www.expressvpn.com Open in urlscan Pro
18.238.49.64 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYo...
Effective URL:
https://www.expressvpn.com/
Submission: On November 07 via api (November 7th 2024, 11:10:19 am UTC) from BE — Scanned from US

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 18.238.49.64, located in United States and belongs to AMAZON-02, US. The main domain is www.expressvpn.com. The Cisco Umbrella rank of the primary domain is 103217.
TLS certificate: Issued by Amazon RSA 2048 M02 on October 13th 2024. Valid for: a year.

This is the only time www.expressvpn.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	64.227.123.27 64.227.123.27	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2 2	184.107.84.181 184.107.84.181	32613 (IWEB-AS) (IWEB-AS)
1 1	79.133.41.53 79.133.41.53	44066 (DE-FIRSTC...) (DE-FIRSTCOLO firstcolo.net)
1 1	13.35.93.72 13.35.93.72	16509 (AMAZON-02) (AMAZON-02)
1	18.238.49.64 18.238.49.64	16509 (AMAZON-02) (AMAZON-02)
8	3

2 64.227.123.27 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: new-survey.info

64.227.123.27	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.107.84.181 (Canada) 2 redirects

ASN32613 (IWEB-AS, CA)

www.codeworksquick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 79.133.41.53 (Germany) 1 redirects

ASN44066 (DE-FIRSTCOLO firstcolo.net, DE)

xmu.fastestopt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.93.72 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-72.jfk50.r.cloudfront.net

expressvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.49.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-64.jfk52.r.cloudfront.net

www.expressvpn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	expressvpn.com 1 redirects expressvpn.com — Cisco Umbrella Rank: 83401 www.expressvpn.com — Cisco Umbrella Rank: 103217	287 B
2	codeworksquick.com 2 redirects www.codeworksquick.com	1 KB
1	fastestopt.com 1 redirects xmu.fastestopt.com	376 B
0	xvservice.net Failed prod-assets-cms.mtech.xvservice.net Failed
8	4

	Domain	Requested by
2	www.codeworksquick.com	2 redirects
1	www.expressvpn.com	64.227.123.27
1	expressvpn.com	1 redirects
1	xmu.fastestopt.com	1 redirects
0	prod-assets-cms.mtech.xvservice.net Failed	www.expressvpn.com
8	5

This site contains no links.

Subject Issuer	Validity	Valid
expressvpn.com Amazon RSA 2048 M02	`2024-10-13` - `2025-11-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.expressvpn.com/
Frame ID: 465F67892DD5E8F852C7E0B5DC0FAD35
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

High-Speed, Secure & Anonymous VPN Service | ExpressVPN

Page URL History Show full URLs

http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigpps... HTTP 307
https://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigpps... HTTP 307
http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigpps... Page URL
http://64.227.123.27/t/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigp... Page URL
https://www.codeworksquick.com/418B7NF/X9XKSQJ/?&sub1=12&sub2=4487-26427&sub3=739674-4791-78703 HTTP 302
https://www.codeworksquick.com/418B7NF/S5T8TN8/?__rpt=0&__po=14859&__ptid=c08119e4164746a2852dab484d53c5a8&... HTTP 302
https://xmu.fastestopt.com/?kw=1856&s2=2f5e8a3982f84b27be4f806aebff96f9 HTTP 301
https://expressvpn.com/ HTTP 301
https://www.expressvpn.com/ Page URL

Page Statistics

8
Requests

13 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

3
IPs

3
Countries

1 kB
Transfer

34 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 HTTP 307
https://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 HTTP 307
http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 Page URL
http://64.227.123.27/t/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 Page URL
https://www.codeworksquick.com/418B7NF/X9XKSQJ/?&sub1=12&sub2=4487-26427&sub3=739674-4791-78703 HTTP 302
https://www.codeworksquick.com/418B7NF/S5T8TN8/?__rpt=0&__po=14859&__ptid=c08119e4164746a2852dab484d53c5a8&__rpa=1&__rc=1&sub1=12&sub2=4487-26427&sub3=739674-4791-78703&sub4=&sub5=&source_id=&__pcd=9 HTTP 302
https://xmu.fastestopt.com/?kw=1856&s2=2f5e8a3982f84b27be4f806aebff96f9 HTTP 301
https://expressvpn.com/ HTTP 301
https://www.expressvpn.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 HTTP 307
https://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 HTTP 307
http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 Show response
64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/
Redirect Chain

http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
https://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12

458 B
711 B

139ms
138ms

Document
text/html

64.227.123.27
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
Protocol: HTTP/1.1
Server: 64.227.123.27 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: new-survey.info
Software: /
Resource Hash: 0f3a07f36d6bddee418f7d7548bc165b09817e10764a359d2773388cdec9ff8a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Content-Length: 458
Content-Type: text/html; charset=utf-8
Date: Thu, 07 Nov 2024 11:10:04 GMT
X-Address: gin_throttle_mw_7200000000_38.132.118.75
X-Ratelimit-Limit: 500
X-Ratelimit-Remaining: 497
X-Ratelimit-Reset: 1730981334

Redirect headers

Location: http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK 4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12 Show response
64.227.123.27/t/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/ 316 B
569 B 166ms
165ms Document
text/html 64.227.123.27
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://64.227.123.27/t/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
Requested by: Host: 64.227.123.27
URL: http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
Protocol: HTTP/1.1
Server: 64.227.123.27 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: new-survey.info
Software: /
Resource Hash: 6dae552237cb258cdecf4043b8c0e6536c4b9d29202ff38108368bb4709470cf

Request headers

Referer: http://64.227.123.27/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Content-Length: 316
Content-Type: text/html; charset=utf-8
Date: Thu, 07 Nov 2024 11:10:06 GMT
X-Address: gin_throttle_mw_7200000000_38.132.118.75
X-Ratelimit-Limit: 500
X-Ratelimit-Remaining: 496
X-Ratelimit-Reset: 1730981334

GET
H2

200

Primary Request /
www.expressvpn.com/
Redirect Chain

https://www.codeworksquick.com/418B7NF/X9XKSQJ/?&sub1=12&sub2=4487-26427&sub3=739674-4791-78703
https://www.codeworksquick.com/418B7NF/S5T8TN8/?__rpt=0&__po=14859&__ptid=c08119e4164746a2852dab484d53c5a8&__rpa=1&__rc=1&sub1=12&sub2=4487-26427&sub3=739674-4791-78703&sub4=&sub5=&source_id=&__pcd=9
https://xmu.fastestopt.com/?kw=1856&s2=2f5e8a3982f84b27be4f806aebff96f9
https://expressvpn.com/
https://www.expressvpn.com/

33 KB
0

477ms
338ms

Document
text/html

18.238.49.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.expressvpn.com/

Requested by

Host: 64.227.123.27
URL: http://64.227.123.27/t/r/ugeyzxuvkhshpxygmdhpfoijxszcruvhvjkvqnqtpooroqnqrp.aLklcGnDCfSpYowOyCigppsjXeKrituhkusblwYYeYoVGZQFpg/4HfKWn26427eZev4487xydnnsjiqq739674GNOZHHUODHTSZXQ4791BXWY78703a12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.64 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-64.jfk52.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://64.227.123.27/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Thu, 07 Nov 2024 11:10:08 GMT
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 1f85764c0bc1f70d16858df07753dfa8.cloudfront.net (CloudFront)
x-amz-cf-id: TCcws8zV-iPNh8lyd8K3WSVf_gzZNgLsZefdS0uhr8ptp9RdSWQlDw==
x-amz-cf-pop: JFK52-P3
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

content-length: 0
date: Thu, 07 Nov 2024 11:10:08 GMT
location: https://www.expressvpn.com/
server: CloudFront
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 6379820fbac3eca5570c58b520f7931e.cloudfront.net (CloudFront)
x-amz-cf-id: iHbCODP00F0PiyDIDEbhkdCUrxqDk9wSoe6--pimADbP1G9o0AqrzQ==
x-amz-cf-pop: JFK50-P8
x-cache: Miss from cloudfront

GET fs-kim-text-w03-medium.woff2
prod-assets-cms.mtech.xvservice.net/fonts/xv/ 0
0

GET inter-bold.woff2
prod-assets-cms.mtech.xvservice.net/fonts/xv/ 0
0

GET inter-regular.woff2
prod-assets-cms.mtech.xvservice.net/fonts/xv/ 0
0

GET inter-medium.woff2
prod-assets-cms.mtech.xvservice.net/fonts/xv/ 0
0

GET inter-semibold.woff2
prod-assets-cms.mtech.xvservice.net/fonts/xv/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: prod-assets-cms.mtech.xvservice.net
URL: https://prod-assets-cms.mtech.xvservice.net/fonts/xv/fs-kim-text-w03-medium.woff2

Domain: prod-assets-cms.mtech.xvservice.net
URL: https://prod-assets-cms.mtech.xvservice.net/fonts/xv/inter-bold.woff2

Domain: prod-assets-cms.mtech.xvservice.net
URL: https://prod-assets-cms.mtech.xvservice.net/fonts/xv/inter-regular.woff2

Domain: prod-assets-cms.mtech.xvservice.net
URL: https://prod-assets-cms.mtech.xvservice.net/fonts/xv/inter-medium.woff2

Domain: prod-assets-cms.mtech.xvservice.net
URL: https://prod-assets-cms.mtech.xvservice.net/fonts/xv/inter-semibold.woff2

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.expressvpn.com/	1970-01-21 09:35:13	Name: xvid Value: TCcws8zV-iPNh8lyd8K3WSVf_gzZNgLsZefdS0uhr8ptp9RdSWQlDw%3D%3D
www.expressvpn.com/	1970-01-21 10:25:37	Name: landing_page Value: https://www.expressvpn.com/
www.expressvpn.com/	1970-01-21 01:32:49	Name: locale Value:
www.expressvpn.com/	1970-01-21 01:09:47	Name: xvsrcwebsite Value: 64.227.123.27
www.expressvpn.com/	1969-12-31 23:59:59	Name: xvgtm Value: %7B%22logged_in%22%3Afalse%7D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

expressvpn.com
prod-assets-cms.mtech.xvservice.net
www.codeworksquick.com
www.expressvpn.com
xmu.fastestopt.com
prod-assets-cms.mtech.xvservice.net
13.35.93.72
18.238.49.64
184.107.84.181
64.227.123.27
79.133.41.53
0f3a07f36d6bddee418f7d7548bc165b09817e10764a359d2773388cdec9ff8a
6dae552237cb258cdecf4043b8c0e6536c4b9d29202ff38108368bb4709470cf

www.expressvpn.com Open in urlscan Pro 18.238.49.64 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

13 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

3 IPs

3 Countries

1 kBTransfer

34 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

5 Cookies

Indicators

www.expressvpn.com Open in urlscan Pro
18.238.49.64 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

13 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

3
IPs

3
Countries

1 kB
Transfer

34 kB
Size

5
Cookies

8 HTTP transactions
0 data transactions