![](/screenshots/252a0e15-3dca-4d46-a64a-e58702771260.png)
ca.12xlwin8.net
Open in
urlscan Pro
172.67.135.23
Public Scan
Effective URL: https://ca.12xlwin8.net/index.php?v=5034
Submission: On July 31 via api from US — Scanned from CA
Summary
TLS certificate: Issued by WE1 on June 18th 2024. Valid for: 3 months.
This is the only time ca.12xlwin8.net was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 116.202.12.61 116.202.12.61 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 1 | 46.4.172.148 46.4.172.148 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 1 | 2606:4700:303... 2606:4700:3033::6815:1c56 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 172.67.179.203 172.67.179.203 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 172.67.177.35 172.67.177.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 34.239.206.72 34.239.206.72 | 14618 (AMAZON-AES) (AMAZON-AES) | |
10 | 172.67.135.23 172.67.135.23 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0d::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.4.33 152.199.4.33 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0f::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c07::5e | 15169 (GOOGLE) (GOOGLE) | |
14 | 5 |
ASN24940 (HETZNER-AS, DE)
PTR: static.148.172.4.46.clients.your-server.de
nastobad.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-239-206-72.compute-1.amazonaws.com
x.trc85.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
12xlwin8.net
ca.12xlwin8.net inc-ca.12xlwin8.net |
536 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 fonts.googleapis.com — Cisco Umbrella Rank: 110 |
34 KB |
1 |
gstatic.com
fonts.gstatic.com |
29 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 5661 |
8 KB |
1 |
trc85.com
1 redirects
x.trc85.com |
2 KB |
1 |
bhjkf.com
1 redirects
trk.bhjkf.com |
1013 B |
1 |
bytefixgq.com
1 redirects
sctrk2.bytefixgq.com |
766 B |
1 |
zsylo.com
1 redirects
sctrk.zsylo.com |
756 B |
1 |
nastobad.com
1 redirects
nastobad.com |
489 B |
1 |
trckfollowme.com
1 redirects
trckfollowme.com — Cisco Umbrella Rank: 941546 |
380 B |
14 | 10 |
Domain | Requested by | |
---|---|---|
5 | inc-ca.12xlwin8.net |
ca.12xlwin8.net
|
5 | ca.12xlwin8.net |
ca.12xlwin8.net
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
ca.12xlwin8.net
|
1 | ajax.aspnetcdn.com |
ca.12xlwin8.net
|
1 | ajax.googleapis.com |
ca.12xlwin8.net
|
1 | x.trc85.com | 1 redirects |
1 | trk.bhjkf.com | 1 redirects |
1 | sctrk2.bytefixgq.com | 1 redirects |
1 | sctrk.zsylo.com | 1 redirects |
1 | nastobad.com | 1 redirects |
1 | trckfollowme.com | 1 redirects |
14 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
12xlwin8.net WE1 |
2024-06-18 - 2024-09-16 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ca.12xlwin8.net/index.php?v=5034
Frame ID: 643332877C816F61012293923F424B8C
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/252a0e15-3dca-4d46-a64a-e58702771260.png)
Page Title
CostcoDetected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://trckfollowme.com/click.php?key=i089bmk9trbffdqxa9hx&clickid=GFk4w4MBaJ2pG3C_tj7oAcr-L4AC3IqhwrDYku0B&cost=0.0000&zoneid=786250&device=desktop&useragent=Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+AppleWebKit/537.36+(KHTML HTTP 302
- https://nastobad.com/s?k=cdcfc65765dfac27&click_id=4d5c3e2ghlpe2dzc55&source_id=786250 HTTP 302
- https://sctrk.zsylo.com/451dc331-ed80-0a43-875a-5e4eb5f0f358/?transaction_id=9040b0f0b3b556eab30e0809&offer_id=7941&aff_id=717&aff_sub=&msisdn={mobile}&email={email} HTTP 301
- https://sctrk2.bytefixgq.com/7a9883d6-ccce-38a2-408e-9e906955313a?fb=yes&src=amz_km_ca_a1_sh367_pp_adr2&transaction_id=9040b0f0b3b556eab30e0809&offer_id=7941&aff_id=717&aff_sub=&sl1=ed9f0c4e-36f8-c041-e43f-ca1b2ab950f1&sl2=D4CN3ztX&sl3=B3L5lqJd&sl4=t5Ys2AiG&stp= HTTP 301
- https://trk.bhjkf.com/282d8e40-51e8-44da-aa74-872711413aa4?fb=yes&src=amz_km_ca_a1_sh367_pp_adr2&transaction_id=9040b0f0b3b556eab30e0809&offer_id=7941&aff_id=717&aff_sub=&sl1=dd296428-8c2c-34b7-cc6d-482a7c5816ff&sl2=xyyyysJY&sl3=KaBxINFO&sl4=t5Ys2AiG&stp= HTTP 302
- http://x.trc85.com/aff_c?offer_id=3498&aff_id=3172&url_id=12754&source=&aff_sub=w4ab26noluls834334vsjcbe HTTP 307
- https://x.trc85.com/aff_c?offer_id=3498&aff_id=3172&url_id=12754&source=&aff_sub=w4ab26noluls834334vsjcbe HTTP 302
- https://ca.12xlwin8.net/gtrax.php?ct=1&v=5034&aff_id=3172&offer_id=3498&sub_source=&t1=102fc7f2150cdd3b4b792f7d8ab9d9&t2=w4ab26noluls834334vsjcbe&t3=167.114.209.103&t4=&udc=Desktop--Google--Chrome--%3F&gender={gender}&email={email}&firstname={firstname}&lastname={lastname}&pl={pl}
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
gtrax.php
ca.12xlwin8.net/ Redirect Chain
|
0 565 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
index.php
ca.12xlwin8.net/ |
19 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
ca.12xlwin8.net/ |
196 B 600 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gen.css
ca.12xlwin8.net/css/ |
19 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
template50.css
ca.12xlwin8.net/css/ |
36 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ |
91 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
ajax.aspnetcdn.com/ajax/jquery.validate/1.10.0/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 955 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
CA_5034_IMG_P1_4_COSTCO_CA.png
inc-ca.12xlwin8.net/images2/ |
94 KB 94 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
CA_5034_IMG_P1_5_COSTCO_CA.png
inc-ca.12xlwin8.net/images2/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
CA_5034_IMG_P1_6_COSTCO_CA.png
inc-ca.12xlwin8.net/images2/ |
219 KB 219 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
CA_5034_BODY_BACKGROUND_IMAGE_COSTCO_CA.jpg
inc-ca.12xlwin8.net/images2/ |
179 KB 180 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
u-4k0rCzjgs5J7oXnJcM_0kACGMtT-Dfqw.woff2
fonts.gstatic.com/s/ubuntucondensed/v16/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
inc-ca.12xlwin8.net/images/ |
198 B 541 B |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| unhide function| hide function| toggle_display function| $ function| jQuery function| open_affiliate_div function| close_affiliate_div11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
trckfollowme.com/ | Name: uclick Value: e2ghlpe2dz |
|
trckfollowme.com/ | Name: uclickhash Value: e2ghlpe2dz-e2ghlpe2dz-16a0-0-lpj2-ciu33y-ikqe-72352f |
|
nastobad.com/ | Name: aff_tds_id Value: 6000c2a9d40899fd2b065bf8a4f2a1b8f44c47f69aa24ae56bb8fe0c61a0977aa%3A2%3A%7Bi%3A0%3Bs%3A10%3A%22aff_tds_id%22%3Bi%3A1%3Bs%3A16%3A%228c518edfc689fcdb%22%3B%7D |
|
sctrk.zsylo.com/ | Name: PHPSESSID Value: t699d09lsu01o1qf6ub434c271 |
|
sctrk2.bytefixgq.com/ | Name: PHPSESSID Value: hhdbtg4ndb5rumo0e5r9be6n83 |
|
.trk.bhjkf.com/ | Name: 282d8e40-51e8-44da-aa74-872711413aa4-v4 Value: nQrXtarbKU-HyM6H4ShRekLoBI0QEC92WWqkqCRfENM |
|
.trk.bhjkf.com/ | Name: voluum-cid-v4 Value: %7B%22cid%22%3A%22w4ab26noluls834334vsjcbe%22%2C%22caid%22%3A%22282d8e40-51e8-44da-aa74-872711413aa4%22%7D |
|
x.trc85.com/ | Name: aff_ran_url_3498 Value: 12754 |
|
x.trc85.com/ | Name: enc_aff_session_3498 Value: ENC034952971e67e3b181acbbf46076413e49bd7f339eddbc2b21317dc5604f3eefd33bb1b797ebe1a8bc2f936739443eb403e4ca7ca8e55ab1bf46801689a7665ab10287fa2a544303a824806a52c4e2044eccc599a5acbd86be6bfe2eb949143818d4e2ca972ebe7f8eaf9f3ceb342ca04016f4cc4bd534c91d52517a0893a0f5c1e0feccf431b34af47c70b026053dce182fcbe9b0da7a7f32ca7d69890e64ebc909193109 |
|
x.trc85.com/ | Name: ho_mob Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMjciLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTI3LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJlbi1DQSxlbjtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ== |
|
ca.12xlwin8.net/ | Name: PHPSESSID Value: 6rbfpj2lp1ic0je3m4jv34tncc |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
ajax.googleapis.com
ca.12xlwin8.net
fonts.googleapis.com
fonts.gstatic.com
inc-ca.12xlwin8.net
nastobad.com
sctrk.zsylo.com
sctrk2.bytefixgq.com
trckfollowme.com
trk.bhjkf.com
x.trc85.com
116.202.12.61
152.199.4.33
172.67.135.23
172.67.177.35
172.67.179.203
2606:4700:3033::6815:1c56
2607:f8b0:4004:c07::5e
2607:f8b0:400d:c0d::5f
2607:f8b0:400d:c0f::5f
34.239.206.72
46.4.172.148
25461c9daecd2982601519df8b20983f941da8fb33e63b489f8b468369cfd870
37134e467c044d66650008860134ed1ffe56ccff1ba11dc385d798b7c9ed6e0d
5c416c07633987fe910c91ff632c45e0e2366afde556b74713c236b2f51cd130
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
6b1adc37a16294b5127dc6e84c9fc36e1f50bac718dcfe35f60f466fdf692bbf
6e096459890ee866f93a796e37e4137330fb79680c2cb4366eccf347387284f2
9deb629637088856fe61dc868bf40a7d21ed942e4117659f3d6c3408f59b906b
a9d642e84bc12e2e23178951712e4e96be430987542fe251add4b6ca81951bf3
b98989421be69558bdad8096c25f508eec9b745fb9f9c23e633054e713aefe8e
cde0578486717bb6f75c3a33376116b77677619475c38b5904258e5b118e8436
d5b698dcfec204c9d774b76e517b25edf465b982830e50508481cd1e4594dac4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb365de257406c58ce3112f04f21f3d1bb0ee6f038c0d7ba66f3e24445e7f9ca