urlscan.io logo urlscan.io
SecurityTrails logo

mls.whirlpool.eu Open in urlscan Pro
35.210.13.162  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://rdir.inxmail.com/4flying/d?o000kzfq0bcvzy00d0000000000000000hpj57x5iqz0del77i7234n6svq5345
Effective URL: https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
Submission Tags: falconsandbox
Submission: On July 12 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 35.210.13.162, located in Brussels, Belgium and belongs to GOOGLE, US. The main domain is mls.whirlpool.eu.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on January 11th 2022. Valid for: a year.
This is the only time mls.whirlpool.eu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 93.191.162.150 47372 (BIG3AS)
1 4 35.210.13.162 15169 (GOOGLE)
3 1
Apex Domain
Subdomains		 Transfer
4 whirlpool.eu
mls.whirlpool.eu
24 KB
1 inxmail.com
rdir.inxmail.com — Cisco Umbrella Rank: 187416
214 B
3 2
Domain Requested by
4 mls.whirlpool.eu 1 redirects mls.whirlpool.eu
1 rdir.inxmail.com 1 redirects
3 2

This site contains no links.

Subject Issuer Validity Valid
mls.whirlpool.eu
Sectigo RSA Organization Validation Secure Server CA		 2022-01-11 -
2023-01-11		 a year crt.sh

This page contains 1 frames:

Primary Page: https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
Frame ID: 02F903ADBAC93EC47C3463175F709060
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Newsletter PDF version

Page URL History Show full URLs

  1. https://rdir.inxmail.com/4flying/d?o000kzfq0bcvzy00d0000000000000000hpj57x5iqz0del77i7234n6svq5345 HTTP 302
    http://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732 HTTP 301
    https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732 Page URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

24 kB
Transfer

26 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rdir.inxmail.com/4flying/d?o000kzfq0bcvzy00d0000000000000000hpj57x5iqz0del77i7234n6svq5345 HTTP 302
    http://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732 HTTP 301
    https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request downpdf
mls.whirlpool.eu/
Redirect Chain
  • https://rdir.inxmail.com/4flying/d?o000kzfq0bcvzy00d0000000000000000hpj57x5iqz0del77i7234n6svq5345
  • http://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
  • https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.210.13.162 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
162.13.210.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
41037adcb417fca4f1fe7527dbc0b1db6d66904e6b9533d4db72af3eb671e9f2
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=0, s-maxage=0, must-revalidate, proxy-revalidate
content-encoding
gzip
content-length
685
content-security-policy
default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
content-type
text/html; charset=UTF-8
date
Tue, 12 Jul 2022 02:41:25 GMT
expect-ct
max-age=43200, report-uri="https://eteam.report-uri.com/r/d/ct/reportOnly"
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 google
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ns
eteam-web-group-419c
x-xss-protection
1; mode=block

Redirect headers

Cache-Control
private
Content-Length
280
Content-Type
text/html; charset=UTF-8
Date
Tue, 12 Jul 2022 02:41:25 GMT
Location
https://mls.whirlpool.eu:443/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
Referrer-Policy
no-referrer
logo_base.png
mls.whirlpool.eu/images/unsubscribenl/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mls.whirlpool.eu/images/unsubscribenl/logo_base.png
Requested by
Host: mls.whirlpool.eu
URL: https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.210.13.162 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
162.13.210.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
85ca53b26a821c03ef7cddca7f975f5a6ced83a074e9a6f18cba93bfb0578217
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Tue, 12 Jul 2022 02:41:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
x-ns
eteam-web-group-419c
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15147
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 31 May 2022 10:54:37 GMT
server
Apache
x-frame-options
SAMEORIGIN
etag
"3b26-5e04c9949b569-gzip"
expect-ct
max-age=43200, report-uri="https://eteam.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding
content-type
image/png
via
1.1 google
cache-control
public, max-age=0, s-maxage=0, must-revalidate, proxy-revalidate, max-age=30
content-security-policy
default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
accept-ranges
bytes
expires
Tue, 12 Jul 2022 02:41:56 GMT
sf_base.jpg
mls.whirlpool.eu/images/unsubscribenl/ 		10 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mls.whirlpool.eu/images/unsubscribenl/sf_base.jpg
Requested by
Host: mls.whirlpool.eu
URL: https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.210.13.162 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
162.13.210.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
6270ee62a3cd65a32ecc2de7e538c8687a96d6f768a5c002c3a6b987a1c6c14c
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mls.whirlpool.eu/downpdf?ALKUID=[ALKUID]&LOC=fr_FR&SPR=50853732
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Tue, 12 Jul 2022 02:41:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
x-ns
eteam-web-group-419c
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6987
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 31 May 2022 10:54:37 GMT
server
Apache
x-frame-options
SAMEORIGIN
etag
"29d5-5e04c994a0b5b-gzip"
expect-ct
max-age=43200, report-uri="https://eteam.report-uri.com/r/d/ct/reportOnly"
vary
Accept-Encoding
content-type
image/jpeg
via
1.1 google
cache-control
public, max-age=0, s-maxage=0, must-revalidate, proxy-revalidate, max-age=30
content-security-policy
default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
accept-ranges
bytes
expires
Tue, 12 Jul 2022 02:41:56 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

3 Cookies

Domain/Path Name / Value
mls.whirlpool.eu/ Name: ALKSESSID
Value: 00tldranjekmfgdp6sdfkikbkj
mls.whirlpool.eu/ Name: cookielingua
Value: en_TC
mls.whirlpool.eu/ Name: Nv_ps
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' blob: *.4flow.cloud; style-src 'self' 'unsafe-inline' *.4flow.cloud; img-src 'self' data: *.4flow.cloud *.4flow.net; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.4flow.cloud; connect-src 'self' *.4flow.cloud *.4flow.net; frame-ancestors 'self' *.4flow.cloud; frame-src 'self' *.4flow.cloud; font-src 'self' data: *.4flow.cloud ;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mls.whirlpool.eu
rdir.inxmail.com
35.210.13.162
93.191.162.150
41037adcb417fca4f1fe7527dbc0b1db6d66904e6b9533d4db72af3eb671e9f2
6270ee62a3cd65a32ecc2de7e538c8687a96d6f768a5c002c3a6b987a1c6c14c
85ca53b26a821c03ef7cddca7f975f5a6ced83a074e9a6f18cba93bfb0578217