topsolutions.rdtk.io Open in urlscan Pro
85.17.54.67 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://softnet.sbs/
Effective URL:
https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20423336&sub5=windows&...
Submission: On March 23 via api (March 23rd 2024, 1:16:55 am UTC) from GB — Scanned from NL

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 8 domains to perform 11 HTTP transactions. The main IP is 85.17.54.67, located in Kortenhoef, Netherlands and belongs to LEASEWEB-NL-AMS-01 Netherlands, NL. The main domain is topsolutions.rdtk.io. The Cisco Umbrella rank of the primary domain is 275801.
TLS certificate: Issued by GoGetSSL RSA DV CA on July 19th 2023. Valid for: a year.

This is the only time topsolutions.rdtk.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 3	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:4780:b:7... 2a02:4780:b:739:0:2be4:9d0b:10	47583 (AS-HOSTINGER) (AS-HOSTINGER)
2 6	139.45.197.245 139.45.197.245	9002 (RETN-AS) (RETN-AS)
2	139.45.195.8 139.45.195.8	9002 (RETN-AS) (RETN-AS)
2	37.48.68.71 37.48.68.71	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	85.17.54.67 85.17.54.67	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	52.28.74.73 52.28.74.73	() ()
11	6

3 2a06:98c1:3121::3 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

softnet.sbs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.savinist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:4780:b:739:0:2be4:9d0b:10 (Phoenix, United States)

ASN47583 (AS-HOSTINGER, CY)

metvin.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 139.45.197.245 (United Kingdom) 2 redirects

ASN9002 (RETN-AS, GB)

deckedsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)

my.rtmark.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.48.68.71 (Amsterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

datatechone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.17.54.67 (Kortenhoef, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

topsolutions.rdtk.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.74.73 (None, )

ASN- ()

www.opera.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	deckedsi.com 2 redirects deckedsi.com	32 KB
2	savinist.com 2 redirects www.savinist.com — Cisco Umbrella Rank: 154808	2 KB
2	datatechone.com datatechone.com — Cisco Umbrella Rank: 19762	929 B
2	rtmark.net my.rtmark.net — Cisco Umbrella Rank: 7780	996 B
1	opera.com www.opera.com
1	rdtk.io topsolutions.rdtk.io — Cisco Umbrella Rank: 275801	1 KB
1	metvin.info metvin.info	1 KB
1	softnet.sbs 1 redirects softnet.sbs	667 B
11	8

	Domain	Requested by
6	deckedsi.com	2 redirects metvin.info deckedsi.com
2	www.savinist.com	2 redirects
2	datatechone.com	deckedsi.com
2	my.rtmark.net	deckedsi.com
1	www.opera.com
1	topsolutions.rdtk.io
1	metvin.info
1	softnet.sbs	1 redirects
11	8

This site contains no links.

Subject Issuer	Validity	Valid
metvin.info R3	`2024-03-13` - `2024-06-11`	3 months	crt.sh
rtmark.net R3	`2024-03-02` - `2024-05-31`	3 months	crt.sh
datatechone.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-10` - `2024-12-23`	a year	crt.sh
deckedsi.com R3	`2024-01-13` - `2024-04-12`	3 months	crt.sh
*.rdtk.io GoGetSSL RSA DV CA	`2023-07-19` - `2024-07-19`	a year	crt.sh
www.opera.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-13` - `2024-07-02`	4 months	crt.sh

This page contains 1 frames:

Frame: https://www.opera.com/gx?utm_source=PWNgames3&utm_medium=pa&utm_campaign=PWN_NL_LVR_OOM&utm_id=e75e644e8cb8432397b43e170a7519f9&edition=std-1
Frame ID: 2AC4872C72A189638E4E069B324CA5C1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://softnet.sbs/ HTTP 301
https://metvin.info/lpoiu Page URL
http://deckedsi.com/4/6106038 Page URL
http://deckedsi.com/?z=6106038&syncedCookie=true&rhd=false HTTP 302
https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60 Page URL
https://deckedsi.com/?z=6118780&syncedCookie=false&rhd=false HTTP 302
https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20... Page URL

Page Statistics

11
Requests

82 %
HTTPS

29 %
IPv6

8
Domains

8
Subdomains

6
IPs

3
Countries

34 kB
Transfer

69 kB
Size

12
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://softnet.sbs/ HTTP 301
https://metvin.info/lpoiu Page URL
http://deckedsi.com/4/6106038 Page URL
http://deckedsi.com/?z=6106038&syncedCookie=true&rhd=false HTTP 302
https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60 Page URL
https://deckedsi.com/?z=6118780&syncedCookie=false&rhd=false HTTP 302
https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20423336&sub5=windows&sub6=NL&sub7=20423336&sub8=ziggo%20services%20b.v.&sub9=desktop&sub10=broadband&ref_id=795211078241100207&cost=0.001468 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://softnet.sbs/ HTTP 301
https://metvin.info/lpoiu

Request Chain 5

http://deckedsi.com/?z=6106038&syncedCookie=true&rhd=false HTTP 302
https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60

Request Chain 9

https://www.savinist.com/cmp/44L6LFH/226H3TK/?sub1=60ebfe6805b2980001060e6f_6118780&sub2=65fe2d869fc73e0001fd445e HTTP 302
https://www.savinist.com/6NP2CC7/JP5MDPD/?__rpt=0&__po=9482&__ptid=39f69c0e51d7445bad5038cc50b85980&__rpa=0&__rc=1&sub1=60ebfe6805b2980001060e6f_6118780&sub2=65fe2d869fc73e0001fd445e&sub3=&sub4=&sub5=&source_id=&__pcd=1 HTTP 302
https://www.opera.com/gx?utm_source=PWNgames3&utm_medium=pa&utm_campaign=PWN_NL_LVR_OOM&utm_id=e75e644e8cb8432397b43e170a7519f9&edition=std-1

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

lpoiu Show response
metvin.info/
Redirect Chain

http://softnet.sbs/
https://metvin.info/lpoiu

3 KB
1 KB

607ms
196ms

Document
text/html

2a02:4780:b:739:0:2be4:9d0b:10
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://metvin.info/lpoiu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:b:739:0:2be4:9d0b:10 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed / PHP/7.4.33

Resource Hash

8e31a466af497d91618e827e0fc9de256ccc7e2e9d5c76f166df10b7ab1db435

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 897
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Sat, 23 Mar 2024 01:16:51 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
platform: hostinger
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

Redirect headers

CF-RAY: 868a9413391c65f6-AMS
Cache-Control: max-age=3600
Connection: keep-alive
Date: Sat, 23 Mar 2024 01:16:51 GMT
Expires: Sat, 23 Mar 2024 02:16:51 GMT
Location: https://metvin.info/lpoiu
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x7Ts5sg4MlyHbxBBkWAPrK2zqCjObUJuaPJOznVDfm5EWa1e37EUir4wy7vXJfK6FI7q2gu6oDQpPaF8st4c7xnEzMMMeyjXxVcZO%2BcTn0VjrgZrqwcz84W8AIFvCXsg5lWmYUNVz3Wzcw%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK 6106038 Show response
deckedsi.com/4/ 33 KB
14 KB 195ms
18ms Document
text/html 139.45.197.245
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://deckedsi.com/4/6106038

Requested by

Host: metvin.info
URL: https://metvin.info/lpoiu

Protocol

HTTP/1.1

Server

139.45.197.245 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

91430aaa3500541a747e13c2bd3745bf5243918858e2dd56f78250c944f5b3e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Accept-Ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf8
Date: Sat, 23 Mar 2024 01:16:53 GMT
Expires: Tue, 11 Jan 1994 10:00:00 GMT
Link: <https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=1
Timing-Allow-Origin: * *
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Trace-Id: 6b8d1073387dea3f6d407a81461eeef9

POST
H/1.1 200
OK sftouch
deckedsi.com/ 2 B
875 B 15ms
14ms Ping
text/plain 139.45.197.245
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://deckedsi.com/sftouch?userId=00802858305643a8ff052d6b2c3d9ef4&z=6106038&p_rid=527001a2-0c9c-41c6-8cf8-c1b2ce5e7fd6&p_src=sf&branchId=400701&rb=al8SocYl-BZxW4-hSRJzRGYBW5RYM_yH_CH5N1UvhlkEZxoI5TKpgyIl-5blnih63RYZ3xnaRVD2W7J2zGIMGabDXZEwi9MLW-QfH6PlfX8tEnX-kBkHGW4MXikigp3N3gb8zHCrbqug1BZICN2v1TvYxwiavNf1FFXHrb2Sy7EL8l6FB278w4AoyIgyx3bpcN5ayyJz_xuqMQEzKlsslURQVLxse9fWHfc342E2fqaUceXYsyTOCY0y2ELSGMjK6NmnGP7T28LdSnkCancimZh6T60zRaeuD9pEdJvKg5rAZcN4VcwaGA==

Requested by

Host: deckedsi.com
URL: http://deckedsi.com/4/6106038

Protocol

HTTP/1.1

Server

139.45.197.245 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://deckedsi.com/4/6106038
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Sat, 23 Mar 2024 01:16:53 GMT
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 2
X-Trace-Id: d2b01e7f98cc3b89cfa04358a033cc0f
Pragma: no-cache
Server: nginx
Accept-Ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: http://deckedsi.com
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *, *
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
Expires: Tue, 11 Jan 1994 10:00:00 GMT

GET
H2 200 img.gif
my.rtmark.net/ 43 B
492 B 338ms
13ms Image
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=00802858305643a8ff052d6b2c3d9ef4&z=6106038&p_rid=527001a2-0c9c-41c6-8cf8-c1b2ce5e7fd6&p_src=sf

Requested by

Host: deckedsi.com
URL: http://deckedsi.com/4/6106038

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://deckedsi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Sat, 23 Mar 2024 01:16:54 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

POST
H/1.1 200
OK add Show response
datatechone.com/log/ 2 B
464 B 306ms
15ms XHR
text/plain 37.48.68.71
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=527001a2-0c9c-41c6-8cf8-c1b2ce5e7fd6
Requested by: Host: deckedsi.com
URL: http://deckedsi.com/4/6106038
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.48.68.71 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: http://deckedsi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 23 Mar 2024 01:16:54 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: http://deckedsi.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 2

GET
H2

200

/ Show response
deckedsi.com/4/6118780/
Redirect Chain

http://deckedsi.com/?z=6106038&syncedCookie=true&rhd=false
https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60

33 KB
14 KB

61ms
31ms

Document
text/html

139.45.197.245
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.245 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

8af1078a71cfe20f39a428b92d0dacd2d424b79a0c2b2b599a0e46735bd988bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: http://deckedsi.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf8
date: Sat, 23 Mar 2024 01:16:54 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
link: <https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma: no-cache
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: * *
x-content-type-options: nosniff
x-trace-id: 107471331037989e7d9679a06dc701cf

Redirect headers

Accept-Ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: http://deckedsi.com
Access-Control-Max-Age: 86400
Cache-Control: no-transform, no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Date: Sat, 23 Mar 2024 01:16:54 GMT
Expires: Tue, 11 Jan 1994 10:00:00 GMT
Link: <https://deckedsi.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
Location: https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60
Pragma: no-cache
Referrer-Policy: no-referrer
Server: nginx
Strict-Transport-Security: max-age=1
Timing-Allow-Origin: * *
X-Content-Type-Options: nosniff
X-Trace-Id: d57f476edad5e8c4f7efcdb95ac9f677

POST
H2 200 sftouch
deckedsi.com/ 2 B
602 B 17ms
17ms Ping
text/plain 139.45.197.245
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://deckedsi.com/sftouch?userId=00802858305643a8ff052d6b2c3d9ef4&z=6118780&p_rid=f4f1cc53-4e42-4099-8149-db160f5bfe4e&p_src=sf&branchId=0&rb=pa6Uwn48ICc4tN7VEo1nXVCFaHL-pVx2RhDqmTF9ancOzgWOXc8JRO8dJyQ8EH78rZMMAXFSWn8x4Q7oESWZrx0eziUTKu4XhUTpzg_L2GWWk9E3qD2DB5z04UkgU6LpaEJQcgZ6dr_kfarx9TaJ6L1IsHP4Qy3tBj8iLMnFYVSvrZb4CN4aQPBUuenexCV2S5Sj4UyacL2VB9MgUrnsNePSkjNeih5hhYcHVE6ILbzRCRyh_ifaC8fyGaBYRvvw-EsT_cfoZmS9a-rVa9GMBATmPjM_YF5SwIZl0lY-xUlgspnFbO_Ffw==

Requested by

Host: deckedsi.com
URL: https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.245 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Sat, 23 Mar 2024 01:16:54 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
content-length: 2
x-trace-id: 5fdf2ad09923cb9bb940466762829691
pragma: no-cache
server: nginx
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
access-control-allow-origin: https://deckedsi.com
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
expires: Tue, 11 Jan 1994 10:00:00 GMT

POST
H2 200 img.gif
my.rtmark.net/ 43 B
504 B 14ms
13ms Ping
image/gif 139.45.195.8
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://my.rtmark.net/img.gif?f=merge&userId=00802858305643a8ff052d6b2c3d9ef4&z=6118780&p_rid=f4f1cc53-4e42-4099-8149-db160f5bfe4e&p_src=sf

Requested by

Host: deckedsi.com
URL: https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://deckedsi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Sat, 23 Mar 2024 01:16:54 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: image/gif
access-control-allow-origin: https://deckedsi.com
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length: 43

POST
H/1.1 200
OK add
datatechone.com/log/ 2 B
465 B 13ms
13ms XHR
text/plain 37.48.68.71
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=f4f1cc53-4e42-4099-8149-db160f5bfe4e
Requested by: Host: deckedsi.com
URL: https://deckedsi.com/4/6118780/?var=6106038&btz=Europe/Amsterdam&bto=-60
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.48.68.71 Amsterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

Referer: https://deckedsi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 23 Mar 2024 01:16:54 GMT
Server: nginx/1.19.10
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://deckedsi.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Content-Length: 2

GET
H/1.1

200
OK

Primary Request 65c87b46bf3c3f00016a8581 Show response
topsolutions.rdtk.io/
Redirect Chain

https://deckedsi.com/?z=6118780&syncedCookie=false&rhd=false
https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20423336&sub5=windows&sub6=NL&sub7=20423336&sub8=ziggo%20services%20b.v.&sub9=desktop&sub10=br...

258 B
1 KB

62ms
16ms

Document
text/html

85.17.54.67
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20423336&sub5=windows&sub6=NL&sub7=20423336&sub8=ziggo%20services%20b.v.&sub9=desktop&sub10=broadband&ref_id=795211078241100207&cost=0.001468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 85.17.54.67 Kortenhoef, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: nginx/1.20.2 /
Resource Hash: f2e0f568fcebf69efb0e7684067de2e165b886fcaba147e2ee3173a33a11a33c

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://deckedsi.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 258
Content-Type: text/html; charset=utf-8
Date: Sat, 23 Mar 2024 01:16:54 GMT
Server: nginx/1.20.2

Redirect headers

accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://deckedsi.com
access-control-max-age: 86400
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
content-length: 0
date: Sat, 23 Mar 2024 01:16:54 GMT
expires: Tue, 11 Jan 1994 10:00:00 GMT
link: <https://topsolutions.rdtk.io>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
location: https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20423336&sub5=windows&sub6=NL&sub7=20423336&sub8=ziggo services b.v.&sub9=desktop&sub10=broadband&ref_id=795211078241100207&cost=0.001468
pragma: no-cache
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=1
timing-allow-origin: * *
x-content-type-options: nosniff
x-trace-id: ef0930e262c2ac8cb33b00ab782c33aa

GET
H2

200

gx
www.opera.com/
Redirect Chain

https://www.savinist.com/cmp/44L6LFH/226H3TK/?sub1=60ebfe6805b2980001060e6f_6118780&sub2=65fe2d869fc73e0001fd445e
https://www.savinist.com/6NP2CC7/JP5MDPD/?__rpt=0&__po=9482&__ptid=39f69c0e51d7445bad5038cc50b85980&__rpa=0&__rc=1&sub1=60ebfe6805b2980001060e6f_6118780&sub2=65fe2d869fc73e0001fd445e&sub3=&sub4=&su...
https://www.opera.com/gx?utm_source=PWNgames3&utm_medium=pa&utm_campaign=PWN_NL_LVR_OOM&utm_id=e75e644e8cb8432397b43e170a7519f9&edition=std-1

0
0

748ms
160ms

Document
text/html

52.28.74.73

General

Check archive.org

Show headers Download Go to

Full URL

https://www.opera.com/gx?utm_source=PWNgames3&utm_medium=pa&utm_campaign=PWN_NL_LVR_OOM&utm_id=e75e644e8cb8432397b43e170a7519f9&edition=std-1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

52.28.74.73 -, , ASN (),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.opera.com; upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://topsolutions.rdtk.io/65c87b46bf3c3f00016a8581?sub1=6118780&sub2=7967436&sub3={creativeId}&sub4=20423336&sub5=windows&sub6=NL&sub7=20423336&sub8=ziggo%20services%20b.v.&sub9=desktop&sub10=broadband&ref_id=795211078241100207&cost=0.001468
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=3600
content-encoding: gzip
content-language: en
content-security-policy: frame-ancestors 'self' https://*.opera.com; upgrade-insecure-requests;
content-type: text/html; charset=utf-8
date: Sat, 23 Mar 2024 01:16:55 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 868a9429debd6729-AMS
content-type: text/html; charset=utf-8
date: Sat, 23 Mar 2024 01:16:54 GMT
location: https://www.opera.com/gx?utm_source=PWNgames3&utm_medium=pa&utm_campaign=PWN_NL_LVR_OOM&utm_id=e75e644e8cb8432397b43e170a7519f9&edition=std-1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MofMYZzCd10l7X8hrUyD%2BavhkoukOIG2aKkg1MDsPYkAZMTFcp%2BwgncMSGNN%2BpLSp4zKd8OaIZbn%2FD5hXjfhLHg46AVGVkGOhXZkfQJUFSTsaaDO7MV3djS5i4yH3rtM8K88qngucAp5pGo9%2F0ql"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
via: 1.1 google, 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-eflow-request-id: f47a4d88-535a-4ab4-b057-5f7828fdd2b8
x-served-by: cache-ams21031-AMS
x-timer: S1711156615.704716,VS0,VE114

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.savinist.com/6NP2CC7/JP5MDPD	1969-12-31 23:59:59	Name: transaction_id Value: 39f69c0e51d7445bad5038cc50b85980
metvin.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2c6e85382af196bf9142b8477fe9f9d8
metvin.info/	1970-01-20 19:19:17	Name: short_297 Value: 1
deckedsi.com/	1970-01-21 04:04:52	Name: OAID Value: 00802858305643a8ff052d6b2c3d9ef4
deckedsi.com/	1970-01-21 04:04:52	Name: oaidts Value: 1711156613
my.rtmark.net/	1970-01-21 04:04:52	Name: ID Value: 00802858305643a8ff052d6b2c3d9ef4
deckedsi.com/	1970-01-20 19:29:21	Name: syncedCookie Value: true
.topsolutions.rdtk.io/	1970-01-20 19:20:43	Name: redcmps Value: W3siaWQiOiI2NWM4N2I0NmJmM2MzZjAwMDE2YTg1ODEiLCJ0IjoiMjAyNC0wMy0yM1QwMToxNjo1NC40ODgwNDIzMzJaIn1d
.topsolutions.rdtk.io/	1970-01-21 04:04:52	Name: redhash Value: NjVmZTJkODY5ZmM3M2UwMDAxZmQ0NDVlfDB8NjVjODdiNDZiZjNjM2YwMDAxNmE4NTgxfHwzYWIwNzljMy0yZjkyLTRmOTQtYWEyNi1kOTUyZGIzMTg4YmF8MTcxMTE1NjYxNA==
www.savinist.com/	1970-01-20 19:20:43	Name: uniqueClick_226H3TK Value: bc903416-8207-491c-8d22-8b2a15fd5b24:1711156614
www.savinist.com/	1970-01-20 21:28:52	Name: transaction_id Value: 39f69c0e51d7445bad5038cc50b85980
www.savinist.com/	1970-01-20 19:20:43	Name: uniqueClick_JP5MDPD Value: 6bb8e6eb-a022-4848-a6c6-c01e0a3808b5:1711156614

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: http://deckedsi.com/4/6106038(Line 46) Message: getGamepad will now require Secure Context. Please update your application accordingly. For more information see https://github.com/w3c/gamepad/pull/120
other	warning	URL: http://deckedsi.com/4/6106038 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://deckedsi.com/afu.php?zoneid=6118780&var=6118780&rid=33-IJ2mCiw9DGbmF2LWarg%3D%3D&rhd=false&ab2r=0&sf=1&is_mobile=false Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://deckedsi.com/afu.php?zoneid=6118780&var=6118780&rid=33-IJ2mCiw9DGbmF2LWarg%3D%3D&rhd=false&ab2r=0&sf=1&is_mobile=false Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

datatechone.com
deckedsi.com
metvin.info
my.rtmark.net
softnet.sbs
topsolutions.rdtk.io
www.opera.com
www.savinist.com
139.45.195.8
139.45.197.245
2a02:4780:b:739:0:2be4:9d0b:10
2a06:98c1:3121::3
37.48.68.71
52.28.74.73
85.17.54.67
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
8af1078a71cfe20f39a428b92d0dacd2d424b79a0c2b2b599a0e46735bd988bd
8e31a466af497d91618e827e0fc9de256ccc7e2e9d5c76f166df10b7ab1db435
91430aaa3500541a747e13c2bd3745bf5243918858e2dd56f78250c944f5b3e7
f2e0f568fcebf69efb0e7684067de2e165b886fcaba147e2ee3173a33a11a33c

topsolutions.rdtk.io Open in urlscan Pro 85.17.54.67 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

11 Requests

82 %HTTPS

29 %IPv6

8 Domains

8 Subdomains

6 IPs

3 Countries

34 kBTransfer

69 kBSize

12 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

12 Cookies

4 Console Messages

Security Headers

Indicators

topsolutions.rdtk.io Open in urlscan Pro
85.17.54.67 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

29 %
IPv6

8
Domains

8
Subdomains

6
IPs

3
Countries

34 kB
Transfer

69 kB
Size

12
Cookies

11 HTTP transactions
0 data transactions