urlscan.io logo urlscan.io
SecurityTrails logo

click.trlxcf02.com Open in urlscan Pro
2606:4700:3031::6815:1c79  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://storage.googleapis.com/nbvcdfghytre/xiferptcslokd.html#rd/c1706BlKxo1218904GgEK932FQO1469vMzZ574
Effective URL: https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027
Submission: On April 22 via api from BE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3031::6815:1c79, located in United States and belongs to CLOUDFLARENET, US. The main domain is click.trlxcf02.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 21st 2020. Valid for: a year.
This is the only time click.trlxcf02.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
1 2 178.238.228.71 51167 (CONTABO)
1 1 34.91.44.202 15169 (GOOGLE)
1 1 35.204.14.125 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 3
1    2a00:1450:4001:828::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
storage.googleapis.com
2    178.238.228.71 (Munich, Germany)

ASN51167 (CONTABO, DE)
PTR: codesnipper.de
178.238.228.71
1    34.91.44.202 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 202.44.91.34.bc.googleusercontent.com
vipeterst.com
1    35.204.14.125 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 125.14.204.35.bc.googleusercontent.com
plaqexit.com
1    2606:4700:3031::6815:1c79 (United States)

ASN13335 (CLOUDFLARENET, US)
click.trlxcf02.com
Apex Domain
Subdomains		 Transfer
1 trlxcf02.com
click.trlxcf02.com
2 KB
1 plaqexit.com
plaqexit.com
739 B
1 vipeterst.com
vipeterst.com
287 B
1 googleapis.com
storage.googleapis.com
837 B
3 4
Domain Requested by
1 click.trlxcf02.com 178.238.228.71
1 plaqexit.com 1 redirects
1 vipeterst.com 1 redirects
1 storage.googleapis.com
3 4

This site contains no links.

Subject Issuer Validity Valid
*.storage.googleapis.com
GTS CA 1O1		 2021-03-23 -
2021-06-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-21 -
2021-07-21		 a year crt.sh

This page contains 1 frames:

Primary Page: https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027
Frame ID: 0928B2D484D019216A079460552D6158
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://storage.googleapis.com/nbvcdfghytre/xiferptcslokd.html Page URL
  2. http://178.238.228.71/rd/c1706BlKxo1218904GgEK932FQO1469vMzZ574 Page URL
  3. http://178.238.228.71/track/c1706BlKxo1218904GgEK932FQO1469vMzZ574 HTTP 302
    https://vipeterst.com/?a=2027&oc=13336&c=38001&m=3&s1=9&s2=574-1706&s3=1218904-932-1469 HTTP 302
    https://plaqexit.com/?a=2027&oc=13336&c=38001&m=3&s1=9&s2=574-1706&s3=1218904-932-1469&ckmguid=a9... HTTP 302
    https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027 Page URL

Page Statistics

3
Requests

67 %
HTTPS

40 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

3 kB
Transfer

0 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://storage.googleapis.com/nbvcdfghytre/xiferptcslokd.html Page URL
  2. http://178.238.228.71/rd/c1706BlKxo1218904GgEK932FQO1469vMzZ574 Page URL
  3. http://178.238.228.71/track/c1706BlKxo1218904GgEK932FQO1469vMzZ574 HTTP 302
    https://vipeterst.com/?a=2027&oc=13336&c=38001&m=3&s1=9&s2=574-1706&s3=1218904-932-1469 HTTP 302
    https://plaqexit.com/?a=2027&oc=13336&c=38001&m=3&s1=9&s2=574-1706&s3=1218904-932-1469&ckmguid=a91623a8-f0d0-4738-a189-8ac9f1a4c1e3 HTTP 302
    https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
xiferptcslokd.html
storage.googleapis.com/nbvcdfghytre/ 		250 B
837 B 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/nbvcdfghytre/xiferptcslokd.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash

Request headers

:method
GET
:authority
storage.googleapis.com
:scheme
https
:path
/nbvcdfghytre/xiferptcslokd.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-guploader-uploadid
ABg5-UzxAkMK_OBo7hXxplVuuutkZ8un6SGPuecmG1ucUkxByB6KQgtcbHYZ8ZMkAUyEUQOk07OC_F9XoWCpEw1dqk5IBKxYHw
expires
Thu, 22 Apr 2021 18:25:56 GMT
date
Thu, 22 Apr 2021 17:25:56 GMT
last-modified
Sun, 07 Mar 2021 04:27:16 GMT
etag
"f53619b9fdafc368a59ed0c9ccffd535"
x-goog-generation
1615091236823381
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
250
content-type
text/html
x-goog-hash
crc32c=BCG5Iw== md5=9TYZuf2vw2ilntDJzP/VNQ==
x-goog-storage-class
STANDARD
accept-ranges
bytes
content-length
250
server
UploadServer
age
3441
cache-control
public, max-age=3600
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
c1706BlKxo1218904GgEK932FQO1469vMzZ574
178.238.228.71/rd/ 		235 B
352 B 		Document
General
Check archive.org
Download Go to
Full URL
http://178.238.228.71/rd/c1706BlKxo1218904GgEK932FQO1469vMzZ574
Requested by
Host: storage.googleapis.com
URL: https://storage.googleapis.com/nbvcdfghytre/xiferptcslokd.html
Protocol
HTTP/1.1
Server
178.238.228.71 Munich, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
codesnipper.de
Software
/
Resource Hash

Request headers

Host
178.238.228.71
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
text/html; charset=utf-8
Date
Thu, 22 Apr 2021 18:23:17 GMT
Content-Length
235
Primary Request yX3CWb8iyJQi8Bznu2
click.trlxcf02.com/click/
Redirect Chain
  • http://178.238.228.71/track/c1706BlKxo1218904GgEK932FQO1469vMzZ574
  • https://vipeterst.com/?a=2027&oc=13336&c=38001&m=3&s1=9&s2=574-1706&s3=1218904-932-1469
  • https://plaqexit.com/?a=2027&oc=13336&c=38001&m=3&s1=9&s2=574-1706&s3=1218904-932-1469&ckmguid=a91623a8-f0d0-4738-a189-8ac9f1a4c1e3
  • https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027
24 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027
Requested by
Host: 178.238.228.71
URL: http://178.238.228.71/rd/c1706BlKxo1218904GgEK932FQO1469vMzZ574
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:1c79 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e37b6f5753f324cba2796bfa3efdb1b0b0f20d97596abb201e281af57858235f

Request headers

:method
GET
:authority
click.trlxcf02.com
:scheme
https
:path
/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://178.238.228.71/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
http://178.238.228.71/rd/c1706BlKxo1218904GgEK932FQO1469vMzZ574

Response headers

date
Thu, 22 Apr 2021 18:23:19 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d747ca99e01054705410c17d6712605a31619115798; expires=Sat, 22-May-21 18:23:18 GMT; path=/; domain=.trlxcf02.com; HttpOnly; SameSite=Lax AWSALB=aekfF9wBzzlLGNsPykhQaBmig41/vMuaoTgIeNiDOj3TAbrnNR7L+wj9640O9qkHZf8XSrzMZDPuXdqUxts01vkXBzrZ4hGxx3j1rj0JmpyK188LspZ8v5lRTiOd; Expires=Thu, 29 Apr 2021 18:23:19 GMT; Path=/ AWSALBCORS=aekfF9wBzzlLGNsPykhQaBmig41/vMuaoTgIeNiDOj3TAbrnNR7L+wj9640O9qkHZf8XSrzMZDPuXdqUxts01vkXBzrZ4hGxx3j1rj0JmpyK188LspZ8v5lRTiOd; Expires=Thu, 29 Apr 2021 18:23:19 GMT; Path=/; SameSite=None XSRF-TOKEN=eyJpdiI6Ikp0RitNZTBWbGpvdWV5MG9ENGR5Rnc9PSIsInZhbHVlIjoiMm81OVJ4WWdxdTJramx2Zk0zZzJnUUk4enFsVjIybEtKclhFZ3U2MHMwMTFTdTBLOHdxeUNFNWRLMWRjdk1seE0rUkcwRUM4aUJXY3VEd1J2a1JpN3c9PSIsIm1hYyI6IjgxM2RkOGVhYjNkYmZjOWViMzMyNTgxYWVkZTJhODczYWVlZDVhNmJmMzBiMjkwYjU4M2U4YmFhY2JjZGU1ZTEifQ%3D%3D; expires=Thu, 22-Apr-2021 20:23:19 GMT; Max-Age=7200; path=/ session=eyJpdiI6Ikdscndtb2JJanRCSjE5TmNpS3ZSbFE9PSIsInZhbHVlIjoiY0c4Z052WHVkeHg0VGZaZ1hzVWtMV2tWWVgxUFlSbDA5RDlnSEZ6ZE93NWtcL1dMZFZYWk9Sd3N5dlZnaVo3WDV2UURCekZHSllqV3Q4U0IrWFZ1NFd3PT0iLCJtYWMiOiJiNjcyYjFhZjZjNDgwZDE5YTc2NDEyMzAyZjkyZjg5MGViMjRjYjNkZTE0MjQ3M2JhYWRiMWI5Y2E3YmQxYzczIn0%3D; expires=Thu, 22-Apr-2021 20:23:19 GMT; Max-Age=7200; path=/; HttpOnly KhkYxTcoK45zMXxVPqGSlZu3MG95ftmX5peaRmRA=eyJpdiI6InpkWkpGR2h2QWkrMzA4Nld2bzhKVWc9PSIsInZhbHVlIjoiaENQdk9pNndjeXpcL2tHMzhSNkcyZllSU1wvOHI0aWw5ZGhHTFRcL1N6MGJudnZNVmo0TjdSeGxnM0M3SUdjbkVJMkJPTWQxRDRZbFNHUng2d1RqVjFpNjZHZ2NOSkFjMWJvN0V0XC9TY296V3BiR2JSOTRyNnFOZE00aEdDTlwvRFpcL3JyN01cL2UrdzR1Y0NyRkZyQjlvQ1F1WU5RSFN4TUNNWmR0K1FVbnNWVlwvb2l2VStyTUVtS092RjBUQWE4ZzZrR1ZcL1d2SkVxTkZiRUt3clFNTlg0dlBcLzJzWmZ2b2FvUDFteXd2UGlSSDBLSWZ6NytDTnZxVVdNNlRQTVcweFdVb2hJUkw1T3Y5YzRlYmk4bHhJcmt2WmRFUFFWMGhWbHVNY3p0QTVtRVZCdDVqaG9nUUF6SUxWMk5pM0JvV1dXUWs1TVFyMXdBdkpVY0pqYkt4NW42UXJZMmdTMkFNWTRPRk9QRDNjYm1PRXg4MGRFSnQ0cG9HWHU1VkZLNzk1S0d0ZThTeVA2NTZGQWhMOXpSMEFlQ0RyTWc9PSIsIm1hYyI6IjU5Y2MzYmVjMTUzNGI5NGJmNjcxMGFlYzYzYjc5MDZkM2M3N2NiNDNlY2RkYWEwZDRlNWM4MzQ1YTJhZjUyNzIifQ%3D%3D; expires=Thu, 22-Apr-2021 20:23:19 GMT; Max-Age=7200; path=/; HttpOnly
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-request-id
099c6b894900002b897696e000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ELiRcHpE%2Bu3LwciyESaDPI%2Bde0OGQ3VJOe5wpeCODeFinbrKrXjNOErO24F%2FNfDOC%2Fum3MXfqBX8t5o0I5pdafqLYGv0PuukKWi3qaMeP46%2F1rQRlzAgKxHF15m%2FpWw%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6440e1eedbc12b89-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date
Thu, 22 Apr 2021 18:23:18 GMT
Content-Type
text/html; charset=utf-8
Content-Length
210
Cache-Control
private
Location
https://click.trlxcf02.com/click/yX3CWb8iyJQi8Bznu2?affid=100481&c1=196421747&c3=2027
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Set-Cookie
sl=sWtpZlIUTCA+ow4rgRmjJxLdTlpHAzBGm/3BWUU2bPaDFDS8OMzNVA==; domain=.plaqexit.com; path=/; HttpOnly tib=ItBZ8XsFpclmOJxzM1va4xLdTlpHAzBGm/3BWUU2bPaDFDS8OMzNVA==; domain=.plaqexit.com; expires=Wed, 22-Apr-2026 19:23:18 GMT; path=/; HttpOnly c12658=sWtpZlIUTCDLBLGGMNOFtU5M/jdO0n9eHXHK4dJBDEj6FJEco9B6Bg==; domain=.plaqexit.com; expires=Sat, 22-May-2021 18:23:18 GMT; path=/; HttpOnly

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

5 Cookies

Domain/Path Name / Value
click.trlxcf02.com/ Name: KhkYxTcoK45zMXxVPqGSlZu3MG95ftmX5peaRmRA
Value: eyJpdiI6InpkWkpGR2h2QWkrMzA4Nld2bzhKVWc9PSIsInZhbHVlIjoiaENQdk9pNndjeXpcL2tHMzhSNkcyZllSU1wvOHI0aWw5ZGhHTFRcL1N6MGJudnZNVmo0TjdSeGxnM0M3SUdjbkVJMkJPTWQxRDRZbFNHUng2d1RqVjFpNjZHZ2NOSkFjMWJvN0V0XC9TY296V3BiR2JSOTRyNnFOZE00aEdDTlwvRFpcL3JyN01cL2UrdzR1Y0NyRkZyQjlvQ1F1WU5RSFN4TUNNWmR0K1FVbnNWVlwvb2l2VStyTUVtS092RjBUQWE4ZzZrR1ZcL1d2SkVxTkZiRUt3clFNTlg0dlBcLzJzWmZ2b2FvUDFteXd2UGlSSDBLSWZ6NytDTnZxVVdNNlRQTVcweFdVb2hJUkw1T3Y5YzRlYmk4bHhJcmt2WmRFUFFWMGhWbHVNY3p0QTVtRVZCdDVqaG9nUUF6SUxWMk5pM0JvV1dXUWs1TVFyMXdBdkpVY0pqYkt4NW42UXJZMmdTMkFNWTRPRk9QRDNjYm1PRXg4MGRFSnQ0cG9HWHU1VkZLNzk1S0d0ZThTeVA2NTZGQWhMOXpSMEFlQ0RyTWc9PSIsIm1hYyI6IjU5Y2MzYmVjMTUzNGI5NGJmNjcxMGFlYzYzYjc5MDZkM2M3N2NiNDNlY2RkYWEwZDRlNWM4MzQ1YTJhZjUyNzIifQ%3D%3D
click.trlxcf02.com/ Name: session
Value: eyJpdiI6Ikdscndtb2JJanRCSjE5TmNpS3ZSbFE9PSIsInZhbHVlIjoiY0c4Z052WHVkeHg0VGZaZ1hzVWtMV2tWWVgxUFlSbDA5RDlnSEZ6ZE93NWtcL1dMZFZYWk9Sd3N5dlZnaVo3WDV2UURCekZHSllqV3Q4U0IrWFZ1NFd3PT0iLCJtYWMiOiJiNjcyYjFhZjZjNDgwZDE5YTc2NDEyMzAyZjkyZjg5MGViMjRjYjNkZTE0MjQ3M2JhYWRiMWI5Y2E3YmQxYzczIn0%3D
click.trlxcf02.com/ Name: XSRF-TOKEN
Value: eyJpdiI6Ikp0RitNZTBWbGpvdWV5MG9ENGR5Rnc9PSIsInZhbHVlIjoiMm81OVJ4WWdxdTJramx2Zk0zZzJnUUk4enFsVjIybEtKclhFZ3U2MHMwMTFTdTBLOHdxeUNFNWRLMWRjdk1seE0rUkcwRUM4aUJXY3VEd1J2a1JpN3c9PSIsIm1hYyI6IjgxM2RkOGVhYjNkYmZjOWViMzMyNTgxYWVkZTJhODczYWVlZDVhNmJmMzBiMjkwYjU4M2U4YmFhY2JjZGU1ZTEifQ%3D%3D
click.trlxcf02.com/ Name: AWSALB
Value: aekfF9wBzzlLGNsPykhQaBmig41/vMuaoTgIeNiDOj3TAbrnNR7L+wj9640O9qkHZf8XSrzMZDPuXdqUxts01vkXBzrZ4hGxx3j1rj0JmpyK188LspZ8v5lRTiOd
.trlxcf02.com/ Name: __cfduid
Value: d747ca99e01054705410c17d6712605a31619115798

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

click.trlxcf02.com
plaqexit.com
storage.googleapis.com
vipeterst.com
178.238.228.71
2606:4700:3031::6815:1c79
2a00:1450:4001:828::2010
34.91.44.202
35.204.14.125
e37b6f5753f324cba2796bfa3efdb1b0b0f20d97596abb201e281af57858235f