URL: https://x3newyearnewyou.davidefish.com/
Submission Tags: phishingrod
Submission: On October 05 via api from DE — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 205.201.132.26, located in United States and belongs to THEROCKETSCIENCEGROUP, US. The main domain is x3newyearnewyou.davidefish.com.
TLS certificate: Issued by R11 on October 4th 2024. Valid for: 3 months.
This is the only time x3newyearnewyou.davidefish.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 205.201.132.26 14782 (THEROCKET...)
5 3.168.102.39 16509 (AMAZON-02)
6 2
Apex Domain
Subdomains
Transfer
5 mailchimp.com
cdn-images.mailchimp.com — Cisco Umbrella Rank: 6599
91 KB
1 davidefish.com
x3newyearnewyou.davidefish.com
3 KB
6 2
Domain Requested by
5 cdn-images.mailchimp.com x3newyearnewyou.davidefish.com
1 x3newyearnewyou.davidefish.com
6 2

This site contains links to these domains. Also see Links.

Domain
admin.mailchimp.com
Subject Issuer Validity Valid
x3newyearnewyou.davidefish.com
R11
2024-10-04 -
2025-01-02
3 months crt.sh
cdn-images.mailchimp.com
Amazon RSA 2048 M02
2024-06-24 -
2025-07-22
a year crt.sh

This page contains 1 frames:

Primary Page: https://x3newyearnewyou.davidefish.com/
Frame ID: 823391760445142594EFC0A61050232C
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

404: Page Not Found | Mailchimp

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

94 kB
Transfer

102 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
x3newyearnewyou.davidefish.com/
11 KB
3 KB
Document
General
Full URL
https://x3newyearnewyou.davidefish.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
205.201.132.26 , United States, ASN14782 (THEROCKETSCIENCEGROUP, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
29e34527f6a87ab98a8e00d9b6ce4ec214c2214ddb894dfd51dc1861b255b3bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-length
2542
content-location
https://us20.campaign-archive.com/domain-proxy?d=x3newyearnewyou.davidefish.com&p=%2F&u=ef44cd5f6255edaaf94bdb7e2
content-type
text/html;charset=utf-8
date
Sat, 05 Oct 2024 09:33:05 GMT
intuit_tid
1-670107d1-3050d5e575915185190c59fe
server
istio-envoy
status
404 Not Found
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-amzn-trace-id
Root=1-670107d1-3050d5e575915185190c59fe
x-cloud-trace-context
640112512d7e39b2106646ab7128173c/15159228788937004787;o=0
x-envoy-decorator-operation
http-interposer-desired-service.mailchimp-cloud-httpinterposer-use2-prd-m2.svc.cluster.local:8090/*
x-envoy-upstream-service-time
251
x-mc-dc
atl01
x-request-id
1-670107d1-3050d5e575915185190c59fe
x-spanid
26f74de3-cc18-e081-f2f9-3604355c7677
x-ua-compatible
IE=edge,chrome=1
freddie-icon.svg
cdn-images.mailchimp.com/error-pages/
5 KB
3 KB
Image
General
Full URL
https://cdn-images.mailchimp.com/error-pages/freddie-icon.svg
Requested by
Host: x3newyearnewyou.davidefish.com
URL: https://x3newyearnewyou.davidefish.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-168-102-39.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ff0f07f2b8c1f9827e0a845c25817d987561a5322f8348378d83a1a6f460f630

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://x3newyearnewyou.davidefish.com/

Response headers

x-amz-cf-pop
JFK52-P6
content-encoding
gzip
x-amz-version-id
YesEZ6jik1AtYYtukJl0GFh1Xq3zMxyq
etag
W/"49d553ce63fee0c84d95e4769d3d06f0"
age
62077
via
1.1 258e36f8d5b4bc35294b1885246887c8.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
4TtgS4NHPFlwdz_zvnuVLXl1d03QLPp7h4s4_Alo8Oz-IWpfy3Ef-A==
date
Fri, 04 Oct 2024 16:18:29 GMT
content-type
image/svg+xml
vary
Accept-Encoding
server
AmazonS3
last-modified
Wed, 09 Mar 2022 23:09:48 GMT
art-hero-404.png
cdn-images.mailchimp.com/error-pages/
15 KB
15 KB
Image
General
Full URL
https://cdn-images.mailchimp.com/error-pages/art-hero-404.png
Requested by
Host: x3newyearnewyou.davidefish.com
URL: https://x3newyearnewyou.davidefish.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-168-102-39.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3e7266410773f05c289daad97fd23468308d808058862be16088c915e7c9b734

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://x3newyearnewyou.davidefish.com/

Response headers

x-amz-version-id
null
etag
"31ca1805e452f2fdee32082819c8cb80"
age
62077
via
1.1 258e36f8d5b4bc35294b1885246887c8.cloudfront.net (CloudFront)
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
15003
x-amz-cf-id
P5X78CLlcl81bzvEghDjsU3OJiF1R_1bPLn5dPRYT8oiJn2Qt4eT_g==
date
Fri, 04 Oct 2024 16:18:29 GMT
content-type
image/png
last-modified
Fri, 16 Nov 2018 14:37:26 GMT
server
AmazonS3
x-amz-cf-pop
JFK52-P6
vary
Accept-Encoding
Means-Regular-Web.woff2
cdn-images.mailchimp.com/product/fonts/mailchimp/means/
36 KB
36 KB
Font
General
Full URL
https://cdn-images.mailchimp.com/product/fonts/mailchimp/means/Means-Regular-Web.woff2
Requested by
Host: x3newyearnewyou.davidefish.com
URL: https://x3newyearnewyou.davidefish.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-168-102-39.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4878364326b0dc04dd99ae3ae19c9e9dafab2e556aa8b8710915778f6985bc7a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://x3newyearnewyou.davidefish.com
Referer
https://x3newyearnewyou.davidefish.com/

Response headers

access-control-expose-headers
*
x-amz-version-id
qfX0F.XqBn8WHsYKc8embV7arrbPVBxi
etag
"241819c8fa1248eb3ef4279ebec70cc3"
age
62108
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
Q9DqzG6F9dfTiYYWJNXQ4LKX6nmklkl-jufl1PT4LHt0qgDT1VxzsA==
date
Fri, 04 Oct 2024 16:17:58 GMT
content-type
binary/octet-stream
last-modified
Mon, 28 Aug 2023 14:46:12 GMT
cache-control
max-age=604800
via
1.1 ce2e89e44d58ce842c3a3f58083fd886.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
36744
x-amz-cf-pop
JFK52-P6
server
AmazonS3
x-amz-server-side-encryption
AES256
Graphik-Regular-Web.woff2
cdn-images.mailchimp.com/product/fonts/mailchimp/graphik/
28 KB
28 KB
Font
General
Full URL
https://cdn-images.mailchimp.com/product/fonts/mailchimp/graphik/Graphik-Regular-Web.woff2
Requested by
Host: x3newyearnewyou.davidefish.com
URL: https://x3newyearnewyou.davidefish.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-168-102-39.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3481f3491c3963b896f794e8f890bf9b138406d1a2a1066ce9ceb96871ca9ad7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://x3newyearnewyou.davidefish.com
Referer
https://x3newyearnewyou.davidefish.com/

Response headers

access-control-expose-headers
*
x-amz-version-id
9tz5z.um3WcJhRS8Zx40ngrVM6Zu0aJT
etag
"51b489efb0654e9f9494727cd3772ad6"
age
74584
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
pY4gLGCVC9f34k2vG3qGMXjBXUQeOTEacuyptJ4jKRyzxPGggG-_CQ==
date
Fri, 04 Oct 2024 12:50:02 GMT
content-type
binary/octet-stream
last-modified
Mon, 28 Aug 2023 14:45:27 GMT
cache-control
max-age=604800
via
1.1 ce2e89e44d58ce842c3a3f58083fd886.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
28164
x-amz-cf-pop
JFK52-P6
server
AmazonS3
x-amz-server-side-encryption
AES256
favicon.ico
cdn-images.mailchimp.com/favicons/
8 KB
9 KB
Other
General
Full URL
https://cdn-images.mailchimp.com/favicons/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-168-102-39.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1e9840287decb8799f6da96f04ed4393a7380d5236f4dfc42947174550b25c92

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://x3newyearnewyou.davidefish.com/

Response headers

x-amz-version-id
null
etag
"8969a0a66f67fb12242f39ad1ad79d1f"
age
62106
via
1.1 258e36f8d5b4bc35294b1885246887c8.cloudfront.net (CloudFront)
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
8348
x-amz-cf-id
rFH5TE9qTCO_eo8SE2Ru6u10MBQrfGKR_To8RGEQ2OXo1K0KowqCNA==
date
Fri, 04 Oct 2024 16:18:01 GMT
content-type
image/x-icon
last-modified
Wed, 21 Nov 2018 21:02:19 GMT
server
AmazonS3
x-amz-cf-pop
JFK52-P6
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| images function| onImageClick

1 Cookies

Domain/Path Name / Value
x3newyearnewyou.davidefish.com/ Name: _mcid
Value: 1.953330fdd21950caaa66db6e13e7b977.797cbf38ecd39218a7e13de27e5b0372d8594cddfb8ad65971c12ba8c8e5712e

1 Console Messages

Source Level URL
Text
network error URL: https://x3newyearnewyou.davidefish.com/
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000