Submitted URL: https://trk.klclick3.com/ls/click?upn=u001.mcuXDv9vSuF-2FJzFYU0me2ioCpon3UX6GNmR3I53oU5cD0QwVmlz8a-2FNNXg2ETtpsp5-2FoUylg...
Effective URL: https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
Submission: On December 20 via manual from NZ — Scanned from NZ

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 108.158.32.11, located in United States and belongs to AMAZON-02, US. The main domain is qrs.ly. The Cisco Umbrella rank of the primary domain is 393731.
TLS certificate: Issued by Amazon RSA 2048 M03 on October 6th 2024. Valid for: a year.
This is the only time qrs.ly was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2600:9000:221... 16509 (AMAZON-02)
3 108.158.32.11 16509 (AMAZON-02)
1 104.18.11.207 13335 (CLOUDFLAR...)
2 104.17.25.14 13335 (CLOUDFLAR...)
6 3
Apex Domain
Subdomains
Transfer
3 qrs.ly
qrs.ly — Cisco Umbrella Rank: 393731
4 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
166 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3370
25 KB
1 klclick3.com
trk.klclick3.com — Cisco Umbrella Rank: 215311
443 B
6 4
Domain Requested by
3 qrs.ly qrs.ly
2 cdnjs.cloudflare.com qrs.ly
cdnjs.cloudflare.com
1 stackpath.bootstrapcdn.com qrs.ly
1 trk.klclick3.com 1 redirects
6 4

This site contains no links.

Subject Issuer Validity Valid
qrs.ly
Amazon RSA 2048 M03
2024-10-06 -
2025-11-05
a year crt.sh
bootstrapcdn.com
WE1
2024-11-18 -
2025-02-16
3 months crt.sh
cdnjs.cloudflare.com
WE1
2024-11-26 -
2025-02-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
Frame ID: 24A5E9B31E32C4624E36AE60B86A92E2
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

Access Forbidden

Page URL History Show full URLs

  1. https://trk.klclick3.com/ls/click?upn=u001.mcuXDv9vSuF-2FJzFYU0me2ioCpon3UX6GNmR3I53oU5cD0QwVmlz8a-2F... HTTP 302
    https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

6
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

195 kB
Transfer

405 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://trk.klclick3.com/ls/click?upn=u001.mcuXDv9vSuF-2FJzFYU0me2ioCpon3UX6GNmR3I53oU5cD0QwVmlz8a-2FNNXg2ETtpsp5-2FoUylgUD25d-2FmF3IZYstgT8ZBu3AlrGZuVAW-2FkS37HkB-2F0-2BLZCJyh6YbtU7rk-2BMov2_Qi4GG6Y-2FHgv8F87r5EnJbgIBL032Kh4jWMsdHaBdjzY4sJqYrUzpstmf1FbnUZbKt-2FvSa9luayYyIlPzurEmQiqLumXEYTzyZHkwoyErXSmnbbyec7vpxICFxy4TD6Vui448okJAwTpX0PDpu9Qf-2FRawuxVx9bCU63I600JiYo863MzFp3P-2BlgGiPl5n-2BaUeMxR3-2FXz-2FxqOpO9VJJ3bq7ryoSdg-2F25f0uslY4lqTYpg8ZcD7BT6-2BU0ELVOVmbQloiU4UuDbOwnc-2BYX-2BzBn2-2Bkua6mw5ZOAo00fOW10oturPqRKnWXN5tDRkEJFAJnR5E763K1VwmrHrX-2FhmM2T607sB8BrSsQtPNWktp6-2BsJ7TOgcHb2sIkP1mZJPGzeqVDh8L45DfSYktImxsX7-2BKeNjJWVOjLEjVJtAs2-2Fv6wLSztaUF4oZe0UkbqXIfgeHvJOIKPSIXYnLCaW13zLugrDQ7oxjPcUUA1GABF1qfjBS58-3D HTTP 302
    https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 1lfwi1n
qrs.ly/
Redirect Chain
  • https://trk.klclick3.com/ls/click?upn=u001.mcuXDv9vSuF-2FJzFYU0me2ioCpon3UX6GNmR3I53oU5cD0QwVmlz8a-2FNNXg2ETtpsp5-2FoUylgUD25d-2FmF3IZYstgT8ZBu3AlrGZuVAW-2FkS37HkB-2F0-2BLZCJyh6YbtU7rk-2BMov2_Qi4GG...
  • https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
998 B
2 KB
Document
General
Full URL
https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.158.32.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-158-32-11.syd3.r.cloudfront.net
Software
nginx/1.22.1 / PHP/8.2.17
Resource Hash
63a334e92bc067b6c11682553f5d724f6fdb0fcd3cd3e0b0ae2ecf653460f2fd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, private
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 20 Dec 2024 08:27:45 GMT
server
nginx/1.22.1
via
1.1 34472d6f20d066888df6f09fc51137ba.cloudfront.net (CloudFront)
x-amz-cf-id
xpKVnFtlsG5qorDDw_2iVtvN3Kl2JSNOv6OGV9AgInWIoObdybckLg==
x-amz-cf-pop
SYD3-P2
x-cache
Error from cloudfront
x-powered-by
PHP/8.2.17

Redirect headers

content-length
102
content-type
text/html; charset=utf-8
date
Fri, 20 Dec 2024 08:27:44 GMT
location
https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4#9
server
nginx
via
1.1 332185989ef2da97d1a56bdaee204b78.cloudfront.net (CloudFront)
x-amz-cf-id
R2PzQZGIYj-PX4qNYAJ9wLcOUi4oOwijEAmuUi69OpuKU9M-iPkLJg==
x-amz-cf-pop
SYD62-P1
x-cache
Miss from cloudfront
x-robots-tag
noindex, nofollow
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/
157 KB
25 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: qrs.ly
URL: https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://qrs.ly/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"816af0eddd3b4822c2756227c7e7b7ee"
age
2177176
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 20 Dec 2024 08:27:46 GMT
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
09/26/2024 11:51:12
cdn-requestpullcode
200
priority
u=0,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
1
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
709a0f3ff8ca9b26a4ac5e7ba1bf193f
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8f4e414d18361c56-AKL
access-control-allow-origin
*
cdn-edgestorageid
1001
server
cloudflare
cdn-requestcountrycode
US
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/
100 KB
19 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Requested by
Host: qrs.ly
URL: https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://qrs.ly/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"64cac444-495a"
age
63305
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eblxzshk1grl0XynbTOq0mkX6enZG5ulz54fDRo8gQidrb4E%2BspYmkKnA9BTW5O1H6iczgda0HWfA%2F%2Fc8OPNoGuSeOOXjSVXjx1ZM8YxEqBFqBk%2FFjSo5OZs1gylZ3Bhrv8DBL4I"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 10 Dec 2025 08:27:46 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 20 Dec 2024 08:27:46 GMT
content-type
text/css; charset=utf-8
last-modified
Wed, 02 Aug 2023 21:01:56 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f4e414d0c01d9be-AKL
accept-ranges
bytes
access-control-allow-origin
*
content-length
18778
server
cloudflare
app.css
qrs.ly/css/
1 KB
2 KB
Stylesheet
General
Full URL
https://qrs.ly/css/app.css?id=b56b7e40c3a79450dda94bf09d44127c
Requested by
Host: qrs.ly
URL: https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.158.32.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-158-32-11.syd3.r.cloudfront.net
Software
nginx/1.22.1 /
Resource Hash
f8b92b48f16303c9159ecc9b54b69be5bf6288f4496679c4832fc06c16329ef0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4

Response headers

etag
"675bb7dc-4d6"
x-content-type-options
nosniff
via
1.1 34472d6f20d066888df6f09fc51137ba.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Miss from cloudfront
content-length
1238
x-amz-cf-id
9a3EwEhGYcln6YJWEQURPWoaiiR4MCqt__3XTbUBq-vOtmkEkET1RA==
date
Fri, 20 Dec 2024 08:27:46 GMT
content-type
text/css
last-modified
Fri, 13 Dec 2024 04:28:12 GMT
server
nginx/1.22.1
x-amz-cf-pop
SYD3-P2
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/
147 KB
147 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://qrs.ly
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"64cac444-24a04"
age
79634
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dp0urMEtKHdfYfBLJYD%2Fdtvrc9R6g5v5%2FUwItoIKpZawNZnFJYQOK4YU15T6sgyConn9C%2Ffily%2BCEgc3e1sQh8Pz2Pb%2FFiYFZ9TSNukjACnePQ7p2xcJo6vKPk1w%2BCtfFc2Zx%2B3v"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 10 Dec 2025 08:27:46 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 20 Dec 2024 08:27:46 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Wed, 02 Aug 2023 21:01:56 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f4e41522df1d9be-AKL
accept-ranges
bytes
access-control-allow-origin
*
content-length
150020
server
cloudflare
favicon.ico
qrs.ly/
0
311 B
Other
General
Full URL
https://qrs.ly/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.158.32.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-158-32-11.syd3.r.cloudfront.net
Software
nginx/1.22.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4

Response headers

etag
"675bb7dc-0"
x-content-type-options
nosniff
via
1.1 34472d6f20d066888df6f09fc51137ba.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Miss from cloudfront
content-length
0
x-amz-cf-id
lktTtkp6lGvn5JZYQFJa5ihnJOZ7-ZvyzBIUSv_56aYqgks0VA_EGw==
date
Fri, 20 Dec 2024 08:27:47 GMT
content-type
image/x-icon
last-modified
Fri, 13 Dec 2024 04:28:12 GMT
server
nginx/1.22.1
x-amz-cf-pop
SYD3-P2

Verdicts & Comments Add Verdict or Comment

0 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Domain/Path Name / Value
qrs.ly/ Name: 1lfwi1n_visited
Value: eyJpdiI6IlNxR0JSaXVhMEZYRFdJTVUrcVlGNGc9PSIsInZhbHVlIjoiRkpUSjlzRHBwNk1UTUtLUWNMVmRpcmJPVjBSWmdmKytIL0xWR2FvS3N6Z1IzL1ZYeVgxeDlnMC8rZlRPMzVoUSIsIm1hYyI6IjAzNDI1YWNjMzM4YTY0ZTNmMDg4MTY1MmVlZWRkNDI3NmI3NTFkMzFkNDQ2MWZmNjE0N2IzMmYxZjY5ZDU2YWIiLCJ0YWciOiIifQ%3D%3D
qrs.ly/ Name: devuniqid
Value: eyJpdiI6IlFOKzVCVU9WQ2dkblhrbHgvR0pJWWc9PSIsInZhbHVlIjoiamk5MU5tUmR6cnh0RzBObGtqcmJua2dqNThMc2cvdXZEV1hHQjkreXUyVGJlcVEwRmxCUTJXTnJidWxNUHRzUGI5WGlYMTk0cmhwOUoxc0MwRnoyZTh3dzJvRVNGRDNwK1R1WEZjZC9aUDQ9IiwibWFjIjoiMTA3MzU1NmJlNThjYmJjYzUzZWRjMTU4M2ZmNGNiNjFkZmYxZDQ2OTkwMDI1N2Y4OTg2ZDI0YTRiY2UwOTc1OSIsInRhZyI6IiJ9
qrs.ly/ Name: shurl_session
Value: eyJpdiI6InhTbmVKTnVRK2svTFVxZFg0NzhLNXc9PSIsInZhbHVlIjoib3VEVVpPd1l2YnR4aUg1b004TkZ0UDlzeTJlMnRFMXRldUQ5ZWROQnk4YythU2JmMDNjdkZ0YStwNmxvTzI3SFlCaGgrSENzK1BpRGdFQThXR3BqTEsreTBFUUxTdTJuNmoveWtrZW90QmRUcUpqTytQQWFLV1FMQ21WTVBOZUYiLCJtYWMiOiI4OGZlMWYyNTYyMGU1YTJmNGJhMDlmMWVlNmE1Mzg5MDEwMzBjZDdjODM4OWU1NmE2YzZkYThkNWJlODI5ZTYyIiwidGFnIjoiIn0%3D

1 Console Messages

Source Level URL
Text
network error URL: https://qrs.ly/1lfwi1n?_kx=J1akkz2P-3UUWWlPecGarjgYD3hD3h0oM0x_ofBSEjA.YtLKy4#9
Message:
Failed to load resource: the server responded with a status of 403 ()