xtretre4-com.preview-domain.com Open in urlscan Pro
104.18.24.120 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ht.ly/whaj30rTyGk
Effective URL:
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Submission: On September 10 via manual (September 10th 2021, 6:23:45 pm UTC) — Scanned from DE

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 104.18.24.120, located in and belongs to CLOUDFLARENET, US. The main domain is xtretre4-com.preview-domain.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 4th 2021. Valid for: a year.

This is the only time xtretre4-com.preview-domain.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.67.62.204 54.67.62.204	16509 (AMAZON-02) (AMAZON-02)
1 1	99.84.82.83 99.84.82.83	16509 (AMAZON-02) (AMAZON-02)
11	104.18.24.120 104.18.24.120	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2

1 54.67.62.204 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ow.ly

ht.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.82.83 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-99-84-82-83.muc50.r.cloudfront.net

h3gfh.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.18.24.120 (None, )

ASN13335 (CLOUDFLARENET, US)

xtretre4-com.preview-domain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	preview-domain.com xtretre4-com.preview-domain.com	115 KB
1	app.link 1 redirects h3gfh.app.link	461 B
1	ht.ly 1 redirects ht.ly	390 B
12	3

	Domain	Requested by
11	xtretre4-com.preview-domain.com	xtretre4-com.preview-domain.com
1	h3gfh.app.link	1 redirects
1	ht.ly	1 redirects
12	3

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-04` - `2022-07-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Frame ID: 224B3F563707E081629857F7D24FD497
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

http://ht.ly/whaj30rTyGk HTTP 301
https://h3gfh.app.link/87utggggg4334g4 HTTP 307
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925 Page URL
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925 Page URL

Detected technologies

hCaptcha (Security) Expand

Overall confidence: 100%
Detected patterns

<style[^>]+[^<]+#cf-hcaptcha-container[^<]+</style>

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

115 kB
Transfer

214 kB
Size

3
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/5xx-error-landing/
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ht.ly/whaj30rTyGk HTTP 301
https://h3gfh.app.link/87utggggg4334g4 HTTP 307
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925 Page URL
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://ht.ly/whaj30rTyGk HTTP 301
https://h3gfh.app.link/87utggggg4334g4 HTTP 307
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

12 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

503

/ Show response
xtretre4-com.preview-domain.com/
Redirect Chain

http://ht.ly/whaj30rTyGk
https://h3gfh.app.link/87utggggg4334g4
https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

10 KB
10 KB

170ms
36ms

Document
text/html

104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8665fe5de777ec242fa920654f5ab77b6508ee18999f70396149194d7e252339

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: xtretre4-com.preview-domain.com
:scheme: https
:path: /?_branch_match_id=964941553917315925
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 10 Sep 2021 18:23:41 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 68cab059ca352788-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

location: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
server: openresty
date: Fri, 10 Sep 2021 18:23:40 GMT
x-powered-by: Express
set-cookie: _s=F6nKFfCrgCIgI3lwIupiDeHTIJ6l4mRBwRwYQOKIuyH7rU7gYvothgbOk2mFxS5P; Max-Age=31536000; Domain=.app.link; Path=/; Expires=Sat, 10 Sep 2022 18:23:40 GMT; Secure; SameSite=None
last-modified: Fri, 10 Sep 2021 18:23:40 GMT
x-cache: Miss from cloudfront
via: 1.1 dcc00cbe52c84a141576f927caec03b4.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-C1
x-amz-cf-id: cgy_Q8eTeiJDZgVfgQndVsDk832HXgvqDKg2lTp_sqtXJrglTpJHSQ==

GET
H2 200 v1 Show response
xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/ 38 KB
13 KB 67ms
66ms Script
text/javascript 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab059ca352788
Requested by: Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbc54ba13b369cb10468c9aef2e6ba0e2d2dcc3858928a2f8143b3d50087a42f

Request headers

:path: /cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab059ca352788
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:23:41 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, must-revalidate
cf-ray: 68cab05a2b132788-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 transparent.gif
xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/js/ 42 B
101 B 21ms
20ms Image
image/gif 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/js/transparent.gif?ray=68cab059ca352788

Requested by

Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/images/trace/jschal/js/transparent.gif?ray=68cab059ca352788
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:23:41 GMT
x-content-type-options: nosniff
last-modified: Tue, 07 Sep 2021 12:25:28 GMT
server: cloudflare
etag: "61375a38-2a"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=7200 public
accept-ranges: bytes
cf-ray: 68cab05a2b162788-PRG
vary: Accept-Encoding
content-length: 42
expires: Fri, 10 Sep 2021 20:23:41 GMT

GET
H2 200 transparent.gif
xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/nojs/ 42 B
220 B 20ms
20ms Image
image/gif 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/nojs/transparent.gif?ray=68cab059ca352788

Requested by

Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/images/trace/jschal/nojs/transparent.gif?ray=68cab059ca352788
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:23:41 GMT
x-content-type-options: nosniff
last-modified: Tue, 07 Sep 2021 12:25:28 GMT
server: cloudflare
etag: "61375a38-2a"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=7200 public
accept-ranges: bytes
cf-ray: 68cab05a2b182788-PRG
vary: Accept-Encoding
content-length: 42
expires: Fri, 10 Sep 2021 20:23:41 GMT

POST
H3 200 18fd92e6efd1891 Show response
xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab059ca352788/ 61 KB
33 KB 105ms
104ms XHR
text/plain 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab059ca352788/18fd92e6efd1891
Requested by: Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab059ca352788
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bda5e50cb3d29a6c2dda650317a89177e79bb3aa29a641a52ccdd6c7c08e329e

Request headers

sec-fetch-mode: cors
origin: https://xtretre4-com.preview-domain.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
cookie: cf_chl_prog=e
content-length: 1957
:path: /cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab059ca352788/18fd92e6efd1891
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: */*
cache-control: no-cache
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
cf-challenge: 18fd92e6efd1891
:method: POST
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
CF-Challenge: 18fd92e6efd1891
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 10 Sep 2021 18:23:41 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
set-cookie: cf_chl_seq_18fd92e6efd1891=d03a0bcabef81b3;SameSite=Strict;Secure;HttpOnly
cf-ray: 68cab05abc172774-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8db5683b03bcc1fddae0af0e25c0bad89aec1aed75fff9217cd056c17d76599

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 18fd92e6efd1891 Show response
xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab059ca352788/ 2 KB
2 KB 149ms
148ms XHR
text/plain 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab059ca352788/18fd92e6efd1891
Requested by: Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab059ca352788
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4381268051f2762de30f27b7a71728e6ace5c93c758dfe45a1d9267a974113f7

Request headers

sec-fetch-mode: cors
origin: https://xtretre4-com.preview-domain.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
cookie: cf_chl_seq_18fd92e6efd1891=d03a0bcabef81b3; cf_chl_prog=a5
content-length: 19581
:path: /cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab059ca352788/18fd92e6efd1891
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: */*
cache-control: no-cache
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
cf-challenge: 18fd92e6efd1891
:method: POST
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
CF-Challenge: 18fd92e6efd1891
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 10 Sep 2021 18:23:41 GMT
content-encoding: gzip
server: cloudflare
cf_chl_out: Qfa2yMnzzBZeiYms4pa4twyX57cEOSPcI/EOaxcl9vyw3Xj1NloL0Y2J6uV9d5RYL0SaYdVQn/iNzeR0vkLFFA==$UwFnFaEO4YPbS577ZNkNGA==
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/plain;charset=UTF-8
cf_chl_out_s: ev+eGyOtTpELwN9fMcllX7b3pPztuQiIYPwJdYM1vSQ2i+lt5NE70OwIdR+kxcMLFluZYjuNTSTpAhJJluCqow==$bKjlQdwpvHtfr8W/gCrJog==
set-cookie: cf_chl_seq_18fd92e6efd1891=;Expires=Thu, 09 Sep 2021 18:23:41 GMT;SameSite=Strict;Secure;HttpOnly
cf-ray: 68cab05cc86d2774-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET /
xtretre4-com.preview-domain.com/ 0
0

GET
H3 503 Primary Request / Show response
xtretre4-com.preview-domain.com/ 9 KB
10 KB 29ms
28ms Document
text/html 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Requested by

Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f90822cdf16c8a1917c6997569d2cf1570d4df2a199a2724ee26e02a98c209d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: xtretre4-com.preview-domain.com
:scheme: https
:path: /?_branch_match_id=964941553917315925
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
accept-encoding: gzip, deflate, br
cookie: cf_chl_prog=F10; cf_chl_rc_ni=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Response headers

date: Fri, 10 Sep 2021 18:23:44 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 68cab06d5d612774-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 v1 Show response
xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/ 38 KB
13 KB 644ms
644ms Script
text/javascript 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab06d5d612774
Requested by: Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbc54ba13b369cb10468c9aef2e6ba0e2d2dcc3858928a2f8143b3d50087a42f

Request headers

:path: /cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab06d5d612774
pragma: no-cache
cookie: cf_chl_prog=F10; cf_chl_rc_ni=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:23:44 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, must-revalidate
cf-ray: 68cab06d9df32774-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 transparent.gif
xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/js/ 42 B
222 B 15ms
15ms Image
image/gif 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/js/transparent.gif?ray=68cab06d5d612774

Requested by

Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/images/trace/jschal/js/transparent.gif?ray=68cab06d5d612774
pragma: no-cache
cookie: cf_chl_prog=F10; cf_chl_rc_ni=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:23:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 07 Sep 2021 12:25:28 GMT
server: cloudflare
etag: "61375a38-2a"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=7200 public
accept-ranges: bytes
cf-ray: 68cab06d9df82774-PRG
vary: Accept-Encoding
content-length: 42
expires: Fri, 10 Sep 2021 20:23:44 GMT

GET
H3 200 transparent.gif
xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/nojs/ 42 B
222 B 16ms
16ms Image
image/gif 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://xtretre4-com.preview-domain.com/cdn-cgi/images/trace/jschal/nojs/transparent.gif?ray=68cab06d5d612774

Requested by

Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/images/trace/jschal/nojs/transparent.gif?ray=68cab06d5d612774
pragma: no-cache
cookie: cf_chl_prog=F10; cf_chl_rc_ni=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:23:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 07 Sep 2021 12:25:28 GMT
server: cloudflare
etag: "61375a38-2a"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=7200 public
accept-ranges: bytes
cf-ray: 68cab06d9dfb2774-PRG
vary: Accept-Encoding
content-length: 42
expires: Fri, 10 Sep 2021 20:23:44 GMT

POST
H3 200 1438ce1791ca7dc
xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab06d5d612774/ 57 KB
32 KB 113ms
112ms XHR
text/plain 104.18.24.120
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab06d5d612774/1438ce1791ca7dc
Requested by: Host: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=68cab06d5d612774
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.120 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-fetch-mode: cors
origin: https://xtretre4-com.preview-domain.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
cookie: cf_chl_rc_ni=1; cf_chl_prog=e
content-length: 1906
:path: /cdn-cgi/challenge-platform/h/g/flow/ov1/0.9601692569337099:1631297293:8afb6f57ca11aab1815c18c23e04d73e1b5c91125e99b901c6a9b559a5617ae1/68cab06d5d612774/1438ce1791ca7dc
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: */*
cache-control: no-cache
:authority: xtretre4-com.preview-domain.com
referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
:scheme: https
sec-fetch-site: same-origin
cf-challenge: 1438ce1791ca7dc
:method: POST
Referer: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
CF-Challenge: 1438ce1791ca7dc
Content-type: application/x-www-form-urlencoded

Response headers

date: Fri, 10 Sep 2021 18:23:45 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
set-cookie: cf_chl_seq_1438ce1791ca7dc=072bbc5e1feb0eb;SameSite=Strict;Secure;HttpOnly
cf-ray: 68cab071df1e2774-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 184 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: xtretre4-com.preview-domain.com
URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| _cf_chl_opt function| _cf_chl_enter

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.app.link/	1970-01-20 05:53:54	Name: _s Value: F6nKFfCrgCIgI3lwIupiDeHTIJ6l4mRBwRwYQOKIuyH7rU7gYvothgbOk2mFxS5P
xtretre4-com.preview-domain.com/	1970-01-19 21:08:21	Name: cf_chl_prog Value: F10
xtretre4-com.preview-domain.com/	1970-01-19 21:08:21	Name: cf_chl_rc_ni Value: 1

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network	error	URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925 Message: Failed to load resource: the server responded with a status of 503 ()
deprecation	warning	(Line 4) Message: 'window.webkitStorageInfo' is deprecated. Please use 'navigator.webkitTemporaryStorage' or 'navigator.webkitPersistentStorage' instead.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network	error	URL: https://xtretre4-com.preview-domain.com/?_branch_match_id=964941553917315925 Message: Failed to load resource: the server responded with a status of 503 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

h3gfh.app.link
ht.ly
xtretre4-com.preview-domain.com
xtretre4-com.preview-domain.com
104.18.24.120
54.67.62.204
99.84.82.83
4381268051f2762de30f27b7a71728e6ace5c93c758dfe45a1d9267a974113f7
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
8665fe5de777ec242fa920654f5ab77b6508ee18999f70396149194d7e252339
8f90822cdf16c8a1917c6997569d2cf1570d4df2a199a2724ee26e02a98c209d
a8db5683b03bcc1fddae0af0e25c0bad89aec1aed75fff9217cd056c17d76599
bda5e50cb3d29a6c2dda650317a89177e79bb3aa29a641a52ccdd6c7c08e329e
cbc54ba13b369cb10468c9aef2e6ba0e2d2dcc3858928a2f8143b3d50087a42f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

xtretre4-com.preview-domain.com Open in urlscan Pro 104.18.24.120 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

115 kBTransfer

214 kBSize

3 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

3 Cookies

5 Console Messages

Security Headers

Indicators

xtretre4-com.preview-domain.com Open in urlscan Pro
104.18.24.120 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

115 kB
Transfer

214 kB
Size

3
Cookies

12 HTTP transactions
4 data transactions