ww25.tw.email-winzip.com
Open in
urlscan Pro
199.59.243.226
Public Scan
Effective URL: http://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c
Submission Tags: @phish_report
Submission: On September 01 via api from FI — Scanned from AU
Summary
This is the only time ww25.tw.email-winzip.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 103.224.212.101 103.224.212.101 | 133618 (TRELLIAN-...) (TRELLIAN-AS-AP Trellian Pty. Limited) | |
3 | 199.59.243.226 199.59.243.226 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 142.250.71.68 142.250.71.68 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.204.2 142.250.204.2 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 142.251.221.78 142.251.221.78 | 15169 (GOOGLE) (GOOGLE) | |
6 | 3 |
ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU)
PTR: lb-212-101.above.com
tw.email-winzip.com |
ASN15169 (GOOGLE, US)
PTR: syd15s17-in-f4.1e100.net
www.google.com |
ASN15169 (GOOGLE, US)
PTR: syd09s25-in-f2.1e100.net
partner.googleadservices.com |
ASN15169 (GOOGLE, US)
PTR: syd09s31-in-f14.1e100.net
syndicatedsearch.goog |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
email-winzip.com
1 redirects
tw.email-winzip.com ww25.tw.email-winzip.com |
42 KB |
2 |
google.com
www.google.com — Cisco Umbrella Rank: 10 |
54 KB |
1 |
syndicatedsearch.goog
1 redirects
syndicatedsearch.goog — Cisco Umbrella Rank: 6209 |
1 KB |
1 |
googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 5754 |
264 B |
6 | 4 |
Domain | Requested by | |
---|---|---|
3 | ww25.tw.email-winzip.com |
ww25.tw.email-winzip.com
|
2 | www.google.com |
ww25.tw.email-winzip.com
www.google.com |
1 | syndicatedsearch.goog | 1 redirects |
1 | partner.googleadservices.com |
www.google.com
|
1 | tw.email-winzip.com | 1 redirects |
6 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.com WR2 |
2024-08-05 - 2024-10-28 |
3 months | crt.sh |
*.googleadservices.com WR2 |
2024-08-05 - 2024-10-28 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c
Frame ID: 4D2B22306F14C7B76EB3F84F92AFF53C
Requests: 5 HTTP requests in this frame
Frame:
https://www.google.com/sorry/index?continue=https://syndicatedsearch.goog/afs/ads%3Fadtest%3Doff%26psid%3D6397872023%26pcsa%3Dfalse%26channel%3Dpid-bodis-gcontrol97%252Cpid-bodis-gcontrol305%252Cpid-bodis-gcontrol420%252Cpid-bodis-gcontrol152%252Cpid-bodis-gcontrol216%26client%3Ddp-bodis30_3ph%26r%3Dm%26hl%3Den%26ivt%3D1%26rpbu%3Dhttp%253A%252F%252Fww25.tw.email-winzip.com%252F%253Fcaf%253D1%2526bpt%253D342%2526subid1%253D20240901-1510-2981-a6ab-addf134bb58c%26max_radlink_len%3D60%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2497786236455022%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17301431%252C17301433%252C17301436%252C17301511%252C17301516%252C17301266%26format%3Dr3%26nocache%3D3271725167431722%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww25.tw.email-winzip.com%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D1%26u_tz%3D480%26dt%3D1725167431723%26u_w%3D1600%26u_h%3D1200%26biw%3D1600%26bih%3D1200%26psw%3D1600%26psh%3D1080%26frm%3D0%26uio%3D-%26cont%3Drs%26drt%3D0%26jsid%3Dcaf%26jsv%3D667606770%26rurl%3Dhttp%253A%252F%252Fww25.tw.email-winzip.com%252F%253Fsubid1%253D20240901-1510-2981-a6ab-addf134bb58c&hl=en&q=EgR0WkhkGMfuz7YGIjChbvngrddRxxX5ihtol9YuHBkz3W9Z23hbZlbgE0IAQnSuvU_CNwNSpgn69XBJJW8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
Frame ID: 3FAE4A856A9F7265A72AD40D47368FDB
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
email-winzip.comPage URL History Show full URLs
-
http://tw.email-winzip.com/
HTTP 307
https://tw.email-winzip.com/ HTTP 302
http://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c HTTP 307
https://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c HTTP 307
http://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c Page URL
Detected technologies
Zip (Payment processors) ExpandDetected patterns
- zip\.co
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://tw.email-winzip.com/
HTTP 307
https://tw.email-winzip.com/ HTTP 302
http://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c HTTP 307
https://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c HTTP 307
http://ww25.tw.email-winzip.com/?subid1=20240901-1510-2981-a6ab-addf134bb58c Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://syndicatedsearch.goog/afs/ads?adtest=off&psid=6397872023&pcsa=false&channel=pid-bodis-gcontrol97%2Cpid-bodis-gcontrol305%2Cpid-bodis-gcontrol420%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol216&client=dp-bodis30_3ph&r=m&hl=en&ivt=1&rpbu=http%3A%2F%2Fww25.tw.email-winzip.com%2F%3Fcaf%3D1%26bpt%3D342%26subid1%3D20240901-1510-2981-a6ab-addf134bb58c&max_radlink_len=60&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301511%2C17301516%2C17301266&format=r3&nocache=3271725167431722&num=0&output=afd_ads&domain_name=ww25.tw.email-winzip.com&v=3&bsl=8&pac=0&u_his=1&u_tz=480&dt=1725167431723&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1080&frm=0&uio=-&cont=rs&drt=0&jsid=caf&jsv=667606770&rurl=http%3A%2F%2Fww25.tw.email-winzip.com%2F%3Fsubid1%3D20240901-1510-2981-a6ab-addf134bb58c HTTP 302
- https://www.google.com/sorry/index?continue=https://syndicatedsearch.goog/afs/ads%3Fadtest%3Doff%26psid%3D6397872023%26pcsa%3Dfalse%26channel%3Dpid-bodis-gcontrol97%252Cpid-bodis-gcontrol305%252Cpid-bodis-gcontrol420%252Cpid-bodis-gcontrol152%252Cpid-bodis-gcontrol216%26client%3Ddp-bodis30_3ph%26r%3Dm%26hl%3Den%26ivt%3D1%26rpbu%3Dhttp%253A%252F%252Fww25.tw.email-winzip.com%252F%253Fcaf%253D1%2526bpt%253D342%2526subid1%253D20240901-1510-2981-a6ab-addf134bb58c%26max_radlink_len%3D60%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2497786236455022%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17301431%252C17301433%252C17301436%252C17301511%252C17301516%252C17301266%26format%3Dr3%26nocache%3D3271725167431722%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww25.tw.email-winzip.com%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D1%26u_tz%3D480%26dt%3D1725167431723%26u_w%3D1600%26u_h%3D1200%26biw%3D1600%26bih%3D1200%26psw%3D1600%26psh%3D1080%26frm%3D0%26uio%3D-%26cont%3Drs%26drt%3D0%26jsid%3Dcaf%26jsv%3D667606770%26rurl%3Dhttp%253A%252F%252Fww25.tw.email-winzip.com%252F%253Fsubid1%253D20240901-1510-2981-a6ab-addf134bb58c&hl=en&q=EgR0WkhkGMfuz7YGIjChbvngrddRxxX5ihtol9YuHBkz3W9Z23hbZlbgE0IAQnSuvU_CNwNSpgn69XBJJW8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ww25.tw.email-winzip.com/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bkduyAHUb.js
ww25.tw.email-winzip.com/ |
33 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
_fd
ww25.tw.email-winzip.com/ |
6 KB 6 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
caf.js
www.google.com/adsense/domains/ |
150 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cookie.js
partner.googleadservices.com/gampad/ |
386 B 264 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index
www.google.com/sorry/ Frame 3FAE Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 string| park object| version object| __parkour number| googleNDT_ number| googleAltLoader object| google function| __sasCookie3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
tw.email-winzip.com/ | Name: __tad Value: 1725167429.5639414 |
|
ww25.tw.email-winzip.com/ | Name: parking_session Value: f86c9af2-0ac1-458e-b451-4884cf643a2f |
|
.email-winzip.com/ | Name: __gsas Value: ID=f83342a56540311f:T=1725167431:RT=1725167431:S=ALNI_MYVtwKV0pYVZ2agK8AKgSe9s4Rz8g |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
partner.googleadservices.com
syndicatedsearch.goog
tw.email-winzip.com
ww25.tw.email-winzip.com
www.google.com
103.224.212.101
142.250.204.2
142.250.71.68
142.251.221.78
199.59.243.226
034e2623b00143ea4fcebc759ae3aa795e8db933d85ef875b297344ed859fb8a
5fd81bdb36c36d241ec24043f54bbc996abdda9fe03dc81fe6f3157f0cba22d0
b02155efbea15830327d3a2f090cfe849c290a7b1338841396a40b0a06346c54
c086565f8e810e3cfb83078238b3effe264225d2ca7428ddeb493fb7cc1d55a2
f109c3a3c8fec1b34e8e016ae73c38c7b66f047a77832bf6d7f75c0999c23b19