Submitted URL: http://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfmzdjknwvmnzuymzgzzmy0...
Effective URL: https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
Submission: On August 17 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 139.45.197.239, located in United Kingdom and belongs to RETN-AS, GB. The main domain is dukirliaon.com.
TLS certificate: Issued by R10 on July 21st 2024. Valid for: 3 months.
This is the only time dukirliaon.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 18.239.50.58 16509 (AMAZON-02)
6 139.45.197.239 9002 (RETN-AS)
1 139.45.195.8 9002 (RETN-AS)
8 3
Apex Domain
Subdomains
Transfer
6 dukirliaon.com
dukirliaon.com
15 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 5822
491 B
1 whichhereally.info
whichhereally.info — Cisco Umbrella Rank: 621908
534 B
0 aliexpress.com Failed
www.aliexpress.com Failed
8 4
Domain Requested by
6 dukirliaon.com dukirliaon.com
1 my.rtmark.net dukirliaon.com
1 whichhereally.info 1 redirects
0 www.aliexpress.com Failed
8 4

This site contains no links.

Subject Issuer Validity Valid
dukirliaon.com
R10
2024-07-21 -
2024-10-19
3 months crt.sh
rtmark.net
R11
2024-07-05 -
2024-10-03
3 months crt.sh

This page contains 1 frames:

Frame: https://www.aliexpress.com/gcp/300001528/Aliexpress?wh_html=csr&forcebottom=true&aff_downgrade=true&wh_ttid=pc
Frame ID: FA12AA689A58EC0A78128E5EEFF14E0A
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Redirect

Page URL History Show full URLs

  1. http://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfm... HTTP 307
    https://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfm... HTTP 302
    https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

16 kB
Transfer

30 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfmzdjknwvmnzuymzgzzmy0zdjkywrinnwxnzm1mjz8mhxxaw5kb3dzidewfenocm9tzxxxegrvd25sb2fklmnvbxwxmdfsaxzyb3n8nduumty5ljg2lji1nhww HTTP 307
    https://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfmzdjknwvmnzuymzgzzmy0zdjkywrinnwxnzm1mjz8mhxxaw5kb3dzidewfenocm9tzxxxegrvd25sb2fklmnvbxwxmdfsaxzyb3n8nduumty5ljg2lji1nhww HTTP 302
    https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://dukirliaon.com/?z=1320852&syncedCookie=true&rhd=false HTTP 302
  • https://s.click.aliexpress.com/e/_DebBhQH?dp=848632511537090729 HTTP 302
  • https://www.aliexpress.com/gcp/300001528/Aliexpress?wh_html=csr&forcebottom=true&aff_downgrade=true&wh_ttid=pc

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request afu.php
dukirliaon.com/
Redirect Chain
  • http://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfmzdjknwvmnzuymzgzzmy0zdjkywrinnwxnzm1mjz8mhxxaw5kb3dzidewfenocm9tzxxxegrvd25sb2fklmnvbxwxmdfsaxz...
  • https://whichhereally.info/redirect?tid=1012371&puid=118&file=title_text&subid=mjqxzdk2ztbmywewztnmztfmzdjknwvmnzuymzgzzmy0zdjkywrinnwxnzm1mjz8mhxxaw5kb3dzidewfenocm9tzxxxegrvd25sb2fklmnvbxwxmdfsax...
  • https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
30 KB
14 KB
Document
General
Full URL
https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
460d28e2a5ed9b5b852b4a8f43c936c1e348e974f60781b9e7bdcc8d2b5d2108
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=utf8
date
Sat, 17 Aug 2024 11:14:36 GMT
expires
Tue, 11 Jan 1994 10:00:00 GMT
link
<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
pragma
no-cache
server
nginx
strict-transport-security
max-age=1
timing-allow-origin
* *
x-content-type-options
nosniff
x-trace-id
25262c6e3b0f76c384eee232f497874c

Redirect headers

accept-ch
DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
cache-control
no-store, no-cache, must-revalidate, no-transform
content-length
0
content-type
text/plain
date
Sat, 17 Aug 2024 11:14:36 GMT
location
https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
p3p
CP="NID DSP ALL COR"
pragma
no-cache
server
openresty/1.17.8.2
via
1.1 c2c44e18165da827386e0ed36aeea344.cloudfront.net (CloudFront)
x-amz-cf-id
FoWe6LlthKyi83cJkXV4d8DBY4U6MI7h8tUGaHtOQby37oiE7PzL6g==
x-amz-cf-pop
AMS58-P3
x-cache
Miss from cloudfront
sftouch
dukirliaon.com/
2 B
589 B
Image
General
Full URL
https://dukirliaon.com/sftouch?userId=0080bbb5e94a4e11f88daf7a52b8904c&z=1320852&p_rid=fc483d74-0878-4478-ab90-5a9b82b6e5c5&p_src=sf&branchId=0&rb=mZ4wKN3ZkwiDJVCVFJCK66uYwWwbaf_ct-0_IYtFAzekaaX8OsQ5ak2Q1MGT5jE3RWK3DLriHqwJHIXv4ad0NdYyK93T70flTEHRO8d_Pdj8A5tTjPsZID5cylaV_USDVebrXOUUl2lejldS74upAm5Fy23S_x6YrGITHN2PGC2oBh2ZdZFpcWYVNTqKgriTqx2RBX2EoxaslJEdhaBwR8x7SKViMaCKUEHO-Ue7rKsZrzleXqMdC_Kp2Uzqptr7R8oZW7pD9BFaogIBtu8JyoBmCFvpKVR9vSgUx8u2lnz3GsyF5Ng-G8lDayHuglyZPm1oo4WTFCoBg8N8
Requested by
Host: dukirliaon.com
URL: https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 11:14:36 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
content-length
2
x-trace-id
5a1cbf4df53af2c10ec0397d57b662ca
pragma
no-cache
server
nginx
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain
access-control-allow-origin
*
cache-control
no-transform, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
expires
Tue, 11 Jan 1994 10:00:00 GMT
add
dukirliaon.com/log/
12 B
384 B
XHR
General
Full URL
https://dukirliaon.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=fc483d74-0878-4478-ab90-5a9b82b6e5c5
Requested by
Host: dukirliaon.com
URL: https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
fe85cceb474303eb80a5ca9a60b16d92208a8e0b38647647654b0c42447b51f7
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sat, 17 Aug 2024 11:14:36 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://dukirliaon.com
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
content-length
12
img.gif
my.rtmark.net/
43 B
491 B
Image
General
Full URL
https://my.rtmark.net/img.gif?f=merge&userId=0080bbb5e94a4e11f88daf7a52b8904c&z=1320852&p_rid=fc483d74-0878-4478-ab90-5a9b82b6e5c5&p_src=sf
Requested by
Host: dukirliaon.com
URL: https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://dukirliaon.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 11:14:36 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
43
add
dukirliaon.com/async_log/
0
338 B
XHR
General
Full URL
https://dukirliaon.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=fc483d74-0878-4478-ab90-5a9b82b6e5c5
Requested by
Host: dukirliaon.com
URL: https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sat, 17 Aug 2024 11:14:36 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
https://dukirliaon.com
access-control-allow-credentials
true
timing-allow-origin
*
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
content-length
0
favicon.ico
dukirliaon.com/
0
150 B
Other
General
Full URL
https://dukirliaon.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://dukirliaon.com/afu.php?zoneid=1320852&var=1012371&ymid=877261132467461749
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
public
date
Sat, 17 Aug 2024 11:14:36 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT
Aliexpress
www.aliexpress.com/gcp/300001528/
Redirect Chain
  • https://dukirliaon.com/?z=1320852&syncedCookie=true&rhd=false
  • https://s.click.aliexpress.com/e/_DebBhQH?dp=848632511537090729
  • https://www.aliexpress.com/gcp/300001528/Aliexpress?wh_html=csr&forcebottom=true&aff_downgrade=true&wh_ttid=pc
0
0

favicon.ico
dukirliaon.com/
0
0
Other
General
Full URL
https://dukirliaon.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.197.239 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://dukirliaon.com/afu.php?zoneid=1320852&var=1320852&rid=utqiXGyo7RV-Hp-SjoEPSg%3D%3D&rhd=false&ab2r=0&sf=1&is_mobile=false
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
public
date
Sat, 17 Aug 2024 11:14:36 GMT
cache-control
max-age=315360000, public, must-revalidate, proxy-revalidate
server
nginx
expires
Thu, 31 Dec 2037 23:55:55 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.aliexpress.com
URL
https://www.aliexpress.com/gcp/300001528/Aliexpress?wh_html=csr&forcebottom=true&aff_downgrade=true&wh_ttid=pc

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| onLazyPixel boolean| lazyPixelLoaded

12 Cookies

Domain/Path Name / Value
whichhereally.info/ Name: csu
Value: f6438b81-54fc-45d7-9a8b-bc5e2e3c3e86
dukirliaon.com/ Name: OAID
Value: 0080bbb5e94a4e11f88daf7a52b8904c
dukirliaon.com/ Name: oaidts
Value: 1723893276
my.rtmark.net/ Name: ID
Value: 0080bbb5e94a4e11f88daf7a52b8904c
dukirliaon.com/ Name: syncedCookie
Value: true
.aliexpress.com/ Name: xman_us_f
Value: x_l=0&x_as_i=%7B%22aeuCID%22%3A%22978b233b82be4b2b99102591a1a7be04-1723893278934-06266-_DebBhQH%22%2C%22affiliateKey%22%3A%22_DebBhQH%22%2C%22channel%22%3A%22AFFILIATE%22%2C%22cv%22%3A%221%22%2C%22isCookieCache%22%3A%22N%22%2C%22ms%22%3A%221%22%2C%22pid%22%3A%223531547649%22%2C%22tagtime%22%3A1723893278934%7D&acs_rt=84739a96049b47ff978f4e57e42760fb
.aliexpress.com/ Name: acs_usuc_t
Value: x_csrf=dd2a_1tf9ltu&acs_rt=84739a96049b47ff978f4e57e42760fb
.aliexpress.com/ Name: aeu_cid
Value: 978b233b82be4b2b99102591a1a7be04-1723893278934-06266-_DebBhQH
.aliexpress.com/ Name: xman_t
Value: uZPe90wqpVO7+pZXffC55uZCy9yEKQhps39fvfXxaVFhFMLISmhu+AnPBCB7PC0w
.aliexpress.com/ Name: xman_f
Value: l6Am5+25h3Ar743uKOdrGfarL0//K/KPMs0tUCYt2JtOjIw71KYzNe6dnsMRmRYzdAUo495i1KIVtqd8CLryU49BuFFmg1pAdLmqjsZm3ht1tlGFNT3xlg==
.aliexpress.com/ Name: af_ss_a
Value: 1
.aliexpress.com/ Name: af_ss_b
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff