![](/screenshots/057eca90-22b8-402e-88ec-151f035a9a9a.png)
secure.winred.com
Open in
urlscan Pro
2606:4700::6812:9b15
Public Scan
Effective URL: https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.100863_t1300746-573&ex_ti...
Submission: On January 11 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 23rd 2022. Valid for: a year.
This is the only time secure.winred.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 128.245.97.53 128.245.97.53 | 14340 (SALESFORCE) (SALESFORCE) | |
16 | 2606:4700::68... 2606:4700::6812:9b15 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
17 | 2 |
ASN14340 (SALESFORCE, US)
PTR: click.email.thenrcc.org
click.email.thenrcc.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
winred.com
secure.winred.com — Cisco Umbrella Rank: 80629 |
224 KB |
1 |
thenrcc.org
1 redirects
click.email.thenrcc.org — Cisco Umbrella Rank: 295536 |
333 B |
17 | 2 |
Domain | Requested by | |
---|---|---|
16 | secure.winred.com |
secure.winred.com
|
1 | click.email.thenrcc.org | 1 redirects |
17 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure.winred.com Cloudflare Inc ECC CA-3 |
2022-03-23 - 2023-03-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.100863_t1300746-573&ex_tid=20230110_FY-XP.100863_t1300746-573
Frame ID: 8F75FBCF320CEB5E6CA40AFDB8ECF842
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/057eca90-22b8-402e-88ec-151f035a9a9a.png)
Page Title
Just a moment...Page URL History Show full URLs
-
https://click.email.thenrcc.org/?qs=7b7af579cb84d60e966d45d248c42b6a56d37027b8d3ac945fdf8175adbf7af82c08edc4...
HTTP 302
https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.10086... Page URL
- https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.10086... Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://click.email.thenrcc.org/?qs=7b7af579cb84d60e966d45d248c42b6a56d37027b8d3ac945fdf8175adbf7af82c08edc4aebc3b96287faf3c6517d58776261e83f477156d7c9414511db7cad8
HTTP 302
https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.100863_t1300746-573&ex_tid=20230110_FY-XP.100863_t1300746-573 Page URL
- https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.100863_t1300746-573&ex_tid=20230110_FY-XP.100863_t1300746-573 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://click.email.thenrcc.org/?qs=7b7af579cb84d60e966d45d248c42b6a56d37027b8d3ac945fdf8175adbf7af82c08edc4aebc3b96287faf3c6517d58776261e83f477156d7c9414511db7cad8 HTTP 302
- https://secure.winred.com/nrcc/fired-nancy-sticker-5/?recurring=true&utm_campaign=20230110_FY-XP.100863_t1300746-573&ex_tid=20230110_FY-XP.100863_t1300746-573
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
secure.winred.com/nrcc/fired-nancy-sticker-5/ Redirect Chain
|
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
challenges.css
secure.winred.com/cdn-cgi/styles/ |
6 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
secure.winred.com/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
secure.winred.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/ |
46 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
transparent.gif
secure.winred.com/cdn-cgi/images/trace/jsch/js/ |
42 B 258 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
586 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
d7c7ce133c3780a
secure.winred.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.1718080414046095:1673417826:Likn9f_iOBLC-K6DdID1WW6XxUL_XrM1nnV4q-XbADA/787bcb123ae590a3/ |
91 KB 59 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
YRWLJG-yA0HoSLc
secure.winred.com/cdn-cgi/challenge-platform/h/g/img/787bcb123ae590a3/1673420613696/ |
61 B 191 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Egsy40uq9zw375v
secure.winred.com/cdn-cgi/challenge-platform/h/g/pat/787bcb123ae590a3/1673420613698/10a6a4f88c83fbbe984195d33af0307400a01e4d47ceac0b83b3fb5cd499092f/ |
1 B 661 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
d7c7ce133c3780a
secure.winred.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.1718080414046095:1673417826:Likn9f_iOBLC-K6DdID1WW6XxUL_XrM1nnV4q-XbADA/787bcb123ae590a3/ |
1 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
secure.winred.com/nrcc/fired-nancy-sticker-5/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
challenges.css
secure.winred.com/cdn-cgi/styles/ |
6 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
secure.winred.com/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
secure.winred.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/ |
49 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
transparent.gif
secure.winred.com/cdn-cgi/images/trace/jsch/js/ |
42 B 222 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
586 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
2b499b906f59290
secure.winred.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.9134745637360723:1673417828:ANFDCyzL1LMwLr_YFEocX_STyU8pJs55IN30rGKVSsc/787bcb272e5c5c56/ |
138 KB 78 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
zA-A56MjnGfDUKp
secure.winred.com/cdn-cgi/challenge-platform/h/g/img/787bcb272e5c5c56/1673420617047/ |
61 B 191 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNv0fWkEILhxYck
secure.winred.com/cdn-cgi/challenge-platform/h/g/pat/787bcb272e5c5c56/1673420617047/dc30a0fcbbfbb37a0516219c6eb5d5515bbaebed0135134e171140598fd81c88/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secure.winred.com
- URL
- https://secure.winred.com/cdn-cgi/challenge-platform/h/g/pat/787bcb272e5c5c56/1673420617047/dc30a0fcbbfbb37a0516219c6eb5d5515bbaebed0135134e171140598fd81c88/RNv0fWkEILhxYck
Verdicts & Comments Add Verdict or Comment
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange object| _cf_chl_opt function| sendRequest function| _cf_chl_enter boolean| _cf_chl_done_ran function| _cf_chl_done function| SHA256 object| _cf_chl_ctx string| prefix object| _3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.secure.winred.com/ | Name: __cf_bm Value: Q8uViv7Rg76L9.RjETWWFlvUL4pS4wSljKS2F2glmsg-1673420613-0-AUhtA50VRPmXQRSDFY1RNaq0lwPcVy2gcDCVIGvkS4c5FciX/mM8lWlCunJVNMi90ZzsZUvpPOVWUSkcfGaCljWYVK/rjnRr/wOnmWEcJU0X |
|
secure.winred.com/ | Name: cf_chl_rc_ni Value: 1 |
|
secure.winred.com/ | Name: cf_chl_2 Value: 2b499b906f59290 |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
click.email.thenrcc.org
secure.winred.com
secure.winred.com
128.245.97.53
2606:4700::6812:9b15
00e21f82c1cf357f1d062ea5c8a8675c3dd84425d8bc15e832234d27c341f50a
058204df2672d8c667332f51066c5c3c94733ff0875e1279e90d689ba204f95d
1752a43a6e163dd522b8ddd59506aca942f646dc76b57e280d273943a9a194be
25621d6e6c3e0c704ab247a7da188c4d13ff401f172c4c26a92a453e16ddcdc1
590755b6d0d946b7e7c8f63ec0bd477b28b1efc14f7800cb5c079b01b12afc7c
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6c58a16040510bd12ac97c68dbb26eee9fc3aff5f3a2acbc96b15ba7f91b0e4a
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
913c9403035b1e8f17c53e4bd2bd31d98bbc0c6514a215727065f3d90ee0deea
a69c593071b902908a28b27aa59b1735efd7e11bf21a9847db1e4cb1c467d084
ad89bd16e29313f673a06a9d04563a5613052da272a524372fad158258a95af6
cf89381f18c7892c8111a53dea3f071c6686e2d0a1c7f13bfa798febb25cbe66
d4e04bcd7e6aa2011f94d8dd38b634a3377078d77e0fb0bf69f7b419b47b696c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efdb5bcc25efa09532fbbf93e67a4bd0f74016ad3cfe118a2fbc94296adf875b
faa67d3b2b2220dc526c921c1fc47df5b956559a293d5e07fbaf58a52462f6bd
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa