gu-msn-mktg-dns-prod.2u.com

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 52.222.161.248, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is gu-msn-mktg-dns-prod.2u.com.

This is the only time gu-msn-mktg-dns-prod.2u.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.222.161.248 52.222.161.248	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2.20.21.198 2.20.21.198	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	45.40.130.22 45.40.130.22	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
3	3

1 52.222.161.248 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-161-248.fra54.r.cloudfront.net

gu-msn-mktg-dns-prod.2u.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.21.198 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-21-198.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.40.130.22 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net

img.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	secureserver.net img.secureserver.net	598 B
1	wsimg.com img1.wsimg.com	5 KB
1	2u.com gu-msn-mktg-dns-prod.2u.com	1 KB
3	3

	Domain	Requested by
1	img.secureserver.net
1	img1.wsimg.com	gu-msn-mktg-dns-prod.2u.com
1	gu-msn-mktg-dns-prod.2u.com
3	3

This site contains no links.

Subject Issuer	Validity	Valid
*.wsimg.com Starfield Secure Certificate Authority - G2	`2018-09-25` - `2020-09-25`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://gu-msn-mktg-dns-prod.2u.com/
Frame ID: 93CCC674962DA54B5D059E43153E6BD7
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

6 kB
Transfer

13 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response gu-msn-mktg-dns-prod.2u.com/	898 B 1 KB	38ms 7ms	Document text/html	52.222.161.248 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://gu-msn-mktg-dns-prod.2u.com/ Protocol HTTP/1.1 Server 52.222.161.248 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-222-161-248.fra54.r.cloudfront.net Software Apache / Resource Hash `d60915e33e0af42096bc9f481349c58af2da89063563b1cb70675ad1e884b303` Request headers Host gu-msn-mktg-dns-prod.2u.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Content-Type text/html Content-Length 594 Connection keep-alive Date Sat, 27 Oct 2018 09:31:40 GMT Server Apache Last-Modified Sun, 05 Aug 2018 15:50:13 GMT ETag "87021bc-1e8-572b21dcf149d-gzip" Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding Age 13083 X-Cache Hit from cloudfront Via 1.1 c771900addaa417be1d0b79ff157a3f9.cloudfront.net (CloudFront) X-Amz-Cf-Id ZD-yoI9lZ2tjZzoGSoxVms324RZtfdg-muDTZk-Fo7Mt_o2TnkkTLQ==
GET S	200	tcc_l.combined.1.0.6.min.js Show response img1.wsimg.com/tcc/	12 KB 5 KB	74ms 7ms	Script application/x-javascript	2.20.21.198 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js Requested by Host: gu-msn-mktg-dns-prod.2u.com URL: http://gu-msn-mktg-dns-prod.2u.com/ Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.20.21.198 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-20-21-198.deploy.static.akamaitechnologies.com Software / Resource Hash `aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350` Request headers Referer http://gu-msn-mktg-dns-prod.2u.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Oct 2018 13:09:43 GMT content-encoding gzip last-modified Fri, 31 Mar 2017 16:26:41 GMT status 200 etag "52ef5c943baad21:0" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 4564 expires Sun, 27 Oct 2019 13:09:43 GMT
GET H/1.1	200 OK	event img.secureserver.net/t/1/tl/	43 B 598 B	311ms 150ms	Image image/gif	45.40.130.22 GoDaddy.com
General Check archive.org Show headers Download Go to Show image Full URL http://img.secureserver.net/t/1/tl/event?cts=1540645783504&tce=1540645783213&tcs=1540645783207&tdc=1540645783303&tdclee=1540645783303&tdcles=1540645783303&tdi=1540645783303&tdl=1540645783223&tdle=1540645783207&tdls=1540645783183&tfs=1540645783182&tns=1540645783182&trqs=1540645783213&tre=1540645783221&trps=1540645783220&tles=1540645783303&tlee=1540645783303&ht=perf&dh=gu-msn-mktg-dns-prod.2u.com&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F67.0.3396.87%20Safari%2F537.36&vci=1921810132&cv=1.0.6&z=2003352683&vg=20399998-3505-4239-863e-03c768d700d1&vtg=20399998-3505-4239-863e-03c768d700d1&ap=cpsh&trfd=%7B%22cts%22%3A1540645783303%2C%22tccl.baseHost%22%3A%22secureserver.net%22%2C%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22a2plcpnl0143%22%7D&dp=%2F Protocol HTTP/1.1 Server 45.40.130.22 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-45-40-130-22.ip.secureserver.net Software Microsoft-IIS/8.5 / ARR/2.5, ASP.NET Resource Hash `a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7` Request headers Referer http://gu-msn-mktg-dns-prod.2u.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 27 Oct 2018 13:09:43 GMT Server Microsoft-IIS/8.5 X-Powered-By ARR/2.5, ASP.NET Access-Control-Max-Age 1000 Access-Control-Allow-Methods GET, PUT, POST, DELETE, OPTIONS P3P CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Access-Control-Allow-Origin http://gu-msn-mktg-dns-prod.2u.com, * Cache-Control 0 Content-Type image/gif Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Content-Length 43

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gu-msn-mktg-dns-prod.2u.com
img.secureserver.net
img1.wsimg.com
2.20.21.198
45.40.130.22
52.222.161.248
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
d60915e33e0af42096bc9f481349c58af2da89063563b1cb70675ad1e884b303

gu-msn-mktg-dns-prod.2u.com Open in urlscan Pro 52.222.161.248 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

33 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

6 kBTransfer

13 kBSize

0 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

0 Cookies

Indicators

gu-msn-mktg-dns-prod.2u.com Open in urlscan Pro
52.222.161.248 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

6 kB
Transfer

13 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions