urlscan.io logo urlscan.io
SecurityTrails logo

aff.cashback.im Open in urlscan Pro
194.146.39.234  Public Scan

Go To Rescan Add Verdict Report
URL: http://aff.cashback.im/
Submission: On April 30 via manual from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 194.146.39.234, located in and belongs to CLOUDWEBMANAGE-EU, GB. The main domain is aff.cashback.im.
This is the only time aff.cashback.im was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 194.146.39.234 41436 (CLOUDWEBM...)
1 2600:9000:219... 16509 (AMAZON-02)
1 34.226.72.172 14618 (AMAZON-AES)
3 3
Apex Domain
Subdomains		 Transfer
2 typeform.com
embed.typeform.com
itaynoy.typeform.com
42 KB
1 cashback.im
aff.cashback.im
1 KB
3 2
Domain Requested by
1 itaynoy.typeform.com embed.typeform.com
1 embed.typeform.com aff.cashback.im
1 aff.cashback.im
3 3

This site contains links to these domains. Also see Links.

Domain
admin.typeform.com
Subject Issuer Validity Valid
*.typeform.com
Amazon		 2019-12-24 -
2021-01-24		 a year crt.sh

This page contains 2 frames:

Primary Page: http://aff.cashback.im/
Frame ID: 9BC3495D440EDA408D7A78BA487BE78B
Requests: 2 HTTP requests in this frame

Frame: https://itaynoy.typeform.com/to/F5kBdW?typeform-embed=embed-widget&embed-hide-footer=true&embed-hide-headers=true&typeform-embed-id=i0fyg
Frame ID: B1E6B2B5B4299485B36C4CAE0308397C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

3
Requests

67 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

43 kB
Transfer

130 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
aff.cashback.im/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://aff.cashback.im/
Protocol
HTTP/1.1
Server
194.146.39.234 -, , ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software
nginx / PHP/5.6.40 PleskLin
Resource Hash
f5a2267eedd4cd38654c73dcc89b040691899087e22f595c51913ac238a5e275

Request headers

Host
aff.cashback.im
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Thu, 30 Apr 2020 19:30:53 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Powered-By
PHP/5.6.40 PleskLin
Access-Control-Allow-Origin
*
Content-Encoding
gzip
embed.js
embed.typeform.com/ 		128 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.typeform.com/embed.js
Requested by
Host: aff.cashback.im
URL: http://aff.cashback.im/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2190:8e00:2:c605:29c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
01489937b031f96eddb2e7f5ae50122091047d841d17884fd65064adf561f4c0

Request headers

Referer
http://aff.cashback.im/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 30 Apr 2020 19:28:38 GMT
content-encoding
gzip
last-modified
Mon, 27 Apr 2020 14:28:12 GMT
server
AmazonS3
age
287
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
x-amz-cf-pop
ZRH50-C1
x-amz-cf-id
9_u6dwEVjT-sjTNBKP99NGmecSHjwX3JMjdydgSmoM1TTu9BDZlYlA==
via
1.1 eb7b239aed47669f8a7b6ac95bc8aff1.cloudfront.net (CloudFront)
F5kBdW
itaynoy.typeform.com/to/ Frame B1E6 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://itaynoy.typeform.com/to/F5kBdW?typeform-embed=embed-widget&embed-hide-footer=true&embed-hide-headers=true&typeform-embed-id=i0fyg
Requested by
Host: embed.typeform.com
URL: https://embed.typeform.com/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.72.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-226-72-172.compute-1.amazonaws.com
Software
istio-envoy / 1.378.0-3.20.0
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:method
GET
:authority
itaynoy.typeform.com
:scheme
https
:path
/to/F5kBdW?typeform-embed=embed-widget&embed-hide-footer=true&embed-hide-headers=true&typeform-embed-id=i0fyg
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://aff.cashback.im/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://aff.cashback.im/

Response headers

status
200
date
Thu, 30 Apr 2020 19:30:52 GMT
content-type
text/html; charset=utf-8
accept-ranges
bytes
age
0
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy-report-only
report-uri https://endpoint2.collection.us2.sumologic.com/receiver/v1/http/ZaVnC4dhaV13syWPqbJn9XwMGe4caaop-n9urcHvJLaMJIs-ysikqC26ja3rzeMNHUqlhJ6Jj32snr_AmKUAt2hrNPOgIYRfr_GPi-UndDkRUPtIQ-yZfA== ; block-all-mixed-content ; default-src https: data: blob: 'unsafe-eval' 'unsafe-inline' ; frame-ancestors https: ; script-src 'report-sample' 'nonce-e48b3d7f3e2db1cd95c57662489ea510' 'sha256-IxfYGmPkymEWVy7H9cX5NdXLb0jzVYzK/jKUZdUJhuk=' 'sha256-BOYPnPai7eqFOx2xqIBQyzCWvs5dXx6Qfmeetf4MMms=' 'sha256-i5SReBLl9RlI3Tf1JRILxbLlULhm+vivh26dqbFxYSw=' 'strict-dynamic' https://renderer-assets.typeform.com https://www.googletagmanager.com https://www.google-analytics.com https://js.hs-scripts.com https://*.segment.com https://*.facebook.com https://*.googleadservices.com https://*.analytics.net https://*.doubleclick.net 'unsafe-inline' ; style-src 'report-sample' https://fonts.googleapis.com 'unsafe-inline' ; font-src 'report-sample' https://fonts.googleapis.com https://fonts.gstatic.com data: ; connect-src https://app.launchdarkly.com https://api.segment.io https://events.launchdarkly.com https://www.google-analytics.com https://*.typeform.com https://bam.nr-data.net https://www.facebook.com https://stats.g.doubleclick.net https://*.vimeo.com ; img-src 'report-sample' 'self' https://*.typeform.com https://*.facebook.com https://*.google-analytics.com https://*.googletagmanager.com https://*.google.com https://*.doubleclick.net https://*.pinterest.com https://*.mailchimp.com https://*.linkedin.com https://*.bing.com https://*.gstatic.com ;
pragma
no-cache
server
istio-envoy
vary
Accept-Encoding
x-cache
MISS
x-cache-lookup
HIT
x-envoy-upstream-service-time
224
x-powered-by
1.378.0-3.20.0
x-varnish
14203883
access-control-allow-methods
GET, OPTIONS, POST, PUT, PATCH, DELETE
access-control-allow-headers
X-Typeform-Key, Content-Type, Authorization, Typeform-Version
access-control-expose-headers
Location, X-Request-Id
strict-transport-security
max-age=63072000; includeSubDomains
x-newp
Yes

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| typeformEmbed object| __SECRET_EMOTION__ boolean| typeformEmbedIsloaded

1 Cookies

Domain/Path Name / Value
.typeform.com/ Name: attribution_user_id
Value: 6ce888c1-a2d7-425d-b02b-a8eec55895c6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aff.cashback.im
embed.typeform.com
itaynoy.typeform.com
194.146.39.234
2600:9000:2190:8e00:2:c605:29c0:93a1
34.226.72.172
01489937b031f96eddb2e7f5ae50122091047d841d17884fd65064adf561f4c0
f5a2267eedd4cd38654c73dcc89b040691899087e22f595c51913ac238a5e275