urlscan.io logo urlscan.io
SecurityTrails logo

ak.itponytaa.com Open in urlscan Pro
2a02:26f0:6c00::210:ba19  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://newsermans.blogspot.com/2023/05/posterman.html
Effective URL: https://ak.itponytaa.com/4/5639768?ymid=fda7d83bdc624d68eb8d3996023e6795&var=513
Submission: On May 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 9 domains to perform 11 HTTP transactions. The main IP is 2a02:26f0:6c00::210:ba19, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is ak.itponytaa.com. The Cisco Umbrella rank of the primary domain is 115355.
TLS certificate: Issued by R3 on May 4th 2023. Valid for: 3 months.
This is the only time ak.itponytaa.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 144.76.30.234 24940 (HETZNER-AS)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
11 6
2    2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
newsermans.blogspot.com
1    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
3    2a00:1450:4001:801::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.blogger.com
resources.blogblog.com
1    144.76.30.234 (Bad Durrheim, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.234.30.76.144.clients.your-server.de
da.rt-redirect.com
1    2a02:26f0:6c00::210:ba19 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
ak.itponytaa.com
Apex Domain
Subdomains		 Transfer
2 blogger.com
www.blogger.com — Cisco Umbrella Rank: 9258
63 KB
2 blogspot.com
newsermans.blogspot.com
19 KB
1 itponytaa.com
ak.itponytaa.com — Cisco Umbrella Rank: 115355
4 KB
1 rt-redirect.com
da.rt-redirect.com
2 KB
1 blogblog.com
resources.blogblog.com — Cisco Umbrella Rank: 17411
135 KB
1 gstatic.com
www.gstatic.com
4 KB
0 gearbest.com Failed
www.gearbest.com Failed
0 rtmark.net Failed
my.rtmark.net Failed
0 go-mpulse.net Failed
s.go-mpulse.net Failed
11 9
Domain Requested by
2 www.blogger.com newsermans.blogspot.com
2 newsermans.blogspot.com newsermans.blogspot.com
1 ak.itponytaa.com
1 da.rt-redirect.com newsermans.blogspot.com
1 resources.blogblog.com newsermans.blogspot.com
1 www.gstatic.com newsermans.blogspot.com
0 www.gearbest.com Failed ak.itponytaa.com
0 my.rtmark.net Failed ak.itponytaa.com
0 s.go-mpulse.net Failed ak.itponytaa.com
11 9

This site contains no links.

Subject Issuer Validity Valid
misc-sni.blogspot.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
*.blogger.com
GTS CA 1C3		 2023-04-24 -
2023-07-17		 3 months crt.sh
da.rt-redirect.com
R3		 2023-03-30 -
2023-06-28		 3 months crt.sh
ak.hetaruwg.com
R3		 2023-05-04 -
2023-08-02		 3 months crt.sh

This page contains 1 frames:

Frame: https://www.gearbest.com/promotion-bestseller-special-1308.html?lkid=45687009&cid=683991529190339207
Frame ID: A972D6A4F8F7F924BFB5114013B3F87D
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://newsermans.blogspot.com/2023/05/posterman.html Page URL
  2. https://da.rt-redirect.com/sl/f18582b9 Page URL
  3. https://ak.itponytaa.com/4/5639768?ymid=fda7d83bdc624d68eb8d3996023e6795&var=513 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Page Statistics

11
Requests

73 %
HTTPS

80 %
IPv6

9
Domains

9
Subdomains

6
IPs

1
Countries

227 kB
Transfer

417 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://newsermans.blogspot.com/2023/05/posterman.html Page URL
  2. https://da.rt-redirect.com/sl/f18582b9 Page URL
  3. https://ak.itponytaa.com/4/5639768?ymid=fda7d83bdc624d68eb8d3996023e6795&var=513 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
posterman.html
newsermans.blogspot.com/2023/05/ 		84 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
gzip
content-length
17242
content-type
text/html; charset=UTF-8
date
Sun, 21 May 2023 03:30:07 GMT
etag
W/"3a8b6b36f702a5d9d471ad86114abe4c98a151eb96c1a8a21fb51ce7d7387b25"
expires
Sun, 21 May 2023 03:30:07 GMT
last-modified
Sat, 20 May 2023 10:24:27 GMT
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
clipboard.min.js
www.gstatic.com/external_hosted/clipboardjs/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js
Requested by
Host: newsermans.blogspot.com
URL: https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://newsermans.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sun, 21 May 2023 03:30:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3475
x-xss-protection
0
last-modified
Wed, 14 Apr 2021 19:28:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=0
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Sun, 21 May 2023 03:30:07 GMT
976584016-comment_from_post_iframe.js
www.blogger.com/static/v1/jsbin/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/jsbin/976584016-comment_from_post_iframe.js
Requested by
Host: newsermans.blogspot.com
URL: https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://newsermans.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 16 May 2023 11:18:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
403915
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6756
x-xss-protection
0
last-modified
Tue, 16 May 2023 04:52:05 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Wed, 15 May 2024 11:18:12 GMT
1900360796-indie_compiled.js
resources.blogblog.com/blogblog/data/res/ 		135 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.blogblog.com/blogblog/data/res/1900360796-indie_compiled.js
Requested by
Host: newsermans.blogspot.com
URL: https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://newsermans.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 18 May 2023 01:55:57 GMT
x-content-type-options
nosniff
age
264850
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
138206
x-xss-protection
0
last-modified
Wed, 17 May 2023 20:52:37 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Thu, 25 May 2023 01:55:57 GMT
cookienotice.js
newsermans.blogspot.com/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://newsermans.blogspot.com/js/cookienotice.js
Requested by
Host: newsermans.blogspot.com
URL: https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://newsermans.blogspot.com/2023/05/posterman.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 18 May 2023 12:31:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
226692
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2026
x-xss-protection
0
last-modified
Wed, 17 May 2023 18:53:45 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Thu, 25 May 2023 12:31:55 GMT
3434683727-widgets.js
www.blogger.com/static/v1/widgets/ 		154 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/widgets/3434683727-widgets.js
Requested by
Host: newsermans.blogspot.com
URL: https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://newsermans.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 20 May 2023 06:16:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
76408
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
56801
x-xss-protection
0
last-modified
Wed, 17 May 2023 08:51:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Sun, 19 May 2024 06:16:39 GMT
f18582b9
da.rt-redirect.com/sl/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://da.rt-redirect.com/sl/f18582b9
Requested by
Host: newsermans.blogspot.com
URL: https://newsermans.blogspot.com/2023/05/posterman.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
144.76.30.234 Bad Durrheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.234.30.76.144.clients.your-server.de
Software
nginx/1.22.1 /
Resource Hash

Request headers

Referer
https://newsermans.blogspot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html;charset=UTF-8
Date
Sun, 21 May 2023 03:30:07 GMT
Expires
0
Pragma
no-cache
Server
nginx/1.22.1
Transfer-Encoding
chunked
Vary
Accept-Encoding
Primary Request 5639768
ak.itponytaa.com/4/ 		5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ak.itponytaa.com/4/5639768?ymid=fda7d83bdc624d68eb8d3996023e6795&var=513
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00::210:ba19 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://da.rt-redirect.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
* *
access-control-max-age
86400
cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
2626
content-type
text/html; charset=utf8
date
Sun, 21 May 2023 03:30:07 GMT
expires
Sun, 21 May 2023 03:30:07 GMT
link
<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch" <https://www.gearbest.com>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://xobr219pa.com>; rel="preconnect dns-prefetch"
pragma
no-cache
server-timing
cdn-cache; desc=MISS edge; dur=23 origin; dur=4 ak_p; desc="467955_34650645_26710226_2704_645_12_0";dur=1
timing-allow-origin
*
vary
Accept-Encoding
x-akamai-transformed
9 638 0 pmb=mRUM,1
x-trace-id
d8e8ba5853fd211eacc504cc3d15ccc9
6WL56-FSD2M-ZCAVG-BJ5B7-474ZA
s.go-mpulse.net/boomerang/ 		0
0
img.gif
my.rtmark.net/ 		0
0
promotion-bestseller-special-1308.html
www.gearbest.com/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s.go-mpulse.net
URL
https://s.go-mpulse.net/boomerang/6WL56-FSD2M-ZCAVG-BJ5B7-474ZA
Domain
my.rtmark.net
URL
https://my.rtmark.net/img.gif?f=merge&userId=659576b010b14b17992ebe07ced74c50
Domain
www.gearbest.com
URL
https://www.gearbest.com/promotion-bestseller-special-1308.html?lkid=45687009&cid=683991529190339207

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

8 Cookies

Domain/Path Name / Value
da.rt-redirect.com/ Name: user_key
Value: 1692415807%7CY2FkZDAwY2U5ZWVlYTAxMzc2NzQxMmIyZjAyZDAyOGM%3D%7Ca435ead5bbf0314cc8b66dc689e513e14e8d8bf0
da.rt-redirect.com/ Name: visited.f18582b9
Value: 1684683007%7CYToxOntpOjU5MDU7aToxO30%3D%7Cb61e60067e27b25be6b560d3ee7caf8076136a76
da.rt-redirect.com/ Name: visited_time.f18582b9
Value: 1684683007%7CMTY4NDY4MzAwNw%3D%3D%7Cf1cac844493a897c22b382f9056fc9e1ac56805d
da.rt-redirect.com/ Name: tracking.1.f18582b9
Value: 1684726207%7CMQ%3D%3D%7C8dffad16f297b95e7b81eb9cc51ebca70d7cdf7a
da.rt-redirect.com/ Name: tracking.1.f18582b9-5905
Value: 1684899007%7CMQ%3D%3D%7C22fccdd2e01f29b7ca822ebd79b22c6f6c42c386
ak.itponytaa.com/ Name: OAID
Value: 659576b010b14b17992ebe07ced74c50
ak.itponytaa.com/ Name: oaidts
Value: 1684639807
my.rtmark.net/ Name: ID
Value: 659576b010b14b17992ebe07ced74c50

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block