news.mailclick.me Open in urlscan Pro
34.65.209.240 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Effective URL:
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Submission: On July 20 via api (July 20th 2023, 9:42:42 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 34.65.209.240, located in Zurich, Switzerland and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is news.mailclick.me.
TLS certificate: Issued by R3 on July 17th 2023. Valid for: 3 months.

This is the only time news.mailclick.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	161.156.186.10 161.156.186.10	36351 (SOFTLAYER) (SOFTLAYER)
8	34.65.209.240 34.65.209.240	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	64.185.227.156 64.185.227.156	18450 (WEBNX) (WEBNX)
9	2

1 161.156.186.10 (United States) 1 redirects

ASN36351 (SOFTLAYER, US)
PTR: a.ba.9ca1.ip4.static.sl-reverse.com

news.mailclick.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.65.209.240 (Zurich, Switzerland)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 240.209.65.34.bc.googleusercontent.com

news.mailclick.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tyrell.armor.zone	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.185.227.156 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: 64-185-227-156.static.webnx.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	armor.zone tyrell.armor.zone	122 KB
2	mailclick.me 1 redirects news.mailclick.me	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2618	206 B
9	3

	Domain	Requested by
7	tyrell.armor.zone	news.mailclick.me tyrell.armor.zone
2	news.mailclick.me	1 redirects
1	api.ipify.org	tyrell.armor.zone
9	3

This site contains no links.

Subject Issuer	Validity	Valid
news.mailclick.me R3	`2023-07-17` - `2023-10-15`	3 months	crt.sh
tyrell.armor.zone R3	`2023-05-24` - `2023-08-22`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Frame ID: 7D1AA8CB210CB51CC31C0DDDB44FA350
Requests: 1 HTTP requests in this frame

Frame: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone
Frame ID: 8C06CABF846F395D1CDB8115ABFB694E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ HTTP 302
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

123 kB
Transfer

448 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ HTTP 302
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	Primary Request tl.php Show response news.mailclick.me/ Redirect Chain http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/	649 B 557 B	165ms 103ms	Document text/html	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `10f83b1bc005f5eea20b5febc92202aca0eddea1c2968004d030a81153e3f2c7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Thu, 20 Jul 2023 21:42:37 GMT secured By XLabs Security www.xlabs.com.br server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security Redirect headers Connection keep-alive Content-Length 243 Content-Type text/html; charset=iso-8859-1 Date Thu, 20 Jul 2023 21:42:37 GMT Location https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Public-Key-Pins pin-sha256="qqmFDnGuWc+Y3Fiz0wVRpi8Gyst9PPl/bntrmJLWHEY="; pin-sha256="dNTbAJyOHrT95Xs7l5wl8fxblQkJkgNn2Ez7Drvy7CY="; max-age=300 Secured By XLabs Security www.xlabs.com.br Server XLabs WAF v4.0 http://www.xlabs.com.br/waf Strict-Transport-Security max-age=63072000; preload x-cdn XLabs Security
GET H2	200	host_block Show response tyrell.armor.zone/ Frame 8C06	3 KB 1 KB	585ms 36ms	Document text/html	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Requested by Host: news.mailclick.me URL: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `d963d11e01e142db5d91d3b42af03690220d10418a23dd08e442a207a005f95a` Request headers Referer https://news.mailclick.me/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html;charset=UTF-8 date Thu, 20 Jul 2023 21:42:38 GMT secured By XLabs Security www.xlabs.com.br server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security
GET H2	200	bootstrap-4.4.1.css tyrell.armor.zone/styles/ Frame 8C06	193 KB 35 KB	34ms 33ms	Stylesheet text/css	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://tyrell.armor.zone/styles/bootstrap-4.4.1.css Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:38 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"197413-1685499922000" secured By XLabs Security www.xlabs.com.br content-type text/css cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:38 GMT
GET H2	200	style_error.css tyrell.armor.zone/styles/ Frame 8C06	7 KB 2 KB	64ms 64ms	Stylesheet text/css	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://tyrell.armor.zone/styles/style_error.css Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:38 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"7118-1685499922000" secured By XLabs Security www.xlabs.com.br content-type text/css cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:38 GMT
GET H/1.1	200 OK	/ Show response api.ipify.org/ Frame 8C06	32 B 206 B	353ms 110ms	Script application/javascript	64.185.227.156 WEBNX
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 64.185.227.156 Los Angeles, United States, ASN18450 (WEBNX, US), Reverse DNS 64-185-227-156.static.webnx.com Software nginx/1.25.1 / Resource Hash `b76c23d385eb5502baf32dedc9ca0821e8e07e49f6b3fc2aee3cc6d3669df20a` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers Date Thu, 20 Jul 2023 21:42:38 GMT Server nginx/1.25.1 Connection keep-alive Content-Length 32 Vary Origin Content-Type application/javascript
GET H2	200	elements_error.svg tyrell.armor.zone/images/ Frame 8C06	6 KB 7 KB	32ms 32ms	Image image/svg+xml	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://tyrell.armor.zone/images/elements_error.svg Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:38 GMT last-modified Wed, 31 May 2023 02:25:20 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"6640-1685499920000" secured By XLabs Security www.xlabs.com.br content-type image/svg+xml accept-ranges bytes content-length 6640
GET H2	200	jquery-3.4.1.min.js Show response tyrell.armor.zone/scripts/ Frame 8C06	86 KB 35 KB	35ms 35ms	Script application/javascript	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://tyrell.armor.zone/scripts/jquery-3.4.1.min.js Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:38 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"88145-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:38 GMT
GET H2	200	popper.min.js Show response tyrell.armor.zone/scripts/ Frame 8C06	21 KB 8 KB	33ms 33ms	Script application/javascript	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://tyrell.armor.zone/scripts/popper.min.js Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:38 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"21257-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:38 GMT
GET H2	200	bootstrap-4.4.1.js Show response tyrell.armor.zone/scripts/ Frame 8C06	132 KB 34 KB	35ms 35ms	Script application/javascript	34.65.209.240 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://tyrell.armor.zone/scripts/bootstrap-4.4.1.js Requested by Host: tyrell.armor.zone URL: https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.65.209.240 Zurich, Switzerland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 240.209.65.34.bc.googleusercontent.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f` Request headers accept-language de-DE,de;q=0.9 Referer https://tyrell.armor.zone/host_block?host=news.mailclick.me&waf=tyrell.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:38 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"135079-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:38 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
news.mailclick.me
tyrell.armor.zone
161.156.186.10
34.65.209.240
64.185.227.156
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6
10f83b1bc005f5eea20b5febc92202aca0eddea1c2968004d030a81153e3f2c7
3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f
8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e
b76c23d385eb5502baf32dedc9ca0821e8e07e49f6b3fc2aee3cc6d3669df20a
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
d963d11e01e142db5d91d3b42af03690220d10418a23dd08e442a207a005f95a
eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f

news.mailclick.me Open in urlscan Pro 34.65.209.240 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

123 kBTransfer

448 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

news.mailclick.me Open in urlscan Pro
34.65.209.240 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

123 kB
Transfer

448 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions