t49.bareflort.no Open in urlscan Pro
104.31.91.5 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://allbooking24.eu/campaigns/ls2537a057ab4/track-url/zq798rf4dyf53/f35c9eaab7ace6287587aef6ef33f7b93126aa40
Effective URL:
https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15...
Submission: On September 11 via manual (September 11th 2020, 12:00:03 pm UTC) from FR

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 8 domains to perform 14 HTTP transactions. The main IP is 104.31.91.5, located in United States and belongs to CLOUDFLARENET, US. The main domain is t49.bareflort.no.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 8th 2020. Valid for: a year.

This is the only time t49.bareflort.no was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	45.129.184.128 45.129.184.128	205220 (RHC-HOSTING) (RHC-HOSTING)
1 1	35.241.7.124 35.241.7.124	15169 (GOOGLE) (GOOGLE)
1 2	81.89.12.68 81.89.12.68	6830 (LIBERTYGL...) (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding)
1 5	104.31.91.5 104.31.91.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	151.139.237.33 151.139.237.33	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.114.110 151.101.114.110	54113 (FASTLY) (FASTLY)
1	162.247.242.20 162.247.242.20	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
14	7

1 45.129.184.128 (Russian Federation) 1 redirects

ASN205220 (RHC-HOSTING, GB)
PTR: host0.team-flash.eu

allbooking24.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.7.124 (Ascension Island) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 124.7.241.35.bc.googleusercontent.com

trk.an3trk8.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 81.89.12.68 (Bucharest, Romania) 1 redirects

ASN6830 (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding, aka AORTA), AT)

dlvr.xcash.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.31.91.5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

trk.bareflort.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
t49.bareflort.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.139.237.33 (Dallas, United States)

ASN33438 (HIGHWINDS2, US)

static-01-2ug82pacs7u3bksy.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-03-2ug82pacs7u3bksy.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-02-2ug82pacs7u3bksy.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.242.20 (San Francisco, United States)

ASN23467 (NEWRELIC-AS-1, US)
PTR: bam-8.nr-data.net

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	netdna-ssl.com static-01-2ug82pacs7u3bksy.netdna-ssl.com static-03-2ug82pacs7u3bksy.netdna-ssl.com static-02-2ug82pacs7u3bksy.netdna-ssl.com	762 KB
5	bareflort.no 1 redirects trk.bareflort.no t49.bareflort.no	125 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	xcash.com 1 redirects dlvr.xcash.com	2 KB
1	nr-data.net bam.nr-data.net	275 B
1	newrelic.com js-agent.newrelic.com	10 KB
1	an3trk8.tech 1 redirects trk.an3trk8.tech	311 B
1	allbooking24.eu 1 redirects allbooking24.eu	576 B
14	8

	Domain	Requested by
4	t49.bareflort.no	dlvr.xcash.com t49.bareflort.no
3	static-02-2ug82pacs7u3bksy.netdna-ssl.com	static-01-2ug82pacs7u3bksy.netdna-ssl.com
2	www.google-analytics.com	t49.bareflort.no www.google-analytics.com
2	dlvr.xcash.com	1 redirects
1	bam.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	t49.bareflort.no
1	static-03-2ug82pacs7u3bksy.netdna-ssl.com	t49.bareflort.no
1	static-01-2ug82pacs7u3bksy.netdna-ssl.com	t49.bareflort.no
1	trk.bareflort.no	1 redirects
1	trk.an3trk8.tech	1 redirects
1	allbooking24.eu	1 redirects
14	11

This site contains no links.

Subject Issuer	Validity	Valid
dlvr.xcash.com Let's Encrypt Authority X3	`2020-07-03` - `2020-10-01`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-08` - `2021-08-08`	a year	crt.sh
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA	`2020-02-18` - `2021-03-18`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-09-09` - `2021-05-07`	8 months	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Frame ID: 3E4473C51E055702BDA5C697807B6CC4
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://allbooking24.eu/campaigns/ls2537a057ab4/track-url/zq798rf4dyf53/f35c9eaab7ace6287587aef6ef33... HTTP 301
https://trk.an3trk8.tech/t/MTYyOV8yNjU/?creative_name=Den+perfekte+l%C3%B8sningen+for+de+som+leter+et... HTTP 302
https://dlvr.xcash.com/35416?subaffiliate_id=1629&session_id=5f5b66b2705d1a048f4674ce HTTP 302
https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%2... Page URL
https://trk.bareflort.no/a/ff0049/?promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keywo... HTTP 302
https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&k... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

22 %
IPv6

8
Domains

11
Subdomains

7
IPs

5
Countries

916 kB
Transfer

1388 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://allbooking24.eu/campaigns/ls2537a057ab4/track-url/zq798rf4dyf53/f35c9eaab7ace6287587aef6ef33f7b93126aa40 HTTP 301
https://trk.an3trk8.tech/t/MTYyOV8yNjU/?creative_name=Den+perfekte+l%C3%B8sningen+for+de+som+leter+etter+sexy+m%C3%B8ter HTTP 302
https://dlvr.xcash.com/35416?subaffiliate_id=1629&session_id=5f5b66b2705d1a048f4674ce HTTP 302
https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1 Page URL
https://trk.bareflort.no/a/ff0049/?promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel= HTTP 302
https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://allbooking24.eu/campaigns/ls2537a057ab4/track-url/zq798rf4dyf53/f35c9eaab7ace6287587aef6ef33f7b93126aa40 HTTP 301
https://trk.an3trk8.tech/t/MTYyOV8yNjU/?creative_name=Den+perfekte+l%C3%B8sningen+for+de+som+leter+etter+sexy+m%C3%B8ter HTTP 302
https://dlvr.xcash.com/35416?subaffiliate_id=1629&session_id=5f5b66b2705d1a048f4674ce HTTP 302
https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

r Show response
dlvr.xcash.com/
Redirect Chain

https://allbooking24.eu/campaigns/ls2537a057ab4/track-url/zq798rf4dyf53/f35c9eaab7ace6287587aef6ef33f7b93126aa40
https://trk.an3trk8.tech/t/MTYyOV8yNjU/?creative_name=Den+perfekte+l%C3%B8sningen+for+de+som+leter+etter+sexy+m%C3%B8ter
https://dlvr.xcash.com/35416?subaffiliate_id=1629&session_id=5f5b66b2705d1a048f4674ce
https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b298...

1 KB
917 B

161ms
161ms

Document
text/html

81.89.12.68
LIBERTYGLOBAL Lib...

General

Check archive.org

Show headers Download Go to

Full URL: https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.89.12.68 Bucharest, Romania, ASN6830 (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding, aka AORTA), AT),
Reverse DNS
Software: nginx / HHVM/3.11.1
Resource Hash: 3a6799f70e9f21a799497e5dbd21511cfe1e0fd74cdf795a950b753544f35d71

Request headers

:method: GET
:authority: dlvr.xcash.com
:scheme: https
:path: /r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: 51D_Bandwidth=1599825586.5621; ubbc=eyJpdiI6IkF4dGtrSkNoalZGWmg2NGlqbjRySHc9PSIsInZhbHVlIjoiWndBYWFkc1ZGMXRCdlQyakpKbFwvTkE9PSIsIm1hYyI6ImU5ZWU5ZjcxYTBhNDdkMjk4ZTMxN2Q0MTdjYzliZTA3MmQ0NWM0ZDIyMzM4NDFlMmIwZjY3YTQ0NzUyNWVkMWUifQ%3D%3D; bbuc=eyJpdiI6Ik9mUzhZOE14Y2ducmZvbDFJQ0cwZ2c9PSIsInZhbHVlIjoiZENBaWVxTlNvTjBmSWsxK0tQdEFHMEt5MTh3T0xNdVJUYnloVm5GeGtVOD0iLCJtYWMiOiIxOGMzZTAwZTE0MWUwYjNlZjFkZGNjM2M3ODBlYmU4MzU3ODRlYTIyM2VmOTViYjBkYTQyZDIxZjZmOGZmOWIwIn0%3D; bbrc=eyJpdiI6IkF1Znd5ZVlBeXl2UzI1Wm1SZHU1dUE9PSIsInZhbHVlIjoiRVhud3hEQXFpMHFaWjFiYzhFalBsZz09IiwibWFjIjoiZDM1ZjQzMjEyODQ1ZTFkMmEzY2IzNTQzN2RhNzVlZmFiZjAyM2RjZmU4YjA4ZjhjOTNlNzlhNjk1MzVjMjM4MiJ9; laravel_session=eyJpdiI6ImhaZW9OdytSeDdlTmdRQnlwc1diQ2c9PSIsInZhbHVlIjoiRVFQOWtKcUFPT2pyQ0JRdVJyMElZZWZ1V21cL0duTG5seEhCcU4zUnhjZzJMNFZ0Uk80SlYwT0Z4TnczUjJKR3ZDSWYzemNFTE94UFZsZDhndzZGNktBPT0iLCJtYWMiOiJhZmJlNjM0ZDQyOTczMWI2NjM5NmJmYjNkOWU0ZDg2MDhkZDNiMzkyMjEyMDYwNjJmYTI5ZmJlZTFkNTNiMjc5In0%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
content-type: text/html; charset=UTF-8
set-cookie: laravel_session=eyJpdiI6IkF6cUlyZ2ZGN0k2SlpGajRialR2ZFE9PSIsInZhbHVlIjoidCt1dFRLXC9iYVRQdVNoYjgwc2E4ZGdNdk9LTk9TR0dObytTUFp0ZnpRQTkwVEVZUDk2M1hWZ2RjV21aQm8ycFN6ZXJSVjczK2I1c0Y2WTZZOXRIVXR3PT0iLCJtYWMiOiI2Y2U3ODg2YzRkZTc2Mjc4NTM4NzEyMTA2MmYwZTM5YWNmZmE2NmQ5NjNhNThiYTMxYmU4NzE0YTI4N2QxNGMxIn0%3D; path=/; httponly
x-powered-by: HHVM/3.11.1
content-encoding: gzip
vary: Accept-Encoding
date: Fri, 11 Sep 2020 11:59:46 GMT
cache-control: no-cache

Redirect headers

status: 302
server: nginx
content-type: text/html; charset=UTF-8
location: https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1
set-cookie: 51D_Bandwidth=1599825586.5621 ubbc=eyJpdiI6IkF4dGtrSkNoalZGWmg2NGlqbjRySHc9PSIsInZhbHVlIjoiWndBYWFkc1ZGMXRCdlQyakpKbFwvTkE9PSIsIm1hYyI6ImU5ZWU5ZjcxYTBhNDdkMjk4ZTMxN2Q0MTdjYzliZTA3MmQ0NWM0ZDIyMzM4NDFlMmIwZjY3YTQ0NzUyNWVkMWUifQ%3D%3D; expires=Sat, 12-Sep-2020 11:59:46 GMT; Max-Age=86400; path=/; httponly bbuc=eyJpdiI6Ik9mUzhZOE14Y2ducmZvbDFJQ0cwZ2c9PSIsInZhbHVlIjoiZENBaWVxTlNvTjBmSWsxK0tQdEFHMEt5MTh3T0xNdVJUYnloVm5GeGtVOD0iLCJtYWMiOiIxOGMzZTAwZTE0MWUwYjNlZjFkZGNjM2M3ODBlYmU4MzU3ODRlYTIyM2VmOTViYjBkYTQyZDIxZjZmOGZmOWIwIn0%3D; expires=Sat, 12-Sep-2020 11:59:46 GMT; Max-Age=86400; path=/; httponly bbrc=eyJpdiI6IkF1Znd5ZVlBeXl2UzI1Wm1SZHU1dUE9PSIsInZhbHVlIjoiRVhud3hEQXFpMHFaWjFiYzhFalBsZz09IiwibWFjIjoiZDM1ZjQzMjEyODQ1ZTFkMmEzY2IzNTQzN2RhNzVlZmFiZjAyM2RjZmU4YjA4ZjhjOTNlNzlhNjk1MzVjMjM4MiJ9; expires=Fri, 11-Sep-2020 18:59:46 GMT; Max-Age=25200; path=/; httponly laravel_session=eyJpdiI6ImhaZW9OdytSeDdlTmdRQnlwc1diQ2c9PSIsInZhbHVlIjoiRVFQOWtKcUFPT2pyQ0JRdVJyMElZZWZ1V21cL0duTG5seEhCcU4zUnhjZzJMNFZ0Uk80SlYwT0Z4TnczUjJKR3ZDSWYzemNFTE94UFZsZDhndzZGNktBPT0iLCJtYWMiOiJhZmJlNjM0ZDQyOTczMWI2NjM5NmJmYjNkOWU0ZDg2MDhkZDNiMzkyMjEyMDYwNjJmYTI5ZmJlZTFkNTNiMjc5In0%3D; path=/; httponly
cache-control: no-cache
vary: Accept-Encoding
date: Fri, 11 Sep 2020 11:59:46 GMT
x-powered-by: HHVM/3.11.1
content-encoding: gzip

GET
H2

200

Primary Request / Show response
t49.bareflort.no/
Redirect Chain

https://trk.bareflort.no/a/ff0049/?promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_p...
https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&...

41 KB
9 KB

447ms
434ms

Document
text/html

104.31.91.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Requested by: Host: dlvr.xcash.com
URL: https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.31.91.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e23161c067c4dd4de725395aad3dd7084adf01acdf9f5c9b13c292a93ba61ee

Request headers

:method: GET
:authority: t49.bareflort.no
:scheme: https
:path: /?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d35a677e006dea110029839150b0f93e41599825587
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://dlvr.xcash.com/r?url=https%3A%2F%2Ftrk.bareflort.no%2Fa%2Fff0049%2F%3Fpromo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&redirect_back=%2F%2Fdlvr.xcash.com%2F35416%2F%3Fsubaffiliate_id%3D1629%26session_id%3D5f5b66b2705d1a048f4674ce%26tt%3D1

Response headers

status: 200
date: Fri, 11 Sep 2020 11:59:47 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: PHPSESSID=800ggrv9sohb35m54h8hhaf4l4; path=/; domain=bareflort.no pc_aff=6gbWAEJdvE_885loqRyjRYjTx_EBNjLZXs1dNlUpvlIKNuDED6kr6SAurI8n7Lzxh0g7Amqv0KjYiO5AJH9bMnTofwNshY3IvXF4vdyo3inzWwLrmNOdU7giHGPmKo66k689aGfBvDntGjscctkmXGKPp9Cl-HELrvCec7G0lxBjN5u53nmU4-XInNJAxh3yx-n92shPS4GnHqp-33Ud0E-c64ZG-zM2UiOgiY3tG_5b8JXfu214tk8_7YT6Uh9uEBGpSwrE3TGbOv4UyWn_ndoZ1dqNYFdO1zVC5AQVNs7NWFVH8BaxJcoDO9GGqmhI_rp11cuIvJqh48X_rXwM8Q; expires=Sun, 11-Oct-2020 11:59:47 GMT; Max-Age=2592000; path=/; domain=bareflort.no promo_code=103657; expires=Sun, 11-Oct-2020 11:59:47 GMT; Max-Age=2592000; path=/; domain=t49.bareflort.no ev=xc15998255866e1dc5f5b66b2980d3164353474; expires=Sun, 11-Oct-2020 11:59:47 GMT; Max-Age=2592000; path=/; domain=t49.bareflort.no keyword=687; expires=Sun, 11-Oct-2020 11:59:47 GMT; Max-Age=2592000; path=/; domain=t49.bareflort.no APPID=promo SERVERID=wbs06; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
cf-cache-status: DYNAMIC
cf-request-id: 051ea243fd0000f1664817a200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d11397fff96f166-ARN
content-encoding: br

Redirect headers

status: 302
date: Fri, 11 Sep 2020 11:59:47 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d35a677e006dea110029839150b0f93e41599825587; expires=Sun, 11-Oct-20 11:59:47 GMT; path=/; domain=.bareflort.no; HttpOnly; SameSite=Lax SERVERID=wbs03; path=/
location: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
cf-cache-status: DYNAMIC
cf-request-id: 051ea2436a0000f16648172200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d11397f1dcdf166-ARN

GET
H2 200 landing0039.css
static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/ 42 KB
8 KB 200ms
62ms Stylesheet
text/css 151.139.237.33
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
Requested by: Host: t49.bareflort.no
URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.237.33 Dallas, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a3d91e12e843bbb0564bd3671abe278955af5c87d5de2241f3ee43e2f69b1bce

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 6
cf-polished: origSize=43239
x-cache: HIT
status: 200
cf-request-id: 0518eeeb6700002784038f0200000001
last-modified: Wed, 09 Sep 2020 06:37:42 GMT
server: NetDNA-cache/2.2
etag: W/"5f587836-a8e7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Sat, 10 Oct 2020 09:25:33 GMT
cache-control: max-age=2592000
cf-ray: 5d081a8bd8b72784-PRG
cf-bgj: minify

GET
H2 200 config.js Show response
t49.bareflort.no/js/dist/ 2 KB
767 B 125ms
124ms Script
application/javascript 104.31.91.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t49.bareflort.no/js/dist/config.js
Requested by: Host: t49.bareflort.no
URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.31.91.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11cc7e35f2660f25bbafda2f592c042db4407312764511d0bb9e104eda6f0416

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
content-encoding: br
cf-cache-status: BYPASS
last-modified: Wed, 09 Sep 2020 06:29:56 GMT
server: cloudflare
etag: W/"5f587664-745"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=2592000
cf-ray: 5d113982cd9ff166-ARN
cf-request-id: 051ea245bb0000f16648190200000001
expires: Sun, 11 Oct 2020 11:59:47 GMT

GET
H2 200 require.js Show response
t49.bareflort.no/node_modules/requirejs/ 84 KB
20 KB 177ms
177ms Script
application/javascript 104.31.91.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t49.bareflort.no/node_modules/requirejs/require.js
Requested by: Host: t49.bareflort.no
URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.31.91.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9485f0917f97fcf4f63a5ea365200ffd57f123f451382a2f9a1ad2e2fd51ac9b

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
content-encoding: br
cf-cache-status: BYPASS
last-modified: Mon, 27 Aug 2018 06:00:39 GMT
server: cloudflare
etag: W/"5b839387-151d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=2592000
cf-ray: 5d113982cda1f166-ARN
cf-request-id: 051ea245bb0000f16648191200000001
expires: Sun, 11 Oct 2020 11:59:47 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: t49.bareflort.no
URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 19 Aug 2020 20:46:40 GMT
server: Golfe2
age: 2647
date: Fri, 11 Sep 2020 11:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18323
expires: Fri, 11 Sep 2020 13:15:40 GMT

GET
H2 200 bg_1.jpg
static-03-2ug82pacs7u3bksy.netdna-ssl.com/promo-static/img/landing0039/ 617 KB
618 KB 83ms
74ms Image
image/jpeg 151.139.237.33
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-03-2ug82pacs7u3bksy.netdna-ssl.com/promo-static/img/landing0039/bg_1.jpg?v=2.85.0.master.20200909083135
Requested by: Host: t49.bareflort.no
URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.237.33 Dallas, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 584fe4084789f308d4adf54b2a54cc573e83b5f79f6f7aa091366c85e373d4bb

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
cf-cache-status: HIT
last-modified: Thu, 31 Oct 2019 07:15:46 GMT
server: NetDNA-cache/2.2
age: 5
etag: "5dba8a22-9a407"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-cache: HIT
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d081a8d3ef9277c-PRG
content-length: 631815
cf-request-id: 0518eeec400000277c612f5200000001

GET
H2 200 heading_triangle.svg
static-02-2ug82pacs7u3bksy.netdna-ssl.com/promo/img/landing0039/ 460 B
783 B 70ms
63ms Image
image/svg+xml 151.139.237.33
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-02-2ug82pacs7u3bksy.netdna-ssl.com/promo/img/landing0039/heading_triangle.svg?1599632996
Requested by: Host: static-01-2ug82pacs7u3bksy.netdna-ssl.com
URL: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.237.33 Dallas, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 15c670d38e8f4583cd5e4bd50023c75c15eecb4ec214e36ccdf1082ee4ba668f

Request headers

Referer: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 09 Sep 2020 06:37:49 GMT
server: NetDNA-cache/2.2
age: 5
etag: W/"5f58783d-1cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
status: 200
cf-ray: 5d081a8d4d992798-PRG
cf-request-id: 0518eeec51000027986d09c200000001

GET
H2 200 OpenSans-Bold.woff
static-02-2ug82pacs7u3bksy.netdna-ssl.com/promo/node_modules/g4.font.family/fonts/ 69 KB
69 KB 194ms
62ms Font
application/font-woff 151.139.237.33
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://static-02-2ug82pacs7u3bksy.netdna-ssl.com/promo/node_modules/g4.font.family/fonts/OpenSans-Bold.woff?1545811722
Requested by: Host: static-01-2ug82pacs7u3bksy.netdna-ssl.com
URL: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.237.33 Dallas, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0a4d3ba79d0dac0d8b7b4f2571e5f10b6accbac2e29f6cd792483bf2984196e2

Request headers

Origin: https://t49.bareflort.no
Referer: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
cf-cache-status: MISS
x-cache: HIT
status: 200
content-length: 70188
cf-request-id: 0518eeec51000027888d376200000001
last-modified: Wed, 09 Sep 2020 06:37:28 GMT
server: NetDNA-cache/2.2
etag: "5f587828-1122c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5d081a8d4dd12788-PRG
expires: Sat, 10 Oct 2020 09:25:47 GMT

GET
H2 200 OpenSans-Regular.woff
static-02-2ug82pacs7u3bksy.netdna-ssl.com/promo/node_modules/g4.font.family/fonts/ 66 KB
67 KB 278ms
146ms Font
application/font-woff 151.139.237.33
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://static-02-2ug82pacs7u3bksy.netdna-ssl.com/promo/node_modules/g4.font.family/fonts/OpenSans-Regular.woff?1545811722
Requested by: Host: static-01-2ug82pacs7u3bksy.netdna-ssl.com
URL: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.237.33 Dallas, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 565eb53dab9961bc6d8b78fcd23ba799254aabd7658f21bf385e84675e46fb51

Request headers

Origin: https://t49.bareflort.no
Referer: https://static-01-2ug82pacs7u3bksy.netdna-ssl.com/promo/css/pages/landing0039.css?v=2.85.0.master.20200909083135
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:47 GMT
cf-cache-status: MISS
x-cache: HIT
status: 200
content-length: 67528
cf-request-id: 0518eeec51000027809d9d6200000001
last-modified: Wed, 09 Sep 2020 06:37:29 GMT
server: NetDNA-cache/2.2
etag: "5f587829-107c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5d081a8d495e2780-PRG
expires: Sat, 10 Oct 2020 09:25:40 GMT

GET
H2 200 landing0039.js Show response
t49.bareflort.no/js/dist/ 394 KB
94 KB 244ms
244ms Script
application/javascript 104.31.91.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://t49.bareflort.no/js/dist/landing0039.js?v=2.85.0.master.20200909083135
Requested by: Host: t49.bareflort.no
URL: https://t49.bareflort.no/node_modules/requirejs/require.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.31.91.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 338846d053a77ccd9b755e43a84f7ea210c3b9147190f0b7391d2b796b118e8e

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 09 Sep 2020 06:36:51 GMT
server: cloudflare
etag: W/"5f587803-626bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=2592000
cf-ray: 5d11398448d9f166-ARN
cf-request-id: 051ea246ac0000f1664819a200000001
expires: Sun, 11 Oct 2020 11:59:47 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
395 B 39ms
13ms XHR
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j85&a=1155489905&t=pageview&_s=1&dl=https%3A%2F%2Ft49.bareflort.no%2F%3Fq%3D%2Fa%2Fff0049%2F%26promo_code%3D103657%26ev%3Dxc15998255866e1dc5f5b66b2980d3164353474%26keyword%3D687%26pass%3Dxc15998255866e1dc5f5b66b2980d3164353474%26m%3D0%7C0%7C0%7C0%26email%3D%26email_encoded%3D%26flow%3D18%26fb_pixel%3D&dr=https%3A%2F%2Fdlvr.xcash.com%2Fr%3Furl%3Dhttps%253A%252F%252Ftrk.bareflort.no%252Fa%252Fff0049%252F%253Fpromo_code%253D103657%2526ev%253Dxc15998255866e1dc5f5b66b2980d3164353474%2526keyword%253D687%2526pass%253Dxc15998255866e1dc5f5b66b2980d3164353474%2526m%253D0%257C0%257C0%257C0%2526email%253D%2526email_encoded%253D%2526flow%253D18%2526fb_pixel%253D%26redirect_back%3D%252F%252Fdlvr.xcash.com%252F35416%252F%253Fsubaffiliate_id%253D1629%2526session_id%253D5f5b66b2705d1a048f4674ce%2526tt%253D1&ul=en-us&de=UTF-8&dt=Bareflort%3A%20Stevnem%C3%B8ter%20og%20uformelle%20hookups&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1589667795&gjid=1083972789&cid=20007824.1599825588&tid=UA-87667025-25&_gid=2104867096.1599825588&_r=1&z=4536665

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 11 Sep 2020 11:59:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://t49.bareflort.no
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nr-1177.min.js Show response
js-agent.newrelic.com/ 27 KB
10 KB 59ms
59ms Script
application/javascript 151.101.114.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1177.min.js
Requested by: Host: t49.bareflort.no
URL: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 67f243af83cf56b2fd0fb502ab9f7a8533500e2571b4459d5bf6f6481a2da4ca

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 11:59:48 GMT
content-encoding: gzip
x-amz-request-id: 4F930AF2622C2177
x-cache: HIT
status: 200
content-length: 10405
x-amz-id-2: U7tObmI036MTRpBI0DMqANsZED0ff6ySLFb6J6xUAvrjeydJkzxfcOtpUXwF34MJgKtcfhq4e+o=
x-served-by: cache-hhn4068-HHN
last-modified: Tue, 18 Aug 2020 17:23:32 GMT
server: AmazonS3
x-timer: S1599825588.236681,VS0,VE0
etag: "97c8d5802b0de603104986846cdc509a"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 22312

GET
H/1.1 200
OK 6cbab69a58 Show response
bam.nr-data.net/1/ 57 B
275 B 147ms
146ms Script
text/javascript 162.247.242.20
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/6cbab69a58?a=192394552&v=1177.96a4d39&to=ZlNaYhEDDEBYBUZQDF8Ze0MQFg1eFiNHXTNDWVVZTDIQXFQJHXANVVNAGSoMBlZB&rst=1335&ck=1&ref=https://t49.bareflort.no/&ap=303&be=686&fe=1264&dc=892&perf=%7B%22timing%22:%7B%22of%22:1599825586940,%22n%22:0,%22f%22:226,%22dn%22:226,%22dne%22:226,%22c%22:226,%22ce%22:226,%22rq%22:239,%22rp%22:673,%22rpe%22:674,%22dl%22:677,%22di%22:892,%22ds%22:892,%22de%22:892,%22dc%22:1264,%22l%22:1264,%22le%22:1266%7D,%22navigation%22:%7B%7D%7D&fp=926&fcp=926&at=ShRZFFkZH04%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1177.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.20 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS: bam-8.nr-data.net
Software: /
Resource Hash: d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1

Request headers

Referer: https://t49.bareflort.no/?q=/a/ff0049/&promo_code=103657&ev=xc15998255866e1dc5f5b66b2980d3164353474&keyword=687&pass=xc15998255866e1dc5f5b66b2980d3164353474&m=0|0|0|0&email=&email_encoded=&flow=18&fb_pixel=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 57
Content-Type: text/javascript;charset=ISO-8859-1

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bareflort.no/	1970-01-19 12:23:45	Name: _gat Value: 1
.t49.bareflort.no/	1970-01-19 13:06:57	Name: keyword Value: 687
.t49.bareflort.no/	1970-01-19 13:06:57	Name: ev Value: xc15998255866e1dc5f5b66b2980d3164353474
t49.bareflort.no/	1969-12-31 23:59:59	Name: SERVERID Value: wbs06
.bareflort.no/	1970-01-19 13:06:57	Name: __cfduid Value: d35a677e006dea110029839150b0f93e41599825587
.bareflort.no/	1970-01-19 13:06:57	Name: pc_aff Value: 6gbWAEJdvE_885loqRyjRYjTx_EBNjLZXs1dNlUpvlIKNuDED6kr6SAurI8n7Lzxh0g7Amqv0KjYiO5AJH9bMnTofwNshY3IvXF4vdyo3inzWwLrmNOdU7giHGPmKo66k689aGfBvDntGjscctkmXGKPp9Cl-HELrvCec7G0lxBjN5u53nmU4-XInNJAxh3yx-n92shPS4GnHqp-33Ud0E-c64ZG-zM2UiOgiY3tG_5b8JXfu214tk8_7YT6Uh9uEBGpSwrE3TGbOv4UyWn_ndoZ1dqNYFdO1zVC5AQVNs7NWFVH8BaxJcoDO9GGqmhI_rp11cuIvJqh48X_rXwM8Q
.bareflort.no/	1970-01-19 12:25:11	Name: _gid Value: GA1.2.2104867096.1599825588
.t49.bareflort.no/	1970-01-19 13:06:57	Name: promo_code Value: 103657
.bareflort.no/	1970-01-20 05:54:57	Name: _ga Value: GA1.2.20007824.1599825588
t49.bareflort.no/	1969-12-31 23:59:59	Name: APPID Value: promo
.bareflort.no/	1969-12-31 23:59:59	Name: PHPSESSID Value: 800ggrv9sohb35m54h8hhaf4l4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

allbooking24.eu
bam.nr-data.net
dlvr.xcash.com
js-agent.newrelic.com
static-01-2ug82pacs7u3bksy.netdna-ssl.com
static-02-2ug82pacs7u3bksy.netdna-ssl.com
static-03-2ug82pacs7u3bksy.netdna-ssl.com
t49.bareflort.no
trk.an3trk8.tech
trk.bareflort.no
www.google-analytics.com
104.31.91.5
151.101.114.110
151.139.237.33
162.247.242.20
2a00:1450:4001:824::200e
2a00:1450:4001:825::200e
35.241.7.124
45.129.184.128
81.89.12.68
0a4d3ba79d0dac0d8b7b4f2571e5f10b6accbac2e29f6cd792483bf2984196e2
11cc7e35f2660f25bbafda2f592c042db4407312764511d0bb9e104eda6f0416
15c670d38e8f4583cd5e4bd50023c75c15eecb4ec214e36ccdf1082ee4ba668f
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
338846d053a77ccd9b755e43a84f7ea210c3b9147190f0b7391d2b796b118e8e
3a6799f70e9f21a799497e5dbd21511cfe1e0fd74cdf795a950b753544f35d71
565eb53dab9961bc6d8b78fcd23ba799254aabd7658f21bf385e84675e46fb51
584fe4084789f308d4adf54b2a54cc573e83b5f79f6f7aa091366c85e373d4bb
67f243af83cf56b2fd0fb502ab9f7a8533500e2571b4459d5bf6f6481a2da4ca
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8e23161c067c4dd4de725395aad3dd7084adf01acdf9f5c9b13c292a93ba61ee
9485f0917f97fcf4f63a5ea365200ffd57f123f451382a2f9a1ad2e2fd51ac9b
a3d91e12e843bbb0564bd3671abe278955af5c87d5de2241f3ee43e2f69b1bce
d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1

t49.bareflort.no Open in urlscan Pro 104.31.91.5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

22 %IPv6

8 Domains

11 Subdomains

7 IPs

5 Countries

916 kBTransfer

1388 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

11 Cookies

Indicators

t49.bareflort.no Open in urlscan Pro
104.31.91.5 Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

22 %
IPv6

8
Domains

11
Subdomains

7
IPs

5
Countries

916 kB
Transfer

1388 kB
Size

11
Cookies

14 HTTP transactions
0 data transactions