urlscan.io logo urlscan.io
SecurityTrails logo

www1.trfrc.com Open in urlscan Pro
2606:4700:3034::ac43:c74c  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://u.to/h_3QGw
Effective URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&re...
Submission: On December 10 via manual — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 7 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3034::ac43:c74c, located in United States and belongs to CLOUDFLARENET, US. The main domain is www1.trfrc.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 10th 2021. Valid for: a year.
This is the only time www1.trfrc.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 195.216.243.155 57724 (DDOS-GUARD)
3 7 2a02:6b8::1:119 208722 (YNDX)
1 2 88.212.201.204 39134 (UNITEDNET)
1 1 87.236.16.62 198610 (BEGET-AS)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
7 2606:4700:303... 13335 (CLOUDFLAR...)
13 4
2    195.216.243.155 (Moscow, Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: s5.unet.com
u.to
7    2a02:6b8::1:119 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)
mc.yandex.ru
mc.yandex.com
2    88.212.201.204 (Russian Federation)

ASN39134 (UNITEDNET, RU)
PTR: host204.rax.ru
counter.yadro.ru
1    87.236.16.62 (Russian Federation)

ASN198610 (BEGET-AS, RU)
PTR: ssl.orion.beget.com
btfk.cc
1    2606:4700:3037::6815:1a14 (United States)

ASN13335 (CLOUDFLARENET, US)
track.trackbyfast.com
7    2606:4700:3034::ac43:c74c (United States)

ASN13335 (CLOUDFLARENET, US)
www1.trfrc.com
Apex Domain
Subdomains		 Transfer
7 trfrc.com
www1.trfrc.com
7 MB
5 yandex.com
mc.yandex.com
2 KB
2 yadro.ru
counter.yadro.ru
1 KB
2 yandex.ru
mc.yandex.ru
67 KB
2 u.to
u.to
1 KB
1 trackbyfast.com
track.trackbyfast.com
832 B
1 btfk.cc
btfk.cc
491 B
13 7
Domain Requested by
7 www1.trfrc.com u.to
www1.trfrc.com
5 mc.yandex.com 2 redirects u.to
2 counter.yadro.ru 1 redirects u.to
2 mc.yandex.ru 1 redirects u.to
2 u.to 1 redirects
1 track.trackbyfast.com 1 redirects
1 btfk.cc 1 redirects
13 7

This site contains no links.

Subject Issuer Validity Valid
u.to
GoGetSSL RSA DV CA		 2021-10-04 -
2022-10-04		 a year crt.sh
mc.yandex.ru
Yandex CA		 2021-07-28 -
2022-01-07		 5 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-10 -
2022-06-09		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Frame ID: 465BA1965D545ED8CABD56CA177F47C3
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Beachtung! Diese Seite ist nur für Erwachsene!

Page URL History Show full URLs

  1. http://u.to/h_3QGw HTTP 301
    https://u.to/h_3QGw Page URL
  2. https://btfk.cc/gfd54tghf8ew9vbc32h455f0hg45r75gf5d?w HTTP 302
    https://track.trackbyfast.com/click?pid=1850&offer_id=25&sub1=2avt9soet1oaddia HTTP 302
    https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&ac... Page URL

Page Statistics

13
Requests

77 %
HTTPS

50 %
IPv6

7
Domains

7
Subdomains

4
IPs

2
Countries

7569 kB
Transfer

7687 kB
Size

18
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://u.to/h_3QGw HTTP 301
    https://u.to/h_3QGw Page URL
  2. https://btfk.cc/gfd54tghf8ew9vbc32h455f0hg45r75gf5d?w HTTP 302
    https://track.trackbyfast.com/click?pid=1850&offer_id=25&sub1=2avt9soet1oaddia HTTP 302
    https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://u.to/h_3QGw HTTP 301
  • https://u.to/h_3QGw
Request Chain 2
  • https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/h_3QGw;1639148516128 HTTP 302
  • https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/h_3QGw;1639148516128
Request Chain 3
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9483.91w7LSGqWo_Mu_ihvpuwedKXSle40vU4nnWIyIyo2_lVEPA9tsOkKcryOJesymxu.v0T4IOpUTOLysoNVqc7f9uK1T6k%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9483.URGm5V2R83grJ-HyxCQcGvBDrqim9Rqx2JnoHGpQ83d888XfS8b9yctr3SpX0hIVBSml3a-Dn_HYU3DjnwxwLQ%2C%2C.fmHX4oCbRmPu0hT4QCaYneuSXQA%2C
Request Chain 5
  • https://mc.yandex.com/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2Fh_3QGw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aykcyjkqfph1z85b6in%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A720%3Acn%3A1%3Adp%3A0%3Als%3A1490162717849%3Ahid%3A969929664%3Az%3A0%3Ai%3A202112010150156%3Aet%3A1639148516%3Ac%3A1%3Arn%3A282680103%3Arqn%3A1%3Au%3A1639148516518918896%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1639148515792%3Ads%3A0%2C148%2C68%2C0%2C102%2C0%2C%2C17%2C0%2C%2C%2C%2C338%3Adsn%3A0%2C148%2C67%2C1%2C101%2C0%2C%2C19%2C0%2C%2C%2C%2C337%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1639148517%3At%3ARedirecting&t=gdpr(14)aw(1)ti(2) HTTP 302
  • https://mc.yandex.com/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fh_3QGw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aykcyjkqfph1z85b6in%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A720%3Acn%3A1%3Adp%3A0%3Als%3A1490162717849%3Ahid%3A969929664%3Az%3A0%3Ai%3A202112010150156%3Aet%3A1639148516%3Ac%3A1%3Arn%3A282680103%3Arqn%3A1%3Au%3A1639148516518918896%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1639148515792%3Ads%3A0%2C148%2C68%2C0%2C102%2C0%2C%2C17%2C0%2C%2C%2C%2C338%3Adsn%3A0%2C148%2C67%2C1%2C101%2C0%2C%2C19%2C0%2C%2C%2C%2C337%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1639148517%3At%3ARedirecting&t=gdpr%2814%29aw%281%29ti%282%29

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
h_3QGw
u.to/
Redirect Chain
  • http://u.to/h_3QGw
  • https://u.to/h_3QGw
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://u.to/h_3QGw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.216.243.155 Moscow, Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
s5.unet.com
Software
nginx/1.8.0 /
Resource Hash
ff94a054c38a73763a9c10ebb7603138c1cee8ab5d840cfebaa939b7c26220fd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx/1.8.0
Date
Fri, 10 Dec 2021 15:01:56 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=15
Cache-Control
no-cache no-store
Pragma
no-cache
Vary
host
Content-Encoding
gzip

Redirect headers

Server
nginx/1.8.0
Date
Fri, 10 Dec 2021 15:01:55 GMT
Content-Type
text/html
Content-Length
184
Connection
keep-alive
Keep-Alive
timeout=15
Location
https://u.to/h_3QGw
tag.js
mc.yandex.ru/metrika/ 		194 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: u.to
URL: https://u.to/h_3QGw
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
debb229daffbe34e17c32f8d56a72dfa9ba4debfcfcb330e733bf56d88da117c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:56 GMT
content-encoding
br
last-modified
Fri, 10 Dec 2021 11:53:03 GMT
etag
"61b3156f-107fa"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
67578
expires
Fri, 10 Dec 2021 16:01:56 GMT
hit;utostat
counter.yadro.ru/
Redirect Chain
  • https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/h_3QGw;1639148516128
  • https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/h_3QGw;1639148516128
43 B
528 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/h_3QGw;1639148516128
Requested by
Host: u.to
URL: https://u.to/h_3QGw
Protocol
HTTP/1.1
Server
88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS
host204.rax.ru
Software
nginx/1.17.9 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 10 Dec 2021 15:02:09 GMT
Server
nginx/1.17.9
Strict-Transport-Security
max-age=86400
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin
*
Cache-control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Wed, 09 Dec 2020 21:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 10 Dec 2021 15:02:09 GMT
Server
nginx/1.17.9
Strict-Transport-Security
max-age=86400
P3P
policyref="/w3c/p3p.xml", CP="UNI"
Location
https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/h_3QGw;1639148516128
Cache-control
no-cache
Connection
keep-alive
Content-Type
text/html
Content-Length
32
Expires
Wed, 09 Dec 2020 21:00:00 GMT
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9483.91w7LSGqWo_Mu_ihvpuwedKXSle40vU4nnWIyIyo2_lVEPA9tsOkKcryOJesymxu.v0T4IOpUTOLysoNVqc7f9uK1T6k%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9483.URGm5V2R83grJ-HyxCQcGvBDrqim9Rqx2JnoHGpQ83d888XfS8b9yctr3SpX0hIVBSml3a-Dn_HYU3DjnwxwLQ%2C%2C.fmHX4oCbRmPu0hT4QCaYneuSXQA%2C
75 B
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9483.URGm5V2R83grJ-HyxCQcGvBDrqim9Rqx2JnoHGpQ83d888XfS8b9yctr3SpX0hIVBSml3a-Dn_HYU3DjnwxwLQ%2C%2C.fmHX4oCbRmPu0hT4QCaYneuSXQA%2C
Requested by
Host: u.to
URL: https://u.to/h_3QGw
Protocol
H2
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:56 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9483.URGm5V2R83grJ-HyxCQcGvBDrqim9Rqx2JnoHGpQ83d888XfS8b9yctr3SpX0hIVBSml3a-Dn_HYU3DjnwxwLQ%2C%2C.fmHX4oCbRmPu0hT4QCaYneuSXQA%2C
date
Fri, 10 Dec 2021 15:01:56 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
advert.gif
mc.yandex.com/metrika/ 		43 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: u.to
URL: https://u.to/h_3QGw
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:56 GMT
last-modified
Fri, 10 Dec 2021 11:53:03 GMT
etag
"61b3156f-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Fri, 10 Dec 2021 16:01:56 GMT
1
mc.yandex.com/watch/51604940/
Redirect Chain
  • https://mc.yandex.com/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2Fh_3QGw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aykcyjkqfph1z85b6in%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A72...
  • https://mc.yandex.com/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fh_3QGw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aykcyjkqfph1z85b6in%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A...
350 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fh_3QGw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aykcyjkqfph1z85b6in%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A720%3Acn%3A1%3Adp%3A0%3Als%3A1490162717849%3Ahid%3A969929664%3Az%3A0%3Ai%3A202112010150156%3Aet%3A1639148516%3Ac%3A1%3Arn%3A282680103%3Arqn%3A1%3Au%3A1639148516518918896%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1639148515792%3Ads%3A0%2C148%2C68%2C0%2C102%2C0%2C%2C17%2C0%2C%2C%2C%2C338%3Adsn%3A0%2C148%2C67%2C1%2C101%2C0%2C%2C19%2C0%2C%2C%2C%2C337%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1639148517%3At%3ARedirecting&t=gdpr%2814%29aw%281%29ti%282%29
Protocol
H2
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
7376c97b5541652a91836082348adbfc4ab8198f2f90f036a8af5c600987c0b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.to/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 10 Dec 2021 15:01:56 GMT
x-content-type-options
nosniff
last-modified
Fri, 10-Dec-2021 15:01:56 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://u.to
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
350
x-xss-protection
1; mode=block
expires
Fri, 10-Dec-2021 15:01:56 GMT

Redirect headers

pragma
no-cache
date
Fri, 10 Dec 2021 15:01:56 GMT
last-modified
Fri, 10-Dec-2021 15:01:56 GMT
location
/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fh_3QGw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aykcyjkqfph1z85b6in%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A720%3Acn%3A1%3Adp%3A0%3Als%3A1490162717849%3Ahid%3A969929664%3Az%3A0%3Ai%3A202112010150156%3Aet%3A1639148516%3Ac%3A1%3Arn%3A282680103%3Arqn%3A1%3Au%3A1639148516518918896%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1639148515792%3Ads%3A0%2C148%2C68%2C0%2C102%2C0%2C%2C17%2C0%2C%2C%2C%2C338%3Adsn%3A0%2C148%2C67%2C1%2C101%2C0%2C%2C19%2C0%2C%2C%2C%2C337%3Awv%3A2%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1639148517%3At%3ARedirecting&t=gdpr%2814%29aw%281%29ti%282%29
strict-transport-security
max-age=31536000
access-control-allow-origin
https://u.to
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Fri, 10-Dec-2021 15:01:56 GMT
Primary Request c.php
www1.trfrc.com/
Redirect Chain
  • https://btfk.cc/gfd54tghf8ew9vbc32h455f0hg45r75gf5d?w
  • https://track.trackbyfast.com/click?pid=1850&offer_id=25&sub1=2avt9soet1oaddia
  • https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Requested by
Host: u.to
URL: https://u.to/h_3QGw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03a1cc5c8ef57d6e3f2927aa645a6bd44ed22d9fc17e65ee92cfb10493005712
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://u.to/

Response headers

date
Fri, 10 Dec 2021 15:01:57 GMT
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=31536000
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x9JyZoSPQGpkvVssZzxqrn66W0kfY90oWXAhDQN7Vt2Xn9xJ%2FFh6XVKIw7jE9UEoANqXn2TDxmyGFXf0hyucVCTH6sWP3XE5oP0Bs6Kgp3xexTVRf0DxVE%2BgO3VEMRnvck8LgP9myob%2FXhhgjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6bb759fc1f393744-MXP
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date
Fri, 10 Dec 2021 15:01:57 GMT
content-length
0
location
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
access-control-allow-origin
*
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pcOuaPhh9DnSalzE9TxxBKcUhmoB2SX9ydH4u2H%2F5BEuu4ZK2DFlHidAGbx1XCgwE0SPRMp%2B7BBbaKy7yLmWMSBS7gVCc7vO8CD0gR%2BsoXVR71R5BRBRIV9TltfI5fGzFzmMNIaXlTOUtm4awcN4N1kRzx8%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6bb759fb6d0183ac-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
preview.jpg
www1.trfrc.com/landers/602a85ceda326/ 		111 KB
112 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www1.trfrc.com/landers/602a85ceda326/preview.jpg?1
Requested by
Host: www1.trfrc.com
URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bc732ae97f0d60fb50316e60c29a3cf22dc09d3fda343b3b8ac06e180969ce0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:58 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
113867
last-modified
Tue, 20 Jul 2021 10:52:32 GMT
server
cloudflare
etag
"60f6aaf0-1bccb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JYhr3m6hOkC4hMBCYw01P7lewjckmaJ9b4%2Bl8u0CSXvTLi2j1om1IBiInv8V%2BnordtF8Tmlz7ZPFqHlHK1wm7KA2Vf5XbDUrP7vbWGC0qs7lKgeUHi48LV5Axwb89yAgGi4fu64OwVkjytc9lg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
6bb759fce9833744-MXP
pattern.png
www1.trfrc.com/landers/602a85ceda326/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www1.trfrc.com/landers/602a85ceda326/pattern.png
Requested by
Host: www1.trfrc.com
URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
367dacef3f3650058439ad17f01b2b82c9de869cd470ccc068c380d71cae7a06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:57 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
2804
last-modified
Tue, 20 Jul 2021 10:52:32 GMT
server
cloudflare
etag
"60f6aaf0-af4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DZA3ENn%2F5apOyRL%2BLA7yxPXakJN5Sa1tjCyu6MvIrVLd%2FNVn0PtZzhyu9KOm3Q48n%2FLe%2FtEa0dPk7G84Xnz%2FZElLaN%2BnsbA%2FYovREo%2FoivfILS8h1MbWJoFaf0fDTRrqFGyWDR1%2Bl6%2BwSIS8Xg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
6bb759fce9883744-MXP
Montserrat-ExtraLight.woff
www1.trfrc.com/landers/602a85ceda326/fonts/ 		175 KB
175 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www1.trfrc.com/landers/602a85ceda326/fonts/Montserrat-ExtraLight.woff
Requested by
Host: www1.trfrc.com
URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b53100f5197f2df519b4dea2b69928887f319a598404d15cf078ff6e1dc47009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Origin
https://www1.trfrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:58 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
178944
last-modified
Tue, 20 Jul 2021 10:52:32 GMT
server
cloudflare
etag
"60f6aaf0-2bb00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N1Oz5ZXKV26zH3r4vZI0IlyJCIBNkXVFXjJeX7zWJPBEBvGcy1aNsBDImRTO963qHTPZiJEK%2F4yWqt7nHQPlzpKbVMyEU3Kw%2FnF5YqPayON7a6Ec3yt3cNuoxQEftPcTo11jyEqRY1Q26ZFuOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
6bb759fce9903744-MXP
Montserrat-Bold.woff
www1.trfrc.com/landers/602a85ceda326/fonts/ 		174 KB
174 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www1.trfrc.com/landers/602a85ceda326/fonts/Montserrat-Bold.woff
Requested by
Host: www1.trfrc.com
URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbab597ae18ef8748b75b1f705bef3df84fa7d8520fc51a92f4843b0a28fab25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Origin
https://www1.trfrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:58 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
177924
last-modified
Tue, 20 Jul 2021 10:52:31 GMT
server
cloudflare
etag
"60f6aaef-2b704"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q7WaG58borYftkiu9sNF%2FVYyV70p9RTVB333fSEZgQif5KFqklJ7aVhNhW6%2B35zMy0bXmRavI256Zz9mRvFR7IV5EIWmUXL%2FBFcE3x9bdoAD0VIEKNtKWKlOH3IBSbEnDtwKNDMuKIxCy4%2BnGg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
6bb759fce9923744-MXP
Montserrat-Regular.woff
www1.trfrc.com/landers/602a85ceda326/fonts/ 		177 KB
177 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www1.trfrc.com/landers/602a85ceda326/fonts/Montserrat-Regular.woff
Requested by
Host: www1.trfrc.com
URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
581f4e23900b88c2bfe488fa5bf091832fe21c62ef1fcabda19d8a9e6bfa61ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Origin
https://www1.trfrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 15:01:58 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
181108
last-modified
Tue, 20 Jul 2021 10:52:31 GMT
server
cloudflare
etag
"60f6aaef-2c374"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2Bhs48GIJHJDn%2Ft7ktLDewUPi6dAB7sih7sVfmM3T86PtHbLeG81YcVDJKvUFvQQ1QrVkgzrhN2Zk2Po8LUBYNVQ40HBapN%2Bjl7A6F9qEgP6tDvZfKMImDgM0OXiGWKMjPNzreYlO5%2BUnfkR0A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
6bb759fce9943744-MXP
girls.mp4
www1.trfrc.com/landers/602a85ceda326/ 		7 MB
7 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://www1.trfrc.com/landers/602a85ceda326/girls.mp4
Requested by
Host: www1.trfrc.com
URL: https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:c74c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
80cdfa8facf98c9b04fec643aa60b945bcfe7b3205f7218dfbad6d6a10a6e936
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www1.trfrc.com/c.php?k=63r1l5p2seqav3mqsdvc&clickid=61b36be5dc03080001e9aae2&affpid=1850&action_id=DEdesktop&referrer=https%3A%2F%2Fu.to%2F&sub1=2avt9soet1oaddia&sub2=&sub3=&sub4=&sub5=&sub6=
Accept-Encoding
identity;q=1, *;q=0
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 10 Dec 2021 15:01:57 GMT
vary
Accept-Encoding
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Range
bytes 0-7013326/7013327
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Content-Length
7013327
last-modified
Tue, 20 Jul 2021 10:52:31 GMT
server
cloudflare
etag
"60f6aaef-6b03cf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z4bNw8u5NjZVBlJHgve%2B6ffyKrudA4qDvvl301kqlIhNGW6xCWXOGVCJMg7yI6qYEAOExoI1gzWv3m3mpZ3HcFC6iGrpx8sLWZ9WgXXssPwHGPfN5ZlVYEgspO7PLdj4uLbeZSuWoIbWsTEsAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
video/mp4
cache-control
max-age=14400
cf-ray
6bb759fcf9c23744-MXP

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

18 Cookies

Domain/Path Name / Value
.u.to/ Name: lng
Value: de
.yadro.ru/ Name: FTID
Value: 1Xisln3yqaOD1Xisln0028xb
.yadro.ru/ Name: VID
Value: 1_qFkR0XCm8D1Xisln002LwM
.u.to/ Name: _ym_uid
Value: 1639148516518918896
.u.to/ Name: _ym_d
Value: 1639148516
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 1544552782fake
.u.to/ Name: _ym_isad
Value: 2
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 1395251077fake
.yandex.com/ Name: yandexuid
Value: 4580475961639148516
.yandex.com/ Name: yuidss
Value: 4580475961639148516
mc.yandex.com/ Name: yabs-sid
Value: 1005422531639148516
.yandex.com/ Name: i
Value: 0XCwoqxHznGZ6TU/BPhx1hZbXBgWskdWLbl5yghRCYn5Dgo5hyle7GcnnfcSt9F0E46oJMGox2NzweQ38XeTvyxjwTs=
.yandex.com/ Name: ymex
Value: 1670684516.yrts.1639148516#1670684516.yrtsi.1639148516
.btfk.cc/ Name: 847ba
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjNcIjoxNjM5MTQ4NTE3fSxcImNhbXBhaWduc1wiOntcIjFcIjoxNjM5MTQ4NTE3fSxcInRpbWVcIjoxNjM5MTQ4NTE3fSJ9.j882stw850_xGO-cBhVUDtpHbJVWkvPhrR0GGFi5KY0
track.trackbyfast.com/ Name: afclick
Value: 61b36be5dc03080001e9aae2
track.trackbyfast.com/ Name: afoffers
Value: {"25":1639148517}
www1.trfrc.com/ Name: uclick
Value: 1mdva7j2
www1.trfrc.com/ Name: uclickhash
Value: 1mdva7j2-1mdva715-tlbl-twtw-ho3v-vc46dz-wf17i4-4504e1

1 Console Messages

Source Level URL
Text
network error URL: https://mc.yandex.com/sync_cookie_image_decide?token=9483.URGm5V2R83grJ-HyxCQcGvBDrqim9Rqx2JnoHGpQ83d888XfS8b9yctr3SpX0hIVBSml3a-Dn_HYU3DjnwxwLQ%2C%2C.fmHX4oCbRmPu0hT4QCaYneuSXQA%2C
Message:
Failed to load resource: the server responded with a status of 400 ()