2no.co Open in urlscan Pro
104.21.79.229  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request viperimage Show response 2no.co/	59 KB 25 KB	1496ms 1419ms	Document text/html	104.21.79.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://2no.co/viperimage Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.79.229 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56fe900393df7424f8a2b8d6d093c9d5d00095bc1960957a1313facfba8479de Security Headers Name Value Content-Security-Policy img-src https: data:; upgrade-insecure-requests Strict-Transport-Security max-age=604800 max-age=31536000 X-Frame-Options SAMEORIGIN Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8f91bc2b7a0879d0-SYD content-encoding zstd content-security-policy img-src https: data:; upgrade-insecure-requests content-type text/html; charset=UTF-8 date Sat, 28 Dec 2024 13:00:46 GMT expires Sat, 28 Dec 2024 13:00:45 +0000 memory 0.49158477783203125 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JlkNukTwNX6qYqj2aeD7d0gHZXsc1%2FthKGtzSAYYOlUGvP7qfBxFIuXWFQnJNIzNzGRTTf8loUgHDCqU8%2Fd3131Q2cp2KvSg03qQwzK0q6p%2Fq7aH1%2FRCI3g%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=67562&min_rtt=64400&rtt_var=16427&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4137&recv_bytes=4489&delivery_rate=313&cwnd=12000&unsent_bytes=0&cid=304d379223ffdc57&ts=1424&x=1" cfExtPri cfHdrFlush;dur=0 strict-transport-security max-age=604800 max-age=31536000 vary accept-encoding x-frame-options SAMEORIGIN
GET H2	200	polyfill.min.js Show response cdn.jsdelivr.net/npm/promise-polyfill@8/dist/	4 KB 2 KB	103ms 32ms	Script application/javascript	2a04:4e42:200::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/promise-polyfill@8/dist/polyfill.min.js Requested by Host: 2no.co URL: https://2no.co/viperimage Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e555151e63c492ea4f05ecedbcaf488acecfdf147d814e1920bcef9b028968ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://2no.co/ Response headers access-control-expose-headers * content-encoding br etag W/"1132-XysC4a2Vt+mONL0o6U+bsaeRjIc" age 6510 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Sat, 28 Dec 2024 13:00:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220140-FRA, cache-akl10320-AKL vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 1560 x-jsd-version 8.3.0
GET		hit counter.yadro.ru/	0 0
GET H2	200	pay.js Show response pay.google.com/gp/p/js/	168 KB 49 KB	626ms 215ms	Script application/javascript	2404:6800:4008:c01::5c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pay.google.com/gp/p/js/pay.js Requested by Host: 2no.co URL: https://2no.co/viperimage Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4008:c01::5c Taipei, Taiwan, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 5a14940f0a21fbaf837f74a6fab5a41418aac620f2bd807f51207557d405487e Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-hum1USD2wc_vssiXOdzptw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://2no.co/ Response headers content-encoding gzip x-content-type-options nosniff expires Sat, 28 Dec 2024 13:00:46 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." date Sat, 28 Dec 2024 13:00:46 GMT content-type application/javascript; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 reporting-endpoints default="/gp/p/_/InstantbuyFrontendHttp/web-reports?context=eJzjKtHikmLw1pBiWFYqxbBkphSDxNeXTBpA7JQ-gzUIiFtvnmOdCsRzA86zhmeeZzVae57VCYiT_p1nLQJiQ4VLrI5A_CvvEqtqzyVWUyAukrjC2gTEDaFXWbdcvcq6kfUaayzvNdZZFtdYA7KusQrxcPx7s383m8CF5qVvmJS0k_IL4zPziksS80qSSivTivLzSlLzUopTi8pSi-KNDIxMDI0MjfQMjOMLDAAUcEUv" content-security-policy script-src 'report-sample' 'nonce-hum1USD2wc_vssiXOdzptw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport cache-control private, max-age=600 cross-origin-opener-policy same-origin accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/InstantbuyFrontendHttp/cspreport/fine-allowlist permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* x-xss-protection 0 server ESF
GET H3	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	156 KB 52 KB	363ms 195ms	Script text/javascript	172.217.24.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: 2no.co URL: https://2no.co/viperimage Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.24.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS hkg07s23-in-f2.1e100.net Software cafe / Resource Hash b9e331eced97c796f9303c3b054b5ad2418d4f0711a4a0537768dc887fe76813 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://2no.co/ Response headers content-encoding br etag 4232833951156238389 x-content-type-options nosniff expires Sat, 28 Dec 2024 13:00:46 GMT alt-svc h3=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" date Sat, 28 Dec 2024 13:00:46 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding content-disposition attachment; filename="f.txt" link <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin cache-control private, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * cross-origin-resource-policy cross-origin access-control-allow-origin * content-length 53256 x-xss-protection 0 server cafe
GET H2	200	payframe pay.google.com/gp/p/ui/ Frame 46DC	0 0	791ms 388ms	Document text/html	2404:6800:4008:c01::5c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2F2no.co&mid= Requested by Host: pay.google.com URL: https://pay.google.com/gp/p/js/pay.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4008:c01::5c Taipei, Taiwan, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-POBNnopWc2Dv4mUY_VnkXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://2no.co/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=3600 content-encoding gzip content-security-policy require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-POBNnopWc2Dv4mUY_VnkXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist content-security-policy-report-only script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.BY62uICrLh0.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/fine-allowlist content-type text/html; charset=utf-8 cross-origin-opener-policy same-origin cross-origin-resource-policy same-site date Sat, 28 Dec 2024 13:00:47 GMT expires Sat, 28 Dec 2024 13:00:47 GMT origin-trial AssDE6uDpaVUq9mb8HyrCnDR4hxNa3P1PQl8E0huFRpGw4MFWswRwyuk1E68LufiBFMulCrRk3VCexIRW39eYwoAAABMeyJvcmlnaW4iOiJodHRwczovL3BheS5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJUcGNkIiwiZXhwaXJ5IjoxNzM1MzQzOTk5fQ== permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=* reporting-endpoints default="/gp/p/_/InstantbuyFrontendBuyflowPayframeUi/web-reports?context=eJzjKtHikmLw1pBiWFYqxbBkphSDxNeXTBpA7JQ-gzUIiFtvnmOdCsRzA86zhmeeZzVae57VCYiT_p1nLQJiQ4VLrI5A_CvvEqtqzyVWUyAukrjC2gTEDaFXWbdcvcq6kfUaayzvNdZZFtdYA7KusQrxcPx_s383m8CO9V8WMitpJ-UXxmfmFZck5pUklVamFeXnlaTmpRSnFpWlFsUbGRiZGBoZGukZGMcXGAAAGZ1FSQ" server ESF strict-transport-security max-age=31536000 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site x-content-type-options nosniff x-ua-compatible IE=edge x-xss-protection 0
GET H2	200	light_square_gpay.svg www.gstatic.com/instantbuy/svg/	2 KB 1 KB	291ms 68ms	Other image/svg+xml	2404:6800:4006:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/instantbuy/svg/light_square_gpay.svg Requested by Host: 2no.co URL: https://2no.co/viperimage Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4006:812::2003 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c76f766ed128ff1c05cbab4f53e470751b475152992a770d42273047bc1708c5 Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/instantbuy-eng X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://2no.co/ Response headers content-encoding br age 571187 report-to {"group":"instantbuy-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/instantbuy-eng"}]} x-content-type-options nosniff expires Sun, 21 Dec 2025 22:21:02 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sat, 21 Dec 2024 22:21:02 GMT last-modified Fri, 03 Mar 2023 17:58:00 GMT content-type image/svg+xml vary Accept-Encoding content-security-policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/instantbuy-eng cache-control public, max-age=31536000 cross-origin-opener-policy same-origin; report-to="instantbuy-eng" cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 894 x-xss-protection 0 server sffe

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

counter.yadro.ru

URL

https://counter.yadro.ru/hit?t38.6;r;s1600*1200*24;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.3215125847116982

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _y object| _z function| _x function| _b function| _c function| _s function| fpx number| ouch function| watchPos object| d object| a object| url object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac object| google_persistent_state_async object| google_tag_data object| google_reactive_ads_global_state object| adsbygoogle string| google_user_agent_client_hint object| denylistedDomainsHashedValueListForGpayButtonWithCardInfo object| whitelistedDomainsHashedValueListForGpayButtonWithCardInfo object| denylistedMerchentIdsHashedValueListForGpayButtonWithCardInfo object| denylistedMerchantIdsHashedValueListForGpayButtonVariant object| allowlistedMerchantDomainsForBnplDynamicButton object| allowlistedMerchantDomainsForRlmiaDynamicButton object| allowlistedMerchantDomainsForPopupModeLoadingScreen string| dynamicGpayButtonVariant object| google

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			2no.co/	1970-01-21 10:48:46	Name: 566901551732971352 Value: 3
			2no.co/	1970-01-21 10:48:46	Name: clhf03028ja Value: 103.75.11.88
			2no.co/	1969-12-31 23:59:59	Name: unikey Value: unikey_7fe130bc773ba0e881c59d3a94bedf3de0e594f5acc67375e3cc85d2a7ac9294
			.google.com/	1970-01-21 06:26:42	Name: NID Value: 520=UrNUUrcA_24lOWt963hLxi5-NE-MQhcpWQyBGbBqv29Lqg-9hCNPJlBO6-JSe8UT_rjdOl3uM45ajtu7od0TcO9e_-GZtaxg17PZ7muE2m4ZCUqXdW99elmNVSVnsXQOpokKvsX3AjdxDr-yczfj2ybqtK1R9hPtjNFthlYku88ES7jO3g

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://2no.co/viperimage Message: [GroupMarkerNotSet(crbug.com/242999)!:A0901D00440E0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
other	warning	URL: https://2no.co/viperimage Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "sizes".
other	warning	URL: https://2no.co/viperimage Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "type".
other	warning	URL: https://2no.co/viperimage Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "sizes".
other	warning	URL: https://2no.co/viperimage Message: Each dictionary in the list "icons" should contain a non-empty UTF8 string field "type".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=604800 max-age=31536000
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2no.co
cdn.jsdelivr.net
counter.yadro.ru
pagead2.googlesyndication.com
pay.google.com
www.gstatic.com
counter.yadro.ru
104.21.79.229
172.217.24.34
2404:6800:4006:812::2003
2404:6800:4008:c01::5c
2a04:4e42:200::485
56fe900393df7424f8a2b8d6d093c9d5d00095bc1960957a1313facfba8479de
5a14940f0a21fbaf837f74a6fab5a41418aac620f2bd807f51207557d405487e
b9e331eced97c796f9303c3b054b5ad2418d4f0711a4a0537768dc887fe76813
c76f766ed128ff1c05cbab4f53e470751b475152992a770d42273047bc1708c5
e555151e63c492ea4f05ecedbcaf488acecfdf147d814e1920bcef9b028968ab