urlscan.io logo urlscan.io
SecurityTrails logo

t4.aaflnow.com Open in urlscan Pro
2606:4700:3036::ac43:c680  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://khliwznielarayi.blob.core.windows.net/khliwznielarayi/url.html#cl/13395_md/1110/10463/2023/49/477433
Effective URL: http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821...
Submission: On February 23 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 6 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3036::ac43:c680, located in United States and belongs to CLOUDFLARENET, US. The main domain is t4.aaflnow.com.
This is the only time t4.aaflnow.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 52.239.170.36 8075 (MICROSOFT...)
1 172.99.173.54 398343 (BAXET-GROUP)
2 2 66.195.197.23 11402 (CCCAS-1)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
6 5
1    52.239.170.36 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
khliwznielarayi.blob.core.windows.net
1    172.99.173.54 (United States)

ASN398343 (BAXET-GROUP, US)
jornosled.com
2    66.195.197.23 (United States)

ASN11402 (CCCAS-1, US)
6ecq0.firstnowload.com
6ecq0.linkstoknow.com
1    2606:4700:3036::ac43:c680 (United States)

ASN13335 (CLOUDFLARENET, US)
t4.aaflnow.com
1    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
www.ipqscdn.com
Apex Domain
Subdomains		 Transfer
1 ipqscdn.com
www.ipqscdn.com — Cisco Umbrella Rank: 37970
fn.us.ipqscdn.com Failed
68 KB
1 aaflnow.com
t4.aaflnow.com
1 KB
1 linkstoknow.com
6ecq0.linkstoknow.com
720 B
1 firstnowload.com
6ecq0.firstnowload.com
700 B
1 jornosled.com
jornosled.com — Cisco Umbrella Rank: 596612
405 B
1 windows.net
khliwznielarayi.blob.core.windows.net
1012 B
6 6
Domain Requested by
1 www.ipqscdn.com t4.aaflnow.com
1 t4.aaflnow.com jornosled.com
1 6ecq0.linkstoknow.com 1 redirects
1 6ecq0.firstnowload.com 1 redirects
1 jornosled.com khliwznielarayi.blob.core.windows.net
1 khliwznielarayi.blob.core.windows.net
0 fn.us.ipqscdn.com Failed khliwznielarayi.blob.core.windows.net
6 7

This site contains no links.

Subject Issuer Validity Valid
*.blob.core.windows.net
Microsoft RSA TLS CA 01		 2023-09-27 -
2024-09-27		 a year crt.sh
jornosled.com
R3		 2024-01-26 -
2024-04-25		 3 months crt.sh
ipqscdn.com
GTS CA 1P5		 2024-01-31 -
2024-04-30		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821c-5537967d1871&
Frame ID: E11397E7FF69BA3A240B224B38B2FA14
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://khliwznielarayi.blob.core.windows.net/khliwznielarayi/url.html Page URL
  2. https://jornosled.com/0/0/0/e93c536708e70152648d8257a8e62dba/1110/13395_32/49_477433_10463_2023_md Page URL
  3. https://6ecq0.firstnowload.com/?kw=31&s2=1146125198 HTTP 302
    https://6ecq0.linkstoknow.com/o/4S5HJDZF/8133ff34-d22c-11ee-b6f2-2bc0c3b4477b/813c6cb4-d22c-11ee-88f2-8dc3... HTTP 302
    http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81... Page URL

Page Statistics

6
Requests

50 %
HTTPS

40 %
IPv6

6
Domains

7
Subdomains

5
IPs

1
Countries

70 kB
Transfer

140 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://khliwznielarayi.blob.core.windows.net/khliwznielarayi/url.html Page URL
  2. https://jornosled.com/0/0/0/e93c536708e70152648d8257a8e62dba/1110/13395_32/49_477433_10463_2023_md Page URL
  3. https://6ecq0.firstnowload.com/?kw=31&s2=1146125198 HTTP 302
    https://6ecq0.linkstoknow.com/o/4S5HJDZF/8133ff34-d22c-11ee-b6f2-2bc0c3b4477b/813c6cb4-d22c-11ee-88f2-8dc33b59a9cc HTTP 302
    http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821c-5537967d1871& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
url.html
khliwznielarayi.blob.core.windows.net/khliwznielarayi/ 		609 B
1012 B 		Document
General
Check archive.org
Download Go to
Full URL
https://khliwznielarayi.blob.core.windows.net/khliwznielarayi/url.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.170.36 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Content-Length
609
Content-MD5
U6SSOkUkcPkFpRdeHWSjKQ==
Content-Type
text/html
Date
Fri, 23 Feb 2024 09:18:25 GMT
ETag
0x8DC33FF0D25419F
Last-Modified
Thu, 22 Feb 2024 23:36:10 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type
BlockBlob
x-ms-lease-status
unlocked
x-ms-request-id
fc9539a0-a01e-0096-7539-66d6be000000
x-ms-version
2009-09-19
49_477433_10463_2023_md
jornosled.com/0/0/0/e93c536708e70152648d8257a8e62dba/1110/13395_32/ 		114 B
405 B 		Document
General
Check archive.org
Download Go to
Full URL
https://jornosled.com/0/0/0/e93c536708e70152648d8257a8e62dba/1110/13395_32/49_477433_10463_2023_md
Requested by
Host: khliwznielarayi.blob.core.windows.net
URL: https://khliwznielarayi.blob.core.windows.net/khliwznielarayi/url.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.99.173.54 , United States, ASN398343 (BAXET-GROUP, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://khliwznielarayi.blob.core.windows.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-length
114
content-type
text/html; charset=UTF-8
date
Fri, 23 Feb 2024 09:18:27 GMT
server
Apache
Primary Request aff_c
t4.aaflnow.com/
Redirect Chain
  • https://6ecq0.firstnowload.com/?kw=31&s2=1146125198
  • https://6ecq0.linkstoknow.com/o/4S5HJDZF/8133ff34-d22c-11ee-b6f2-2bc0c3b4477b/813c6cb4-d22c-11ee-88f2-8dc33b59a9cc
  • http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821c-5537967d1871&
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821c-5537967d1871&
Requested by
Host: jornosled.com
URL: https://jornosled.com/0/0/0/e93c536708e70152648d8257a8e62dba/1110/13395_32/49_477433_10463_2023_md
Protocol
HTTP/1.1
Server
2606:4700:3036::ac43:c680 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51df605198fbd21f68ede088e51f68f97aed1e937fc21385c82ef8ca100011bf

Request headers

Referer
https://jornosled.com/0/0/0/e93c536708e70152648d8257a8e62dba/1110/13395_32/49_477433_10463_2023_md
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
859e61bc6c517192-LHR
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Fri, 23 Feb 2024 09:18:30 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qp1bt9SESBWNB9Mv%2BrpAAVTaa14%2BAAwWn%2BgFgx%2BgaJOATInZR0iYCuG8ljfYXF7Ed69X2S%2FFmspiEBujmRDOxVYI3cSLD2QOJy5eD5R%2FfWWCuHdLTiXA8O%2BDHit%2FimBkgnVRAeSPDDC83rK56w%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400

Redirect headers

cache-control
no-cache, private
content-encoding
br
content-length
304
content-type
text/html; charset=UTF-8
date
Fri, 23 Feb 2024 09:18:29 GMT
location
http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821c-5537967d1871&
server
swoole-http-server
strict-transport-security
max-age=15768000
x-redir
true
learn.js
www.ipqscdn.com/api/*/iS1filCPb0DlseaEfHRo7QhJkQiiPgpnyeDmRp9BRSqgPdQim7Ok3DtfUJEnll6B9lShpvNxI5SVbAr60ZQnytHwENJJwRh0ZjWPmZxAxHluFthNxJZYkLVBQpjn2RU3s5yaqRwCYp8N35fNWDsFGgOPTDOJpqRkXwAFDYjsSmntorP... 		138 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.ipqscdn.com/api/*/iS1filCPb0DlseaEfHRo7QhJkQiiPgpnyeDmRp9BRSqgPdQim7Ok3DtfUJEnll6B9lShpvNxI5SVbAr60ZQnytHwENJJwRh0ZjWPmZxAxHluFthNxJZYkLVBQpjn2RU3s5yaqRwCYp8N35fNWDsFGgOPTDOJpqRkXwAFDYjsSmntorPiAKQ7wXitUZfARTr7jQGA0tJPo5CnlfkYpfY6NMdsoQxLTRzYRqOMbEFn0tkqtIFAnMPPFeX3nhSH9U5C/learn.js
Requested by
Host: t4.aaflnow.com
URL: http://t4.aaflnow.com/aff_c?offer_id=733&aff_id=1163&aff_sub=uk-atv-eff&aff_sub3=77403&aff_sub2=81f62708-d22c-11ee-821c-5537967d1871&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6f3d7d5baf59ad92ef44b928736ff67d7ae9071bfc3e83b26f7dcd712c4ba50

Request headers

Referer
http://t4.aaflnow.com/
Origin
http://t4.aaflnow.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36

Response headers

date
Fri, 23 Feb 2024 09:18:30 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
64446
alt-svc
h3=":443"; ma=86400
pragma
cache
last-modified
Thu, 22 Feb 2024 15:24:24 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4sGN%2BpQOxCMTOW%2Bmz%2FW2jswjdlxt8oA4ui%2FhhPcfAnTOb1I3xIR%2Bm0BqciD3EfGNdwgUIGETh6eq8MAjpd72NU4OChISBcvdI2tT2Irs2t%2FgNZeDvPW6mL66SYPrU2JsLHrOeorEIpc9l6OAvg4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
x-robots-tag
noindex
cf-ray
859e61befca5dc25-LHR
expires
Fri, 23 Feb 2024 10:24:24 GMT
udid.json
fn.us.ipqscdn.com/udid/ 		0
0
fetch
fn.us.ipqscdn.com/api/*/iS1filCPb0DlseaEfHRo7QhJkQiiPgpnyeDmRp9BRSqgPdQim7Ok3DtfUJEnll6B9lShpvNxI5SVbAr60ZQnytHwENJJwRh0ZjWPmZxAxHluFthNxJZYkLVBQpjn2RU3s5yaqRwCYp8N35fNWDsFGgOPTDOJpqRkXwAFDYjsSmnto... 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fn.us.ipqscdn.com
URL
https://fn.us.ipqscdn.com/udid/udid.json
Domain
fn.us.ipqscdn.com
URL
https://fn.us.ipqscdn.com/api/*/iS1filCPb0DlseaEfHRo7QhJkQiiPgpnyeDmRp9BRSqgPdQim7Ok3DtfUJEnll6B9lShpvNxI5SVbAr60ZQnytHwENJJwRh0ZjWPmZxAxHluFthNxJZYkLVBQpjn2RU3s5yaqRwCYp8N35fNWDsFGgOPTDOJpqRkXwAFDYjsSmntorPiAKQ7wXitUZfARTr7jQGA0tJPo5CnlfkYpfY6NMdsoQxLTRzYRqOMbEFn0tkqtIFAnMPPFeX3nhSH9U5C/learn/fetch

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| CHARSET object| CHARSET_MAP object| Loader function| myListener1 function| myListener2 function| myListener3 function| myListener4 function| myListener5 function| myListener6 object| Learn object| Startup function| loader object| IPQ object| xmlrr object| pxi object| compressor object| device object| fingerprint number| char object| fullScreenProperties number| mathAcos number| mathAcosh number| mathAcoshPf number| mathAsin number| mathAsinh number| mathCosh number| mathCoshPf number| mathExpm1 number| mathExpm1Pf number| mathSinh number| mathSinhPf number| mathTane boolean| mathExpE

3 Cookies

Domain/Path Name / Value
jornosled.com/ Name: uid31
Value: 1146125198-20240223041827-51cd74691425c8c2de45052cead6d772-
6ecq0.firstnowload.com/ Name: yredir_session
Value: eyJpdiI6IjNnZ0RXbUVpRlNDeUtMTlFXM0kwZ2c9PSIsInZhbHVlIjoiamFXWmp1amxLRjJHcElLL04zeE9OYlgrbHNkSU50d3lqT1hxQjMweWZaS2trSkk5Y0V1cHo4N0lsSzloOFc4MzJzc1R2K3BpUmJ0aDhmSWVWa0d6QzY3S2IrdFB0bHhQVHVOUnVZWWQ2eEFmZWtZQkF4b3RHK2RwYVRDNzJCTm4iLCJtYWMiOiJmNTI4M2Q2YWQyMzZkNTg3ODlhODY1ZTY1ZjM3MGE4ZTI4ZDVhODYyODhhNTA4ZjU2YjhjZGVhNjNkMTc0MTlhIiwidGFnIjoiIn0%3D
6ecq0.linkstoknow.com/ Name: yredir_session
Value: eyJpdiI6IjRiVUgvcmg3WEFGS3R0bDZSQlBSMGc9PSIsInZhbHVlIjoiTXVmUzFCWjNjVFlqa1lrK2RHdFpSYnhOaFhBamhSbnJ4aGhWaWVtR2RZelBTaHg1WFYza0FxTFNtWVU1T2hnaHZaRmxqdFp3YWIvYXJnWGdXK2VpZVBqRThzWi9INjRsb2tXQk1ZOU1kQTBFekFOSm9Ia2NpNzhlNy9keUFVNjciLCJtYWMiOiJjNTY3MTE1MmQyYTUzNWE2ZDBjMGI1Yjc5MGE4MTBhODAwZTM5YmNlYzVlZWM2Njg4Y2Q1MjlkOWQ3ZmNmNWNmIiwidGFnIjoiIn0%3D

2 Console Messages

Source Level URL
Text
rendering warning
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering warning
Message:
Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently