news.mailclick.me Open in urlscan Pro
169.61.36.34 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Effective URL:
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Submission: On July 20 via api (July 20th 2023, 9:42:52 pm UTC) from US — Scanned from GB

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 169.61.36.34, located in United States and belongs to SOFTLAYER, US. The main domain is news.mailclick.me.
TLS certificate: Issued by R3 on July 17th 2023. Valid for: 3 months.

This is the only time news.mailclick.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.125.138.136 34.125.138.136	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
8	169.61.36.34 169.61.36.34	36351 (SOFTLAYER) (SOFTLAYER)
1	173.231.16.76 173.231.16.76	18450 (WEBNX) (WEBNX)
9	2

1 34.125.138.136 (Las Vegas, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 136.138.125.34.bc.googleusercontent.com

news.mailclick.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 169.61.36.34 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 22.24.3da9.ip4.static.sl-reverse.com

news.mailclick.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cisco.armor.zone	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.231.16.76 (United States)

ASN18450 (WEBNX, US)
PTR: 173-231-16-76.static.webnx.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	armor.zone cisco.armor.zone	122 KB
2	mailclick.me 1 redirects news.mailclick.me	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2618	206 B
9	3

	Domain	Requested by
7	cisco.armor.zone	news.mailclick.me cisco.armor.zone
2	news.mailclick.me	1 redirects
1	api.ipify.org	cisco.armor.zone
9	3

This site contains no links.

Subject Issuer	Validity	Valid
news.mailclick.me R3	`2023-07-17` - `2023-10-15`	3 months	crt.sh
cisco.armor.zone R3	`2023-07-12` - `2023-10-10`	3 months	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2023-02-07` - `2024-02-18`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/
Frame ID: 425DD0B966D646DE37D98E4F3059A28A
Requests: 1 HTTP requests in this frame

Frame: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone
Frame ID: 13EAA658EA4D1BBE80D7BBA149BA4E70
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ HTTP 302
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

123 kB
Transfer

448 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ HTTP 302
https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	403	Primary Request tl.php Show response news.mailclick.me/ Redirect Chain http://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/	647 B 554 B	917ms 628ms	Document text/html	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0b3418f5042adf0caa8b57363c4d6bd178aeeb9a12aaf1cf827084062862362b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Thu, 20 Jul 2023 21:42:47 GMT secured By XLabs Security www.xlabs.com.br server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security Redirect headers Connection keep-alive Content-Length 243 Content-Type text/html; charset=iso-8859-1 Date Thu, 20 Jul 2023 21:42:46 GMT Location https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Public-Key-Pins pin-sha256="qqmFDnGuWc+Y3Fiz0wVRpi8Gyst9PPl/bntrmJLWHEY="; pin-sha256="XTVE99mOJYqvWYVDTiW5/u/vVR2VqZHFjGy9/pMdMxs="; max-age=300 Secured By XLabs Security www.xlabs.com.br Server XLabs WAF v4.0 http://www.xlabs.com.br/waf Strict-Transport-Security max-age=63072000; preload x-cdn XLabs Security
GET H2	200	host_block Show response cisco.armor.zone/ Frame 13EA	3 KB 1 KB	760ms 145ms	Document text/html	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Requested by Host: news.mailclick.me URL: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `6f78fd10429cf77bc08c3f56d727be187902dc410abf2ca95675aa075ae32f31` Request headers Referer https://news.mailclick.me/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers content-encoding gzip content-type text/html;charset=UTF-8 date Thu, 20 Jul 2023 21:42:48 GMT secured By XLabs Security www.xlabs.com.br server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security
GET H2	200	bootstrap-4.4.1.css cisco.armor.zone/styles/ Frame 13EA	193 KB 35 KB	147ms 146ms	Stylesheet text/css	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://cisco.armor.zone/styles/bootstrap-4.4.1.css Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:48 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"197413-1685499922000" secured By XLabs Security www.xlabs.com.br content-type text/css cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:48 GMT
GET H2	200	style_error.css cisco.armor.zone/styles/ Frame 13EA	7 KB 2 KB	286ms 286ms	Stylesheet text/css	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://cisco.armor.zone/styles/style_error.css Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:48 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"7118-1685499922000" secured By XLabs Security www.xlabs.com.br content-type text/css cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:48 GMT
GET H/1.1	200 OK	/ Show response api.ipify.org/ Frame 13EA	32 B 206 B	447ms 148ms	Script application/javascript	173.231.16.76 WEBNX
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 173.231.16.76 , United States, ASN18450 (WEBNX, US), Reverse DNS 173-231-16-76.static.webnx.com Software nginx/1.25.1 / Resource Hash `3c0495145f777e181ad57c4fd8dc74148e7269a0be702d067ba61cd15d20dbf5` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers Date Thu, 20 Jul 2023 21:42:49 GMT Server nginx/1.25.1 Connection keep-alive Content-Length 32 Vary Origin Content-Type application/javascript
GET H2	200	elements_error.svg cisco.armor.zone/images/ Frame 13EA	6 KB 7 KB	145ms 145ms	Image image/svg+xml	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Show image Full URL https://cisco.armor.zone/images/elements_error.svg Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:48 GMT last-modified Wed, 31 May 2023 02:25:20 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"6640-1685499920000" secured By XLabs Security www.xlabs.com.br content-type image/svg+xml accept-ranges bytes content-length 6640
GET H2	200	jquery-3.4.1.min.js Show response cisco.armor.zone/scripts/ Frame 13EA	86 KB 35 KB	142ms 142ms	Script application/javascript	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://cisco.armor.zone/scripts/jquery-3.4.1.min.js Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:48 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"88145-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:48 GMT
GET H2	200	popper.min.js Show response cisco.armor.zone/scripts/ Frame 13EA	21 KB 8 KB	142ms 141ms	Script application/javascript	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://cisco.armor.zone/scripts/popper.min.js Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:48 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"21257-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:48 GMT
GET H2	200	bootstrap-4.4.1.js Show response cisco.armor.zone/scripts/ Frame 13EA	132 KB 34 KB	145ms 145ms	Script application/javascript	169.61.36.34 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://cisco.armor.zone/scripts/bootstrap-4.4.1.js Requested by Host: cisco.armor.zone URL: https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone Protocol H2 Security TLS 1.3, , AES_128_GCM Server 169.61.36.34 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 22.24.3da9.ip4.static.sl-reverse.com Software XLabs WAF v4.0 http://www.xlabs.com.br/waf / Resource Hash `eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f` Request headers accept-language en-GB,en;q=0.9 Referer https://cisco.armor.zone/host_block?host=news.mailclick.me&waf=cisco.armor.zone User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36 Response headers date Thu, 20 Jul 2023 21:42:48 GMT content-encoding gzip last-modified Wed, 31 May 2023 02:25:22 GMT server XLabs WAF v4.0 http://www.xlabs.com.br/waf x-cdn XLabs Security etag W/"135079-1685499922000" secured By XLabs Security www.xlabs.com.br content-type application/javascript cache-control max-age=86400 expires Fri, 21 Jul 2023 21:42:48 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://news.mailclick.me/tl.php?p=2042/1w56/rs/u3o/321/rs/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
cisco.armor.zone
news.mailclick.me
169.61.36.34
173.231.16.76
34.125.138.136
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0b3418f5042adf0caa8b57363c4d6bd178aeeb9a12aaf1cf827084062862362b
0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6
3c0495145f777e181ad57c4fd8dc74148e7269a0be702d067ba61cd15d20dbf5
3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f
6f78fd10429cf77bc08c3f56d727be187902dc410abf2ca95675aa075ae32f31
8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f

news.mailclick.me Open in urlscan Pro 169.61.36.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

123 kBTransfer

448 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

news.mailclick.me Open in urlscan Pro
169.61.36.34 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

123 kB
Transfer

448 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions