urlscan.io logo urlscan.io
SecurityTrails logo

tour.camsoda.com Open in urlscan Pro
64.210.151.32  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://sophiemudd.centralpto.com/
Effective URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb...
Submission: On February 19 via manual from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 3 countries across 12 domains to perform 19 HTTP transactions. The main IP is 64.210.151.32, located in Waltham, United States and belongs to REFLECTED, US. The main domain is tour.camsoda.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 21st 2020. Valid for: 3 months.
This is the only time tour.camsoda.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 70.39.97.254 46844 (ST-BGP)
1 1 107.180.126.208 26496 (AS-26496-...)
3 3 192.124.249.110 30148 (SUCURI-SEC)
1 3 107.178.242.109 15169 (GOOGLE)
2 205.185.216.10 20446 (HIGHWINDS3)
1 1 35.159.5.116 16509 (AMAZON-02)
1 2 208.99.67.227 29789 (REFLECTED)
2 9 64.210.151.32 29789 (REFLECTED)
3 66.254.122.104 29789 (REFLECTED)
1 2a00:1450:400... 15169 (GOOGLE)
1 208.99.67.237 29789 (REFLECTED)
2 2a00:1450:400... 15169 (GOOGLE)
19 9
1    70.39.97.254 (Las Vegas, United States)

ASN46844 (ST-BGP, US)
PTR: mail.afraid.org
sophiemudd.centralpto.com
1    107.180.126.208 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-126-208.ip.secureserver.net
shorturl.ws
3    192.124.249.110 (United States)

ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10110.sucuri.net
kikforum.co
www.kikforum.co
cntlckr.com
3    107.178.242.109 (United States)

ASN15169 (GOOGLE, US)
PTR: 109.242.178.107.bc.googleusercontent.com
t.irtyf.com
t.frtyk.com
t.grtyj.com
2    205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net
ckstatic.com
1    35.159.5.116 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-159-5-116.eu-central-1.compute.amazonaws.com
a.vfghd.com
2    208.99.67.227 (Waltham, United States)

ASN29789 (REFLECTED, US)
www.camsoda.com
9    64.210.151.32 (Waltham, United States)

ASN29789 (REFLECTED, US)
tour.camsoda.com
3    66.254.122.104 (Amsterdam, Netherlands)

ASN29789 (REFLECTED, US)
promos.camsoda.com
1    2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    208.99.67.237 (Waltham, United States)

ASN29789 (REFLECTED, US)
partners.camsoda.com
2    2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Domain Requested by
9 tour.camsoda.com 2 redirects t.frtyk.com
tour.camsoda.com
3 promos.camsoda.com tour.camsoda.com
2 www.google-analytics.com tour.camsoda.com
2 www.camsoda.com 1 redirects tour.camsoda.com
2 ckstatic.com t.irtyf.com
t.frtyk.com
1 partners.camsoda.com tour.camsoda.com
1 ajax.googleapis.com tour.camsoda.com
1 t.grtyj.com 1 redirects
1 t.frtyk.com t.irtyf.com
1 a.vfghd.com 1 redirects
1 t.irtyf.com
1 cntlckr.com 1 redirects
1 www.kikforum.co 1 redirects
1 kikforum.co 1 redirects
1 shorturl.ws 1 redirects
1 sophiemudd.centralpto.com 1 redirects
19 16

This site contains no links.

Subject Issuer Validity Valid
t.connexionsafe.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-27 -
2021-09-26		 2 years crt.sh
ckstatic.com
Let's Encrypt Authority X3		 2020-01-17 -
2020-04-16		 3 months crt.sh
tour.camsoda.com
Let's Encrypt Authority X3		 2020-01-21 -
2020-04-20		 3 months crt.sh
*.camsoda.com
Go Daddy Secure Certificate Authority - G2		 2018-06-18 -
2020-06-18		 2 years crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2020-01-29 -
2020-04-22		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-01-29 -
2020-04-22		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Frame ID: C9B193D5C61A9B49F28542E5EB429D35
Requests: 15 HTTP requests in this frame

Frame: https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Frame ID: 764C4C5E19E9E01D41F52248DE50A7A6
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://sophiemudd.centralpto.com/ HTTP 301
    http://shorturl.ws/global HTTP 301
    http://kikforum.co/r/ HTTP 301
    http://www.kikforum.co/r/ HTTP 302
    http://cntlckr.com/global HTTP 301
    https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756 Page URL
  2. https://a.vfghd.com/9d6ec174-d20a-4285-bc62-1d8926198dc2?subID1=5050&affiliateID=43404&source=10... HTTP 302
    https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=256... Page URL
  3. http://t.grtyj.com/bfqld7s98h?campaign_id=3&aff_id=43404&aff_sub=5050&aff_sub2=2563&aff_sub3=w0... HTTP 302
    https://www.camsoda.com/enter.php?id=crakrevenuepps&type=PPS&t=best&cmp=43404_1021376d9d13f0235b95fa... HTTP 302
    https://tour.camsoda.com/pop8g2?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_... HTTP 301
    http://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518... HTTP 302
    https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • headers via /^1\.1 google$/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

19
Requests

100 %
HTTPS

17 %
IPv6

12
Domains

16
Subdomains

9
IPs

3
Countries

1550 kB
Transfer

1665 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://sophiemudd.centralpto.com/ HTTP 301
    http://shorturl.ws/global HTTP 301
    http://kikforum.co/r/ HTTP 301
    http://www.kikforum.co/r/ HTTP 302
    http://cntlckr.com/global HTTP 301
    https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756 Page URL
  2. https://a.vfghd.com/9d6ec174-d20a-4285-bc62-1d8926198dc2?subID1=5050&affiliateID=43404&source=1021376d9d13f0235b95faf0aa7518&subID2=2563&Target=82.102.19.0&Bnr=%7Bbnr%7D HTTP 302
    https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779 Page URL
  3. http://t.grtyj.com/bfqld7s98h?campaign_id=3&aff_id=43404&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&aff_sub4=&aff_sub5=&source=1021376d9d13f0235b95faf0aa7518 HTTP 302
    https://www.camsoda.com/enter.php?id=crakrevenuepps&type=PPS&t=best&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a HTTP 302
    https://tour.camsoda.com/pop8g2?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2 HTTP 301
    http://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2 HTTP 302
    https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://sophiemudd.centralpto.com/ HTTP 301
  • http://shorturl.ws/global HTTP 301
  • http://kikforum.co/r/ HTTP 301
  • http://www.kikforum.co/r/ HTTP 302
  • http://cntlckr.com/global HTTP 301
  • https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
Request Chain 2
  • https://a.vfghd.com/9d6ec174-d20a-4285-bc62-1d8926198dc2?subID1=5050&affiliateID=43404&source=1021376d9d13f0235b95faf0aa7518&subID2=2563&Target=82.102.19.0&Bnr=%7Bbnr%7D HTTP 302
  • https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
5h2xwxuge9
t.irtyf.com/
Redirect Chain
  • http://sophiemudd.centralpto.com/
  • http://shorturl.ws/global
  • http://kikforum.co/r/
  • http://www.kikforum.co/r/
  • http://cntlckr.com/global
  • https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.242.109 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
109.242.178.107.bc.googleusercontent.com
Software
nginx/1.13.12 / Express
Resource Hash
a12dc339a344950b1e492264b2367f8069a0a3e2ce5c2bc7525c647b33e1d493

Request headers

:method
GET
:authority
t.irtyf.com
:scheme
https
:path
/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
x-powered-by
Express
actioncode
1
realaction
/aff_ad
date
Wed, 19 Feb 2020 01:54:42 GMT
content-type
text/html; charset=iso-8859-1
content-length
1792
server
nginx/1.13.12
expires
Sat, 26 Jul 1997 05:00:00 GMT
pragma
no-cache
cache-control
no-cache, no-store, must-revalidate
tracking_id
1021376d9d13f0235b95faf0aa7518
x-robots-tag
noindex, nofollow
set-cookie
enc_aff_session_3664=ENC032fda5b14458505a5a86e9fd2043c7aa746502526c70870f3375af763fd4ea6b0f828dcde4650bc781b7145cfe680ba03b2ab0f4b039ac50bd3e3359fe102107aaa7b13301994217fe456e037108589539d52448a6375ad469f7f23a49ba379c477fc974dcd47b81932ffc2706f46a6771682c442c23e7da8335a006f71e4b5df3ad6c2ad; expires=Fri, 18 Feb 2022 01:54:42 GMT; path=/; SameSite=None; Secure ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI3NC4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzE0XzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS83NC4wLjM3MjkuMTY5IFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJlbi1VUyIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==; expires=Fri, 13 Jan 2023 12:34:42 GMT; path=/; SameSite=None; Secure
p3p
CP="NOI CUR OUR NOR INT"
access-control-allow-origin
*
x-request-id
ae41aa6e0cec604871ee83a0490e1175
etag
W/"700-uxzUcnTRMs2m0BrPr8Y0sXWHgyo"
via
1.1 google
alt-svc
clear

Redirect headers

Server
Sucuri/Cloudproxy
Date
Wed, 19 Feb 2020 01:54:39 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
0
Connection
keep-alive
X-Sucuri-ID
19010
X-XSS-Protection
1; mode=block
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
shorturl=l0eo371tqgbei1pofp7no146m1; path=/
Location
https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
Vary
User-Agent
X-Sucuri-Cache
HIT
history.js
ckstatic.com/js/historyjs/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ckstatic.com/js/historyjs/history.js
Requested by
Host: t.irtyf.com
URL: https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
2324fa2acc1382ed8b1306e981e5c2273e57a0532efd1d6a5a0a4a0aab22d045

Request headers

Referer
https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Wed, 19 Feb 2020 01:54:42 GMT
Content-Encoding
gzip
Last-Modified
Thu, 04 Dec 2014 21:06:56 GMT
ETag
"1417727216"
X-HW
1582077282.dop011.wa1.t,1582077282.cds007.wa1.shn,1582077282.cds007.wa1.c
Content-Type
text/javascript
Cache-Control
max-age=69508
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
6880
5wszez6v7k
t.frtyk.com/
Redirect Chain
  • https://a.vfghd.com/9d6ec174-d20a-4285-bc62-1d8926198dc2?subID1=5050&affiliateID=43404&source=1021376d9d13f0235b95faf0aa7518&subID2=2563&Target=82.102.19.0&Bnr=%7Bbnr%7D
  • https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
Requested by
Host: t.irtyf.com
URL: https://t.irtyf.com/5h2xwxuge9?aff_id=2563&campaign_id=4173&aff_sub=5050&bo=2753,2754,2755,2756
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.178.242.109 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
109.242.178.107.bc.googleusercontent.com
Software
nginx/1.13.12 / Express
Resource Hash
f2ebb8ba2130494a90b2699ecc7af706e5f28f8f7d8be6fde7159ea41cbc6f46

Request headers

:method
GET
:authority
t.frtyk.com
:scheme
https
:path
/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://t.irtyf.com/f2tv4ubdmp?nopop=1&aff_id=2563&campaign_id=2753&aff_sub=5050&bo=2754%2C2755%2C2756
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://t.irtyf.com/f2tv4ubdmp?nopop=1&aff_id=2563&campaign_id=2753&aff_sub=5050&bo=2754%2C2755%2C2756

Response headers

status
200
x-powered-by
Express
actioncode
0
realaction
/aff_c
date
Wed, 19 Feb 2020 01:54:44 GMT
content-type
text/html; charset=iso-8859-1
content-length
1900
server
nginx/1.13.12
expires
Sat, 26 Jul 1997 05:00:00 GMT
pragma
no-cache
cache-control
no-cache, no-store, must-revalidate
x-robots-tag
noindex, nofollow
tracking_id
102e7d1c3c73a2cd1aa43f0816b47f
set-cookie
aff_ran_url_6706=19811; expires=Thu, 20 Feb 2020 01:54:44 GMT; path=/; SameSite=None; Secure enc_aff_session_63=ENC037f7b05e34d68e718d6648ecf223692c064e234d44f661f92ac02a0267b1a4e3c73ea8138a85beea52d4443b478864fcff09d537343f9f9839fc48c9ab35b715525e1085d456f48c2b5c3509e0b5e1e81f2000f3f9cd81f447c74bfc44db89a8862929a7348c97139c4dd2eceab1246d5f5ef26efbfd6df6ccfc7b95ec3e2f0ff47bf8c4adb9ea7abd49a340acd8064b5b666c62a733caafdc6865ebf0203c89c5c13e7cf9a25be202543ada02a7db26017d18aa0c9e5194c232070b09827c1d23852c4d999c7f0b58c9989b886a1fe9594a5e6d3270803315208a083b44d4fb03de6a1fd8ec0892b786963f9542fe60602f367bbb9d6aa5c0c9300269b472a2b03e5a298; expires=Thu, 19 Mar 2020 01:54:44 GMT; path=/; SameSite=None; Secure ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiI3NC4wIiwibW9iaWxlX2NhcnJpZXIiOiI/IiwidXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1hYyBPUyBYIDEwXzE0XzUpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS83NC4wLjM3MjkuMTY5IFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJlbi1VUyIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ==; expires=Fri, 13 Jan 2023 12:34:44 GMT; path=/; SameSite=None; Secure
p3p
CP="NOI CUR OUR NOR INT"
access-control-allow-origin
*
x-request-id
62f2d2c6ecbe00e893eaf939b12ed126
etag
W/"76c-KUQmQ7cQuOVhaPHBgnr63+MEpgg"
via
1.1 google
alt-svc
clear

Redirect headers

Server
nginx
Date
Wed, 19 Feb 2020 01:54:42 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
no-store, no-cache, pre-check=0, post-check=0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
Pragma
no-cache
Set-Cookie
9d6ec174-d20a-4285-bc62-1d8926198dc2-v4=9d6ec174-d20a-4285-bc62-1d8926198dc2; Max-Age=86400; Expires=Thu, 20-Feb-2020 01:54:42 GMT; Domain=a.vfghd.com; Path=/; Secure; HttpOnly;SameSite=None cc-v4=UI6SKglh%2FdQ3i5MnyNAsDdc3kn19XlKCQHWmTjckzlr5gDyMwZ16olirAzPxhOAdNDKIgz%2BficVTKt9tn3kdBUtrFXO5alRMXidolDVG%2B%2Bj4o7lw0wW0QcIBsV%2Boo1Qa9Cnz11kBhFiDghdXJGddPQ%3D%3D; Max-Age=31536000; Expires=Thu, 18-Feb-2021 01:54:42 GMT; Domain=a.vfghd.com; Path=/; Secure; HttpOnly;SameSite=None
history.js
ckstatic.com/js/historyjs/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ckstatic.com/js/historyjs/history.js
Requested by
Host: t.frtyk.com
URL: https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
2324fa2acc1382ed8b1306e981e5c2273e57a0532efd1d6a5a0a4a0aab22d045

Request headers

Referer
https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Wed, 19 Feb 2020 01:54:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 04 Dec 2014 21:06:56 GMT
ETag
"1417727216"
X-HW
1582077282.dop011.wa1.t,1582077284.cds007.wa1.shn,1582077284.cds007.wa1.c
Content-Type
text/javascript
Cache-Control
max-age=69506
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
6880
Primary Request /
tour.camsoda.com/pop8g2/
Redirect Chain
  • http://t.grtyj.com/bfqld7s98h?campaign_id=3&aff_id=43404&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&aff_sub4=&aff_sub5=&source=1021376d9d13f0235b95faf0aa7518
  • https://www.camsoda.com/enter.php?id=crakrevenuepps&type=PPS&t=best&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a
  • https://tour.camsoda.com/pop8g2?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
  • http://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
  • https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Requested by
Host: t.frtyk.com
URL: https://t.frtyk.com/5wszez6v7k?aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=2779
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx / PHP/5.4.45-0reflected3+deb8u1
Resource Hash
af7ddb53c9ca19ad13c7026802f12ad9a8d15ab70efaf41cec6ef27a126a4208

Request headers

Host
tour.camsoda.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
www_cs_session=eyJpdiI6IkJaSnJvRkdtK1ZOdUhCdUhhQjh6bEE9PSIsInZhbHVlIjoiRmJWVGo1Qm9PUmZwaStpUTN2eERTREZ6UXp2aDBXelV5dWIwaEEraklUbDVCc0crNklmd080ZW5td1hMcm9tcyIsIm1hYyI6Ijk4MGQ2MjEzNDM2MzA2N2ZmNWFlN2JkYmU0N2IxMWY5OWYxMmE5MjExNzIxNDA5MDkxYmQxZWYzNDVhOTE2OGEifQ%3D%3D; RNLBSERVERID=ded3239
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://t.frtyk.com/7xlv46ogxt?nopop=1&aff_id=43404&offer_id=6706&url_id=19811&aff_sub=5050&aff_sub2=2563&aff_sub3=w0tid05pj2d66p1t19joujei&source=1021376d9d13f0235b95faf0aa7518&bo=&campaign_id=2779

Response headers

Server
nginx
Date
Wed, 19 Feb 2020 01:54:48 GMT
Content-Type
text/html
Transfer-Encoding
chunked
X-Powered-By
PHP/5.4.45-0reflected3+deb8u1
Access-Control-Allow-Origin
https://www.camsoda.com/api/v1/auth/register_promos

Redirect headers

Cache-Control
no-cache
Content-length
0
Location
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
style.css
promos.camsoda.com/pop17b/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://promos.camsoda.com/pop17b/style.css
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.254.122.104 Amsterdam, Netherlands, ASN29789 (REFLECTED, US),
Reverse DNS
Software
/
Resource Hash
77a22d0529655b67f389c9b9ca29247d21c2eff1a1b842074296609bac009bd1

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Wed, 19 Feb 2020 01:54:48 GMT
last-modified
Wed, 20 Feb 2019 22:23:24 GMT
etag
"5c6dd35c-b1d"
content-type
text/css
status
200
cache-control
max-age=172800, public, no-transform
x-cdn-diag
fra1-11037-2-8383-h-0-0---;11015-10-47942----0-0-0
accept-ranges
bytes
content-length
2845
expires
Tue, 11 Feb 2020 06:03:07 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.1/ 		91 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.8.1/jquery.min.js
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fc184f96dd18794e204c41075a00923be7e8e568744231d74f2fdf8921f78d29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 04 Feb 2020 19:54:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1231190
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
33396
x-xss-protection
0
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 03 Feb 2021 19:54:58 GMT
logo.png
promos.camsoda.com/pop17b/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://promos.camsoda.com/pop17b/logo.png
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.254.122.104 Amsterdam, Netherlands, ASN29789 (REFLECTED, US),
Reverse DNS
Software
/
Resource Hash
733e2f77940daeeffeaf9411c297833e4bfa03df77b3d1f7c11113d233e16c20

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 19 Feb 2020 01:54:48 GMT
last-modified
Wed, 20 Feb 2019 22:23:24 GMT
etag
"5c6dd35c-6396"
content-type
image/png
status
200
cache-control
max-age=172800, public, no-transform
x-cdn-diag
fra1-11028-1-45674-h-0-0---;11015-10-47942----0-0-0
accept-ranges
bytes
content-length
25494
expires
Tue, 11 Feb 2020 06:46:01 GMT
sc.png
promos.camsoda.com/assets/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://promos.camsoda.com/assets/sc.png
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.254.122.104 Amsterdam, Netherlands, ASN29789 (REFLECTED, US),
Reverse DNS
Software
/
Resource Hash
7e5fb14745cab6316f66e48128b483cdaa754a1193e597212e365af15ac7f730

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 19 Feb 2020 01:54:48 GMT
last-modified
Wed, 20 Feb 2019 22:23:18 GMT
etag
"5c6dd356-402c"
content-type
image/png
status
200
cache-control
max-age=172800, public, no-transform
x-cdn-diag
fra1-11015-1-47562-h-0-0---;11015-10-47942----0-0-0
accept-ranges
bytes
content-length
16428
expires
Sun, 09 Feb 2020 18:32:35 GMT
imgcount.php
partners.camsoda.com/ct/ 		42 B
210 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partners.camsoda.com/ct/imgcount.php?a=crakrevenuepps&s=csb&t=pop8g2&r=&p=main&i=82.102.19.132&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad=1021b9eb2c797971da52af73529a7a&u1=&u2=&u3=&u4=best&custom_tour=&custom_aclid=&custom_gclid=&custom_vclid=
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
208.99.67.237 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 19 Feb 2020 01:54:48 GMT
cache-control
no-cache, must-revalidate
expires
Wed, 29 Apr 1992 23:15:00 GMT
server
nginx
access-control-allow-origin
*
content-type
image/gif
Cookie set register.php
tour.camsoda.com/ Frame 764C 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
6fd05ae71e697af189066cc84ace6b36eb511be9f1835ce487aea9aaeb0d42ff

Request headers

Host
tour.camsoda.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2

Response headers

Server
nginx
Date
Wed, 19 Feb 2020 01:54:48 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Access-Control-Allow-Origin
https://www.camsoda.com/api/v1/auth/register_promos
Set-Cookie
RNLBSERVERID=ded3241; path=/
analytics.js
www.google-analytics.com/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
4876
date
Wed, 19 Feb 2020 00:33:32 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
18174
expires
Wed, 19 Feb 2020 02:33:32 GMT
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		715 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
shower-girls2.mp4
tour.camsoda.com/pop8g2/ 		1 MB
1 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/pop8g2/shower-girls2.mp4
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
57ed912f42f3a5398e48faa45c612b4ff656ef3a008c499561d4f743e2c8ca02

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Sec-Fetch-Dest
video
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Date
Wed, 19 Feb 2020 01:54:48 GMT
Last-Modified
Fri, 07 Feb 2020 18:08:22 GMT
Server
nginx
ETag
"5e3da796-127c4c"
Content-Type
video/mp4
Content-Range
bytes 0-1211467/1211468
Cache-Control
max-age=172800, public, no-transform
Content-Length
1211468
Expires
Fri, 21 Feb 2020 01:54:48 GMT
collect
www.google-analytics.com/r/ 		35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1584851929&t=pageview&_s=1&dl=https%3A%2F%2Ftour.camsoda.com%2Fpop8g2%2F%3Fnoterms%3D1%26id%3Dcrakrevenuepps%26cmp%3D43404_1021376d9d13f0235b95faf0aa7518_5050%26ad_id%3D1021b9eb2c797971da52af73529a7a%26type%3DPPS%26u4%3Dbest%26t%3Dpop8g2&ul=en-us&de=UTF-8&dt=CamSoda.com&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1749361783&gjid=1428855238&cid=832045914.1582077289&tid=UA-63416204-2&_gid=56616380.1582077289&_r=1&z=317033855
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://tour.camsoda.com/pop8g2/?noterms=1&id=crakrevenuepps&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&ad_id=1021b9eb2c797971da52af73529a7a&type=PPS&u4=best&t=pop8g2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Wed, 19 Feb 2020 01:54:48 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
bootstrap.min.css
tour.camsoda.com/css/ Frame 764C 		120 KB
120 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/css/bootstrap.min.css
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87

Request headers

Referer
https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Wed, 19 Feb 2020 01:54:48 GMT
Last-Modified
Wed, 20 Feb 2019 22:23:18 GMT
Server
nginx
ETag
"5c6dd356-1deac"
Content-Type
text/css
Cache-Control
max-age=172800, public, no-transform
Accept-Ranges
bytes
Content-Length
122540
Expires
Fri, 21 Feb 2020 01:54:48 GMT
font-awesome.min.css
tour.camsoda.com/css/ Frame 764C 		26 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/css/font-awesome.min.css
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Request headers

Referer
https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Wed, 19 Feb 2020 01:54:48 GMT
Last-Modified
Wed, 20 Feb 2019 22:23:18 GMT
Server
nginx
ETag
"5c6dd356-6857"
Content-Type
text/css
Cache-Control
max-age=172800, public, no-transform
Accept-Ranges
bytes
Content-Length
26711
Expires
Fri, 21 Feb 2020 01:54:48 GMT
register.css
tour.camsoda.com/css/ Frame 764C 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/css/register.css
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
a78ba183d24277a7b4a858ccdc83ef2b9b34b3f71b62c7d27620c655bef1cd2a

Request headers

Referer
https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Wed, 19 Feb 2020 01:54:48 GMT
Last-Modified
Wed, 20 Feb 2019 22:23:18 GMT
Server
nginx
ETag
"5c6dd356-3057"
Content-Type
text/css
Cache-Control
max-age=172800, public, no-transform
Accept-Ranges
bytes
Content-Length
12375
Expires
Fri, 21 Feb 2020 01:54:48 GMT
jquery-2.1.4.min.js
tour.camsoda.com/js/ Frame 764C 		82 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tour.camsoda.com/js/jquery-2.1.4.min.js
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.210.151.32 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

Request headers

Referer
https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Wed, 19 Feb 2020 01:54:48 GMT
Last-Modified
Wed, 20 Feb 2019 22:23:19 GMT
Server
nginx
ETag
"5c6dd357-14979"
Content-Type
application/javascript
Cache-Control
max-age=172800, public, no-transform
Accept-Ranges
bytes
Content-Length
84345
Expires
Fri, 21 Feb 2020 01:54:48 GMT
register.js
www.camsoda.com/landers/js/ Frame 764C 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.camsoda.com/landers/js/register.js
Requested by
Host: tour.camsoda.com
URL: https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
208.99.67.227 Waltham, United States, ASN29789 (REFLECTED, US),
Reverse DNS
Software
nginx /
Resource Hash
2b18049cc471bf675595e62fb211c90239c870bafb65bf4cf72a397041dd8126

Request headers

Referer
https://tour.camsoda.com/register.php?id=crakrevenuepps&ad_id=1021b9eb2c797971da52af73529a7a&cmp=43404_1021376d9d13f0235b95faf0aa7518_5050&t=pop8g2&u1=&u2=&u3=&u4=best&custom_tour=&aclid=&gclid=&vclid=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 19 Feb 2020 01:54:48 GMT
content-encoding
gzip
last-modified
Fri, 01 Nov 2019 14:15:09 GMT
server
nginx
access-control-allow-origin
*
etag
W/"5dbc3ded-ca1"
content-type
application/javascript
status
200
cache-control
max-age=1296000, public, no-transform
expires
Thu, 05 Mar 2020 01:54:48 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| tour function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

4 Cookies

Domain/Path Name / Value
tour.camsoda.com/ Name: RNLBSERVERID
Value: ded3239
.camsoda.com/ Name: _gat
Value: 1
.camsoda.com/ Name: _gid
Value: GA1.2.56616380.1582077289
.camsoda.com/ Name: _ga
Value: GA1.2.832045914.1582077289

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.vfghd.com
ajax.googleapis.com
ckstatic.com
cntlckr.com
kikforum.co
partners.camsoda.com
promos.camsoda.com
shorturl.ws
sophiemudd.centralpto.com
t.frtyk.com
t.grtyj.com
t.irtyf.com
tour.camsoda.com
www.camsoda.com
www.google-analytics.com
www.kikforum.co
107.178.242.109
107.180.126.208
192.124.249.110
205.185.216.10
208.99.67.227
208.99.67.237
2a00:1450:4001:80b::200e
2a00:1450:4001:818::200a
35.159.5.116
64.210.151.32
66.254.122.104
70.39.97.254
2324fa2acc1382ed8b1306e981e5c2273e57a0532efd1d6a5a0a4a0aab22d045
2b18049cc471bf675595e62fb211c90239c870bafb65bf4cf72a397041dd8126
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
57ed912f42f3a5398e48faa45c612b4ff656ef3a008c499561d4f743e2c8ca02
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
6fd05ae71e697af189066cc84ace6b36eb511be9f1835ce487aea9aaeb0d42ff
733e2f77940daeeffeaf9411c297833e4bfa03df77b3d1f7c11113d233e16c20
77a22d0529655b67f389c9b9ca29247d21c2eff1a1b842074296609bac009bd1
7e5fb14745cab6316f66e48128b483cdaa754a1193e597212e365af15ac7f730
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
a12dc339a344950b1e492264b2367f8069a0a3e2ce5c2bc7525c647b33e1d493
a78ba183d24277a7b4a858ccdc83ef2b9b34b3f71b62c7d27620c655bef1cd2a
af7ddb53c9ca19ad13c7026802f12ad9a8d15ab70efaf41cec6ef27a126a4208
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c
f2ebb8ba2130494a90b2699ecc7af706e5f28f8f7d8be6fde7159ea41cbc6f46
fc184f96dd18794e204c41075a00923be7e8e568744231d74f2fdf8921f78d29