urlscan.io logo urlscan.io
SecurityTrails logo

xtplkq.com Open in urlscan Pro
2606:4700:3032::6815:2794  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://xtplkq.com/5f1cc6dd4c
Effective URL: http://xtplkq.com/redirect/7-b5tKJLVYTNxU_v7t-BR1aLHevpO4zNkV4fR0vLPiJJnJz8BDYL6nbHDIOhNXrXfNS9aevkCOddseQB9u3wIQ/
Submission: On July 30 via manual from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3032::6815:2794, located in United States and belongs to CLOUDFLARENET, US. The main domain is xtplkq.com.
This is the only time xtplkq.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 2606:4700:303... 13335 (CLOUDFLAR...)
1 34.229.213.28 14618 (AMAZON-AES)
3 2
Apex Domain
Subdomains		 Transfer
3 xtplkq.com
xtplkq.com
4 KB
1 topxsavings.com
www.topxsavings.com
3 2
Domain Requested by
3 xtplkq.com 1 redirects
1 www.topxsavings.com
3 2

This site contains no links.

Subject Issuer Validity Valid
topxsavings.com
R3		 2021-07-18 -
2021-10-16		 3 months crt.sh

This page contains 1 frames:

Frame: https://www.topxsavings.com/JNP9CLH7/K8CZLMR/?sub1=728_4A
Frame ID: 410039FEBB32678E0853778532585065
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://xtplkq.com/5f1cc6dd4c HTTP 302
    http://xtplkq.com/rtrack38.php Page URL
  2. http://xtplkq.com/redirect/7-b5tKJLVYTNxU_v7t-BR1aLHevpO4zNkV4fR0vLPiJJnJz8BDYL6nbHDIOhNXrXfNS... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

3
Requests

33 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

3 kB
Transfer

3 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://xtplkq.com/5f1cc6dd4c HTTP 302
    http://xtplkq.com/rtrack38.php Page URL
  2. http://xtplkq.com/redirect/7-b5tKJLVYTNxU_v7t-BR1aLHevpO4zNkV4fR0vLPiJJnJz8BDYL6nbHDIOhNXrXfNS9aevkCOddseQB9u3wIQ/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://xtplkq.com/5f1cc6dd4c HTTP 302
  • http://xtplkq.com/rtrack38.php

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set rtrack38.php
xtplkq.com/
Redirect Chain
  • http://xtplkq.com/5f1cc6dd4c
  • http://xtplkq.com/rtrack38.php
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://xtplkq.com/rtrack38.php
Protocol
HTTP/1.1
Server
2606:4700:3032::6815:2794 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e0974a76402d0b40d764437ace32f941f7ff117daccd69d9f19b7f948ec1c7a

Request headers

Host
xtplkq.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
PHPSESSID=bbf8a54d53c77cb773b004f2dd2bf30a
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1

Response headers

Date
Fri, 30 Jul 2021 07:54:12 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
HjGcSrqiFv=088067090067010001029073068071066088065000081094093024092086084071064084083067001004029076007069123125098101105122124073101104088004068003112099001086098123085088066126004077096088102026084099000065098099089100120095122077022113116119126007094085102119121097090127104069118085126125011080085065069112127074086066085102108010069029069120097024
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
CF-Cache-Status
DYNAMIC
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZsWSh0og9RmRXExJTyqrzHH0DzOZr1RNXOve7XB97zUB3PrOiPRP3GTRkIWXI%2FxvWbNAM1AHA1NMtApIPs6XdTxCYVGnM%2BFcljWsJjKsYi6oEFC0TXMpT%2BxVft4tmPVOzh5pyJXWLVP"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
676d04814da9d6d1-FRA
Content-Encoding
gzip
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date
Fri, 30 Jul 2021 07:54:12 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
PHPSESSID=bbf8a54d53c77cb773b004f2dd2bf30a; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Pragma
no-cache
Location
http://xtplkq.com/rtrack38.php
Access-Control-Allow-Origin
*
CF-Cache-Status
DYNAMIC
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rwKmgEuliZAa2iBEkfiB7PbEJ1kLvXAkR5A8rCFUf5n9ai8X8IUuGYMWQitYH93jazw40tBwBs4nORNpwLhDrrgsXPYNTxuVnBc0jUQ5EH0PgIRqy9e8d9NPNn4hl04H%2Fvb2iSill2Xu"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
676d04802beed6d1-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Primary Request /
xtplkq.com/redirect/7-b5tKJLVYTNxU_v7t-BR1aLHevpO4zNkV4fR0vLPiJJnJz8BDYL6nbHDIOhNXrXfNS9aevkCOddseQB9u3wIQ/ 		352 B
998 B 		Document
General
Check archive.org
Download Go to
Full URL
http://xtplkq.com/redirect/7-b5tKJLVYTNxU_v7t-BR1aLHevpO4zNkV4fR0vLPiJJnJz8BDYL6nbHDIOhNXrXfNS9aevkCOddseQB9u3wIQ/?
Protocol
HTTP/1.1
Server
2606:4700:3032::6815:2794 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2c2f25190ee1b57652ad5404ff627b3b39326f7ec3d592c95709d3b9afee4e4

Request headers

Host
xtplkq.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://xtplkq.com/rtrack38.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
PHPSESSID=bbf8a54d53c77cb773b004f2dd2bf30a; HjGcSrqiFv=088067090067010001029073068071066088065000081094093024092086084071064084083067001004029076007069123125098101105122124073101104088004068003112099001086098123085088066126004077096088102026084099000065098099089100120095122077022113116119126007094085102119121097090127104069118085126125011080085065069112127074086066085102108010069029069120097024
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
Referer
http://xtplkq.com/rtrack38.php

Response headers

Date
Fri, 30 Jul 2021 07:54:12 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
CF-Cache-Status
DYNAMIC
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gY%2BTQPcMW%2FRZQ3M5ge7EbutLYKstkECFewkUCL2v6WU8FKtAgYjr6CilKmHtpKVelFVC7YocAWve%2BL2HEw6TWLYfuZw5L3KRSHI4heBWX2T%2FZH00UgidUboIKc09X9G9%2BzhWDnchI3mO"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
676d04821eb8d6d1-FRA
Content-Encoding
gzip
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
/
www.topxsavings.com/JNP9CLH7/K8CZLMR/ 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.topxsavings.com/JNP9CLH7/K8CZLMR/?sub1=728_4A
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.229.213.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-229-213-28.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Host
www.topxsavings.com
Connection
keep-alive
Content-Length
0
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Origin
http://xtplkq.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
Origin
http://xtplkq.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1

Response headers

Server
nginx
Date
Fri, 30 Jul 2021 07:54:12 GMT
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
http://xtplkq.com
Vary
Origin
X-Eflow-Request-Id
6e4ebf2f-e870-41a6-ab24-17e17c7d273f
Via
1.1 google
Alt-Svc
clear

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| go

2 Cookies

Domain/Path Name / Value
xtplkq.com/ Name: HjGcSrqiFv
Value: 088067090067010001029073068071066088065000081094093024092086084071064084083067001004029076007069123125098101105122124073101104088004068003112099001086098123085088066126004077096088102026084099000065098099089100120095122077022113116119126007094085102119121097090127104069118085126125011080085065069112127074086066085102108010069029069120097024
xtplkq.com/ Name: PHPSESSID
Value: bbf8a54d53c77cb773b004f2dd2bf30a

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.topxsavings.com
xtplkq.com
2606:4700:3032::6815:2794
34.229.213.28
8e0974a76402d0b40d764437ace32f941f7ff117daccd69d9f19b7f948ec1c7a
e2c2f25190ee1b57652ad5404ff627b3b39326f7ec3d592c95709d3b9afee4e4