mbiz.mailclick.me Open in urlscan Pro
140.238.64.109 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mbiz.mailclick.me/tl.php?p=22x4/1rms/rs/14pj/4am/rs//hxxps%3A%2F%2Ftwitter.com%2FEstivalShoes
Submission: On June 14 via api (June 14th 2023, 9:01:36 am UTC) from IT — Scanned from GB

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 140.238.64.109, located in Islington, United Kingdom and belongs to ORACLE-BMC-31898, US. The main domain is mbiz.mailclick.me.
TLS certificate: Issued by R3 on April 20th 2023. Valid for: 3 months.

This is the only time mbiz.mailclick.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	140.238.64.109 140.238.64.109	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
1	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
10	3

8 140.238.64.109 (Islington, United Kingdom)

ASN31898 (ORACLE-BMC-31898, US)

mbiz.mailclick.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
irving.armor.zone	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	armor.zone irving.armor.zone	122 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	82 KB
1	mailclick.me mbiz.mailclick.me	809 B
0	ipify.org Failed api.ipify.org Failed
10	4

	Domain	Requested by
7	irving.armor.zone	mbiz.mailclick.me irving.armor.zone
1	www.googletagmanager.com	irving.armor.zone
1	mbiz.mailclick.me
0	api.ipify.org Failed	irving.armor.zone
10	4

This site contains no links.

Subject Issuer	Validity	Valid
mbiz.mailclick.me R3	`2023-04-20` - `2023-07-19`	3 months	crt.sh
irving.armor.zone R3	`2023-06-14` - `2023-09-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://mbiz.mailclick.me/tl.php?p=22x4/1rms/rs/14pj/4am/rs//hxxps%3A%2F%2Ftwitter.com%2FEstivalShoes
Frame ID: FFBD966399D1D2C5CED2DD94CE2D07FE
Requests: 1 HTTP requests in this frame

Frame: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Frame ID: 7D402B848790FD093D91E1080D383D62
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

205 kB
Transfer

680 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 400 Primary Request tl.php Show response
mbiz.mailclick.me/ 653 B
809 B 292ms
92ms Document
text/html 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://mbiz.mailclick.me/tl.php?p=22x4/1rms/rs/14pj/4am/rs//hxxps%3A%2F%2Ftwitter.com%2FEstivalShoes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: 7e8c8ffa6cb2d4bd77aa2511f5884e34227e1b8c2d07862a7be2c225f061635e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-type: text/html; charset=utf-8
date: Wed, 14 Jun 2023 09:01:25 GMT
secured: By XLabs Security www.xlabs.com.br
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security

GET
H2 200 oops Show response
irving.armor.zone/ Frame 7D40 3 KB
2 KB 308ms
34ms Document
text/html 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Requested by: Host: mbiz.mailclick.me
URL: https://mbiz.mailclick.me/tl.php?p=22x4/1rms/rs/14pj/4am/rs//hxxps%3A%2F%2Ftwitter.com%2FEstivalShoes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: 0fa9a5069f1d0f8a821393792fa3e92c629fc2bcabe78811384baa165c62fd27

Request headers

Referer: https://mbiz.mailclick.me/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 14 Jun 2023 09:01:25 GMT
secured: By XLabs Security www.xlabs.com.br
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security

GET
H2 200 bootstrap-4.4.1.css
irving.armor.zone/styles/ Frame 7D40 193 KB
35 KB 33ms
32ms Stylesheet
text/css 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://irving.armor.zone/styles/bootstrap-4.4.1.css
Requested by: Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: 8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
content-encoding: gzip
last-modified: Wed, 31 May 2023 02:25:22 GMT
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security
etag: W/"197413-1685499922000"
secured: By XLabs Security www.xlabs.com.br
content-type: text/css
cache-control: max-age=86400
expires: Thu, 15 Jun 2023 09:01:25 GMT

GET
H2 200 style_error.css
irving.armor.zone/styles/ Frame 7D40 7 KB
2 KB 62ms
62ms Stylesheet
text/css 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://irving.armor.zone/styles/style_error.css
Requested by: Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: 3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
content-encoding: gzip
last-modified: Wed, 31 May 2023 02:25:22 GMT
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security
etag: W/"7118-1685499922000"
secured: By XLabs Security www.xlabs.com.br
content-type: text/css
cache-control: max-age=86400
expires: Thu, 15 Jun 2023 09:01:25 GMT

GET /
api.ipify.org/ Frame 7D40 0
0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 7D40 231 KB
82 KB 160ms
62ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-EGDH8T45FT

Requested by

Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

68cd2fe50514e1c3d8207f179fb35be1285f3434fb885cb1f1874eff4a75874f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83420
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 14 Jun 2023 09:01:25 GMT

GET
H2 200 elements_error.svg
irving.armor.zone/images/ Frame 7D40 6 KB
7 KB 32ms
31ms Image
image/svg+xml 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://irving.armor.zone/images/elements_error.svg
Requested by: Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: 0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
last-modified: Wed, 31 May 2023 02:25:20 GMT
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security
etag: W/"6640-1685499920000"
secured: By XLabs Security www.xlabs.com.br
content-type: image/svg+xml
accept-ranges: bytes
content-length: 6640

GET
H2 200 jquery-3.4.1.min.js Show response
irving.armor.zone/scripts/ Frame 7D40 86 KB
35 KB 34ms
34ms Script
application/javascript 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://irving.armor.zone/scripts/jquery-3.4.1.min.js
Requested by: Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
content-encoding: gzip
last-modified: Wed, 31 May 2023 02:25:22 GMT
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security
etag: W/"88145-1685499922000"
secured: By XLabs Security www.xlabs.com.br
content-type: application/javascript
cache-control: max-age=86400
expires: Thu, 15 Jun 2023 09:01:25 GMT

GET
H2 200 popper.min.js Show response
irving.armor.zone/scripts/ Frame 7D40 21 KB
8 KB 31ms
30ms Script
application/javascript 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://irving.armor.zone/scripts/popper.min.js
Requested by: Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
content-encoding: gzip
last-modified: Wed, 31 May 2023 02:25:22 GMT
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security
etag: W/"21257-1685499922000"
secured: By XLabs Security www.xlabs.com.br
content-type: application/javascript
cache-control: max-age=86400
expires: Thu, 15 Jun 2023 09:01:25 GMT

GET
H2 200 bootstrap-4.4.1.js Show response
irving.armor.zone/scripts/ Frame 7D40 132 KB
34 KB 52ms
52ms Script
application/javascript 140.238.64.109
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://irving.armor.zone/scripts/bootstrap-4.4.1.js
Requested by: Host: irving.armor.zone
URL: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 140.238.64.109 Islington, United Kingdom, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: XLabs WAF v4.0 http://www.xlabs.com.br/waf /
Resource Hash: eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://irving.armor.zone/oops?host=mbiz.mailclick.me&waf=irving.armor.zone&error=400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:01:25 GMT
content-encoding: gzip
last-modified: Wed, 31 May 2023 02:25:22 GMT
server: XLabs WAF v4.0 http://www.xlabs.com.br/waf
x-cdn: XLabs Security
etag: W/"135079-1685499922000"
secured: By XLabs Security www.xlabs.com.br
content-type: application/javascript
cache-control: max-age=86400
expires: Thu, 15 Jun 2023 09:01:25 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.ipify.org
URL: https://api.ipify.org/?format=jsonp&callback=getIP

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mbiz.mailclick.me/tl.php?p=22x4/1rms/rs/14pj/4am/rs//hxxps%3A%2F%2Ftwitter.com%2FEstivalShoes Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
irving.armor.zone
mbiz.mailclick.me
www.googletagmanager.com
api.ipify.org
140.238.64.109
2a00:1450:4001:82f::2008
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0e815577788e67d3f0ab6a65eca2f9f1a4c8d57bb95a192d9effd5030f3121b6
0fa9a5069f1d0f8a821393792fa3e92c629fc2bcabe78811384baa165c62fd27
3d67dd092730a2e50a113c96bf4cfbb6bb1a1f90d5139e2b292fbc139f65cc3f
68cd2fe50514e1c3d8207f179fb35be1285f3434fb885cb1f1874eff4a75874f
7e8c8ffa6cb2d4bd77aa2511f5884e34227e1b8c2d07862a7be2c225f061635e
8467fb36c8bab2e14859b3578a72b504616bf0aff137e1a3913c7aed7c9a412e
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
eba7fab904d092f1c5f23a6788b5898e7b5e11f990682fed01315ec3f9d3040f

mbiz.mailclick.me Open in urlscan Pro 140.238.64.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

205 kBTransfer

680 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

mbiz.mailclick.me Open in urlscan Pro
140.238.64.109 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

205 kB
Transfer

680 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions