my-bot.com/recommend/bl9?web=nordvpn.com&nid=10&uid1=1115058548&uid2=nordvpn&uid3=c7ccf... HTTP 302
    https://oh-my-bot.com/recommend?web=nordvpn.com Page URL
  5. https://tatrck.com/redir/clickGate.php?u=u68EH62H&m=30&p=euu8i3Ft3V&s=bl9e5887f53dbb8ad0d7fd568... HTTP 302
    https://tatrck.com/v1/go/?deeplink=https%3A%2F%2Fqwpeg.com%2Fg%2Fmai1uhgx164cc7b61b34004ed038cb... Page URL

Page Statistics

10
Requests

70 %
HTTPS

25 %
IPv6

8
Domains

10
Subdomains

6
IPs

4
Countries

117 kB
Transfer

360 kB
Size

17
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://betting.nordvpn.io/ HTTP 302
    http://ww99.nordvpn.io/ HTTP 307
    https://ww99.nordvpn.io/ Page URL
  2. https://ww99.nordvpn.io/page/bouncy.php?&bpae=GbhGdK0Gulx7j3O0ZS7jbyV%2B%2FbgMQaxxODEEpvcLBGxE9AYf8Uc3cMyI5vAaWl1VREAR72JmZWabgT%2BEw48yuoY1ubyYhm1N%2Bw4g3q6cw%2FmO85sbrdJfFzMLMpLiEgFODSDl9vfgGWLI4ONH7u0DyA13PlB%2BkziQ64oC8aP48dVb32Ki5O0Qz%2FOid%2Fu8xxiFhZpAr4EAmZPwosrhv7ynstWQ7gDWXuFbp58QytCr6yx2P321J3o%2BXnVMIRJdg%2FVR48sLEM%2Bgm1vhGsQ2T8NSBoVjtgWg1eWKRFi4jEdqHx4brpfHgZpbuIDuRHxs1E7qTjVUNvxHd6ERWCcwQ1RWjTnm16KeTjBB5GTS85XRN3o8ViOvg6RFgnJHi8ihrfs7DabZvhLwdrb86Gz0a2JJ3imVYLTYCiRguJOwYmiZk8r3OS3hqtgj88Yb%2BYtlWOZMJ9%2BYIWy9srB4%2BmTLyzVYYN2W&redirectType=js&inIframe=false&inPopUp=false Page URL
  3. http://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8 HTTP 307
    https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8 Page URL
  4. https://starchoice-1.online/api/v1/pxcheck?impId=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8&minfo=eyJjb29raWVEaXNhYmxlZCI6ZmFsc2UsInVhIjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJpZnJhbWUiOmZhbHNlLCJkZXZpY2VQaXhlbFJhdGlvIjoxLCJ3bmRMb2NIcmVmIjoiaHR0cHM6Ly9zdGFyY2hvaWNlLTEub25saW5lL2FwaS92MS9weD94bWxpZD1FZVJlMUtjZVI0SGoxU0FwY2JCMUozZGg4N2k2bHZGWVpZVkQ0UlY4IiwiZGV2aWNlU3JlZW5TaXplIjoiMTIwMHgxNjAwIiwiZGV2aWNlV2luZG93U2l6ZSI6IjEyMDB4MTYwMCIsInduZDJzcmNSYXRpb0x3cjA2IjpmYWxzZSwiZWZmZWN0aXZlVHlwZSI6IjRnIiwiaXNCb3QiOmZhbHNlLCJmQm90TmFtZSI6IiIsImZSZWFzb25zIjoiIn0= HTTP 302
    http://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0 HTTP 307
    https://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0 HTTP 302
    https://alfebio.com/r/v2?u=bl&f=10&s1=1115058548&s2=nordvpn&s3=c7ccf4b89e6210b0acf81caa8&d=https%3A%2F%2Fnordvpn.com HTTP 302
    https://oh-my-bot.com/recommend/bl9?web=nordvpn.com&nid=10&uid1=1115058548&uid2=nordvpn&uid3=c7ccf4b89e6210b0acf81caa8&url=https%3A%2F%2Fnordvpn.com&rtb_key=fd6b234c4350a3f9750066d9a56b04d9&tsv=1725023699&shv=3f93bfeaff8034117ea694fc552a4474 HTTP 302
    https://oh-my-bot.com/recommend?web=nordvpn.com Page URL
  5. https://tatrck.com/redir/clickGate.php?u=u68EH62H&m=30&p=euu8i3Ft3V&s=bl9e5887f53dbb8ad0d7fd5681f1f000&url=https%3A%2F%2Fnordvpn.com HTTP 302
    https://tatrck.com/v1/go/?deeplink=https%3A%2F%2Fqwpeg.com%2Fg%2Fmai1uhgx164cc7b61b34004ed038cb%2F%3Fsubid%3D3Ceg4J3eqmtVkp4IvFvyXMUtzHtGKvrDbVrjuZ6NBJkHOY%26subid2%3Doh-my-bot.com%26subid3%3D%26subid4%3D247531%26ref%3Dtatrck.com%26ulp%3Dhttps%253A%252F%252Fnordvpn.com&p=euu8i3Ft3V Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://betting.nordvpn.io/ HTTP 302
  • http://ww99.nordvpn.io/ HTTP 307
  • https://ww99.nordvpn.io/
Request Chain 2
  • http://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8 HTTP 307
  • https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
Request Chain 6
  • https://starchoice-1.online/api/v1/pxcheck?impId=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8&minfo=eyJjb29raWVEaXNhYmxlZCI6ZmFsc2UsInVhIjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJpZnJhbWUiOmZhbHNlLCJkZXZpY2VQaXhlbFJhdGlvIjoxLCJ3bmRMb2NIcmVmIjoiaHR0cHM6Ly9zdGFyY2hvaWNlLTEub25saW5lL2FwaS92MS9weD94bWxpZD1FZVJlMUtjZVI0SGoxU0FwY2JCMUozZGg4N2k2bHZGWVpZVkQ0UlY4IiwiZGV2aWNlU3JlZW5TaXplIjoiMTIwMHgxNjAwIiwiZGV2aWNlV2luZG93U2l6ZSI6IjEyMDB4MTYwMCIsInduZDJzcmNSYXRpb0x3cjA2IjpmYWxzZSwiZWZmZWN0aXZlVHlwZSI6IjRnIiwiaXNCb3QiOmZhbHNlLCJmQm90TmFtZSI6IiIsImZSZWFzb25zIjoiIn0= HTTP 302
  • http://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0 HTTP 307
  • https://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0 HTTP 302
  • https://alfebio.com/r/v2?u=bl&f=10&s1=1115058548&s2=nordvpn&s3=c7ccf4b89e6210b0acf81caa8&d=https%3A%2F%2Fnordvpn.com HTTP 302
  • https://oh-my-bot.com/recommend/bl9?web=nordvpn.com&nid=10&uid1=1115058548&uid2=nordvpn&uid3=c7ccf4b89e6210b0acf81caa8&url=https%3A%2F%2Fnordvpn.com&rtb_key=fd6b234c4350a3f9750066d9a56b04d9&tsv=1725023699&shv=3f93bfeaff8034117ea694fc552a4474 HTTP 302
  • https://oh-my-bot.com/recommend?web=nordvpn.com
Request Chain 7
  • https://qwpeg.com/g/mai1uhgx164cc7b61b34004ed038cb/?subid=3Ceg4J3eqmtVkp4IvFvyXMUtzHtGKvrDbVrjuZ6NBJkHOY&subid2=oh-my-bot.com&subid3=&subid4=247531&ref=tatrck.com&ulp=https%3A%2F%2Fnordvpn.com HTTP 302
  • https://go.nordvpn.net/aff_c?offer_id=15&aff_id=8214&url_id=263&aff_sub=2075099&aff_sub2=734ec5f2f45443eeafdcd3cb56401d2c HTTP 302
  • https://visit.nordvpn.com/?offer_id=15&aff_id=8214&aff_transaction_id=102d43f734b2e1ad413b66fe4bd389&source=&params[ho_asub1]=2075099&url_id=177 HTTP 302
  • https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=2075099&utm_campaign=off15&utm_source=aff8214

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
ww99.nordvpn.io/
Redirect Chain
  • https://betting.nordvpn.io/
  • http://ww99.nordvpn.io/
  • https://ww99.nordvpn.io/
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ww99.nordvpn.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.218.25 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
lb07.parklogic.com
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash
a97c9d07b76f63410077a1d5ce3f712055b68401c3a5b2b1b1a09c6c7d065051

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
no-cache
content-length
2146
content-type
text/html; charset=UTF-8
date
Fri, 30 Aug 2024 13:14:56 GMT
pragma
no-cache
server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
x-powered-by
PHP/5.4.16

Redirect headers

Location
https://ww99.nordvpn.io/
Non-Authoritative-Reason
HttpsUpgrades
bouncy.php
ww99.nordvpn.io/page/ 		775 B
837 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ww99.nordvpn.io/page/bouncy.php?&bpae=GbhGdK0Gulx7j3O0ZS7jbyV%2B%2FbgMQaxxODEEpvcLBGxE9AYf8Uc3cMyI5vAaWl1VREAR72JmZWabgT%2BEw48yuoY1ubyYhm1N%2Bw4g3q6cw%2FmO85sbrdJfFzMLMpLiEgFODSDl9vfgGWLI4ONH7u0DyA13PlB%2BkziQ64oC8aP48dVb32Ki5O0Qz%2FOid%2Fu8xxiFhZpAr4EAmZPwosrhv7ynstWQ7gDWXuFbp58QytCr6yx2P321J3o%2BXnVMIRJdg%2FVR48sLEM%2Bgm1vhGsQ2T8NSBoVjtgWg1eWKRFi4jEdqHx4brpfHgZpbuIDuRHxs1E7qTjVUNvxHd6ERWCcwQ1RWjTnm16KeTjBB5GTS85XRN3o8ViOvg6RFgnJHi8ihrfs7DabZvhLwdrb86Gz0a2JJ3imVYLTYCiRguJOwYmiZk8r3OS3hqtgj88Yb%2BYtlWOZMJ9%2BYIWy9srB4%2BmTLyzVYYN2W&redirectType=js&inIframe=false&inPopUp=false
Requested by
Host: ww99.nordvpn.io
URL: https://ww99.nordvpn.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.218.25 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
lb07.parklogic.com
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 / PHP/5.4.16
Resource Hash
5debad784ec6f6fc9d41fedb5f8b6356346a98a7204242666e49c5999fe1a188

Request headers

Referer
https://ww99.nordvpn.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control
no-cache
content-length
775
content-type
text/html; charset=UTF-8
date
Fri, 30 Aug 2024 13:14:58 GMT
pragma
no-cache
server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
x-powered-by
PHP/5.4.16
px
starchoice-1.online/api/v1/
Redirect Chain
  • http://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
  • https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
114 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
Requested by
Host: ww99.nordvpn.io
URL: https://ww99.nordvpn.io/page/bouncy.php?&bpae=GbhGdK0Gulx7j3O0ZS7jbyV%2B%2FbgMQaxxODEEpvcLBGxE9AYf8Uc3cMyI5vAaWl1VREAR72JmZWabgT%2BEw48yuoY1ubyYhm1N%2Bw4g3q6cw%2FmO85sbrdJfFzMLMpLiEgFODSDl9vfgGWLI4ONH7u0DyA13PlB%2BkziQ64oC8aP48dVb32Ki5O0Qz%2FOid%2Fu8xxiFhZpAr4EAmZPwosrhv7ynstWQ7gDWXuFbp58QytCr6yx2P321J3o%2BXnVMIRJdg%2FVR48sLEM%2Bgm1vhGsQ2T8NSBoVjtgWg1eWKRFi4jEdqHx4brpfHgZpbuIDuRHxs1E7qTjVUNvxHd6ERWCcwQ1RWjTnm16KeTjBB5GTS85XRN3o8ViOvg6RFgnJHi8ihrfs7DabZvhLwdrb86Gz0a2JJ3imVYLTYCiRguJOwYmiZk8r3OS3hqtgj88Yb%2BYtlWOZMJ9%2BYIWy9srB4%2BmTLyzVYYN2W&redirectType=js&inIframe=false&inPopUp=false
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.224.234 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ab226b763647f1870.awsglobalaccelerator.com
Software
/
Resource Hash
916e638b41c7a1cafb8327f2d90b1513d151917838541212a94558f53dca51b6

Request headers

Referer
https://ww99.nordvpn.io/page/bouncy.php?&bpae=GbhGdK0Gulx7j3O0ZS7jbyV%2B%2FbgMQaxxODEEpvcLBGxE9AYf8Uc3cMyI5vAaWl1VREAR72JmZWabgT%2BEw48yuoY1ubyYhm1N%2Bw4g3q6cw%2FmO85sbrdJfFzMLMpLiEgFODSDl9vfgGWLI4ONH7u0DyA13PlB%2BkziQ64oC8aP48dVb32Ki5O0Qz%2FOid%2Fu8xxiFhZpAr4EAmZPwosrhv7ynstWQ7gDWXuFbp58QytCr6yx2P321J3o%2BXnVMIRJdg%2FVR48sLEM%2Bgm1vhGsQ2T8NSBoVjtgWg1eWKRFi4jEdqHx4brpfHgZpbuIDuRHxs1E7qTjVUNvxHd6ERWCcwQ1RWjTnm16KeTjBB5GTS85XRN3o8ViOvg6RFgnJHi8ihrfs7DabZvhLwdrb86Gz0a2JJ3imVYLTYCiRguJOwYmiZk8r3OS3hqtgj88Yb%2BYtlWOZMJ9%2BYIWy9srB4%2BmTLyzVYYN2W&redirectType=js&inIframe=false&inPopUp=false
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 30 Aug 2024 13:14:58 GMT
etag
W/"1c8ff-koSGhbt2jtNVnEryXDA1Mp5BtyI"
vary
Accept-Encoding

Redirect headers

Location
https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
Non-Authoritative-Reason
HttpsUpgrades
stormcaster.js
cdn.perfdrive.com/advanced/ 		240 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.perfdrive.com/advanced/stormcaster.js
Requested by
Host: starchoice-1.online
URL: https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.29.114 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
114.29.211.130.bc.googleusercontent.com
Software
nginx/1.10.1 /
Resource Hash
1606203846c1977f6b9eb8f226c623c77f73838df2a622556cfa3efd884c0c65

Request headers

Referer
https://starchoice-1.online/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 30 Aug 2024 12:59:20 GMT
content-encoding
gzip
via
1.1 google
last-modified
Fri, 30 Aug 2024 12:49:48 GMT
server
nginx/1.10.1
age
938
etag
W/"66d1bfec-3bece"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600,public
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
91364
jsdata
cas.avalon.perfdrive.com/ 		360 B
419 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: cdn.perfdrive.com
URL: https://cdn.perfdrive.com/advanced/stormcaster.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Referer
https://starchoice-1.online/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
3ms
date
Fri, 30 Aug 2024 13:14:59 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
360
content-type
text/plain; charset=UTF-8
jsdata
cas.avalon.perfdrive.com/ 		255 B
400 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cas.avalon.perfdrive.com/jsdata?
Requested by
Host: cdn.perfdrive.com
URL: https://cdn.perfdrive.com/advanced/stormcaster.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.15.240 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
240.15.241.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Referer
https://starchoice-1.online/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
x-response-time
2ms
date
Fri, 30 Aug 2024 13:14:59 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
255
content-type
text/plain; charset=UTF-8
recommend
oh-my-bot.com/
Redirect Chain
  • https://starchoice-1.online/api/v1/pxcheck?impId=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8&minfo=eyJjb29raWVEaXNhYmxlZCI6ZmFsc2UsInVhIjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0KSBBcHBsZVdlYktpdC81M...
  • http://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0
  • https://xml-v4.setlitescmode-4.online/click?seat=2892322&i=OlnQicQgEbs_0
  • https://alfebio.com/r/v2?u=bl&f=10&s1=1115058548&s2=nordvpn&s3=c7ccf4b89e6210b0acf81caa8&d=https%3A%2F%2Fnordvpn.com
  • https://oh-my-bot.com/recommend/bl9?web=nordvpn.com&nid=10&uid1=1115058548&uid2=nordvpn&uid3=c7ccf4b89e6210b0acf81caa8&url=https%3A%2F%2Fnordvpn.com&rtb_key=fd6b234c4350a3f9750066d9a56b04d9&tsv=172...
  • https://oh-my-bot.com/recommend?web=nordvpn.com
907 B
762 B 		Document
General
Check archive.org
Download Go to
Full URL
https://oh-my-bot.com/recommend?web=nordvpn.com
Requested by
Host: starchoice-1.online
URL: https://starchoice-1.online/api/v1/px?xmlid=EeRe1KceR4Hj1SApcbB1J3dh87i6lvFYZYVD4RV8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
8bb50c0f98a560f7-LHR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 30 Aug 2024 13:15:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RzHHrPmoCIMDllVUDyA7Tdf41YKCX8pFG29S6ksdB2lzweVe%2ByI%2BQRKcxck6tttomLONRR9M2cxJkDfJ4lwLL7zQFElySAJ2WIuGJG8mXGAmKbFqRkdfqrr75CJObqfW02Zu8M0j7sLTKPoh"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
8bb50c0dae6860f7-LHR
content-type
text/html; charset=utf-8
date
Fri, 30 Aug 2024 13:15:00 GMT
location
https://oh-my-bot.com/recommend?web=nordvpn.com
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
no-referrer
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nxxt6s%2FNaPqLnklGeIpzDtvibRkLcJ0T4Fegj2SnXURivBvzvFPXzEMh4uNS%2B5jmQlBMnb%2BLR50WBNbMtFRgPYYQBp0rUQwvLG5KSvEPorPLQfiFzNvBKeMBCZrYsHeoyZwa1PG5n4uOrNIH"}],"group":"cf-nel","max_age":604800}
server
cloudflare
Primary Request /
tatrck.com/v1/go/
Redirect Chain
  • https://tatrck.com/redir/clickGate.php?u=u68EH62H&m=30&p=euu8i3Ft3V&s=bl9e5887f53dbb8ad0d7fd5681f1f000&url=https%3A%2F%2Fnordvpn.com
  • https://tatrck.com/v1/go/?deeplink=https%3A%2F%2Fqwpeg.com%2Fg%2Fmai1uhgx164cc7b61b34004ed038cb%2F%3Fsubid%3D3Ceg4J3eqmtVkp4IvFvyXMUtzHtGKvrDbVrjuZ6NBJkHOY%26subid2%3Doh-my-bot.com%26subid3%3D%26su...
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tatrck.com/v1/go/?deeplink=https%3A%2F%2Fqwpeg.com%2Fg%2Fmai1uhgx164cc7b61b34004ed038cb%2F%3Fsubid%3D3Ceg4J3eqmtVkp4IvFvyXMUtzHtGKvrDbVrjuZ6NBJkHOY%26subid2%3Doh-my-bot.com%26subid3%3D%26subid4%3D247531%26ref%3Dtatrck.com%26ulp%3Dhttps%253A%252F%252Fnordvpn.com&p=euu8i3Ft3V
Requested by
Host: oh-my-bot.com
URL: https://oh-my-bot.com/recommend?web=nordvpn.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b505a153e036c918b12d78e6ede99d21f65599a0a4087e1ec8a27cc858e83b34

Request headers

Referer
https://oh-my-bot.com/recommend?web=nordvpn.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8bb50c126cbd6437-LHR
content-encoding
br
content-type
text/html
date
Fri, 30 Aug 2024 13:15:00 GMT
last-modified
Mon, 13 Nov 2023 12:55:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eISDlX61z3oMDmbKPtk7rnSMEq%2FZBhLpzWTMAc5GrF%2Bh8WgGCgZG%2BjolWZQbDW92YNaUYX4h9DVFPMP7qr4ef7GbsAQfWASuxMqzRhlb%2BCvY0FfXcJ7oLpj6cl5bcxtZbEeEtXbJq7YX"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
8bb50c11dc1c6437-LHR
content-type
text/html; charset=UTF-8
date
Fri, 30 Aug 2024 13:15:00 GMT
location
/v1/go/?deeplink=https%3A%2F%2Fqwpeg.com%2Fg%2Fmai1uhgx164cc7b61b34004ed038cb%2F%3Fsubid%3D3Ceg4J3eqmtVkp4IvFvyXMUtzHtGKvrDbVrjuZ6NBJkHOY%26subid2%3Doh-my-bot.com%26subid3%3D%26subid4%3D247531%26ref%3Dtatrck.com%26ulp%3Dhttps%253A%252F%252Fnordvpn.com&p=euu8i3Ft3V
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referer
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8dyvK8mLHipwWyZT96h3h4TM0r9%2BKzUR5yTg1tzWt1k%2BTmMUReE%2FHJjEQqetBaXbSTD5Bxo2y3CNx%2FCeVluQaOaBx7FO5flbnh6LOb%2FleP01UWcPe9T7glTom5dMHV%2FfKjXzLrjt3NE"}],"group":"cf-nel","max_age":604800}
server
cloudflare
/
nordvpn.com/special/
Redirect Chain
  • https://qwpeg.com/g/mai1uhgx164cc7b61b34004ed038cb/?subid=3Ceg4J3eqmtVkp4IvFvyXMUtzHtGKvrDbVrjuZ6NBJkHOY&subid2=oh-my-bot.com&subid3=&subid4=247531&ref=tatrck.com&ulp=https%3A%2F%2Fnordvpn.com
  • https://go.nordvpn.net/aff_c?offer_id=15&aff_id=8214&url_id=263&aff_sub=2075099&aff_sub2=734ec5f2f45443eeafdcd3cb56401d2c
  • https://visit.nordvpn.com/?offer_id=15&aff_id=8214&aff_transaction_id=102d43f734b2e1ad413b66fe4bd389&source=&params[ho_asub1]=2075099&url_id=177
  • https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=2075099&utm_campaign=off15&utm_source=aff8214
0
0
favicon.ico
tatrck.com/ 		0
408 B 		Other
General
Check archive.org
Download Go to
Full URL
https://tatrck.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://tatrck.com/euu8i3Ft3V
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Fri, 30 Aug 2024 13:15:00 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2599
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lsxg2P3VYUQW9VSlKp7HYUo0xRUTMScsnfHPWPlC77Ta5GaoWskpXQ%2FVF4bc6RKc%2FLjPjI2mw8gwdADXCjPDwDzj4IAnsVLLBySnXIY07CvZp2X5qGXlgFy0Iz58wpxK9lg9wTNJjPNy"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
cf-ray
8bb50c131d866437-LHR
alt-svc
h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
nordvpn.com
URL
https://nordvpn.com/special/?utm_medium=affiliate&utm_term=&utm_content=2075099&utm_campaign=off15&utm_source=aff8214

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| detectIEEdge

17 Cookies

Domain/Path Name / Value
.starchoice-1.online/ Name: __ssds
Value: 2
.starchoice-1.online/ Name: __ssuzjsr2
Value: a9be0cd8e
.starchoice-1.online/ Name: __uzmaj2
Value: dc898d1b-b044-42fd-ad9c-100f6866a3c7
.starchoice-1.online/ Name: __uzmbj2
Value: 1725023699
.starchoice-1.online/ Name: __uzmcj2
Value: 687111098175
.starchoice-1.online/ Name: __uzmdj2
Value: 1725023699
.starchoice-1.online/ Name: __uzmlj2
Value: 0GRmmfzUdbGQD3NBkpuvedTHhrVamBwqBBg0jeiBPdU=
.starchoice-1.online/ Name: __uzmfj2
Value: 7f60005556eb98-c26f-4193-bc9e-76cb0e123cbb17250236992020-91519905edcac38b10
alfebio.com/ Name: 07b51c5d268f008bf05acc7c3e16d71c
Value: 51b43281091f955415a8898acac18c2bf792fb8ff7855033a714d2ad5baf9f42a%3A2%3A%7Bi%3A0%3Bs%3A32%3A%2207b51c5d268f008bf05acc7c3e16d71c%22%3Bi%3A1%3Bs%3A1%3A%221%22%3B%7D
go.nordvpn.net/ Name: aff_ran_url_15
Value: 263
go.nordvpn.net/ Name: enc_aff_session_15
Value: ENC039e22df2abbb9defa7d8787e0f26415faae32bd0013c7a0190405c3f869c77dc64eba03bb30a9de08ed8d7f1b6871117e7a6b0334d95336f7938dfed05f5b0b942ede53a798713165226d575919b18aebc0424eeaf6cff0b9b3e349c1e7e50dbe48422cbdbf88b2e8a98bd2580391584d187d53ba3cae5b2a84952cf1aeb5c1321426d7d720c9481ff9e158d41e89d6d21f88d9c8e0ae24cbe77d10c0a90b6da0eee677c80b4f1e428e86770420f4244f3f7fd74388c1c4e86456516643107305038fba4e
go.nordvpn.net/ Name: ho_mob
Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMjgiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJlbi1HQixlbjtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJ4ZHNsIn0=
.nordvpn.com/ Name: aff_id
Value: 8214
.nordvpn.com/ Name: aff_transaction_id
Value: 102d43f734b2e1ad413b66fe4bd389
.nordvpn.com/ Name: nordvpn_aff_id
Value: 8214
.nordvpn.com/ Name: nordvpn_aff_transaction_id
Value: 102d43f734b2e1ad413b66fe4bd389
.nordvpn.com/ Name: __cf_bm
Value: 9dR9KdNjqtjtbkYJwni0Q.U2o1b1uHiw5tJlCdf3YHo-1725023701-1.0.1.1-mfUXHXNa.oSfZOJR2zlBE.65sHyWVPHBptAdMjJt3ZxQINqwRK_oXxP4pn6Rm8..hpkMW1vw2Fe2jRaHB.eaUdtaXlIHa3M40jUU2BBDyeo