www.hellyhansen.com Open in urlscan Pro
151.101.129.124 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-K...
Effective URL:
https://www.hellyhansen.com/
Submission: On December 17 via api (December 17th 2024, 8:51:49 am UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 8 HTTP transactions. The main IP is 151.101.129.124, located in San Francisco, United States and belongs to FASTLY, US. The main domain is www.hellyhansen.com. The Cisco Umbrella rank of the primary domain is 250165.
TLS certificate: Issued by R11 on October 30th 2024. Valid for: 3 months.

This is the only time www.hellyhansen.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	88.208.22.2 88.208.22.2	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS DataWeb Global Group B.V.)
1 3	172.67.201.178 172.67.201.178	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	198.11.181.248 198.11.181.248	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
2	151.101.129.124 151.101.129.124	54113 (FASTLY) (FASTLY)
1	65.9.66.28 65.9.66.28	16509 (AMAZON-02) (AMAZON-02)
1	3.78.137.248 3.78.137.248	16509 (AMAZON-02) (AMAZON-02)
8	6

2 88.208.22.2 (Netherlands) 1 redirects

ASN39572 (ADVANCEDHOSTERS-AS DataWeb Global Group B.V., NL)

28906126-28255-ex.noofolotteccis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.201.178 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

display.sigdp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.11.181.248 (United States) 1 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

www.linkbux.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.129.124 (San Francisco, United States)

ASN54113 (FASTLY, US)

www.hellyhansen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.28 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-28.fra56.r.cloudfront.net

ct.captcha-delivery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.78.137.248 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-78-137-248.eu-central-1.compute.amazonaws.com

geo.captcha-delivery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	sigdp.com 1 redirects display.sigdp.com	3 KB
2	captcha-delivery.com ct.captcha-delivery.com — Cisco Umbrella Rank: 30248 geo.captcha-delivery.com — Cisco Umbrella Rank: 23657	11 KB
2	hellyhansen.com www.hellyhansen.com — Cisco Umbrella Rank: 250165	2 KB
2	noofolotteccis.com 1 redirects 28906126-28255-ex.noofolotteccis.com	4 KB
1	linkbux.com 1 redirects www.linkbux.com — Cisco Umbrella Rank: 138548	236 B
0	google.com Failed ads.google.com Failed
8	6

	Domain	Requested by
3	display.sigdp.com	1 redirects 28906126-28255-ex.noofolotteccis.com
2	www.hellyhansen.com
2	28906126-28255-ex.noofolotteccis.com	1 redirects
1	geo.captcha-delivery.com	ct.captcha-delivery.com
1	ct.captcha-delivery.com	www.hellyhansen.com
1	www.linkbux.com	1 redirects
0	ads.google.com Failed	28906126-28255-ex.noofolotteccis.com
8	7

This site contains no links.

Subject Issuer	Validity	Valid
*.noofolotteccis.com R10	`2024-11-13` - `2025-02-11`	3 months	crt.sh
sigdp.com WE1	`2024-10-20` - `2025-01-18`	3 months	crt.sh
hhworkwear.com R11	`2024-10-30` - `2025-01-28`	3 months	crt.sh
*.captcha-delivery.com Amazon RSA 2048 M02	`2024-07-25` - `2025-08-22`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.hellyhansen.com/
Frame ID: 916425E29890C17ED5B3A4959E22C289
Requests: 7 HTTP requests in this frame

Frame: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAbrCRDPR5KtIATp9sCg%3D%3D&hash=89760CC56CC73E0E90A59295C7FA25&cid=43a~Xi34lkWN~x5FwTK_6hZCNx93vS3fnQtC_BINwJDRSTxMTZJ5Vd6LivIlO4mt5w7vqTltCAZDrE6Qw1tgYhvgh43p9uRFe93z8by~846xUqSZzRTVrDRzz03SMyg1&t=fe&referer=https%3A%2F%2Fwww.hellyhansen.com%2F&s=32601&e=4341be401b4cb9d0dfce5d31d8542afc6008ad3af963a39c824e4cce661f1abe&dm=cd
Frame ID: BDE0D10C6E1A9EB537C060A872757D0C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

hellyhansen.com

Page URL History Show full URLs

https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rq... Page URL
https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rq... HTTP 307
https://display.sigdp.com/click.php?key=r98iqvk05ctnun4avv90&cost=0.0002&publicsherid=28255 HTTP 302
http://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3v... HTTP 307
https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3v... Page URL
https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3r... HTTP 302
http://www.hellyhansen.com/ HTTP 307
https://www.hellyhansen.com/ Page URL

Detected technologies

Datadome (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

19 kB
Transfer

29 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1 Page URL
https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5vdworqmp_anbny0rp0...+312+...e%22%2C%22%5B%5D%22%5D&referer=&jsr=1&abl=0&acrc=1&acrs=own&bdd=%5B%22Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F131.0.0.0%20Safari%2F537.36%22%2C%22false%22%2C%22Linux%20x86_64%22%2C%22WebKit%20WebGL%22%2C%22WebKit%22%2C%22Intel%20Iris%20OpenGL%20Engine%22%2C%22Intel%20Inc.%22%2C%22false%22%2C%22true%22%2C%221600%22%2C%221200%22%2C%221600%22%2C%221200%22%2C%221600%22%2C%221285%22%2C%221600%22%2C%221200%22%2C%221600%22%2C%221200%22%2C%22false%22%2C%221%22%2C%2232%22%2C%220%22%2C%22aaaaaaaacceccceffhillllmmprrsssstttellllpss%22%2C%22Tue%20Dec%2017%202024%2009%3A51%3A44%20GMT%2B0100%20(Mitteleurop%C3%A4ische%20Normalzeit)%22%2C%22-60%22%2C%22de-DE%22%2C%22en-US%2Cen%22%2C%22true%22%2C%22true%22%2C%224044038915%22%2C%222697903995%22%2C%222%22%2C%22false%22%2C%22%5B%5D%22%5D HTTP 307
https://display.sigdp.com/click.php?key=r98iqvk05ctnun4avv90&cost=0.0002&publicsherid=28255 HTTP 302
http://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c HTTP 307
https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c Page URL
https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c?url=https%3A%2F%2Fwww.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624 HTTP 302
http://www.hellyhansen.com/ HTTP 307
https://www.hellyhansen.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5vdworqmp_anbny0rp0...+312+...e%22%2C%22%5B%5D%22%5D&referer=&jsr=1&abl=0&acrc=1&acrs=own&bdd=%5B%22Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F131.0.0.0%20Safari%2F537.36%22%2C%22false%22%2C%22Linux%20x86_64%22%2C%22WebKit%20WebGL%22%2C%22WebKit%22%2C%22Intel%20Iris%20OpenGL%20Engine%22%2C%22Intel%20Inc.%22%2C%22false%22%2C%22true%22%2C%221600%22%2C%221200%22%2C%221600%22%2C%221200%22%2C%221600%22%2C%221285%22%2C%221600%22%2C%221200%22%2C%221600%22%2C%221200%22%2C%22false%22%2C%221%22%2C%2232%22%2C%220%22%2C%22aaaaaaaacceccceffhillllmmprrsssstttellllpss%22%2C%22Tue%20Dec%2017%202024%2009%3A51%3A44%20GMT%2B0100%20(Mitteleurop%C3%A4ische%20Normalzeit)%22%2C%22-60%22%2C%22de-DE%22%2C%22en-US%2Cen%22%2C%22true%22%2C%22true%22%2C%224044038915%22%2C%222697903995%22%2C%222%22%2C%22false%22%2C%22%5B%5D%22%5D HTTP 307
https://display.sigdp.com/click.php?key=r98iqvk05ctnun4avv90&cost=0.0002&publicsherid=28255 HTTP 302
http://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c HTTP 307
https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg Show response 28906126-28255-ex.noofolotteccis.com/	8 KB 3 KB	57ms 15ms	Document text/html	88.208.22.2 ADVANCEDHOSTERS-A...
General Check archive.org Show headers Download Go to Full URL https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 88.208.22.2 , Netherlands, ASN39572 (ADVANCEDHOSTERS-AS DataWeb Global Group B.V., NL), Reverse DNS Software nginx / Resource Hash `990ea5e28eabb5e331039415ed6172d7e5aad667bce3394e6a2957a7bb643014` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Device-Memory accept-ch-lifetime 31536000 access-control-allow-credentials true access-control-allow-origin * access-control-max-age 86400 cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-encoding gzip content-type text/html date Tue, 17 Dec 2024 08:51:44 GMT expires Tue, 17 Dec 2024 08:51:44 UTC last-modified Tue, 17 Dec 2024 08:51:44 UTC p3p CP="NOI DEVa TAIa OUR BUS UNI STA" pragma no-cache referrer-policy unsafe-url server nginx vary Accept-Encoding
HEAD		/ ads.google.com/	0 0

GET H3	200	index.php Show response display.sigdp.com/nlp/ Redirect Chain https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharin... https://display.sigdp.com/click.php?key=r98iqvk05ctnun4avv90&cost=0.0002&publicsherid=28255 http://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn... https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDL...	235 B 866 B	43ms 43ms	Document text/html	172.67.201.178 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c Requested by Host: 28906126-28255-ex.noofolotteccis.com URL: https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.201.178 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9106cb21460ccced4f622ff435133e14bee4f74225e4832a4135e20f0312cdf3` Request headers Referer https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 device-memory 8 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8f35ac4a390565be-FRA content-encoding zstd content-type text/html; charset=UTF-8 date Tue, 17 Dec 2024 08:51:44 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5W%2FlH9Ekbvr%2FcgHXF2lx6GLwN08qTn9TANY5JXphSp0fYE73h1K0ht6X0pzbb1p0wWGkIhXmGS51n17xpu614oL%2FeBSxcy%2F8F9c033HycwbJeJdzjeI7I4Ylf8VE3%2FcGkK%2BLxw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=14836&min_rtt=12026&rtt_var=5826&sent=15&recv=12&lost=0&retrans=0&sent_bytes=5301&recv_bytes=5679&delivery_rate=88056&cwnd=12000&unsent_bytes=0&cid=4f91fb46a6c30fb9&ts=153&x=1" cfExtPri cfHdrFlush;dur=0 vary accept-encoding Redirect headers Location https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c Non-Authoritative-Reason HttpsUpgrades
GET H2	403	Primary Request / Show response www.hellyhansen.com/ Redirect Chain https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c?url=https%3A%2F%2Fwww.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624 http://www.hellyhansen.com/ https://www.hellyhansen.com/	735 B 1 KB	245ms 66ms	Document text/html	151.101.129.124 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.hellyhansen.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.129.124 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `be1de48824320bb271506e4d7376656d7a1c6fe5c9c4368266a5a450fafe5b6f` Request headers Referer https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory accept-ranges bytes cache-control max-age=0, private, no-cache, no-store, must-revalidate charset utf-8 content-length 735 content-type text/html;charset=utf-8 date Tue, 17 Dec 2024 08:51:45 GMT pragma no-cache vary ,Cookie x-cache MISS x-cache-hits 0 x-datadome protected x-datadome-cid AHrlqAAAAAMAbrCRDPR5KtIATp9sCg== x-dd-b 1 x-served-by cache-mad22068-MAD x-timer S1734425505.211573,VS0,VE31 Redirect headers Location https://www.hellyhansen.com/ Non-Authoritative-Reason HttpsUpgrades
GET H3	200	favicon.ico display.sigdp.com/	6 KB 904 B	21ms 20ms	Other image/x-icon	172.67.201.178 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://display.sigdp.com/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.201.178 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://display.sigdp.com/nlp/index.php?url=https://www.kredit-umschuldung.ipdgains.de&uid=9cda0qq9r3vbg6o624&url_bnm_redirect=https://www.linkbux.com/track/c8e9wynjyyTD8jjNwVEFnvLBYAVPYKPccUcu_aDLn0pIvTWkQ1BME9WY_aCHjGjw_abT3rXpHVRA6FqHEc_c Response headers content-encoding zstd cf-cache-status HIT etag W/"5b8860d6-1606" age 2910 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eu%2F6nWjznNjAcWYAUruZUupbSYauUXPDJPgatBjWrz4FwmFUPi%2F%2FS5mPh8UHmGmKtb3S6rQy5QGYFZ9mX49WPqlYATEy3%2BUJKH0zt6RkgpNw2o9OOK6uKfdMAmmz1U9cmydJBg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=14110&min_rtt=9029&rtt_var=5821&sent=18&recv=14&lost=0&retrans=0&sent_bytes=6237&recv_bytes=6301&delivery_rate=22641&cwnd=12000&unsent_bytes=0&cid=4f91fb46a6c30fb9&ts=198&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 17 Dec 2024 08:51:44 GMT content-type image/x-icon last-modified Thu, 30 Aug 2018 21:25:42 GMT vary Accept-Encoding priority u=1,i cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8f35ac4a995965be-FRA server cloudflare
GET H2	200	c.js Show response ct.captcha-delivery.com/	11 KB 11 KB	41ms 10ms	Script text/javascript	65.9.66.28 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ct.captcha-delivery.com/c.js Requested by Host: www.hellyhansen.com URL: https://www.hellyhansen.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.66.28 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-66-28.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `fe12fedf5df7e9c9a24865ebda31e65b49b23d6048c5c7178b38eedc3c117429` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.hellyhansen.com/ Response headers x-amz-version-id null etag "14c9d8874f75e12878693ab443f21f5c" age 32499 via 1.1 35a6ad9a7597ea2f4dacbdb5dc66a66c.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 11273 x-amz-cf-id 6sn9f4BsDFeiVGhOrIyN-ppMqM1oc6wZsQQBlXvrJPDry_ROi_Uf1g== date Mon, 16 Dec 2024 23:50:07 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 14:52:45 GMT server AmazonS3 x-amz-cf-pop FRA56-C1 x-amz-server-side-encryption AES256
GET H/1.1	200 OK	/ geo.captcha-delivery.com/captcha/ Frame BDE0	0 0	74ms 17ms	Document text/html	3.78.137.248 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAbrCRDPR5KtIATp9sCg%3D%3D&hash=89760CC56CC73E0E90A59295C7FA25&cid=43a~Xi34lkWN~x5FwTK_6hZCNx93vS3fnQtC_BINwJDRSTxMTZJ5Vd6LivIlO4mt5w7vqTltCAZDrE6Qw1tgYhvgh43p9uRFe93z8by~846xUqSZzRTVrDRzz03SMyg1&t=fe&referer=https%3A%2F%2Fwww.hellyhansen.com%2F&s=32601&e=4341be401b4cb9d0dfce5d31d8542afc6008ad3af963a39c824e4cce661f1abe&dm=cd Requested by Host: ct.captcha-delivery.com URL: https://ct.captcha-delivery.com/c.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.78.137.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-78-137-248.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers Referer https://www.hellyhansen.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Origin * Connection keep-alive Content-Encoding gzip Content-Type text/html;charset=utf-8 Date Tue, 17 Dec 2024 08:51:45 GMT Transfer-Encoding chunked
GET H2	200	favicon.ico www.hellyhansen.com/	4 KB 1 KB	38ms 37ms	Other image/png	151.101.129.124 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.hellyhansen.com/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.129.124 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `bf470aea5455c3432756ef6f4e68b475e736d0cb876f5caed24c4e0e3bf6a0a2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-device-memory 8 Referer https://www.hellyhansen.com/ Response headers content-encoding br etag "5807468d-e36" age 304771 expires Sat, 13 Dec 2025 20:12:14 GMT traceresponse 00-1810d59ede4256cca2c3d05e445ec488-f7d26d42a2a79088-01 x-cache HIT, HIT date Tue, 17 Dec 2024 08:51:45 GMT content-type image/png last-modified Wed, 19 Oct 2016 10:10:21 GMT x-served-by cache-iad-kjyo7100162-IAD, cache-mad22068-MAD x-cache-hits 244, 0 vary Accept fastly-stats io=1 cache-control max-age=31536000 x-timer S1734425506.842089,VS0,VE1 x-debug-info eyJyZXRyaWVzIjowfQ== fastly-io-error not a supported image format accept-ranges bytes content-length 847 fastly-io-served-by img06-us-east4

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ads.google.com
URL: https://ads.google.com/

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| dd

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
display.sigdp.com/	1970-01-21 01:48:31	Name: uclick Value: qq9r3vbg6o
display.sigdp.com/	1970-01-21 01:48:31	Name: uclickhash Value: qq9r3vbg6o-qq9r3vbg6o-fnbl-0-gm6o-9lp2bl-9lj63y-c7a8d5
www.linkbux.com/	1970-01-21 02:30:17	Name: discuz_2132_saltkey Value: seffiXBC
www.linkbux.com/	1969-12-31 23:59:59	Name: discuz_2132_lang Value: en
.hellyhansen.com/	1970-01-21 10:32:41	Name: datadome Value: 43a~Xi34lkWN~x5FwTK_6hZCNx93vS3fnQtC_BINwJDRSTxMTZJ5Vd6LivIlO4mt5w7vqTltCAZDrE6Qw1tgYhvgh43p9uRFe93z8by~846xUqSZzRTVrDRzz03SMyg1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://28906126-28255-ex.noofolotteccis.com/iCJFDoQzPwvnZtczvVvMJyJNkNkRvoHRdqxROsyaS58WZJuc948H_MPbVtdmL9PNlN4Dcflyj_rqeuuzHOKnYBaKm6CluL-KdAcfSLxO8lo818X-fkEqKdMhxf3utg?kws=earn%2Cmoney%2Csharing%2Cimages&abl=0&fsb=0&pageUri=https%3A%2F%2Fpictwn.com%2F1ju-5VDWOrqmp_ANbNY0Rp0...%20312%20...e%22%2C%22%5B%5D%22%5D&focus=1 Message: [GroupMarkerNotSet(crbug.com/242999)!:A0301D0044020000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://www.hellyhansen.com/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

28906126-28255-ex.noofolotteccis.com
ads.google.com
ct.captcha-delivery.com
display.sigdp.com
geo.captcha-delivery.com
www.hellyhansen.com
www.linkbux.com
ads.google.com
151.101.129.124
172.67.201.178
198.11.181.248
3.78.137.248
65.9.66.28
88.208.22.2
9106cb21460ccced4f622ff435133e14bee4f74225e4832a4135e20f0312cdf3
990ea5e28eabb5e331039415ed6172d7e5aad667bce3394e6a2957a7bb643014
be1de48824320bb271506e4d7376656d7a1c6fe5c9c4368266a5a450fafe5b6f
bf470aea5455c3432756ef6f4e68b475e736d0cb876f5caed24c4e0e3bf6a0a2
fe12fedf5df7e9c9a24865ebda31e65b49b23d6048c5c7178b38eedc3c117429

www.hellyhansen.com Open in urlscan Pro 151.101.129.124 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

0 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

19 kBTransfer

29 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

5 Cookies

2 Console Messages

Indicators

www.hellyhansen.com Open in urlscan Pro
151.101.129.124 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

19 kB
Transfer

29 kB
Size

5
Cookies

8 HTTP transactions
0 data transactions