cj.dotomi.com
Open in
urlscan Pro
89.207.16.72
Public Scan
Effective URL: https://cj.dotomi.com/rq114vpyxF/pw0/EFJFHIML/KKIGGGM/D/D/D?l=w0ql%3DmEDjHDliD8DBC9lCBFA9DE8nDlCFFGGn%3c%3cp11x0%3A%2F...
Submission: On November 25 via api from PH — Scanned from DE
Summary
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on August 20th 2021. Valid for: a year.
This is the only time cj.dotomi.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 199.191.50.73 199.191.50.73 | 40034 (CONFLUENC...) (CONFLUENCE-NETWORK-INC) | |
2 2 | 216.139.248.123 216.139.248.123 | 32400 (HWSERVICE...) (HWSERVICES-32400) | |
1 3 | 216.139.248.127 216.139.248.127 | 32400 (HWSERVICE...) (HWSERVICES-32400) | |
1 3 | 89.207.16.72 89.207.16.72 | 41041 (VCLK-EU-SE) (VCLK-EU-SE) | |
6 | 4 |
ASN32400 (HWSERVICES-32400, US)
PTR: 216-139-248-123.aus.us.siteprotect.com
fd.sealthatleak.com |
ASN32400 (HWSERVICES-32400, US)
PTR: 216-139-248-127.aus.us.siteprotect.com
ww2.affinity.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
affinity.net
1 redirects
ww2.affinity.net |
2 KB |
2 |
dotomi.com
cj.dotomi.com |
96 KB |
2 |
sealthatleak.com
2 redirects
fd.sealthatleak.com |
672 B |
2 |
malwarbytes.com
malwarbytes.com |
2 KB |
1 |
anrdoezrs.net
1 redirects
www.anrdoezrs.net |
632 B |
6 | 5 |
Domain | Requested by | |
---|---|---|
3 | ww2.affinity.net |
1 redirects
malwarbytes.com
|
2 | cj.dotomi.com |
cj.dotomi.com
|
2 | fd.sealthatleak.com | 2 redirects |
2 | malwarbytes.com |
malwarbytes.com
|
1 | www.anrdoezrs.net | 1 redirects |
6 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.conversantmedia.eu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.qksrv.net GlobalSign RSA OV SSL CA 2018 |
2021-08-20 - 2022-09-21 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://cj.dotomi.com/rq114vpyxF/pw0/EFJFHIML/KKIGGGM/D/D/D?l=w0ql%3DmEDjHDliD8DBC9lCBFA9DE8nDlCFFGGn%3c%3cp11x0%3A%2F%2F444.ivzlwm7z0.vm1%3AG8%2Fktqks-FFDBBBH-9AEACDHG%3c%3cO%3cp11x%3A%2F%2F44A.innqvq16.vm1%2F%3c%3c9%3c9%3c8%3c8%3c8%3c
Frame ID: C99EA427717779A01A9D1C17BD7E9EC8
Requests: 5 HTTP requests in this frame
Frame:
http://ww2.affinity.net/fly?no_capp=1&enk=MTYzMzkyfDExNHwxfDczOTM4fDE2Mzc4MDYxNDB8MXwxfDQxODA=&ls=1637806140.2703&lbc=1637806140.2714&lac=1637806140.2836
Frame ID: A7CB675FAD602DE22EDFE6D8F44D7223
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
CJ AffiliatePage URL History Show full URLs
- http://malwarbytes.com/ Page URL
-
http://fd.sealthatleak.com/r?o=txe14&s=73938&u=malwarbytes.com&&
HTTP 302
http://ww2.affinity.net/fly?no_capp=1&enk=MTYzODgxfDExNXwxfDczOTM4fDE2Mzc4MDYxNDB8MXwxfDQxODA=&ls=16... Page URL
-
http://ww2.affinity.net/fly1?sid=163881&sa=115&p=1&s=73938&qt=1637806140&q=&rf=http%3A%2F%2Fmalwarby...
HTTP 302
https://www.anrdoezrs.net/click-7753339-12624598?sid=e65b95da505341d43721560f5d47788f HTTP 302
https://cj.dotomi.com/rq114vpyxF/pw0/EFJFHIML/KKIGGGM/D/D/D?l=w0ql%3DmEDjHDliD8DBC9lCBFA9DE8nDlCFF... Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Cookie Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://malwarbytes.com/ Page URL
-
http://fd.sealthatleak.com/r?o=txe14&s=73938&u=malwarbytes.com&&
HTTP 302
http://ww2.affinity.net/fly?no_capp=1&enk=MTYzODgxfDExNXwxfDczOTM4fDE2Mzc4MDYxNDB8MXwxfDQxODA=&ls=1637806140.2636&lbc=1637806140.2647&lac=1637806140.2764 Page URL
-
http://ww2.affinity.net/fly1?sid=163881&sa=115&p=1&s=73938&qt=1637806140&q=&rf=http%3A%2F%2Fmalwarbytes.com%2F&enc=&enk=MTYzODgxfDExNXwxfDczOTM4fDE2Mzc4MDYxNDB8MXwxfDQxODA%3D&xsc=&xsp=&xsm=&xuc=&xcf=&xai=&qxcli=cf57857c651f8fa8&qxsi=a21bfa1c27e9c2a5&mk=1&sx=1600&sy=1200&bx=1600&by=1200&mx=0&my=0&ifm=0&ol=a626fe781deab3aa5a47e2ee7a0634c2&tm=1637806140.5352&etm=1637806140.5412&ls=1637806140.2636&lbc=1637806140.2647&lac=1637806140.2764&cskey=txe14&ipspm=&no_capp=1
HTTP 302
https://www.anrdoezrs.net/click-7753339-12624598?sid=e65b95da505341d43721560f5d47788f HTTP 302
https://cj.dotomi.com/rq114vpyxF/pw0/EFJFHIML/KKIGGGM/D/D/D?l=w0ql%3DmEDjHDliD8DBC9lCBFA9DE8nDlCFFGGn%3c%3cp11x0%3A%2F%2F444.ivzlwm7z0.vm1%3AG8%2Fktqks-FFDBBBH-9AEACDHG%3c%3cO%3cp11x%3A%2F%2F44A.innqvq16.vm1%2F%3c%3c9%3c9%3c8%3c8%3c8%3c Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- http://fd.sealthatleak.com/r?o=txe14&s=73938&u=malwarbytes.com&& HTTP 302
- http://ww2.affinity.net/fly?no_capp=1&enk=MTYzODgxfDExNXwxfDczOTM4fDE2Mzc4MDYxNDB8MXwxfDQxODA=&ls=1637806140.2636&lbc=1637806140.2647&lac=1637806140.2764
- http://fd.sealthatleak.com/r?o=txe14&s=73938&u=malwarbytes.com&& HTTP 302
- http://ww2.affinity.net/fly?no_capp=1&enk=MTYzMzkyfDExNHwxfDczOTM4fDE2Mzc4MDYxNDB8MXwxfDQxODA=&ls=1637806140.2703&lbc=1637806140.2714&lac=1637806140.2836
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
malwarbytes.com/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
malwarbytes.com/ Frame A7CB |
939 B 802 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fly
ww2.affinity.net/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fly
ww2.affinity.net/ Frame A7CB Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
D
cj.dotomi.com/rq114vpyxF/pw0/EFJFHIML/KKIGGGM/D/D/ Redirect Chain
|
96 KB 96 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
22 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gdpr-event-log
cj.dotomi.com/ |
50 B 186 B |
XHR
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| content function| toggleHiddenClass function| togglePage function| changeLanguage function| populateText function| CJIL boolean| enabled string| cjPopId string| cjFwd boolean| enc boolean| useApi string| maxKeepAlive string| keepAlivePeriod string| preselectedLanguage object| cjil4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
malwarbytes.com/ | Name: isframesetenabled Value: 1 |
|
.dotomi.com/ | Name: cjae Value: pOrACTqmD7Ag |
|
.dotomi.com/ | Name: DotomiUser Value: 400604418987300830$0$1 |
|
.dotomi.com/ | Name: LCLK Value: cjo!wnxr-taf0ruh6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cj.dotomi.com
fd.sealthatleak.com
malwarbytes.com
ww2.affinity.net
www.anrdoezrs.net
199.191.50.73
216.139.248.123
216.139.248.127
89.207.16.72
5b021419fd3c8452743034c55ba85cc23f5e117522bcb62ed3aaf69c79e6669d
62cbd23c319965d6893373bd86d1af0078dcf31fc66858f88149c85e868bce3b
cafe6e1f8468aee9660e6d42ee76b3ae65c348be443f32a009f273d9203174ac
ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63
ec8f1b1a43530296b3f8651577a58a98fa9540f344d3aa1ba7ae596d5548c2a1