Submitted URL: https://normdigital-com.fortimailcloud.com/fmlurlsvc/?fewReq=:B:JVc9NjQ1PSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6Zj82PzFlNGMxPjY0ZjBlYj5iNDQwZDR...
Effective URL: https://i.hizliresim.com/29c5hdo.jpg
Submission: On December 20 via api from AE — Scanned from CA

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 172.67.154.131, located in United States and belongs to CLOUDFLARENET, US. The main domain is i.hizliresim.com. The Cisco Umbrella rank of the primary domain is 223591.
TLS certificate: Issued by WE1 on November 13th 2024. Valid for: 3 months.
This is the only time i.hizliresim.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 154.52.2.131 40934 (FORTINET)
2 172.67.154.131 13335 (CLOUDFLAR...)
2 1
Apex Domain
Subdomains
Transfer
2 hizliresim.com
i.hizliresim.com — Cisco Umbrella Rank: 223591
59 KB
1 fortimailcloud.com
normdigital-com.fortimailcloud.com
495 B
2 2
Domain Requested by
2 i.hizliresim.com
1 normdigital-com.fortimailcloud.com 1 redirects
2 2

This site contains no links.

Subject Issuer Validity Valid
hizliresim.com
WE1
2024-11-13 -
2025-02-11
3 months crt.sh

This page contains 1 frames:

Primary Page: https://i.hizliresim.com/29c5hdo.jpg
Frame ID: A16F75DBC613C66D06279D2C1A38F27C
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

29c5hdo.jpg (700×122)

Page URL History Show full URLs

  1. https://normdigital-com.fortimailcloud.com/fmlurlsvc/?fewReq=:B:JVc9NjQ1PSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6Zj82PzFlNGM... HTTP 302
    https://i.hizliresim.com/29c5hdo.jpg Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

59 kB
Transfer

57 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://normdigital-com.fortimailcloud.com/fmlurlsvc/?fewReq=:B:JVc9NjQ1PSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6Zj82PzFlNGMxPjY0ZjBlYj5iNDQwZDRmZD42MDcwZGRjNjZhZDBhMiFzOjYwNDUwMDI2NTMhdm5jOjNGVDFXSF9lNTU0NDQwNSozRlQxV0hfZDU1NDQ0MDUhdWR3czohZDo1MyFvY2s6Nw==&url=https://i.hizliresim.com/29c5hdo.jpg&fmlBlkTk HTTP 302
    https://i.hizliresim.com/29c5hdo.jpg Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 29c5hdo.jpg
i.hizliresim.com/
Redirect Chain
  • https://normdigital-com.fortimailcloud.com/fmlurlsvc/?fewReq=:B:JVc9NjQ1PSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6Zj82PzFlNGMxPjY0ZjBlYj5iNDQwZDRmZD42MDcwZGRjNjZhZDBhMiFzOjYwNDUwMDI2NTMhdm5jOjNGVDFXSF9lN...
  • https://i.hizliresim.com/29c5hdo.jpg
57 KB
58 KB
Document
General
Full URL
https://i.hizliresim.com/29c5hdo.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.154.131 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc739952e52d0309a9cd2c4af317142984e3b625cb78effdc41e5a316e3dafba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
14811
alt-svc
h3=":443"; ma=86400
cache-control
max-age=31556926
cf-cache-status
HIT
cf-ray
8f51b4750a70abae-YYZ
content-length
58349
content-type
image/jpeg
date
Fri, 20 Dec 2024 18:30:40 GMT
etag
"2435e46a7f54ae4575db9e2dbab8c37b"
last-modified
Thu, 16 May 2024 07:34:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3oRtT2tMsZibG0IfmuAqdautCAzy6YwGSkzMs2jTZ9vZRoKlFOoC6FPUn9ygjY7DKFE8ZPgNc9SiLH0bYjAyHxgExySKzcJMCxo3Jr65xcFRopPXwLrDxpjEBOi3XlOCNMDg"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfCacheStatus;desc="HIT" cfL4;desc="?proto=TCP&rtt=19135&min_rtt=18241&rtt_var=5197&sent=6&recv=10&lost=0&retrans=0&sent_bytes=4019&recv_bytes=2298&delivery_rate=188197&cwnd=252&unsent_bytes=0&cid=9e4caa0281b8b44b&ts=53&x=0"
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-amz-id-2
n5UX0bqubyzcbmRyZt2LGgEnTax+YXnvAx/F8jaw3kw0/4dWppB6BSATlCr6hKjd6vf7F0az1HfV
x-amz-request-id
FF726F6031C04895:A
x-content-type-options
nosniff
x-wasabi-cm-reference-id
1732154455971 38.27.106.125 ConID:401422061/EngineConID:3869353/Core:66

Redirect headers

Connection
keep-alive
Content-Length
0
Content-Security-Policy
script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self' https://*.fortimailcloud.com/ https://fortimail.forticloud.com/
Date
Fri, 20 Dec 2024 18:30:40 GMT
Location
https://i.hizliresim.com/29c5hdo.jpg
Server
openresty
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
favicon.ico
i.hizliresim.com/
411 B
933 B
Other
General
Full URL
https://i.hizliresim.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.154.131 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9be441ce45dcbf67cc98bac847e1d6198fbaaceca2a0ffb1a87fdcd7e0aa95f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://i.hizliresim.com/29c5hdo.jpg

Response headers

content-encoding
zstd
cf-cache-status
BYPASS
x-wasabi-cm-reference-id
1734719440283 38.27.106.105 ConID:673413135/EngineConID:6471672/Core:55
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NmSV71TDbpT70uscoSuVMI3ss3%2B0XrTVYisZi9BiCfKsXq71VlJfr9BULmvG6%2FPSMPe2OVjMSDKRXIhERlejI02%2BOOcknlAT%2Bt2IsyHXeCrC5gJq7Nu%2FbPGlXj4mO8zLhrX8"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=20331&min_rtt=18241&rtt_var=576&sent=57&recv=25&lost=0&retrans=0&sent_bytes=64273&recv_bytes=2495&delivery_rate=1671839&cwnd=256&unsent_bytes=0&cid=9e4caa0281b8b44b&ts=221&x=0"
date
Fri, 20 Dec 2024 18:30:40 GMT
content-type
application/xml
vary
Accept-Encoding
x-amz-id-2
L1861357tRYyJgaU8jPVagoVmIBAw8zG+l8/V3NMBiHXaNJ0lubopGnldCqw+FIOue7ggdy5yx1e
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
2B22A3C95996670F:B
cf-ray
8f51b4759b09abae-YYZ
server
cloudflare

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://i.hizliresim.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.hizliresim.com
normdigital-com.fortimailcloud.com
154.52.2.131
172.67.154.131
9be441ce45dcbf67cc98bac847e1d6198fbaaceca2a0ffb1a87fdcd7e0aa95f6
cc739952e52d0309a9cd2c4af317142984e3b625cb78effdc41e5a316e3dafba