gu-msn-mktg-dns-prod.2u.com

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 52.222.161.201, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is gu-msn-mktg-dns-prod.2u.com.

This is the only time gu-msn-mktg-dns-prod.2u.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.222.161.201 52.222.161.201	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2.20.21.198 2.20.21.198	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.0.133 151.101.0.133	54113 (FASTLY) (FASTLY - Fastly)
1	45.40.130.22 45.40.130.22	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
4	4

1 52.222.161.201 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-161-201.fra54.r.cloudfront.net

gu-msn-mktg-dns-prod.2u.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.21.198 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-21-198.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.0.133 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

user-images.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.40.130.22 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net

img.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	secureserver.net img.secureserver.net	598 B
1	githubusercontent.com user-images.githubusercontent.com	706 KB
1	wsimg.com img1.wsimg.com	5 KB
1	2u.com gu-msn-mktg-dns-prod.2u.com	2 KB
4	4

	Domain	Requested by
1	img.secureserver.net
1	user-images.githubusercontent.com	gu-msn-mktg-dns-prod.2u.com
1	img1.wsimg.com	gu-msn-mktg-dns-prod.2u.com
1	gu-msn-mktg-dns-prod.2u.com
4	4

This site contains links to these domains. Also see Links.

Domain
twitter.com

Subject Issuer	Validity	Valid
*.wsimg.com Starfield Secure Certificate Authority - G2	`2018-09-25` - `2020-09-25`	2 years	crt.sh
www.github.com DigiCert SHA2 High Assurance Server CA	`2017-03-23` - `2020-05-13`	3 years	crt.sh

This page contains 1 frames:

Primary Page: http://gu-msn-mktg-dns-prod.2u.com/poc.html
Frame ID: 358DE48301F9A362232BD97297EABF47
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

713 kB
Transfer

720 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/
Title: @qenatechnology

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request poc.html Show response gu-msn-mktg-dns-prod.2u.com/	3 KB 2 KB	43ms 15ms	Document text/html	52.222.161.201 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://gu-msn-mktg-dns-prod.2u.com/poc.html Protocol HTTP/1.1 Server 52.222.161.201 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-222-161-201.fra54.r.cloudfront.net Software Apache / Resource Hash `cbea3531297a39dc0c1cb7e410b729571ca205111f500bc0399f93381f5e8ed9` Request headers Host gu-msn-mktg-dns-prod.2u.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Content-Type text/html Content-Length 1286 Connection keep-alive Date Sat, 27 Oct 2018 09:32:26 GMT Server Apache Last-Modified Thu, 18 Oct 2018 01:54:55 GMT ETag "8700a7b-9f5-5787712ce5764-gzip" Accept-Ranges bytes Content-Encoding gzip Age 13117 Vary Accept-Encoding X-Cache Hit from cloudfront Via 1.1 14484a063800eaed878a3068abf4dfac.cloudfront.net (CloudFront) X-Amz-Cf-Id O7woIPXOfoU2tecmEjd-WipCNJ2PpZXIqlVHPeey3BRNk0oiw1g19w==
GET S	200	tcc_l.combined.1.0.6.min.js Show response img1.wsimg.com/tcc/	12 KB 5 KB	89ms 6ms	Script application/x-javascript	2.20.21.198 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js Requested by Host: gu-msn-mktg-dns-prod.2u.com URL: http://gu-msn-mktg-dns-prod.2u.com/poc.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.20.21.198 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-20-21-198.deploy.static.akamaitechnologies.com Software / Resource Hash `aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350` Request headers Referer http://gu-msn-mktg-dns-prod.2u.com/poc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Oct 2018 13:11:04 GMT content-encoding gzip last-modified Fri, 31 Mar 2017 16:26:41 GMT status 200 etag "52ef5c943baad21:0" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 4564 expires Sun, 27 Oct 2019 13:11:04 GMT
GET H/1.1	200 OK	35098981-84c3c2c2-fc56-11e7-9e7c-df79391bb422.png user-images.githubusercontent.com/18099289/	706 KB 706 KB	41ms 6ms	Image image/png	151.101.0.133 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://user-images.githubusercontent.com/18099289/35098981-84c3c2c2-fc56-11e7-9e7c-df79391bb422.png Requested by Host: gu-msn-mktg-dns-prod.2u.com URL: http://gu-msn-mktg-dns-prod.2u.com/poc.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.133 San Francisco, United States, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software GitHub Cloud / Resource Hash `185850246d0125fe0b043aa596c0e94b4e322b0dedce3b2508f138b275a000d3` Request headers Referer http://gu-msn-mktg-dns-prod.2u.com/poc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers X-Fastly-Request-ID 2a4a42cfb74507e84b4d8aa4da7c5bfec9159f4e Date Sat, 27 Oct 2018 13:11:03 GMT Via 1.1 varnish Age 13130 X-Cache HIT Connection keep-alive Content-Length 722641 X-Served-By cache-fra19122-FRA Last-Modified Thu, 18 Jan 2018 12:50:19 GMT Server GitHub Cloud X-Timer S1540645864.962079,VS0,VE0 ETag "b5e060b5f86e4260f3281da6b7dda5e2" Content-Type image/png Cache-Control max-age=2592000 Accept-Ranges bytes Timing-Allow-Origin https://github.com X-Cache-Hits 2
GET H/1.1	200 OK	event img.secureserver.net/t/1/tl/	43 B 598 B	310ms 149ms	Image image/gif	45.40.130.22 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://img.secureserver.net/t/1/tl/event?cts=1540645864235&tce=1540645863899&tcs=1540645863894&tdc=1540645864034&tdclee=1540645864014&tdcles=1540645864014&tdi=1540645864014&tdl=1540645863917&tdle=1540645863894&tdls=1540645863872&tfs=1540645863871&tns=1540645863871&trqs=1540645863899&tre=1540645863916&trps=1540645863915&tles=1540645864034&tlee=1540645864034&ht=perf&dh=gu-msn-mktg-dns-prod.2u.com&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F67.0.3396.87%20Safari%2F537.36&vci=1358271850&cv=1.0.6&z=897747929&vg=203999e8-4236-41e7-b664-0fb9a1e02ad5&vtg=203999e8-4236-41e7-b664-0fb9a1e02ad5&ap=cpsh&trfd=%7B%22cts%22%3A1540645864013%2C%22tccl.baseHost%22%3A%22secureserver.net%22%2C%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22a2plcpnl0143%22%7D&dp=%2Fpoc.html Protocol HTTP/1.1 Server 45.40.130.22 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-45-40-130-22.ip.secureserver.net Software Microsoft-IIS/8.5 / ARR/2.5, ASP.NET Resource Hash `a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7` Request headers Referer http://gu-msn-mktg-dns-prod.2u.com/poc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 27 Oct 2018 13:11:03 GMT Server Microsoft-IIS/8.5 X-Powered-By ARR/2.5, ASP.NET Access-Control-Max-Age 1000 Access-Control-Allow-Methods GET, PUT, POST, DELETE, OPTIONS P3P CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Access-Control-Allow-Origin http://gu-msn-mktg-dns-prod.2u.com, * Cache-Control 0 Content-Type image/gif Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Content-Length 43

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gu-msn-mktg-dns-prod.2u.com
img.secureserver.net
img1.wsimg.com
user-images.githubusercontent.com
151.101.0.133
2.20.21.198
45.40.130.22
52.222.161.201
185850246d0125fe0b043aa596c0e94b4e322b0dedce3b2508f138b275a000d3
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
cbea3531297a39dc0c1cb7e410b729571ca205111f500bc0399f93381f5e8ed9

gu-msn-mktg-dns-prod.2u.com Open in urlscan Pro 52.222.161.201 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

713 kBTransfer

720 kBSize

0 Cookies

1 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

0 Cookies

Indicators

gu-msn-mktg-dns-prod.2u.com Open in urlscan Pro
52.222.161.201 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

713 kB
Transfer

720 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions