em.realtime.email
Open in
urlscan Pro
3.232.23.246
Public Scan
Submitted URL: https://urlsand.esvalabs.com/?u=http%3A%2F%2Flink.travel.easyjet.com%2Fu%2Fnrd.php%3Fp%3D5PZOyERo5F_1547357_57452_1_11%26ems_...
Effective URL: https://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=easyJet&utm_medium=emai...
Submission: On May 13 via manual from GB — Scanned from IT
Effective URL: https://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=easyJet&utm_medium=emai...
Submission: On May 13 via manual from GB — Scanned from IT
Summary
This website contacted 3 IPs
in 3 countries
across 4 domains to perform 6 HTTP transactions.
The main IP is 3.232.23.246, located in
Ashburn, United States and
belongs to AMAZON-AES, US.
The main domain is em.realtime.email.
The Cisco Umbrella rank of the primary domain is 29463.
TLS certificate: Issued by Thawte TLS RSA CA G1 on May 30th 2023. Valid for: a year.
This is the only time em.realtime.email was scanned on urlscan.io!
TLS certificate: Issued by Thawte TLS RSA CA G1 on May 30th 2023. Valid for: a year.
This is the only time em.realtime.email was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 95.110.136.136 95.110.136.136 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
| 1 1 | 217.175.192.46 217.175.192.46 | 199236 (EMARSYS-A...) (EMARSYS-AS Emarsys eMarketing Systems AG) | |
| 1 3 | 3.232.23.246 3.232.23.246 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 3 | 143.204.215.69 143.204.215.69 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 18.173.205.64 18.173.205.64 | 16509 (AMAZON-02) (AMAZON-02) | |
| 6 | 3 |
1
95.110.136.136
(Ponte San Pietro, Italy)
ASN31034 (ARUBA-ASN, IT)
PTR: net-80-211-49-112.cust.vodafonedsl.it
ASN31034 (ARUBA-ASN, IT)
PTR: net-80-211-49-112.cust.vodafonedsl.it
| urlsand.esvalabs.com |
1
217.175.192.46
(Austria)
ASN199236 (EMARSYS-AS Emarsys eMarketing Systems AG, AT)
ASN199236 (EMARSYS-AS Emarsys eMarketing Systems AG, AT)
| link.travel.easyjet.com |
3
3.232.23.246
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-23-246.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-23-246.compute-1.amazonaws.com
| em.realtime.email |
3
143.204.215.69
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-69.fra53.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-69.fra53.r.cloudfront.net
| d2vxgxvhgubbj8.cloudfront.net |
1
18.173.205.64
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-64.fra56.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-64.fra56.r.cloudfront.net
| d2e6o4w2xtdsul.cloudfront.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
cloudfront.net
d2vxgxvhgubbj8.cloudfront.net d2e6o4w2xtdsul.cloudfront.net |
485 KB |
| 3 |
realtime.email
1 redirects
em.realtime.email — Cisco Umbrella Rank: 29463 |
7 KB |
| 1 |
easyjet.com
1 redirects
link.travel.easyjet.com — Cisco Umbrella Rank: 378352 |
613 B |
| 1 |
esvalabs.com
1 redirects
urlsand.esvalabs.com — Cisco Umbrella Rank: 283814 |
654 B |
| 6 | 4 |
| Domain | Requested by | |
|---|---|---|
| 3 | d2vxgxvhgubbj8.cloudfront.net |
em.realtime.email
|
| 3 | em.realtime.email | 1 redirects |
| 1 | d2e6o4w2xtdsul.cloudfront.net |
em.realtime.email
|
| 1 | link.travel.easyjet.com | 1 redirects |
| 1 | urlsand.esvalabs.com | 1 redirects |
| 6 | 5 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.realtime.email Thawte TLS RSA CA G1 |
2023-05-30 - 2024-06-29 |
a year | crt.sh |
| *.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=easyJet&utm_medium=email&utm_content=lang_EN_market_UK&utm_campaign=mkt_13052024|57452|20240513%7CEM%7CLiveClickerCompetition%7CUK|UK|EN&sc_src=email_57452&sc_lid=3409119&sc_uid=5PZOyERo5F&sc_llid=1547357&sc_customer=36165570&version_id=1656479705
Frame ID: 651D86E2387CFAB9D1FBB3179E6DF56F
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://urlsand.esvalabs.com/?u=http%3A%2F%2Flink.travel.easyjet.com%2Fu%2Fnrd.php%3Fp%3D5PZOyERo5F_15473...
HTTP 302
http://link.travel.easyjet.com/u/nrd.php?p=5PZOyERo5F_1547357_57452_1_11&ems_l=54619&i=1&d=MzYxNjU1NzA%3D%7... HTTP 307
https://link.travel.easyjet.com/u/nrd.php?p=5PZOyERo5F_1547357_57452_1_11&ems_l=54619&i=1&d=MzYxNjU1NzA%3D%7... HTTP 302
https://em.realtime.email/service/rte?kind=livereveal_clickthrough&id=2068336172&esp_uid=36165570&utm_... HTTP 302
http://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=eas... HTTP 307
https://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=eas... Page URL
Detected technologies
Clipboard.js
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- clipboard(?:-([\d.]+))?(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://urlsand.esvalabs.com/?u=http%3A%2F%2Flink.travel.easyjet.com%2Fu%2Fnrd.php%3Fp%3D5PZOyERo5F_1547357_57452_1_11%26ems_l%3D54619%26i%3D1%26d%3DMzYxNjU1NzA%253D%257CRU4%253D%257CVUs%253D%257CMTM%253D%257CMDU%253D%257CMjAyNA%253D%253D%257CMjAyNDA1MTMlN0NFTSU3Q0xpdmVDbGlja2VyQ29tcGV0aXRpb24lN0NVSw%253D%253D%257CVUs%253D%257CRU4%253D%257CMzQwOTExOQ%253D%253D%257CNVBaT3lFUm81Rg%253D%253D%257CMzYxNjU1NzA%253D%257C%26_esuh%3D_11_255d9ef39e645e4e9a865adbdcb705d24ce01eb40f5475bc83fe602f4df25d3c&e=2b5ad427&h=8f1f3296&f=y&p=y
HTTP 302
http://link.travel.easyjet.com/u/nrd.php?p=5PZOyERo5F_1547357_57452_1_11&ems_l=54619&i=1&d=MzYxNjU1NzA%3D%7CRU4%3D%7CVUs%3D%7CMTM%3D%7CMDU%3D%7CMjAyNA%3D%3D%7CMjAyNDA1MTMlN0NFTSU3Q0xpdmVDbGlja2VyQ29tcGV0aXRpb24lN0NVSw%3D%3D%7CVUs%3D%7CRU4%3D%7CMzQwOTExOQ%3D%3D%7CNVBaT3lFUm81Rg%3D%3D%7CMzYxNjU1NzA%3D%7C&_esuh=_11_255d9ef39e645e4e9a865adbdcb705d24ce01eb40f5475bc83fe602f4df25d3c HTTP 307
https://link.travel.easyjet.com/u/nrd.php?p=5PZOyERo5F_1547357_57452_1_11&ems_l=54619&i=1&d=MzYxNjU1NzA%3D%7CRU4%3D%7CVUs%3D%7CMTM%3D%7CMDU%3D%7CMjAyNA%3D%3D%7CMjAyNDA1MTMlN0NFTSU3Q0xpdmVDbGlja2VyQ29tcGV0aXRpb24lN0NVSw%3D%3D%7CVUs%3D%7CRU4%3D%7CMzQwOTExOQ%3D%3D%7CNVBaT3lFUm81Rg%3D%3D%7CMzYxNjU1NzA%3D%7C&_esuh=_11_255d9ef39e645e4e9a865adbdcb705d24ce01eb40f5475bc83fe602f4df25d3c HTTP 302
https://em.realtime.email/service/rte?kind=livereveal_clickthrough&id=2068336172&esp_uid=36165570&utm_source=easyJet&utm_medium=email&utm_content=lang_EN_market_UK&utm_campaign=mkt_13052024|57452|20240513%7CEM%7CLiveClickerCompetition%7CUK|UK|EN&sc_src=email_57452&sc_lid=3409119&sc_uid=5PZOyERo5F&sc_llid=1547357&sc_customer=36165570 HTTP 302
http://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=easyJet&utm_medium=email&utm_content=lang_EN_market_UK&utm_campaign=mkt_13052024|57452|20240513%7CEM%7CLiveClickerCompetition%7CUK|UK|EN&sc_src=email_57452&sc_lid=3409119&sc_uid=5PZOyERo5F&sc_llid=1547357&sc_customer=36165570&version_id=1656479705 HTTP 307
https://em.realtime.email/service/render?kind=livereveal&id=2068336172&esp_uid=36165570&utm_source=easyJet&utm_medium=email&utm_content=lang_EN_market_UK&utm_campaign=mkt_13052024|57452|20240513%7CEM%7CLiveClickerCompetition%7CUK|UK|EN&sc_src=email_57452&sc_lid=3409119&sc_uid=5PZOyERo5F&sc_llid=1547357&sc_customer=36165570&version_id=1656479705 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
render
em.realtime.email/service/ Redirect Chain
|
5 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ldxfk6s67d76njni.gif
d2vxgxvhgubbj8.cloudfront.net/images/client/6873/imageassets/ |
193 KB 194 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
livecoupon2006002366_1520453206_660x816_c9bfc3da3c.c.png
d2e6o4w2xtdsul.cloudfront.net/6873/ |
239 KB 240 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
clipboard.js
d2vxgxvhgubbj8.cloudfront.net/scripts/js/ |
10 KB 11 KB |
Script
text/x-c |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cstfont-28175743-88745133.ttf
d2vxgxvhgubbj8.cloudfront.net/images/client/6873/fileassets/ |
105 KB 40 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
em.realtime.email/ |
9 B 551 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| em.realtime.email/ | Name: AWSALB Value: KAeia76faQtke3I/gPw5NxeJ8EW9iSIcXKSScVvKLZjyNi5mvH3HnPj9aurNWkXmmK32grE774F4w7g+Cudlg25t5kJcvUsDEuCkCVlNErAhO+SSXzhcdrxhX/Z5 |
|
| em.realtime.email/ | Name: AWSALBCORS Value: KAeia76faQtke3I/gPw5NxeJ8EW9iSIcXKSScVvKLZjyNi5mvH3HnPj9aurNWkXmmK32grE774F4w7g+Cudlg25t5kJcvUsDEuCkCVlNErAhO+SSXzhcdrxhX/Z5 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d2e6o4w2xtdsul.cloudfront.net
d2vxgxvhgubbj8.cloudfront.net
em.realtime.email
link.travel.easyjet.com
urlsand.esvalabs.com
143.204.215.69
18.173.205.64
217.175.192.46
3.232.23.246
95.110.136.136
8e09dc43431c7a17cdd8d27fc148b76687619c5bb663de46ca37097a34a6c7f2
ad5545c4e2fdabd1446cd5e265f238e7b737ca04da166dd720f4e44413fa45f9
cae7fa7725d91d3b624252545cfe4e0b431d25b732c439c503551f3cf330739a
ce4b65d219e4320c236d6cf0c40147ce874719ef7b7e78d0af9fd72f804dac05
e3ebaa16dd9d9b9fc107c42183fb6cf9d22927e1af03dbbdfa0ccc38e4e4ac31
faf1d4f9a94bef4a856938425cf78dc73f306a45c7d251e3dc4bdd50cae422f2